Issues connecting Android 10 to Cisco ME - Page 4

dovla091 · ‎01-10-2020

Hi, I had one problem which I found bypass solution, but I would like to share with someone, as I don't want that someone is wasting time as I did troubleshooting the issue.

My case was that I have 15 APs AP1832i set to Cisco ME, so 1 acts as a call it a "controller", while others are getting the instruction. I have set latest version of firmware for APs - 8.10.105.0

Now I have Nokia 7.1 running Android 10 December 2019 patch, and what I found out that after upgrading Android to version 10 and patching Cisco AP1832i from 8.5 to 8.10, android phone cannot connect anymore.

After 1 hour of troubleshooting I found a bypass. By enabling WPA3 (along with WPA2), android 10 started to connect again.

My guess is either Google completely ditched support for WPA2 (for some reason), in favor for WPA3 or there is some mismatch between Cisco 8.10.105.0 for ME and Google Android 10. By enabling WPA3, phone can successfully connect to our network.

I hope I helped someone, and saved him/her some time in dealing with tedious troubleshooting

Best regards

JPavonM · ‎08-14-2020

these are good news for this community thread about some Android 10 devices from vendors Nokia, Sony and Xiaomi not able to connect to Cisco APs.

With the release of the new 17.3.1.9 code last Monday the problems have been fixed using different L2 security features (maybe working similar in recently released 16.2.4a last Friday). The only caveat there is when using 802.11r FT Adaptive (w or w/o over DS) and SHA1 or SHA1+SHA256 with COS-APs.

Config of the SSID must follow Cisco's workaround to disable FT Adaptive and Device Analytics.

This is the matrix for the tests:

JPavonM · ‎08-19-2020

I've also tested Cisco AireOS 8.10.130 on ME and this is also working fine for Xiaomi devices disabling FT or enabling it, but not configuring adaptive which is expected behaviour.

NOTE: I've noticed some issues when trying to upgrade to ME 8.10.130 with errors aboout partitions. Finally I 've managed to solve it downgrading to 8.5.161 before, and then upgrading to 8.10.130.

Alex Ma · ‎07-26-2020

patoberli · ‎08-02-2020

Alternatively downgrade to latest 8.8 release or apply for the TAC supported beta 8.10 release.
Is all goes to plan, it should be released in the next 4 weeks.
Please note that I have another bug in that beta release, which makes it impossible for me to deploy it broadly.
So I suggest, if possible, to downgrade to 8.8.

##- Please type your reply above this line -#
Sent from Nine<>

patoberli · ‎08-25-2020

Make sure to either upgrade to 8.10.130.0 or downgrade to 8.8.130.0. Both versions should work correct with WPA2 and PSK. Make sure PMF is Optional or Disabled. Don't enable WPA3!

yogendra.singh1 · ‎11-20-2020

i have also facing same problem in cisco ME upgrade os with nokia phone

patoberli · ‎11-23-2020

Make sure to run up to date software, like 8.10.130.0 or even 8.10.142.0.

Yordan Yordanov · ‎12-23-2020

Hi patoberli,

i made this changes, but still no success. Pls checn the output

WLAN ID WLAN Name Status Protection
------- ------------------------- --------- ----------
1 Admin LAN Enabled Optional
2 Local LAN Enabled Disabled - still cant connect with my Xiaomi mi 10t - Android 10
3 Guest WLAN Enabled Optional

i am using 8.10.142 latest release

Any sugestions?

yogendra.singh1 · ‎12-23-2020

Just Degrade the firmware on Software Version 8.5.151.0
so Now onwards everything will working fine and not getting any problem from the client end.

just try this and relief yourself to that problem.

Yordan Yordanov · ‎01-04-2021

Hi Yogendra

the downgrade doesnt work for me. i have the error due the update, that tar/rar file are not suported

br

Yordan

patoberli · ‎01-04-2021

This is weird, it should be working with 8.10.142.0.

Can you share the full SSID configuration of the WLAN ID 2?

Yordan Yordanov · ‎01-04-2021

hi patoberli

This is the output:

(Cisco Controller) show>wlan 2

WLAN Identifier.................................. 2
Profile Name..................................... Local Lan
Network Name (SSID).............................. otto
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Client Profiling Status
Radius Profiling ............................ Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Local Profiling ............................. Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum Clients Allowed.......................... Unlimited
Security Group Tag............................... Unknown(0)

--More-- or (q)uit
Maximum number of Clients per AP Radio........... 200
ATF Policy....................................... 0
Number of Active Clients......................... 6
Exclusionlist Timeout............................ 180 seconds
Session Timeout.................................. 86400 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
Sleep Client Auto Auth Feature................... Enabled
Web Auth Captive Bypass Mode..................... Enabled
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... none
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ management
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
mDNS Status...................................... Disabled
mDNS Profile Name................................ unconfigured
DHCP Server...................................... Default
DHCP Scope Name.................................. none

--More-- or (q)uit
Central NAT...................................... Disabled
Central NAT Peer-Peer Blocking................... Disabled
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Tunnel Profile................................... Unconfigured
EoGRE Override VLAN state........................ disable
EoGRE Override VLAN ID........................... 0
Quality of Service............................... Silver
Per-BSSID Rate Limits............................ Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-Client Rate Limits........................... Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-WLAN Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0

--More-- or (q)uit
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... 802.1P (Tag=0)
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
Authentication................................ Global Servers
Accounting.................................... Global Servers
Interim Update............................. Enabled
Interim Update Interval.................... 0
Framed IPv6 Acct AVP ...................... Prefix
Authorization ACA............................. Disabled
Accounting ACA................................ Disabled

--More-- or (q)uit
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Radius NAI-Realm................................. Disabled
Radius Authentication caching.................... Disabled
Mu-Mimo.......................................... Enabled
Security

802.11 Authentication:........................ Open System
FT Support.................................... Adaptive
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2/WPA3)........ Enabled
WPA (SSN IE)............................... Disabled
WPA2 (RSN IE).............................. Enabled
WPA3 (RSN IE).............................. Disabled
WPA2/WPA3 Encryption Ciphers
TKIP Cipher............................. Disabled
CCMP128/AES Cipher...................... Enabled
CCMP256 Cipher.......................... Disabled
GCMP128 Cipher.......................... Disabled
GCMP256 Cipher.......................... Disabled
OSEN IE.................................... Disabled

--More-- or (q)uit
Auth Key Management
802.1x.................................. Disabled
802.1x-SHA2............................. Disabled
PSK..................................... Enabled
PSK-SHA2................................ Disabled
CCKM.................................... Disabled
FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Disabled
OSEN-1X................................. Disabled
SUITEB-1X............................... Disabled
SUITEB192-1X............................ Disabled
OWE..................................... Disabled
SAE..................................... Disabled
PMKID in 4way-handshake.................... Disabled
OWE Transition Mode........................ Disabled
OWE Transition Mode WLAN id................ 0
Auto Key PSK .............................. Disabled
FT Reassociation Timeout................... 20
FT Over-The-DS mode........................ Disabled
GTK Randomization.......................... Disabled
SKC Cache Support.......................... Disabled
CCKM TSF Tolerance......................... 1000
Wi-Fi Direct policy configured................ Disabled

--More-- or (q)uit
EAP-Passthrough............................... Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web Authentication Timeout.................... 300
Web-Passthrough............................... Disabled
Mac-auth-server............................... 0.0.0.0
Web-portal-server............................. 0.0.0.0
qrscan-des-key................................
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
Auto Anchor................................... Disabled
FlexConnect Local Switching................... Enabled
FlexConnect Central Association............... Disabled
flexconnect Central Dhcp Flag................. Disabled
flexconnect nat-pat Flag...................... Disabled
flexconnect Dns Override Flag................. Disabled
flexconnect PPPoE pass-through................ Disabled
flexconnect local-switching IP-source-guar.... Disabled
FlexConnect Vlan based Central Switching ..... Disabled
FlexConnect Local Authentication.............. Disabled
FlexConnect Learn IP Address.................. Enabled
Flexconnect Post-Auth IPv4 ACL................ Unconfigured
Flexconnect Post-Auth IPv6 ACL................ Unconfigured

--More-- or (q)uit
Client MFP.................................... Optional
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60
Eap-params.................................... Disabled
AVC Visibilty.................................... Disabled
Flex Avc Profile Name............................ Local Lan
OpenDns Profile Name............................. None
OpenDns Wlan Mode................................ ignore
OpenDns Wlan Dhcp Option 6....................... enable
Flow Monitor Name................................ None
Split Tunnel Configuration
Split Tunnel................................. Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Enabled
802.11k Neighbor List Dual Band.................. Disabled
802.11v Directed Multicast Service............... Enabled

--More-- or (q)uit
802.11v BSS Max Idle Service..................... Enabled
802.11v BSS Transition Service................... Enabled
802.11v BSS Transition Disassoc Imminent......... Disabled
802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40
802.11v BSS Transition Neigh List Dual Band...... Disabled
DMS DB is empty
Band Select...................................... Enabled
Load Balancing................................... Client-Count Based
Multicast Buffer................................. Disabled
Universal Ap Admin............................... Disabled
Broadcast Tagging................................ Disabled
PRP.............................................. Disabled
Fast Receive..................................... Disabled
11ax Downlink MU-MIMO............................ Disabled
11ax Uplink MU-MIMO.............................. Disabled
11ax Downlink OFDMA.............................. Disabled
11ax Uplink OFDMA................................ Disabled
Wifi Alliance Multiband Operation................ Disabled
11ax Target Wake Time............................ Enabled

Mobility Anchor List
WLAN ID IP Address Status Priority

--More-- or (q)uit
------- --------------- ------ --------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

Local Policy
----------------
Priority Policy Name
-------- ---------------

QoS Fastlane Status.............................. Disable
Selective Reanchoring Status..................... Disable
Lobby Admin Access............................... Disabled

Fabric Status
--------------

Fabric status.................................... Disable
Vnid Name........................................
Vnid............................................. 0
Applied SGT Tag.................................. 0
Peer Ip Address.................................. 0.0.0.0

--More-- or (q)uit
Flex Acl Name....................................
Flex IPv6 Acl Name...............................
Flex Avc Policy Name.............................

U3-Interface................................... Disable

U3-Reporting Interval.......................... 30

patoberli · ‎01-05-2021

Can you try the following changes:

Disable AironetIE (advanced SSID settings)

Disable FT Support

Disable Load Balancing (and Band Select probably too)

You can test by disabling one setting and a time and then check again for stability.

Yordan Yordanov · ‎01-05-2021

Hi Patoberli

Success! Thank you very much. i made this steps:

1. config wlan ccx aironetIeSupport disable 2

- No success
2. config wlan security ft disable 2

-Connected with Wlan

3. Disable Load Balancing (and Band Select probably too)

- didnt try

Br

Yordan

patoberli · ‎01-05-2021

For greater stability, I would also disable load balancing. That actually kicks the clients out of the network if they don't roam when the WLC thinks they should roam. It has its positives and negatives sides, I generally leave it disabled in a mixed environment with many clients that I don't manage.