cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
482
Views
15
Helpful
5
Replies
Highlighted

Client roaming issue between APs

hello,

 

I have a wireless network built with Cisco WLC 5520 (in HA), AP 2800. WLC is running code 8.3.133.0.

 

Randomly, client roaming goes wrong, all I can found in the debug client is this :

xx:xx:xx:xx:xx:xx : MAC of client

yy:yy:yy:yy:yy:yy : BSSID

 

*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-Key from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Ignoring invalid EAPOL version (1) in EAPOL-key message from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx key Desc Version FT - 0

*Dot1x_NW_MsgTask_2: Nov 22 09:53:52.366: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key message in invalid state from mobile xx:xx:xx:xx:xx:xx

*apfOpenDtlSocket: Nov 22 09:55:08.983: [PA] xx:xx:xx:xx:xx:xx Recevied management frame REASSOCIATION REQUEST on BSSID yy:yy:yy:yy:yy:yy destination addr yy:yy:yy:yy:yy:y2

 

Every time it's the same debug, and loss of connection until the client reasscoates with the AP with reassociation request.
 
As you can see in this debug, about 1 minute and 16 seconde of loss of ping.
 
We use [WPA2][Auth(802.1X + CCKM)] with a remote radius server (ACS) a cross the WAN.
 
Any help is much appreciated.
 
regards,
Brahim,
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Enthusiast

Re: Client roaming issue between APs

8.3.133.0 is very old and with no software maintenance support - see https://www.cisco.com/c/en/us/products/collateral/wireless/8500-series-wireless-controllers/bulletin-c25-742339.html
If you *must* run 8.3 for some reason then you should be running 8.3.150.x Escalation code which TAC will still support - see https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc11
If you don't have to stay on 8.3 (eg. for very old APs) then you should seriously consider moving to 8.5 or later.

View solution in original post

5 REPLIES 5
Highlighted

Re: Client roaming issue between APs

hello,

 

I think somehow the client send eapol pkt with the key version 1 that's ignored by the controller (version 2).

is there a way to ignore the version check in the controller ?

 

*dot1xSocketTask: Nov 22 09:53:52.365: [PA] xx:xx:xx:xx:xx:xx validating eapol pkt: key version = 2

*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-Key from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Ignoring invalid EAPOL version (1) in EAPOL-key message from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx key Desc Version FT - 0

*Dot1x_NW_MsgTask_2: Nov 22 09:53:52.366: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key message in invalid state from mobile xx:xx:xx:xx:xx:xx

*apfOpenDtlSocket: Nov 22 09:55:08.983: [PA] xx:xx:xx:xx:xx:xx Recevied management frame REASSOCIATION REQUEST on BSSID yy:yy:yy:yy:yy:yy destination addr yy:yy:yy:yy:yy:y2

 

Thanks in advance,

Highlighted
Enthusiast

Re: Client roaming issue between APs

8.3.133.0 is very old and with no software maintenance support - see https://www.cisco.com/c/en/us/products/collateral/wireless/8500-series-wireless-controllers/bulletin-c25-742339.html
If you *must* run 8.3 for some reason then you should be running 8.3.150.x Escalation code which TAC will still support - see https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc11
If you don't have to stay on 8.3 (eg. for very old APs) then you should seriously consider moving to 8.5 or later.

View solution in original post

Highlighted

Re: Client roaming issue between APs

Hello,
Thank you for your reply, we moved to 8.5.151.0 recommanded by cisco.
We are in observation period.
Regards,
Highlighted
Beginner

Re: Client roaming issue between APs

Hi
Any update on this, please?
Highlighted

Re: Client roaming issue between APs

Hello,

The upgrade solved the problem.

Regards,

CreatePlease to create content
Content for Community-Ad

Cisco COVID-19 Survey

This widget could not be displayed.