topic Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID in Wireless

Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Cisco Support — Tue, 12 Jul 2022 16:01:28 GMT

We are not use Authentication servers to authenticate wireless users.

Just use only WPA 2 encryption mode for authenticate wireless users.

But we identified there are lot of EAPol timeouts happened during the client authentication

What would be the issue for this EAPol timeouts

Is this issue occurring from end user device or Access Point side ?

How Can we minimize this eapol timeout issue?

Guys Help me to rectify this issue

AI-generated summary

From your community moderators: We're experimenting with using AI to summarize some of our longer threads. The summary has been reviewed by humans for accuracy.

Problem

The original poster reported experiencing numerous EAPol timeout issues during client authentication on their WPA 2 PSK SSID network that doesn't use authentication servers, asking whether the issue originates from end-user devices or access points and how to minimize these timeouts.

Summary

Community discussions reveal several solutions, with enabling fast roaming 802.11r being the primary solution that successfully resolved the EAPol timeout issue for at least one user. Other users experiencing the same issue expressed initial skepticism about how 802.11r could solve PSK-related issues but were willing to try the solution. Additional suggested troubleshooting approaches included: checking for RF interference, verifying client device compatibility, examining network congestion, reviewing power settings on client devices, and ensuring proper SSID configuration. The problem appears to be related to the wireless authentication handshake process timing out during the four-way handshake between clients and access points, and while there was no explicit confirmation from the original poster about which solution worked, the 802.11r fast roaming feature was highlighted as the most effective fix for addressing these authentication timeouts.

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

ww^ — Tue, 12 Jul 2022 16:50:51 GMT

Would first verify if your clients running latest wifi drivers

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Cisco Support — Tue, 12 Jul 2022 17:03:03 GMT

Thank you ww for your reply....!

This issue affects not only a few specific users.
This issue randomly affects every user on each day and there are also devices with 802.11ax supported wireless adapters.
If this can be avoided by updating the drivers, do we have to update the drivers of all the wireless devices?

If there is any specific configuration to rectify this issue from meraki dashboard end?

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

MerakiGnome — Tue, 12 Jul 2022 19:33:04 GMT

Hi @Cisco Support , what version of MR firmware are your APs on?

You mention that this is happening across all users/devices albeit sporadically throughout the day? Are all devices the same model and build?

Yes you should look to upgrade drivers across the board.

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

DimuthuSenarathna87747 — Tue, 12 Jul 2022 22:12:34 GMT

Enable 802.11r. It will fix the issue

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

WB2 — Wed, 13 Jul 2022 01:42:33 GMT

If it's only affecting the same users each day I would be advising them to download the latest drivers from their Wi-Fi NIC manufacturers website e.g. Intel's website NOT updating via Windows update

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Cisco Support — Wed, 13 Jul 2022 05:25:48 GMT

MR 36 - Current version: MR 28.6.1
MR 52 - Current version: MR 28.6.1

This is an environment where legacy devices and latest devices are common.

Most of the laptops are HP and there are few other products.

External wireless adapters are also used for desktop PCs and connected to the wireless network.

However, this EAPoL timeout will affect every device.

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Cisco Support — Wed, 13 Jul 2022 05:29:39 GMT

Thanks @DimuthuSenarathna87747

We already enable 802.11r for fast roaming. But it has not worked. Even though 802.11r is enabled for SSID, this eapol timeout continues.

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

DimuthuSenarathna87747 — Wed, 13 Jul 2022 06:03:46 GMT

802.11r enabled with WPA1 and WPA2 ? or WPA2 only ?

What you see from the AP logs for the same time "Unknown Error" ?

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Cisco Support — Wed, 13 Jul 2022 07:50:01 GMT

Thanks @DimuthuSenarathna87747

802.11r enabled with WAP2 only

This is the two types of AP logs we identified when users experience disconnection in the meraki dashboard

auth_mode='wpa2-psk' vlan_id='16' reason='eapol_timeout' radio='1' vap='3' channel='56' rssi='20'
auth_mode='wpa2-psk' vlan_id='13' reason='eapol_timeout' roam_ap='E4:55:A8:09:DD:36' radio='0' vap='0' channel='1' rssi='7'

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Philip D'Ath — Wed, 13 Jul 2022 10:15:29 GMT

My guess - it's probably as simple as they aren't very close to the WiFi network. Perhaps they are walking out of the office, into the office, etc.

Perhaps they drive to the office and park outside. Their devices can just barely see the WiFi, and get constant timeouts till they walk inside.

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Cisco Support — Wed, 13 Jul 2022 12:07:00 GMT

Thanks @Philip D'Ath

In your case, timeout is a very normal thing,

but the problem here is that the wireless connection of users who are in the same place without moving also timeout.

To explain it in another way, in this environment, a user roams from one AP to another AP even when the user is in the same place without physically moving.

After analyzing the user's timeline, we could see that even when the user is in the same place, he connects to several nearby APs within a few seconds, and this eapol timeout occurs when the user continuously jumping nearby APs

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

BigForrest — Tue, 29 Nov 2022 02:10:48 GMT

Hi,

I have a same problem with @Cisco Support that random users on random days, our users can't connect WiFi even the AP is next to week they still can't connect. When I check the logs, it show error "reason='eapol_timeout", and user can't connect again. The workaround is we have to forget the network then re-authenticate again then it works but that happens only for few days then it happens again. Our NPS does show the user is authenticate and reply back. Any ideas?

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

aneduzhk — Wed, 14 Dec 2022 18:41:46 GMT

Hi @Cisco Support have you tried reviewing our new Wireless overview page (Wireless > Monitor > Overview) to drill down on specific problematic clients and find the root cause?

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

aneduzhk — Thu, 15 Dec 2022 17:29:57 GMT

Also, I just wanted to confirm if you are using just WPA2-PSK auth or something else like iPSK w/o RADIUS?

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Silvia3 — Thu, 20 Apr 2023 14:17:09 GMT

Hello. I do have the same issue. Did you find any solution to this?

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Henrik_ — Thu, 20 Apr 2023 14:24:08 GMT

Could the issues in this thread be related to Re: Radius Authentication Issues - The Meraki Community

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Silvia3 — Thu, 20 Apr 2023 14:47:11 GMT

We did disable 802.11w a few days ago but the errors still there.

I also tried disable band steering yesterday and will troubleshoot again next week.

Thanks for the reply.

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

DainBrammage — Mon, 24 Apr 2023 18:42:01 GMT

Flush and forget any stored profiles entries. THESE ARE EASILY CORRUPTED
Update your client wireless drivers

As a SIMPLE test you can change your PSK make sure that it is at least 8 characters in length and test...

For the record just because a client doesn't move, that doesn't mean they will not roam. Clients, and clients alone, decide to which wireless AP they will connect.

Re: Authentication Issue (EAPol Timeout) on WPA 2 PSK SSID

Alex Tapia — Thu, 22 Jun 2023 01:14:26 GMT

Similar issue here:

EAPoL timeout issues to Radius Server. sometimes just a really long "Time to Connect"

affects users/computers randomly,

issue happening at multiple sites

both sites: are using MR52 APs

both sites are using Firmware MR 29.5.1