topic Re: Wi-Fi disassociation reason code when password based RADIUS authentication fails in Wireless

Wi-Fi disassociation reason code when password based RADIUS authentication fails

ESMichal — Thu, 18 Aug 2022 11:05:15 GMT

We use Cisco Meraki APs with WPA2 Enterprise authentication againsts remote RADIUS server with EAP-TTLS + PAP.

When user provides wrong credentials (bad password), RADIUS sends Access-Reject message to the AP.

AP the disassociates the endpoint providing reason code 8. Reason code 8 means "Disassociated because sending STA is leaving or has left Basic Service Set (BSS)." That is a very generic response. In the list of possible reason codes there is also code 23: "IEEE 802.1X authentication failed.". At first look this seems to be more appropriate code to send.

https://www.cisco.com/assets/sol/sb/WAP371_Emulators/WAP371_Emulator_v1-0-1-5/help/Apx_ReasonCodes2.html

Questions:

- Is code 23 suitable for this situation?

- Is Cisco Meraki AP capable of sending code 23?

- Why does not AP send the code 23?

Re: Wi-Fi disassociation reason code when password based RADIUS authentication fails

Raphael_L — Tue, 11 Oct 2022 00:59:41 GMT

Sorry for the late reply.

What MR firmware are you running ?

Were you able to capture the frame and confirm that the AP is really sending a frame with code '8' ?

Could the client be getting a code '23' , upon receving that code simply leaves the AP with code '8' ?

I think you should open a ticket and reproduce the issue and provide them a capture.

EDITv3 : This was solved under 28.7 :

When an Apple client enters an incorrect PSK the AP responds with a disassociation response instead of deauthentication response, resulting in multiple failed connection attempts from the client (Wi-Fi 5 Wave 2 APs)

Might be worth a try to upgrade and test it !

Good luck

Re: Wi-Fi disassociation reason code when password based RADIUS authentication fails

Raphael_L — Tue, 11 Oct 2022 01:04:08 GMT

Update :

Took me a minute to find a code '23' :

MR 28.7.1

SSID configured with WPA enterprise and using Cisco ISE as Radius server. Client didn't provide a valid certificate.

Re: Wi-Fi disassociation reason code when password based RADIUS authentication fails

ESMichal — Tue, 11 Oct 2022 07:20:25 GMT

Hey Raphael. Thank you for the reply.

I think I was mistaken (or confused or something has changed) because last time I tried (week ago) I got the correct reason code from Meraki AP.

So at this point I believe Apple and its UI is to blame.