Access point Issue( Users disconnections)

[happy.nidjo]

Hello,

Users started to complained from disconnections. i have logged one of the AP and found below logs:

*Aug 2 17:34:25.199: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth f859.710c.75fb
*Aug 2 17:38:14.323: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth f859.710c.75fb
*Aug 2 20:45:29.219: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 3 00:49:14.347: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 3 04:52:38.295: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 3 08:10:52.015: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth b4b6.76fc.7cd6
*Aug 3 08:55:48.095: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 3 08:55:50.795: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth d057.7b62.2a91
*Aug 3 09:03:34.531: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth b4b6.76fc.7cd6
*Aug 3 10:58:57.271: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth 3413.e835.a4ee
*Aug 3 11:40:10.851: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth d057.7b62.2a91
*Aug 3 12:59:24.399: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 3 16:23:23.483: %DOT11-4-CCMP_REPLAY: Client f859.711c.9995 had 2 AES-CCMP TSC replays
*Aug 3 17:02:56.315: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 3 17:08:53.627: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth 3413.e835.a4ee
*Aug 3 21:06:52.599: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 4 01:10:14.931: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 4 05:14:05.215: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 4 08:21:45.427: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth d057.7b62.2a91
*Aug 4 09:17:10.091: b048.1ae9.2239-no legacy rates; default to lowest CCK/OFDM rate
*Aug 4 10:52:16.251: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth 3413.e835.a4ee
*Aug 4 11:11:42.483: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth d057.7b62.2a91
*Aug 4 11:42:37.239: %DOT11-4-FLUSH_DEAUTH: Consecutive tx fail 500+: deauth d057.7b62.2a91

Can anyone suggest or guide what is the meaning of the above log?

AP model: AIR-CAP3702I-E-K9

WLC version: 8.0.140.0

Best Regards.

Mohammed

[patoberli]

What rates do you have under Wireless -> 802.11b/g/n and 802.11a/n/ac enabled?

It seems that the client has a low signal strength and not enough slow configured rates. I think though, that you maybe haven't got enough coverage.

[happy.nidjo]

Thanks for you your response patoberli, 

All rates are activated, and the client has a good signal (-52 dBm).

[patoberli]

You might want to upgrade to 8.2.160.0, TAC recommends 8.2.x builds when 3702 APs are used:

http://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-TAC-Recommended-AireOS.html#anc6

Please note that the upgrade will cause a ~15 minutes downtime of the wifi (if you preload the images, otherwise it will take longer, depending on your WLC model and amount of APs).

Have you reloaded one of the affected APs to see if it's a temporary software issue?

[happy.nidjo]

Thanks patoberli,

Let's wait for the wireless community, maybe we will have another answers ;)

[patoberli]

Sure thing :)

Could you maybe create a debug log of one of the affected clients? Start the debug and let it run till a disconnect again happens for that client.

You can do that by entering:

debug client aa:bb:cc:dd:ee:ff (of course with the correct MAC address)

To disable it, enter 'debug disable-all' (without '').

In your output above it's unclear if those MAC addresses are from actually affected clients or just some random clients.

[biaacer2]

Looks like the AP is not able to reach the client, are they connecting to 2.4Ghz or 5Ghz? Look for wifi interference, non wifi interference or high channel utilization.