Severe Issue with Cisco Business Wireless 140AC Access Points - 6 Mont

[thomas-hdf]

I'm facing a critical problem with our wireless network that I haven't been able to solve for the past 6 months. We've installed 11 Cisco Business Wireless 140AC Access Points throughout our company, and I've encountered a persistent issue that's affecting our operations.

The Problem

1. Roaming Disconnections: When a PC moves between access points, users randomly lose WiFi connectivity for approximately 10 minutes. The system shows them "incorrect password" errors despite using the correct credentials.
2. Logs show MAC address bans: When checking the logs, I can see the MAC addresses are being temporarily banned, though I don't fully understand all the log details.
3. Visitor connection issues: When contractors or visitors come on-site, they enter the correct password but their devices (laptops, iPhones, any type of device) report "incorrect password" for about 10 minutes before eventually connecting.

What I've Tried

• I've tested and adjusted every available option in the admin panel
• I've researched numerous potential solutions online
• I discovered a workaround: disabling random MAC address features on devices allows them to connect

The Challenge

The problem is that random MAC addresses are enabled by default on most modern devices, and I can't expect every visitor to change this setting. There must be a proper solution that allows our network to function correctly with devices using default security settings.

Today's example: contractors couldn't connect to our network at all, while my computer right next to them worked perfectly fine.

Has anyone encountered similar issues with Cisco Business Wireless APs? Any insights or solutions would be tremendously helpful, as this has been affecting our business operations for months.

Thank you in advance for any assistance!

[marce1000]

        - Have you done a wireless site survey before the APs where placed (for correct coverage)?
        - If a client get's incorrect password ; check the logs for the particular client.
        - Use the latest firmware on the access points.

 M.

[thomas-hdf]

Everything is up to date, and I’ve disabled the maximum number of options possible on the AP. However, as soon as the Windows computer changes its MAC address (which I forced at one point, to disable it every day), here’s the log I get, and the computer can no longer access the network  :   *apfReceiveTask: Mar 10 13:47:58.941: %APF-5-CLIENT_DEAUTHENTICATE: apf_80211.c:4056 Client Deauthenticated: Client MAC: 56:f1:e0:8c:60:24, Ip Address: (0.0.0.0), AP Name: AP3891.B74E.C748, Radio: 5 GHz , WLAN Id: 1, Reason: 1.
*apfReceiveTask: Mar 10 13:47:58.941: %APF-5-CLIENT_DISASSOCIATE: apf_80211.c:4325 Client Disassociated: Client MAC: 56:f1:e0:8c:60:24, Ip Address: (0.0.0.0), AP Name: AP3891.B74E.C748, Radio: 5 GHz , WLAN Id: 1, Reason: 1.
*apfMsConnTask_0: Mar 10 13:47:55.606: %APF-5-CLIENT_ASSOCIATE: apf_80211.c:13338 Client Association: Client MAC: ce:75:bd:43:6f:fe, AP Name: AP3891.B74E.C748, Radio: 2.4GHz , WLAN Id: 1.
*apfMsConnTask_0: Mar 10 13:47:53.790: %APF-4-PROC_ACTION_FAILED: apf_80211k.c:786 Could not process 802.11 Action. Received RM 11K Action frame while not associated from mobile station. Mobile:56:F1:E0:8C:60:24.
*apfReceiveTask: Mar 10 13:47:48.974: %APF-6-MOBILE_EXCLUDED: apf_ms.c:7172 Excluded the mobile 56:f1:e0:8c:60:24 Reason: "Identity Theft"
*apfReceiveTask: Mar 10 13:47:48.973: %APF-4-REGISTER_IPADD_ON_MSCB_FAILED: apf_foreignap.c:1986 Could not Register IP Add on MSCB. Identity theft alert for IP address. mobility state, apfMsMmInitial and client state, APF_MS_STATE_ASSOCIATEDaddress: 56:f1:e0:8c:60:24 

[marce1000]

 - @thomas-hdf        I have no further insights on those messages ; consider engaging Cisco :
                                https://www.cisco.com/c/en/us/support/web/tsd-cisco-small-business-support-center-contacts.html

   M.

[Rich R]

Can you confirm that they have all been upgraded to 10.10.1.0?
https://software.cisco.com/download/home/286324956/type/286325362/release/10.10.1.0

Unfortunately the regulars here don't work with these products so there's no real experience for us to share.  Your best option is to check through the docs:
https://www.cisco.com/c/en/us/support/docs/smb/wireless/CB-Wireless-Mesh/2109-tz-troubleshooting-CBW-Mesh-Network.html
https://www.cisco.com/c/en/us/support/wireless/business-100-series-access-points/series.html#~tab-documents

Unfortunately there's not a lot of detailed technical documentation for these products and although they share some features with the Cisco enterprise APs it's a cut-down and slightly different feature set with much more limited configuration options.

And if none of that helps then open a case with Cisco TAC (you will normally need a support contract for that).