topic Re: Error in WLC 3504 logs related to clients dropping dot1x and reconnecting in Wireless

Error in WLC 3504 logs related to clients dropping dot1x and reconnecting

Eric R. Jones — Mon, 05 Jul 2021 19:24:49 GMT

We got a report of sporadic wireless client connectivity drops in the last week.

Checking the logs it was discovered that at least back to Aug 8th we were getting this:

%DOT1X-3-ABORT_AUTH: [SA]1x_bauth_sm.c:487 Authentication Aborted for client <MACADDRESS> Abort Reason:DOT1X RESTARTED DUE TO EAPOL-START/CLIENT ROAM

X-3-WPA_SEND_STATE_ERR: [SA]1x_kxsm.c:1736 Unable to send EAPOL-key msg - invalid WPA state (0) - client <MACADDRESS>

We don't see this happening in any other location. In this location there are 20+ connected clients across 3 2800i AP's.

The other locations have 1 to 5 AP's.

We are just rolling things out and the next deployment will be large. We're trying to resolve this before then.

So we ruled out drivers as they are up to date.

Roaming as an issue has been discussed because that's what pops up in the logs.

We are using ISE 2.7 with Dot1X for user clients and printers but we still have MAB for a couple of printer.

There was mention of un-checking the legacy bit for EAP but that's already been done.

Re: Error in WLC 3504 logs related to clients dropping dot1x and reconnecting

Mark Elsen — Wed, 19 Aug 2020 07:26:06 GMT

- Have a look at the controller software version, consider using later or advisory release, if applicable and feasible. Too old release may have many bugs. Further look into https://developer.cisco.com/docs/wireless-troubleshooting-tools/ , have a sanity check of your controller configuration with : https://cway.cisco.com/tools/WirelessAnalyzer/ , for client troubleshooting use : https://cway.cisco.com/tools/WirelessDebugAnalyzer/

Re: Error in WLC 3504 logs related to clients dropping dot1x and reconnecting

Eric R. Jones — Fri, 18 Sep 2020 04:21:39 GMT

I uploaded it but it never gave me any information back.

Re: Error in WLC 3504 logs related to clients dropping dot1x and reconnecting

patoberli — Fri, 18 Sep 2020 13:16:59 GMT

%DOT1X-3-ABORT_AUTH: [SA]1x_bauth_sm.c:487 Authentication Aborted for client <MACADDRESS> Abort Reason:DOT1X RESTARTED DUE TO EAPOL-START/CLIENT ROAM

This could also happen if the client is walking and moving from one AP to another, before he has finished authentication. That could indicate a to small cell overlap.

Re: Error in WLC 3504 logs related to clients dropping dot1x and reconnecting

Eric R. Jones — Tue, 06 Oct 2020 22:37:23 GMT

The user is stationary when this happens.

Some do have laptops and some are desktops.

We seen 3 different "errors" when this happens.

On ISE we see this reported as the client is already authenticated but attempts to authenticate again. It then drops off for 5 to 10 minutes then reconnects to the AP.

Re: Error in WLC 3504 logs related to clients dropping dot1x and reconnecting

patoberli — Fri, 09 Oct 2020 06:38:27 GMT

The client has decided to roam, whatever the reason. Does your ISE configuration allow for reconnections?

Can you check a full client debug in the debug analyzer shared by Marce?

Re: Error in WLC 3504 logs related to clients dropping dot1x and reconnecting

Eric R. Jones — Tue, 13 Oct 2020 21:57:53 GMT

The first 2 attempts at using that tool it didn't return anything. I've been busy with a FW migration and haven't had time to re-investigate. One of my teammates is trying to open a TAC on it.