topic welcome in Wireless

%DOT1X-3-MAX_EAPOL_KEY_RETRANS messages

Rosa Ladeira — Mon, 05 Jul 2021 07:32:24 GMT

I habe been seeing lots of this message on WLC log.

All of them refer to mobile phones.

*dot1xMsgTask: Mar 25 16:57:27.787: %DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444 Max EAPOL-key M1 retransmissions exceeded for client 8c:00:6d:5c:4e:35

Is it necessary a specific configuration for mobile phones ?

can you share , show WLAN
Ali Aqrabawi — Tue, 25 Mar 2014 20:11:24 GMT

can you share , show WLAN <id>

In fact i do not have a

Rosa Ladeira — Tue, 25 Mar 2014 20:22:16 GMT

In fact i do not have a specific wlan for mobile phones.

I have a wlan where all wi-fi clients can login

(Cisco Controller) >show wlan 1

WLAN Identifier.................................. 1
Profile Name..................................... impa-nwl
Network Name (SSID).............................. impa-nwl
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Number of Active Clients......................... 105
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 1800 seconds
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ wifi-clients
Multicast Interface.............................. Not Configured

WLAN ACL......................................... unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Quality of Service............................... Silver (best effort)
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
IPv6 Support..................................... Disabled
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ Disabled
   Accounting.................................... Disabled
   Dynamic Interface............................. Disabled
Local EAP Authentication......................... Disabled
Security
   802.11 Authentication:........................ Open System
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Enabled
         TKIP Cipher............................. Enabled
         AES Cipher.............................. Enabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Enabled
         AES Cipher.............................. Enabled
   Auth Key Management
         802.1x.................................. Disabled
         PSK..................................... Enabled
         CCKM.................................... Disabled
         FT(802.11r)............................. Disabled
         FT-PSK(802.11r)......................... Disabled
FT Reassociation Timeout......................... 20
FT Over-The-Air mode............................. Enabled
FT Over-The-Ds mode.............................. Enabled
CCKM tsf Tolerance............................... 1000
   CKIP ......................................... Disabled
   Web Based Authentication...................... Disabled
   Web-Passthrough............................... Disabled
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   H-REAP Local Switching........................ Disabled
   H-REAP Local Authentication................... Disabled
   H-REAP Learn IP Address....................... Enabled
   Client MFP.................................... Optional
   Tkip MIC Countermeasure Hold-down Timer....... 60
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled

Mobility Anchor List
WLAN ID IP Address Status
------- --------------- ------

ok the configuration of this

Ali Aqrabawi — Tue, 25 Mar 2014 20:25:11 GMT

ok the configuration of this WLAN is not recommended , use either WPA+TKIP or WPA2+AES,

using a combination of WPA WPA2 TKIP AES , may cause confusing for some clients.

Is this the cause of the

Rosa Ladeira — Tue, 25 Mar 2014 20:47:13 GMT

Is this the cause of the message?

this is the most probably

Ali Aqrabawi — Tue, 25 Mar 2014 20:52:27 GMT

this is the most probably cause of this message , as this message indicate that the M1 message of the eapol-key messages exchange is not receivd to the client as the client is not replying to these messages, the eapol messages are the 4-way-handshake of the WPA/WPA2 key management

Tks

Rosa Ladeira — Tue, 25 Mar 2014 21:02:25 GMT

Tks

welcome

Ali Aqrabawi — Tue, 25 Mar 2014 21:05:55 GMT

welcome

Is there any difference

Rosa Ladeira — Wed, 26 Mar 2014 16:27:43 GMT

Is there any difference between M1 and M5 on the msg above?

*dot1xMsgTask: Mar 26 13:19:31.123: %DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444 Max EAPOL-key M5 retransmissions exceeded for client 3c:43:8e:0b:ee:f1

the M1 and M5 are exchange

Ali Aqrabawi — Wed, 26 Mar 2014 19:39:13 GMT

the M1 and M5 are exchange messages of the handshake messages ,

the perpuse of these messages is to generate the PMK of the client, the clinet and the WLC exchange some messages to generate this key , M1 and M5 are one of these messages,

in a technical perspective there is no difference as we can't do or change in these messages , as these messages are a standard

After enabling only WPA + AES

Rosa Ladeira — Wed, 26 Mar 2014 20:21:58 GMT

After enabling only WPA + AES I still have

%DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444 Max EAPOL-key M3

%DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444 Max EAPOL-key M5

Have I do enable WPA2 + AES too? booth of then?

I thought those msgs would desapear after WPA + AES (only) reconfiguration

Hiyour error coming because

Sandeep Choudhary — Wed, 26 Mar 2014 20:36:25 GMT

your error coming because:

the Client is not responding to the WPA M1 To M4 handshake..

1>> Check the client settings

2>> Upgrade the client driver to the latest and see if that helps.

Regards

what is the software version

Ali Aqrabawi — Wed, 26 Mar 2014 20:47:22 GMT

what is the software version of the WLC?

also if you can share , >show advanced eap

for all 3 controllers:

Rosa Ladeira — Wed, 26 Mar 2014 21:03:41 GMT

for all 3 controllers: Software Version 7.0.235.0

(Cisco Controller) >show advanced eap

EAP-Identity-Request Timeout (seconds)........... 30
EAP-Identity-Request Max Retries................. 2
EAP Key-Index for Dynamic WEP.................... 0
EAP Max-Login Ignore Identity Response........... enable
EAP-Request Timeout (seconds).................... 30
EAP-Request Max Retries.......................... 2
EAPOL-Key Timeout (milliseconds)................. 5000
EAPOL-Key Max Retries............................ 4
EAP-Broadcast Key Interval....................... 3600

(Cisco Controller) >logout
(Cisco Controller)
User: ******
Password:********
(Cisco Controller) >show advanced eap

EAP-Identity-Request Timeout (seconds)........... 30
EAP-Identity-Request Max Retries................. 2
EAP Key-Index for Dynamic WEP.................... 0
EAP Max-Login Ignore Identity Response........... enable
EAP-Request Timeout (seconds).................... 30
EAP-Request Max Retries.......................... 2
EAPOL-Key Timeout (milliseconds)................. 1000
EAPOL-Key Max Retries............................ 2
EAP-Broadcast Key Interval....................... 3600

(Cisco Controller) >logout

User:********
Password:********
(Cisco Controller) >show advanced eap

(Cisco Controller) >logout

for all 3 controllers

(Cisco Controller) >show advanced timers

Authentication Response Timeout (seconds)........ 60
Rogue Entry Timeout (seconds).................... 1200
AP Heart Beat Timeout (seconds).................. 30
AP Discovery Timeout (seconds)................... 10
AP Local mode Fast Heartbeat (seconds)........... disable
AP Hreap mode Fast Heartbeat (seconds)........... disable
AP Primary Discovery Timeout (seconds)........... 3600
AP Primed Discovery Timeout (seconds)............ 0

these messages seen on all

Ali Aqrabawi — Wed, 26 Mar 2014 21:09:10 GMT

these messages seen on all controllers ?

Yes, on all controllers's

Rosa Ladeira — Wed, 26 Mar 2014 21:25:39 GMT

Yes, on all controllers's logs I can find these msgs a lot of times

I will.Tks

Rosa Ladeira — Wed, 26 Mar 2014 21:26:17 GMT

I will.

Tks

i searched if this could be

Ali Aqrabawi — Wed, 26 Mar 2014 21:33:19 GMT

i searched if this could be due to a SW bug, but i did not find any thing,

i would suggest to extend the rotation interval to reduce the number of key exchanges:

config advanced eap bcast-key-interval 86400 (no impact to associated clients)

is there any impact on the client ?

Hi,ap per output: EAP

Sandeep Choudhary — Wed, 26 Mar 2014 21:42:19 GMT

Hi,

ap per output: EAP-Broadcast Key Interval....................... 3600

In some case, you might want to configure the idle timeout with a large number, for example 7200 seconds, which is 2 hours). You might think your client will remain in the client table without sending out packets for 2 hours. That is NOT necessarily the case. If the EAP-Broadcast Key Interval(by default 3600 seconds) kicks in, your client might be removed from the WLC.

When the EAP-Broadcast Key Interval kicks in, WLC will ask ALL clients to update their Broadcast Key. If your client happens to be out of the coverage area, it will not update its Broadcast Key of course.

To change the EAP-Broadcast Key Interval you will need to run the following command:

(Cisco Controller)> config advanced eap bcast-key-interval seconds 43200

then clear the log message from WLC by this command:

(Cisco Controller)>clear msg

then press yes.

Then if these messages comes then then check the timeperiod beteen these errors.

Regards

Dont forget to rate helpful posts

Hi, I am facing the same

Ratchapas Shatsa-Nga — Fri, 06 Mar 2015 05:01:20 GMT

Hi,

I am facing the same issue but I change another AP the issue has been solved.

Same client with new AP is fine.

Cloud you share idea another solution?

Thanks

topic welcome in Wireless

%DOT1X-3-MAX_EAPOL_KEY_RETRANS messages

can you share , show WLAN Ali Aqrabawi — Tue, 25 Mar 2014 20:11:24 GMT can you share , show WLAN <id>

In fact i do not have a

ok the configuration of this

Is this the cause of the

this is the most probably

Tks

welcome

Is there any difference

the M1 and M5 are exchange

After enabling only WPA + AES

Hiyour error coming because

what is the software version

for all 3 controllers:

these messages seen on all

Yes, on all controllers's

I will.Tks

i searched if this could be

Hi,ap per output: EAP

Hi, I am facing the same

can you share , show WLAN
Ali Aqrabawi — Tue, 25 Mar 2014 20:11:24 GMT

can you share , show WLAN <id>