CBW 150AX AP - surface pro 7+ cannot connect, intel wifi 6 AX201

[dropshadow]

i have a cbw 150ax wap. single wap, no extenders. i have many clients connected. i have one client that refuses to connect. it is a win11 msft surface pro 7+ running an intel wifi 6 ax201 chip. i have updated all drivers firmware for the machine and network adapter, including bluetooth per intel instructions. these are the logs from the wap:

*Dot1x_NW_MsgTask_0: Jul 28 01:20:25.428: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client b0:60:88:8e:05:c1 may be using an incorrect PSK
*Dot1x_NW_MsgTask_0: Jul 28 01:20:25.427: %DOT1X-4-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:558 Max EAPOL-key M1 retransmissions exceeded for client b0:60:88:8e:05:c1
*apfMsConnTask_0: Jul 28 01:20:22.257: %APF-5-CLIENT_ASSOCIATE: apf_80211.c:13601 Client Association: Client MAC: b0:60:88:8e:05:c1, AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1.
*Dot1x_NW_MsgTask_0: Jul 28 01:20:18.798: %APF-5-CLIENT_DEAUTHENTICATE: apf_80211.c:4071 Client Deauthenticated: Client MAC: b0:60:88:8e:05:c1, Ip Address: (0.0.0.0), AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1, Reason: 15.
*Dot1x_NW_MsgTask_0: Jul 28 01:20:18.797: %DOT1X-4-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:558 Max EAPOL-key M1 retransmissions exceeded for client b0:60:88:8e:05:c1
*apfMsConnTask_0: Jul 28 01:20:15.694: %APF-5-CLIENT_ASSOCIATE: apf_80211.c:13601 Client Association: Client MAC: b0:60:88:8e:05:c1, AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1.
*Dot1x_NW_MsgTask_0: Jul 28 01:20:12.773: %APF-5-CLIENT_DEAUTHENTICATE: apf_80211.c:4071 Client Deauthenticated: Client MAC: b0:60:88:8e:05:c1, Ip Address: (0.0.0.0), AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1, Reason: 15.
*Dot1x_NW_MsgTask_0: Jul 28 01:20:12.772: %DOT1X-4-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:558 Max EAPOL-key M1 retransmissions exceeded for client b0:60:88:8e:05:c1
*apfMsConnTask_0: Jul 28 01:20:09.740: %APF-5-CLIENT_ASSOCIATE: apf_80211.c:13601 Client Association: Client MAC: b0:60:88:8e:05:c1, AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1.
*Dot1x_NW_MsgTask_0: Jul 28 01:20:05.162: %APF-5-CLIENT_DEAUTHENTICATE: apf_80211.c:4071 Client Deauthenticated: Client MAC: b0:60:88:8e:05:c1, Ip Address: (0.0.0.0), AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1, Reason: 15.
*Dot1x_NW_MsgTask_0: Jul 28 01:20:05.161: %DOT1X-4-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:558 Max EAPOL-key M1 retransmissions exceeded for client b0:60:88:8e:05:c1
*apfMsConnTask_0: Jul 28 01:20:02.074: %APF-5-CLIENT_ASSOCIATE: apf_80211.c:13601 Client Association: Client MAC: b0:60:88:8e:05:c1, AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1.

[Flavio Miranda]

Hi @dropshadow 

"Client b0:60:88:8e:05:c1 may be using an incorrect PSK"

AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1, Reason: 15.

Code 15:

"Authentication rejected because of challenge failure"

Based on this information I would say it.might be Authentication problem due wrong psk.

[dropshadow]

i have 18 other clients connected. i do not have a password problem. i have re-entered it many times, preconfigured as known network, etc. i was chasing that clue as well and trying to figure out how to change AES / TKIP on the wlan to only allow one or the other, but does not seem to be an option on the 150ax. i have also tried just using 2.4 and disabling 5ghz, and i also tried disabled WPA3 and only using WPA2.

[dropshadow]

Something is happening during the handshake:

*Dot1x_NW_MsgTask_0: Aug 04 12:53:08.759: %APF-5-CLIENT_DEAUTHENTICATE: apf_80211.c:4071 Client Deauthenticated: Client MAC: b0:60:88:8e:05:c1, Ip Address: (0.0.0.0), AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1, Reason: 15.
*Dot1x_NW_MsgTask_0: Aug 04 12:53:08.758: %DOT1X-4-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:558 Max EAPOL-key M1 retransmissions exceeded for client b0:60:88:8e:05:c1
*Dot1x_NW_MsgTask_0: Aug 04 12:53:07.758: %DOT1X-3-CLIENT_NOT_FOUND: dot1x_msg_task.c:1847 Unable to process 802.1X 2 msg - client 83:46:8f:00:b0:60 not found
*Dot1x_NW_MsgTask_0: Aug 04 12:53:06.753: %DOT1X-3-CLIENT_NOT_FOUND: dot1x_msg_task.c:1847 Unable to process 802.1X 2 msg - client 83:46:8f:00:b0:60 not found
*Dot1x_NW_MsgTask_0: Aug 04 12:53:05.607: %DOT1X-3-CLIENT_NOT_FOUND: dot1x_msg_task.c:1847 Unable to process 802.1X 2 msg - client 83:46:8f:00:b0:60 not found
*apfMsConnTask_0: Aug 04 12:53:05.594: %APF-5-CLIENT_ASSOCIATE: apf_80211.c:13601 Client Association: Client MAC: b0:60:88:8e:05:c1, AP Name: AP34B8.8347.E020, Radio: 5 GHz , WLAN Id: 1.

i dont understand why it presents itself as MAC b0:60:88:8e:05:c1 (correct), but then the authentication messages are showing MAC: 83:46:8f:00:b0:60 (unknown).