Win10 clients can not connect/roam to 2802i-e but roams fine with 2702i-2 in the same area

[hamid.nabil1]

Client can not connect to 2802 AP while roaming from 2702. I see the following msgs in AP logs. As soon as client is in 2702 radius then it connects again. Let me know if you need more info. Any help is appreciated.

Feb 26 12:26:46 kernel: [*02/26/2019 12:26:46.8048] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (72 64)
Feb 26 12:26:56 kernel: [*02/26/2019 12:26:56.7994] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (88 64)
Feb 26 12:27:06 kernel: [*02/26/2019 12:27:06.8232] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (104 64)
Feb 26 12:27:16 kernel: [*02/26/2019 12:27:16.8400] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (120 64)
Feb 26 12:27:26 kernel: [*02/26/2019 12:27:26.8202] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (120 64)
Feb 26 12:27:36 kernel: [*02/26/2019 12:27:36.8315] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (120 64)
Feb 26 12:27:46 kernel: [*02/26/2019 12:27:46.4437] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (120 64)
Feb 26 12:27:56 kernel: [*02/26/2019 12:27:56.4335] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (120 64)
Feb 26 13:03:48 kernel: [*02/26/2019 13:03:48.1204] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (72 64)
Feb 26 13:03:58 kernel: [*02/26/2019 13:03:58.1152] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (88 64)
Feb 26 13:04:08 kernel: [*02/26/2019 13:04:08.0921] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (104 64)
Feb 26 13:04:18 kernel: [*02/26/2019 13:04:18.0919] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (120 64)
Feb 26 13:04:28 kernel: [*02/26/2019 13:04:28.0926] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (136 64)
Feb 26 13:04:38 kernel: [*02/26/2019 13:04:38.1088] macMgmtMlme_AssocReAssocReqHandler[line 2339] out of boundary (136 64)
Feb 26 13:15:37 kernel: [*02/26/2019 13:15:37.8342] Sending GTK KEY message failed hostapd CISCO GTK_KEY bbc7xxxxxxxxxxxxxxx
Feb 26 14:17:04 kernel: [*02/26/2019 14:17:04.2767] Sending GTK KEY message failed hostapd CISCO GTK_KEY 3567cxxxxxxxxxxxxxx
Feb 26 15:18:55 kernel: [*02/26/2019 15:18:55.9041] Sending GTK KEY message failed hostapd CISCO GTK_KEY 16373xxxxxxxxxxxxxx
Feb 26 16:20:48 kernel: [*02/26/2019 16:20:48.3322] Sending GTK KEY message failed hostapd CISCO GTK_KEY 8bb13xxxxxxxxxxxxxx
Feb 26 17:21:54 kernel: [*02/26/2019 17:21:54.0340] Sending GTK KEY message failed hostapd CISCO GTK_KEY 12945xxxxxxxxxxxxxx
Feb 26 18:22:57 kernel: [*02/26/2019 18:22:57.2691] Sending GTK KEY message failed hostapd CISCO GTK_KEY 45d8bxxxxxxxxxxxxxx
Feb 26 19:24:34 kernel: [*02/26/2019 19:24:34.6204] Sending GTK KEY message failed hostapd CISCO GTK_KEY c3d22xxxxxxxxxxxxxx
Feb 26 20:26:10 kernel: [*02/26/2019 20:26:10.3756] Sending GTK KEY message failed hostapd CISCO GTK_KEY 8a5c2xxxxxxxxxxxxxx
Feb 26 21:27:15 kernel: [*02/26/2019 21:27:15.4937] Sending GTK KEY message failed hostapd CISCO GTK_KEY 1ee2dxxxxxxxxxxxxxx

[hamid.nabil1]

I agree that client should be able to run without FT. But it looks that some PDA's in a remote location has different wifi-profile. Those PDA's goes offline and does not reassociate until enabling FT. This isn't the biggest issue to be clear. That is a client issue which maybe fixed by deploying new wifi profile. But I have more problems with FT in adaptive mode with flexconnect only locations with 2800.

[patoberli]

But does it work correct with FT completely disabled? When you have it on "Adaptive" a client might try to use it, even if its driver is buggy.

[hamid.nabil1]

Did not try that yet. I will check it out.

[hamid.nabil1]

Any idea what this means: wl_add_acl_list_mac:4479: ACL List MAC Table is Full Not able to new MAC

[patoberli]

Never seen that message, you might want to open/inform TAC about it.

[a.stephan]

Sorry no bug# available for me. I just got this on short notice from our partner company without reference to the actual bug#

[RaffyLindogan]

1. Are the APs joined on the same WLCs?
2. Is FT enable?
3. Is that specific AP on flexconnect and in standalone mode or has lost association with WLC?
4. Are the APs on different AP Groups and/or Flexconnect Groups?
5. Is WPA gtk-randomize State enabled?
6. Can you please show the output of "show advance eap"

Cheers,

Raffy

[hamid.nabil1]

1. All APs are in the same WLC.
2. FT is in adaptive mode.
3. It is in FlexConnect mode and is associated to WLC as all other APs.
4. All APs are in the same flexconnect group with correct vlan maping.
5. WPA gtk-randomize is disbaled.
6.
EAP-Identity-Request Timeout (seconds)........... 5
EAP-Identity-Request Max Retries................. 2
EAP Key-Index for Dynamic WEP.................... 0
EAP Max-Login Ignore Identity Response........... enable
EAP-Request Timeout (seconds).................... 30
EAP-Request Max Retries.......................... 2
EAPOL-Key Timeout (milliseconds)................. 2000
EAPOL-Key Max Retries............................ 0
EAP-Broadcast Key Interval....................... 3600

[AndreaTornaghi]

Dear,

did you find the solution at this problem?

I'm having your identical problem and I have also opened a TAC but I'm still without a valid solutions.

I can add that the problem is present also with FT disabled.

[a.stephan]

sorry, we didn't find a solution but only a workaround. We have replaced the
Flexconnect 2800 with new 1800 APs, which solved the issue for us.

[hamid.nabil1]

Check if you are using FT if yes disable it and try again. If no check if you are using K,V deactivate it and test it. Check the debugs and see if client and AP are responding correct during epol key exchanging. It did not help us to tune epol timers. 

[Abdelbasset Addamssiri]

Hello Nabil, 

Do you find any solution for this issue without upgrading Airos ?? i have the same sypmtomps with 1850/2802 APs in flexconnect mode.

Thanks in advance.

Best regards, 

[hamid.nabil1]

No, not really :( Contact TAC they may have a solution for your environment. 

[Paccers]

Hey there,

Issue was resolved for me by getting special release 8.3.150.6 from TAC, note you get limited support if you run with this image as it's not a standard release!

[Scott Fella]

I’m not a huge fan of escalation image as you might encounter other issues. Just make sure you upgrade to a standard release when the bug is fixed.