topic Re: Client able to connect due to invalid PMKID in Wireless

Client able to connect due to invalid PMKID

Maccarony — Tue, 22 Jul 2025 21:50:02 GMT

Hello Everyone,

I'm facing client disconnection , it tries to connect to the AP and the user is steady and not moving. Captured RA traces and found out the it is happening due to PMKID is sent during authentication.

Client sending authentication request to AP and AP sending back authentication response with status invalid pmkid.

Two concerns here,

1. what invalid pmkid says? Invalid password? If can someone clear here about what is pmkid and why it's needed.

2. How do I validate what makes pmkid being invalid? Does it have expiry time to be valid?

Re: Client able to connect due to invalid PMKID

Mark Elsen — Wed, 23 Jul 2025 06:20:14 GMT

- @Maccarony What software version are you using on the 9800 controller ?
+ Checkout these bug reports :
https://bst.cloudapps.cisco.com/bugsearch?pf=prdNm&prdNam=Cisco%20Catalyst%209800%20Series%20Wireless%20Controllers&kw=pmkid&bt=custV&sb=anfr

Re: Client able to connect due to invalid PMKID

srimal99 — Wed, 23 Jul 2025 09:38:16 GMT

@Maccarony you can get some undestanding of how PMK, GTK and authentication process work from following link

https://mrncciew.com/2014/09/11/cwsp-pmk-caching-preauthentication/

Re: Client able to connect due to invalid PMKID

Maccarony — Wed, 23 Jul 2025 16:54:59 GMT

Thanks for sharing , I understand its a unique key mutual between AP to station, my concern is it related to password practically when we try to login to wireless network and shown up window with user/password.

So invalid password says invalid pmkid?

Re: Client able to connect due to invalid PMKID

MHM Cisco World — Wed, 23 Jul 2025 17:02:38 GMT

Only make sure wifi client add correct password.

If yoh use symbols in password try change it.

MHM

Re: Client able to connect due to invalid PMKID

Maccarony — Wed, 23 Jul 2025 17:41:35 GMT

So invalid pmkid means incorrect password?

Re: Client able to connect due to invalid PMKID

MHM Cisco World — Wed, 23 Jul 2025 18:02:52 GMT

If you not do roaming' then it can be issue of wrong password.

MHM

Re: Client able to connect due to invalid PMKID

Saikat Nandy — Thu, 24 Jul 2025 04:18:41 GMT

Answers -

1. what invalid pmkid says? Invalid password? If can someone clear here about what is pmkid and why it's needed.
Ans - PMKID is an unique identifier which gets generated as part of the auth mechanism between a client and AP. This ID identifies the PMK used for encrypting comm between and client and AP. During the 4 way handshake the first key that gets generated is MSK. PMK gets derived from MSK. The PMKID is derived from this key and exchanged as part of the handshake process. During fast roaming process, this PMKID allows clients to quickly and securely reconnect to different APs without re-authenticating from scratch.

2. How do I validate what makes pmkid being invalid? Does it have expiry time to be valid?
Ans - We do have option to validate but not east to figure out as it need OTA, WLC internal RA trace and EPC. Every single new auth will generate a new PMKID.

Coming back to your scenario, when the user is already connected to SSID and in RUN state, that means PMKID is already generated. This will come in picture if the device tries to roam. Although it might be physically not moving but if the driver is sensitive and getting signals from multiple APs with almost same signals strength, it can try to roam. Now when WLC says invalid pmkid, there could be 2 possibilities - either device is sending a wrong PMKID which WLC/AP is not aware of. Or else device is sending a correct PMKID, however WLC/AP is reporting it in wrong way. So in your scenario first thing that need to validated if the device is roaming across different APs while physically located in one place. If that's happening and you don't want that, data rates/power levels can be tweaked to see if you can stop that. If that gets stopped, roaming won't happen and subsequently no further issue for PMKID mismatch.

Re: Client able to connect due to invalid PMKID

Ambuj M — Thu, 24 Jul 2025 04:22:43 GMT

are you using fast transition ? if yes disable and test again.

Re: Client able to connect due to invalid PMKID

Haydn Andrews — Thu, 24 Jul 2025 23:20:10 GMT

is this an intune managed device? What authentication method is being used: EAP-TLS, EAP-PEAP with MSChapv2
are these windows 11 devices with credential guard enabled

what is PMK cache set to if intune managed devices

Had situation where PMK cache was set to 5min and this caused similar issues. Also EAP-PEAP is not supported if Credential Guard is enabled from Microsoft