Hi Guys....
Recently my client experienced stations disconnecting from WiFi. When I checked the log, there are some irregularities. There are DOT11-4-CCMP_REPLAY & DOT11-5-EXPECTED_RADIO_RESET. According to my client, he said that the SSID still broadcasting but the stations cannot connect right after the connection dropped. They were only able to reconnect after wait for several minutes.
The DOT11-4-CCMP_REPLAY are the following:
*Jan 10 03:15:40.383: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 18 AES-CCMP TSC replays
*Jan 10 03:15:46.503: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 20 AES-CCMP TSC replays
*Jan 10 03:15:52.623: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 21 AES-CCMP TSC replays
*Jan 10 03:15:58.743: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 34 AES-CCMP TSC replays
*Jan 10 03:16:04.863: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 11 AES-CCMP TSC replays
*Jan 10 03:16:11.071: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 7 AES-CCMP TSC replays
*Jan 10 03:16:17.071: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 8 AES-CCMP TSC replays
*Jan 10 03:16:24.071: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 8 AES-CCMP TSC replays
*Jan 10 03:16:31.071: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 14 AES-CCMP TSC replays
*Jan 10 03:16:37.071: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 12 AES-CCMP TSC replays
*Jan 10 03:16:45.071: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 18 AES-CCMP TSC replays
*Jan 10 03:16:52.071: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 25 AES-CCMP TSC replays
*Jan 10 03:16:58.071: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 94 AES-CCMP TSC replays
*Jan 10 03:17:04.159: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 23 AES-CCMP TSC replays
*Jan 10 03:17:10.415: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 30 AES-CCMP TSC replays
*Jan 10 03:17:16.539: %DOT11-4-CCMP_REPLAY: Client 80a5.8984.0f73 had 11 AES-CCMP TSC replays
The DOT11-5-EXPECTED_RADIO_RESET are the following:
*Jan 9 13:05:24.567: %DOT11-6-DISASSOC: Interface Dot11Radio0, Deauthenticating Station 18cf.5ecb.316c
*Jan 9 13:05:25.163: %DOT11-6-ASSOC: Interface Dot11Radio1, Station c0bd.d105.5cb9 REAP Associated KEY_MGMT[Open]
*Jan 9 13:05:26.603: %DOT11-6-DISASSOC: Interface Dot11Radio1, Deauthenticating Station c0bd.d105.5cb9 Sending station has left the BSS
*Jan 9 13:05:26.967: %DOT11-5-EXPECTED_RADIO_RESET: Restarting Radio interface Dot11Radio0 due to completion of client deauth timeout
*Jan 9 13:05:26.971: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to down
*Jan 9 13:05:26.979: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Jan 9 13:05:27.971: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Jan 9 13:05:28.011: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Jan 9 13:05:29.011: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
*Jan 9 13:05:33.023: %DOT11-6-ASSOC: Interface Dot11Radio1, Station 0056.cd63.1947 REAP Associated KEY_MGMT[Open]
*Jan 9 13:05:39.047: %CLEANAIR-6-STATE: Slot 0 down
*Jan 9 13:05:39.811: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 18cf.5ecb.316c REAP Associated KEY_MGMT[Open]
*Jan 9 13:05:55.899: %CLEANAIR-6-STATE: Slot 0 enabled
*Jan 9 13:06:14.347: %DOT11-6-DISASSOC: Interface Dot11Radio1, Deauthenticating Station 60f8.1dc5.4e06 Sending station has left the BSS
*Jan 9 13:06:15.111: %DOT11-6-ASSOC: Interface Dot11Radio1, Station 60f8.1dc5.4e06 REAP Associated KEY_MGMT[Open]
*Jan 9 13:07:40.983: %DOT11-6-DISASSOC: Interface Dot11Radio1, Deauthenticating Station 5c96.9d2a.18e6 Sending station has left the BSS
*Jan 9 13:07:41.131: %DOT11-6-ASSOC: Interface Dot11Radio1, Station 5c96.9d2a.18e6 REAP Associated KEY_MGMT[Open]
*Jan 9 13:07:43.815: Received and decoded a DMS client request payload SUCCESSFULLY
This never happened before. Just after the new year. Any idea why? Or what I should check? The WLC is 2504 running 8.3.112.0. The LAP is AIR-CAP1702I-F-K9. The connection is H-REAP (or in the newer term flexconnect?).
I already searched for answer before on Cisco and other forums but got no absolute answer. The WMM is enabled, fast reconnect allowed, the system using WPA2 AES 802.1X.
Thank you.
Regads,
Faris
