9800 CL - Two APs Same Configuration Only One Allowing Client Connect

[chtucci]

With the error:  

Client state transition: S_CO_DELETE_IN_PROGRESS WLC9800

{wncd_x_R0-6}{1}: [client-orch-state] [25366]: (note): MAC: 0030.4449.8a24 Client state transition: S_CO_DELETE_IN_PROGRESS -> S_CO_DELETED

I don't understand why clients are connecting fine on one ap but not the other?

[chtucci]

Y'all are gonna love this.  Turns out that cradlepoint doesn't scan for ssid's on lower channels.  All of those secondary aps that wouldn't pick up clients were on channel 11.  So I bumped them to higher than channel 50, and they all now connect clients.  We're going to make an RF profile on the WLC that will make sure aps are on the higher channels, and that will resolve this issue.  Thanks for the education from the posts here - I now know a good bit more about how to properly troubleshoot issues like this - 

[Rich R]

That doesn't really make sense!
Channel 11 is one of the 3 useable 2.4GHz band channels (1, 6 & 11).
While 50 is one of the 5GHz band channels.
https://en.wikipedia.org/wiki/List_of_WLAN_channels#5_GHz_(802.11a/h/j/n/ac/ax)
So what you seem to be implying is that the device is only using 5GHz channels and not 2.4GHz?
You can't make a 2.4GHz radio use channel 50 (although depending on AP model you can change the 2.4GHz radio to a second 5GHz radio)
On a dual band AP you'll normally be broadcasting the SSID on both 2.4GHz and 5GHz so the devices should have worked.  Or had you disabled the 5GHz radios on those APs?

[chtucci]

The cradlepoints have 2.4 disabled.  The AP is dual band and was working for laptops etc, but not for cradlepoints.  Cradlepoints are scan on specific higher number channels, turns it out it's the way they're designed after a certain update.  Testing by manually setting an ap to a higher channel (one that matches the range the cradlepoint support staff sent me) worked.  So I created new RF profile specifically for 5ghz that has the lower channels unchecked.  Changed an RF Tag Name to use it so I don't have to manually set APs each time.  It works.

[Rich R]

Ok I'd call that a faulty product! Do they realise why that's a problem?  Any explanation/rationale?
So it only/mostly uses DFS channels!!!!!

[chtucci]

Testing today, but the same results.  Notes:  Cradlepoints connect on one of the two APs correctly.  When I shut that functioning ap down, Cradlepoints no longer see that ssid, although it's configured on the AP remaining up.  Both AP configurations are the same.  Oddly:  When the cradlepoints are set to 2.4, they can then see the ssid.  But when they try to connect:  "CLIENT_ASSOC_FAIL Failure = IE_VALIDATION_FAILURE Validation Failure Type = 1".  Then they get blacklisted.  

Show wireless state client delete reasons:  
Mon Apr 03 2023 12:44:01 GMT-0400 (Eastern Daylight Time)
===================================================================================
#show wireless stats client delete reasons | ex 0
Total client delete reasons
---------------------------
Controller deletes
---------------------------
---------------------------
WPA key exchange timeout : 414
DOT11r pre-authentication failure : 1
DOT11 failure : 96
DOT11 invalid FT IE : 4
Client EAP ID timeout : 4
wrong replay counter : 1
IP-LEARN connection timeout : 1
BSSID down : 1

[marce1000]

  >....But when they try to connect:  "CLIENT_ASSOC_FAIL Failure = IE_VALIDATION_FAILURE Validation Failure Type = 1".  Then they get blacklisted.  
   Can you also execute in this situation on the involved AP issue (first) :
                              show  ap client-trace events mac <CRADLEPOINT MAC ADDRESS>
then let the device connect and post output here,

 M.