Can’t join a ssid with my Android phone on one AP 9120AXE... why ?

[Elrick Landon]

Hello,

I use two AP 9120AXE-E with Cisco Embedded Wireless Controller, I use the latest version of IOS on each AP.
Both APs are configured to cover the house with the same SSID in 2.4 and 5Ghz.

For some reason, my phones can't authenticate correctly on one of the two APs, it can't join SSID
The connection fails even though there's no distance problem, I'm right next to the AP with my phone.
Sometimes the authentication goes through, but very shortly afterwards it fails again...
Sometimes when it refuses the connection, it asks me to enter the password manually and refuses even though it's correct.

If I take this same phone and do the same thing on the other AP, I have no problem.
I think that one of the APs is causing problems with the phone.
Strangely, I have no problem connecting from a PC on either AP.
Do you know where this could be coming from?

A screenshot to illustrate with log file. 

Thank you in advance for your help.

[Leo Laohoo]

If Galaxy is nearby, why is the a large discrepancies between the 2.4 Ghz & 5.0 Ghz RSSI values?

What is the model of antennae used by the AP?

[Elrick Landon]

I'd like to point out that I didn't have this problem before setup profil with the hardware, and that the APs haven't moved.
The antennas can't be a problem.

Can anyone remind me how to identify one of my APs? i think there was a method to make an AP blink?

[Leo Laohoo]

Set the 5.0 Ghz channel width to 20 Mhz & disable WPA3.

[marce1000]

 # ap name <ap name> led flash start

   Needs 17.3.1 or above.

 M.

[marce1000]

  - Have a checkup of the Embedded Wireless Controller's configuration with the CLI command show tech wireless and feed the output to : Wireless Config Analyzer
 Below you will find the output of your debugTrace when processed with Wireless Debug Analyzer  (Show All flag was checked)

TimeTaskTranslated

Connection attempt #1
Connection attempt #2
2024/03/30 21:05:11.335	client-orch-sm	Client made a new Association to an AP/BSSID: BSSID a4b2.3983.6d2f, WLAN ELR +, Slot 1 AP a4b2.3983.6d20, C9120AXE-1, Site tag default-site-tag, Policy tag PT_ELR, Policy profile ELR +, Switching Local, Socket delay 0ms
2024/03/30 21:05:11.337	dot11	Association success for client, assigned AID is: 3
2024/03/30 21:05:14.380	client-keymgmt	Reached maximum retries for M3
2024/03/30 21:05:14.380	client-orch-sm	Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_KEY_XCHNG_TIMEOUT. Explanation: This can happen during normal scenarios. Client deleted due to EAPoL M1 retries. Possible client side issue, or it roamed during auth phase. Actions: If issue persists, collect RA trace and over the air capture
Connection attempt #3
2024/03/30 21:08:55.986	client-orch-sm	Client made a new Association to an AP/BSSID: BSSID a4b2.3983.6d2f, WLAN ELR +, Slot 1 AP a4b2.3983.6d20, C9120AXE-1, Site tag default-site-tag, Policy tag PT_ELR, Policy profile ELR +, Switching Local, Socket delay 0ms
2024/03/30 21:08:55.988	dot11	Association success for client, assigned AID is: 3
2024/03/30 21:08:59.044	client-keymgmt	Reached maximum retries for M3
2024/03/30 21:08:59.044	client-orch-sm	Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_KEY_XCHNG_TIMEOUT. Explanation: This can happen during normal scenarios. Client deleted due to EAPoL M1 retries. Possible client side issue, or it roamed during auth phase. Actions: If issue persists, collect RA trace and over the air capture
Connection attempt #4
2024/03/30 21:10:18.766	client-orch-sm	Client made a new Association to an AP/BSSID: BSSID a4b2.3983.6d2f, WLAN ELR +, Slot 1 AP a4b2.3983.6d20, C9120AXE-1, Site tag default-site-tag, Policy tag PT_ELR, Policy profile ELR +, Switching Local, Socket delay 0ms
2024/03/30 21:10:18.768	dot11	Association success for client, assigned AID is: 3
2024/03/30 21:10:21.839	client-keymgmt	Reached maximum retries for M3
2024/03/30 21:10:21.839	client-orch-sm	Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_KEY_XCHNG_TIMEOUT. Explanation: This can happen during normal scenarios. Client deleted due to EAPoL M1 retries. Possible client side issue, or it roamed during auth phase. Actions: If issue persists, collect RA trace and over the air capture
Connection attempt #5
2024/03/30 21:10:22.675	client-orch-sm	Client made a new Association to an AP/BSSID: BSSID a4b2.3983.6d2f, WLAN ELR +, Slot 1 AP a4b2.3983.6d20, C9120AXE-1, Site tag default-site-tag, Policy tag PT_ELR, Policy profile ELR +, Switching Local, Socket delay 0ms
2024/03/30 21:10:22.676	dot11	Association success for client, assigned AID is: 3
2024/03/30 21:10:25.738	client-keymgmt	Reached maximum retries for M3
2024/03/30 21:10:25.738	client-orch-sm	Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_KEY_XCHNG_TIMEOUT. Explanation: This can happen during normal scenarios. Client deleted due to EAPoL M1 retries. Possible client side issue, or it roamed during auth phase. Actions: If issue persists, collect RA trace and over the air capture
Connection attempt #6
2024/03/30 21:10:26.027	client-orch-sm	Client made a new Association to an AP/BSSID: BSSID a4b2.3983.6d2f, WLAN ELR +, Slot 1 AP a4b2.3983.6d20, C9120AXE-1, Site tag default-site-tag, Policy tag PT_ELR, Policy profile ELR +, Switching Local, Socket delay 0ms
2024/03/30 21:10:26.028	dot11	Association success for client, assigned AID is: 4
2024/03/30 21:10:29.091	client-keymgmt	Reached maximum retries for M3
2024/03/30 21:10:29.091	client-orch-sm	Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_KEY_XCHNG_TIMEOUT. Explanation: This can happen during normal scenarios. Client deleted due to EAPoL M1 retries. Possible client side issue, or it roamed during auth phase. Actions: If issue persists, collect RA trace and over the air capture
Connection attempt #7
2024/03/30 21:10:30.426	client-orch-sm	Client made a new Association to an AP/BSSID: BSSID a4b2.395c.b580, WLAN ELR +, Slot 0 AP a4b2.395c.b580, C9120AXE-2, Site tag default-site-tag, Policy tag PT_ELR, Policy profile ELR +, Switching Local, Socket delay 0ms
2024/03/30 21:10:30.428	dot11	Association success for client, assigned AID is: 3
2024/03/30 21:10:30.501	client-keymgmt	Negotiated the following encryption mechanism: AKM:SAE Cipher:CCMP WPA Version: WPA3
2024/03/30 21:10:30.501	client-auth	Client successfully completed Pre-shared Key authentication. Assigned VLAN: 1
2024/03/30 21:10:30.501	client-orch-sm	Policy profile is configured for local switching
2024/03/30 21:10:30.501	client-orch-state	Starting Mobility Anchor discovery for client
2024/03/30 21:10:30.504	client-orch-state	Entering IP learn state
Connection attempt #8
2024/03/30 21:10:30.851	client-iplearn	Client got IP: 10.0.1.65, discovered through: IP Snooping
2024/03/30 21:10:30.852	client-orch-state	Client reached RUN state, connection completed.
2024/03/30 21:12:49.596	client-orch-sm	Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_DEAUTH_OR_DISASSOC_REQ. Explanation: Client initiated a deauthentication or deauthentication. Actions: None required in most scenarios. This is normal activity
Connection attempt #9
Connection attempt #10
2024/03/30 21:12:58.821	client-orch-sm	Client made a new Association to an AP/BSSID: BSSID a4b2.395c.b58f, WLAN ELR +, Slot 1 AP a4b2.395c.b580, C9120AXE-2, Site tag default-site-tag, Policy tag PT_ELR, Policy profile ELR +, Switching Local, Socket delay 0ms
2024/03/30 21:12:58.823	dot11	Association success for client, assigned AID is: 4
2024/03/30 21:12:58.905	client-keymgmt	Negotiated the following encryption mechanism: AKM:SAE Cipher:CCMP WPA Version: WPA3
2024/03/30 21:12:58.905	client-auth	Client successfully completed Pre-shared Key authentication. Assigned VLAN: 1
2024/03/30 21:12:58.906	client-orch-sm	Policy profile is configured for local switching
2024/03/30 21:12:58.906	client-orch-state	Starting Mobility Anchor discovery for client
2024/03/30 21:12:58.908	client-orch-state	Entering IP learn state
Connection attempt #11
2024/03/30 21:12:59.285	client-iplearn	Client got IP: 10.0.1.65, discovered through: IP Snooping
2024/03/30 21:12:59.287	client-orch-state	Client reached RUN state, connection completed.

[Elrick Landon]

Here are the results.

In the AP Message Summary, I discovered this message...
It's strange because both APs are connected to a Cisco 9300 switch. I don't understand why it tells me that AP 1 is in 100mb mode!

Ethernet: AP has Interface on 100 Mbps mode. Please validate that this is intentional.
APS: C9120AXE-1
Action: An interface at 100 Mbps could point to negotiation issues with the switch due to cable length, errors, etc. This could lead to significant impact in stability. This could lead to significant impact in stability and performance

How can i fix this problem?

What do you think of the other results, as I won't be interpreting them too much?

Otherwise, during my tests, I identified that it's the AP C9120AXE-1 that's causing the problem, I can't connect to it with my Android phone, it seems that my phone connects to the AP C9120AXE-2 which is much further away.
Looking at the 5Ghz configuration of the AP C9120AXE-1, I see that the Antenna A, B, C, D sections are not checked, whereas they are checked for the AP C9120AXE-2, I think this is not normal?

Thanks for your help.

[marce1000]

               >...I don't understand why it tells me that AP 1 is in 100mb mode
  - Check switchport connection and investigate the speed enabled on the switch where the AP is connected too.

                                                      >... as I won't be interpreting them too much?
  - You should , WirelessAnalyzer is vital tool ; for instance normally all red errors should be corrected ; the rest must be a  learning path and can not be ignored just like that.
                                       -> Some topics could for instance be related to your original problem too

    For detailed testing if you know to which AP a Android phone  will not connect  ; issue this command first on the ('failing') AP:
                          show  ap client-trace events mac aa:bb:cc:01:02:03 (the latter mac address must of course be changed accordingly ). Then during the connecting process (and later) follow up on the outputs shown or check the logs on the AP

 M.

[Elrick Landon]

I just reboot AP , connexion was negociated at 1000mbit instead of 100mbit... and all is fine...

But... i have this error message in red after a new show tech wireless

 Do you know how to fix it please?

[marce1000]

           - I tend to think that one is not too important in the EWC context , despite being flagged otherwise, 

 M.

[JPavonM]

The erros seen in the debug analyzer "Reached maximum retries for M3" are likely to be due to the client roaming to other AP before finishing the previous association process, so this issues might be in the client side which is not finishing the association.

I've seen this when the signal strength from multiple APs in the same location are about the same, so some devices get confused and do a ping-pong effect between them randomly. Try to lower the TX Power from both APs and check how it goes.