That's what I was thinking ... so again, puzzling how it worked before FlexConnect (and only stopped on the 1262 series AP), but honestly, if my clients weren't using FT then it defeats the purpose of enabling it. I'm okay with just shutting it off and saving it for a rainy day project down the road. ... View more

I'll go ahead and disable FT across the board until I get a better handle on what is supported and not with it. I appreciate the comments and help. Thanks! ... View more

So one thing that never occurred to me... and maybe this is significant or not... I've always had my WLAN security setup this way with both PSK and FT PSK checked. When I just checked my voice WLAN clients (7921 and 7925) phones... I notice they aren't showing the FT PSK connection, but they are just connected by WPA2/AES. Now, I'm assuming from that tidbit that most of my clients haven't been connecting by FT PSK at all and just continuing to use PSK. In fact, I just disabled PSK and left FT PSK on and all my clients fell off (and after a period of 3 minutes didn't reconnect). I'm not on site today to verify why, but nevertheless it confirms the theory that FT probably hasn't actually been in use. So, now I'm left with the fact that FT is probably my entire issue and not necessarily FlexConnect. At the very least, it's something I need to read up a bit more on. It's still curious to me why my phone (and presumably other clients) would connect fine without FlexConnect enabled but suddenly acted up with it in place. I appreciate any thoughts you have. ... View more

First of all thank you, and I apologize if I offended you, because I'm not attacking you or your expertise. I very much appreciate your time in helping... I just want more detail than "not supported" because I believe I'm doing the right thing and need help to identify why it may not be. So, to the issue... 1. Yes, TKIP was initially enabled (which I though had been disabled previously, so I apologize for the confusion). Disabling it had no effect, however, per best practice I will leave it disabled. I've never used WEP or WPA, only WPA2. 2. FT has been enabled with FT PSK since January 1. Yes, I have always been aware that devices must support it to work. So with that said, here's a breakdown of what I'm using... All of my laptops are Dell or HP with Windows 7 x64 with the latest drivers and do not have any issues (even now). Their drivers were updated at the time of implementation in January. They are all working fine with FlexConnect and FT enabled. I have a variety of smartphones/tablets... Apple, Android, and Windows devices of varying types. I always require users to update to the latest firmware, mostly because of Apple's bugginess supporting Exchange. So far, I've not had any trouble with tablets... my Surface RT and a user's iPad are connected just fine. I was testing with a Nokia Lumia 920 (Windows Phone 8) and experiencing issues yesterday, however, as I said before it was working prior to enabling FlexConnect, and to the best of my knowledge it IS 802.11r supported... If it's not, then I'm not sure how it was working previously which is where the issue comes in. I don't have any Apple or Android devices handy for testing until business hours tomorrow, but I will verify whether they have any issues. In the meantime, I've disabled FT on my guest and data WLAN in order to ensure everyone can connect. My voice WLAN, however, still has FT enabled for use with my 7921 and 7925 phones, which I believe to support 802.11r using firmware 1.4.3 SR1. Please correct me if I'm wrong on that, although again, with FT and FlexConnect enabled... I'm not seeing any issues on either style AP. 3. Cisco 5508 running 7.4.100.60 software, 1242G's with 12.4(25e)JAM1$, and 1262AGN's with 15.2(2)JB1$. If there is a major difference in functionality with this setup, I realize it's probably the difference in 12.4 and 15.2 IOS on these APs, but if FT/FC are not actually applied to the 1242G, can you please provide the documentation of that? Everything I've seen suggests I should be fine. 4. Here is the show wlan config currently in use (wlan 1 is data, wlan 3 is voice), as I overlooked your request for it earlier. (Cisco Controller) >show wlan 1 WLAN Identifier.................................. 1 Profile Name..................................... SWH Network Name (SSID).............................. SWH Status........................................... Enabled MAC Filtering.................................... Disabled Broadcast SSID................................... Enabled AAA Policy Override.............................. Disabled Network Admission Control   Client Profiling Status ....................... Disabled    DHCP ......................................... Disabled    HTTP ......................................... Disabled   Radius-NAC State............................... Disabled   SNMP-NAC State................................. Disabled   Quarantine VLAN................................ 0 Maximum number of Associated Clients............. 0 Maximum number of Clients per AP Radio........... 200 Number of Active Clients......................... 23 Exclusionlist.................................... Disabled Session Timeout.................................. 86400 seconds User Idle Timeout................................ 300 seconds User Idle Threshold.............................. 0 Bytes NAS-identifier................................... SWH-WLC CHD per WLAN..................................... Enabled Webauth DHCP exclusion........................... Disabled Interface........................................ wlan-data Multicast Interface.............................. Not Configured WLAN IPv4 ACL.................................... unconfigured WLAN IPv6 ACL.................................... unconfigured mDNS Status...................................... Disabled mDNS Profile Name................................ unconfigured DHCP Server...................................... Default DHCP Address Assignment Required................. Disabled Static IP client tunneling....................... Disabled PMIPv6 Mobility Type............................. none Quality of Service............................... Gold Per-SSID Rate Limits............................. Upstream      Downstream Average Data Rate................................   0             0 Average Realtime Data Rate.......................   0             0 Burst Data Rate..................................   0             0 Burst Realtime Data Rate.........................   0             0 Per-Client Rate Limits........................... Upstream      Downstream Average Data Rate................................   0             0 Average Realtime Data Rate.......................   0             0 Burst Data Rate..................................   0             0 Burst Realtime Data Rate.........................   0             0 Scan Defer Priority.............................. 4,5,6 Scan Defer Time.................................. 100 milliseconds WMM.............................................. Allowed WMM UAPSD Compliant Client Support............... Disabled Media Stream Multicast-direct.................... Enabled CCX - AironetIe Support.......................... Enabled CCX - Gratuitous ProbeResponse (GPR)............. Disabled CCX - Diagnostics Channel Capability............. Disabled Dot11-Phone Mode (7920).......................... Disabled Wired Protocol................................... 802.1P (Tag=5) Passive Client Feature........................... Disabled Peer-to-Peer Blocking Action..................... Disabled Radio Policy..................................... 802.11b and 802.11g only DTIM period for 802.11a radio.................... 1 DTIM period for 802.11b radio.................... 1 Radius Servers    Authentication................................ Disabled    Accounting.................................... Disabled    Dynamic Interface............................. Disabled    Dynamic Interface Priority.................... wlan Local EAP Authentication......................... Disabled Security    802.11 Authentication:........................ Open System    FT Support.................................... Disabled    Static WEP Keys............................... Disabled    802.1X........................................ Disabled    Wi-Fi Protected Access (WPA/WPA2)............. Enabled       WPA (SSN IE)............................... Disabled       WPA2 (RSN IE).............................. Enabled          TKIP Cipher............................. Disabled          AES Cipher.............................. Enabled                                                                Auth Key Management          802.1x.................................. Disabled          PSK..................................... Enabled          CCKM.................................... Disabled          FT-1X(802.11r).......................... Disabled          FT-PSK(802.11r)......................... Disabled          PMF-1X(802.11w)......................... Disabled          PMF-PSK(802.11w)........................ Disabled       FT Reassociation Timeout................... 20       FT Over-The-DS mode........................ Enabled       GTK Randomization.......................... Disabled       SKC Cache Support.......................... Disabled       CCKM TSF Tolerance......................... 1000    WAPI.......................................... Disabled    Wi-Fi Direct policy configured................ Disabled    EAP-Passthrough............................... Disabled    CKIP ......................................... Disabled    Web Based Authentication...................... Disabled    Web-Passthrough............................... Disabled    Conditional Web Redirect...................... Disabled    Splash-Page Web Redirect...................... Disabled    Auto Anchor................................... Disabled    FlexConnect Local Switching................... Enabled    flexconnect Central Dhcp Flag................. Disabled    flexconnect nat-pat Flag...................... Disabled    flexconnect Dns Override Flag................. Disabled    FlexConnect Vlan based Central Switching ..... Disabled    FlexConnect Local Authentication.............. Disabled    FlexConnect Learn IP Address.................. Enabled    Client MFP.................................... Optional    PMF........................................... Disabled    PMF Association Comeback Time................. 1    PMF SA Query RetryTimeout..................... 200    Tkip MIC Countermeasure Hold-down Timer....... 60 AVC Visibilty.................................... Disabled AVC Profile Name................................. None Flow Monitor Name................................ None Call Snooping.................................... Disabled Roamed Call Re-Anchor Policy..................... Disabled SIP CAC Fail Send-486-Busy Policy................ Enabled SIP CAC Fail Send Dis-Association Policy......... Disabled KTS based CAC Policy............................. Disabled Assisted Roaming Prediction Optimization......... Disabled 802.11k Neighbor List............................ Disabled 802.11k Neighbor List Dual Band.................. Disabled Band Select...................................... Disabled Load Balancing................................... Disabled Multicast Buffer................................. Disabled Mobility Anchor List WLAN ID     IP Address            Status -------     ---------------       ------ 802.11u........................................ Disabled MSAP Services.................................. Disabled (Cisco Controller) >show wlan 3 WLAN Identifier.................................. 3 Profile Name..................................... WLC-Voice Network Name (SSID).............................. SWHV Status........................................... Enabled MAC Filtering.................................... Disabled Broadcast SSID................................... Disabled AAA Policy Override.............................. Disabled Network Admission Control   Client Profiling Status ....................... Disabled    DHCP ......................................... Disabled    HTTP ......................................... Disabled   Radius-NAC State............................... Disabled   SNMP-NAC State................................. Disabled   Quarantine VLAN................................ 0 Maximum number of Associated Clients............. 0 Maximum number of Clients per AP Radio........... 200 Number of Active Clients......................... 94 Exclusionlist.................................... Disabled Session Timeout.................................. 86400 seconds User Idle Timeout................................ 300 seconds User Idle Threshold.............................. 0 Bytes NAS-identifier................................... SWH-WLC CHD per WLAN..................................... Enabled Webauth DHCP exclusion........................... Disabled Interface........................................ wlan-voice Multicast Interface.............................. Not Configured WLAN IPv4 ACL.................................... unconfigured WLAN IPv6 ACL.................................... unconfigured mDNS Status...................................... Disabled mDNS Profile Name................................ unconfigured DHCP Server...................................... Default DHCP Address Assignment Required................. Disabled Static IP client tunneling....................... Disabled PMIPv6 Mobility Type............................. none Quality of Service............................... Platinum Per-SSID Rate Limits............................. Upstream      Downstream Average Data Rate................................   0             0 Average Realtime Data Rate.......................   0             0 Burst Data Rate..................................   0             0 Burst Realtime Data Rate.........................   0             0 Per-Client Rate Limits........................... Upstream      Downstream Average Data Rate................................   0             0 Average Realtime Data Rate.......................   0             0 Burst Data Rate..................................   0             0 Burst Realtime Data Rate.........................   0             0 Scan Defer Priority.............................. 4,5,6 Scan Defer Time.................................. 100 milliseconds WMM.............................................. Required WMM UAPSD Compliant Client Support............... Disabled Media Stream Multicast-direct.................... Enabled CCX - AironetIe Support.......................... Enabled CCX - Gratuitous ProbeResponse (GPR)............. Disabled CCX - Diagnostics Channel Capability............. Disabled Dot11-Phone Mode (7920).......................... ap-cac-limit Wired Protocol................................... 802.1P (Tag=6) Passive Client Feature........................... Disabled Peer-to-Peer Blocking Action..................... Disabled Radio Policy..................................... 802.11b and 802.11g only DTIM period for 802.11a radio.................... 2 DTIM period for 802.11b radio.................... 2 Radius Servers    Authentication................................ Disabled    Accounting.................................... Disabled    Dynamic Interface............................. Disabled    Dynamic Interface Priority.................... wlan Local EAP Authentication......................... Disabled Security    802.11 Authentication:........................ Open System    FT Support.................................... Enabled    Static WEP Keys............................... Disabled    802.1X........................................ Disabled    Wi-Fi Protected Access (WPA/WPA2)............. Enabled       WPA (SSN IE)............................... Disabled       WPA2 (RSN IE).............................. Enabled          TKIP Cipher............................. Disabled          AES Cipher.............................. Enabled                                                                Auth Key Management          802.1x.................................. Disabled          PSK..................................... Enabled          CCKM.................................... Disabled          FT-1X(802.11r).......................... Disabled          FT-PSK(802.11r)......................... Enabled          PMF-1X(802.11w)......................... Disabled          PMF-PSK(802.11w)........................ Disabled       FT Reassociation Timeout................... 20       FT Over-The-DS mode........................ Enabled       GTK Randomization.......................... Disabled       SKC Cache Support.......................... Disabled       CCKM TSF Tolerance......................... 1000    WAPI.......................................... Disabled    Wi-Fi Direct policy configured................ Disabled    EAP-Passthrough............................... Disabled    CKIP ......................................... Disabled    Web Based Authentication...................... Disabled    Web-Passthrough............................... Disabled    Conditional Web Redirect...................... Disabled    Splash-Page Web Redirect...................... Disabled    Auto Anchor................................... Disabled    FlexConnect Local Switching................... Enabled    flexconnect Central Dhcp Flag................. Disabled    flexconnect nat-pat Flag...................... Disabled    flexconnect Dns Override Flag................. Disabled    FlexConnect Vlan based Central Switching ..... Disabled    FlexConnect Local Authentication.............. Disabled    FlexConnect Learn IP Address.................. Enabled    Client MFP.................................... Optional    PMF........................................... Disabled    PMF Association Comeback Time................. 1    PMF SA Query RetryTimeout..................... 200    Tkip MIC Countermeasure Hold-down Timer....... 0 AVC Visibilty.................................... Disabled AVC Profile Name................................. None Flow Monitor Name................................ None Call Snooping.................................... Disabled Roamed Call Re-Anchor Policy..................... Disabled SIP CAC Fail Send-486-Busy Policy................ Enabled SIP CAC Fail Send Dis-Association Policy......... Disabled KTS based CAC Policy............................. Disabled Assisted Roaming Prediction Optimization......... Disabled 802.11k Neighbor List............................ Disabled 802.11k Neighbor List Dual Band.................. Disabled Band Select...................................... Disabled Load Balancing................................... Disabled Multicast Buffer................................. Disabled Mobility Anchor List WLAN ID     IP Address            Status -------     ---------------       ------ 802.11u........................................ Disabled MSAP Services.................................. Disabled ... View more

I'm sorry to disagree, but I don't believe that you're correct on this. I've had this setup for several months now with no prior issue, and it was implemented under direction from TAC. This is a simple setup here... there's nothing special about it. Standard SSID with WPA2/AES PSK, FT is enabled with the FT PSK option, and the only change now is enabling FlexConnect. 27 APs (only 2 of which are 1262) at one site and 3 1262s at the other site. If I assume you're correct on the FT issue with 1242, then these devices would not have connected at the second site with 1262s alone at any point in the past several months, and yet they did. If there's documentation to explain it, I'd appreciate the link to that information. Otherwise, can we get over the "not supported" claim and figure out what's going on? If I'm better off opening a TAC case, then I will do so. ... View more

I'll be happy to mark it answered when it's answered. TKIP is now disabled... WPA2 (only) with AES (only). Devices are clearly FT capable or they wouldn't connect at all, per your own comments and my own reading of FT documentation when I enabled it. However, they DO connect but only to non-1262AGN APs in this condition. That's NOT normal. ... View more

Understood, but this has been running for more than 8 months now, and only the change to FlexConnect has affected connectivity, and only on the 1262AGN AP's. Even now, I have a 1262AGN outside my office door with FlexConnect, and yet my smartphone is connected to the 1242G down the hall instead (turned Wi-Fi off for a few minutes and then back on to force a change). I can also prove the case by rebooting the 1242G so that only the 1262AGN is in range... and then it won't connect at all. If I turn the AP back to Local mode, it connects right away. UPDATE: Turning off FT does allow the AP to connect to the 1262AGN in FlexConnect mode. So, now it seems the key is 1262AGN + FT + FlexConnect. Possibly a bug? ... View more

Actually, yes, TKIP is also enabled. I can try disabling it if that makes a difference. Fast Transition is also enabled, although I'd prefer to not disable that one. ... View more

Thank you! This has been very helpful. ... View more

Yes, I'm running 7.0.116.0 on the WLC25 today, so that sounds promising. I've already downloaded the config file from the WLC25, and I did notice it looked pretty basic command-line, so I was certainly hoping that to be the case. If the 5508 firmware is newer (I haven't even unboxed it yet), do you expect I'd run into trouble importing the old config, or should I version match first, import, then upgrade to latest? Any other gotchas I should look out for in doing this? ... View more