Can not connect because the sign-in requirements for your device and the network are not compatible

[Rps-Cheers]

Hello everyone
I have a question about wireless.
A month ago, our wireless run well, however, one day suddenly can not connect, we did not make any changes, every time you connect SSID, there will be the following error:

"Can not connect because the sign-in requirements for your device and the network are not compatible. Contact your IT support person"

However, I am IT. My Client can connect to SSID normally at other branches.
In addition, I try to debug, Access-Reject appears in the message, the attachment is debug information.

So what is the reason?

PID: AIR-CT5508-K9
version: 7.6.110.0
AP: AIR-LAP1142N-C-K9

WLAN related configuration:
Radius Servers
Authentication ................................ 10.0.0.100 1812
Accounting .................................... Global Servers
Interim Update ............................. Disabled
Framed IPv6 Acct AVP ...................... Prefix
Dynamic Interface ............................. Disabled
Dynamic Interface Priority .................... wlan
Local EAP Authentication ......................... Disabled
Security

802.11 Authentication: ........................ Open System
FT Support ................................... Disabled
Static WEP Keys ............................... Disabled
802.1X ........................................ Disabled
Wi-Fi Protected Access (WPA / WPA2) ............. Enabled
WPA (SSN IE) ............................... Disabled
WPA2 (RSN IE) .............................. Enabled
TKIP Cipher ............................. Disabled
AES Cipher .............................. Enabled
Auth Key Management
802.1x .................................. Enabled
PSK ..................................... Disabled
CCKM .................................... Disabled
FT-1X (802.11r) .......................... Disabled
FT-PSK (802.11r) ......................... Disabled
PMF-1X (802.11w) ......................... Disabled
PMF-PSK (802.11w) ........................ Disabled
FT Reassociation Timeout ................... 20
FT Over-The-DS mode ........................ Disabled
GTK Randomization .......................... Disabled
SKC Cache Support .......................... Disabled
CCKM TSF Tolerance ......................... 1000
WAPI .......................................... Disabled
Wi-Fi Direct policy configured ................ Disabled
EAP-Passthrough ............................... Disabled

[Philip D'Ath]

If you are getting an ACCESS-REJECT that menas the RADIUS is refusing to allowing the user to connect.  Perhaps their password has expired.  Perhaps their account has been disabled.

You need to look at the RADIUS(s) servers and see why they are rejecting the login.

[Rps-Cheers]

no，at other branch，i use the same username and password，it will associate with ssid。there will be other reason？

[Scott Fella]

What are you seeing from the radius logs?

[Rps-Cheers]

i can’t get info from radius server.Is it possible to see from the controller what is the reason？Can not connect because the sign-in requirements for your device and the network are not compatible.What does this sentence mean?

[Scott Fella]

The radius server will be the best location to see what is really happening. You should see a reject and the reason. You can issue a debug aaa on the controller but most likely see that it was rejected but that’s it.

[Rps-Cheers]

OK ,i will try,thx

[vuyomasina]

Good day,

did you ever get a solution to this problem.

[vuyomasina]

Hi all, if you ever run into to this error at a remote site and you are using a Radius server that is not onsite and you are configuring flex connect. below will be the solution.

[vuyomasina]

open exhibit A

[vuyomasina]

the solution is to  go to 

WLANs >Edit >'SSIDxxx' > Advanced

Under flex connect deselect Flex connect Local Auth

open exhibit B

[Akshay K]

It is most probably an issue with the group policy pushed from the AD. Please check whether the policy is configured propoerly in the Wireless Network (IEEE 802.11) Policies which is pushed onto the end machine along with the required CA certificates. Also do check the GPupdate.