Cat9800 psk issues

[KevinR99]

Hi

We have a Cat9800 with some PSK SSIDs in WPA/WPA2 mode with FT Adaptive.  We occasionally see clients being excluded for “Wrong PSK” and on DNA Center the same is reported.  Seems simple enough.  However, the clients are remote so not easy to check what they are doing.  I simulated an incorrect PSK attempt and on DNAC I did an intelligent capture. The failure happens during the eapol 4 way exchange as expected.  The client sends message 2 and the AP doesn’t respond.  This happens 3 times then the client is disassociated.  If I then capture a client that is getting excluded the packets are the same.  eapol message 1 and 2 are exchanged 3 times and the client is disassociated.  So this would correspond with the wrong PSK error and seem to point to the client.  There are many other users connecting with the known key.  However, one client insists they are putting in the correct key.  Apart from what seems obvious from the exclusion message and the same pattern in the capture is there anything in the capture that we can confidently say points to the client or something with their device causing the issue?

Thanks for any input, Kev.

[marce1000]

 - You could have some radioactive trace (client debugging) for the particular client on the 9800 and have that analyzed with : https://cway.cisco.com/wireless-debug-analyzer/

 M.

[KevinR99]

I should have mentioned, I did a radioactive trace first.  That result was pretty clear.  Wrong PSK.  To be honest that’s as far as I would go if the user wasn’t so insistent they have entered the correct key.  

As I understand it the client includes a message integrity check in its eapol message 2.  If that is as far as the exchange goes and the AP doesn’t send message 3 in response with a deliberate wrong PSK test does that mean the MIC is created using the PSK details? Then if the AP doesn’t get the expected MIC it can assume the client has the wrong PSK and stops the 4 way transaction?  The disassociation message after 3 attempts at the 4 way exchange fail says 4 way timeout or something similar.  

Kev.

[KevinR99]

Part of this https://praneethwifi.in/2019/11/09/4-way-hand-shake-keys-generation-and-mic-verification/ shows that the PSK is involved in the generation of the MIC.  Several known parameters and the PSK.  The AP has sent its nonce to the client.  The client is sending its nonce to the AP.  Those pieces of information plus the SSID name, client MAC and AP MAC are used with the PSK to generate the MIC.

I assume the AP then uses those known parameters and its knowledge of the PSK to try to generate the same MIC.  A difference then implies the client is using an incorrect PSK.  So the PSK isn’t sent but its value plus known values generate the MIC which can then be used to infer the client has the same PSK the AP

Kev.

[Haydn Andrews]

 Do the can we try getting someone else to enter the PSK for them? Or the Forget the network, and then start from scratch had users go multiple times they entered it right only to have fat fingered it, or put an old one in because they didn't get the message that the old one gone away.

[Arshad Safrulla]

Why use FT adaptive?

FT adaptive is designed only for certain clients such as Apple, Samsung etc. If you want FT to be used keep it on FT enabled, this way any clients support FT will be using FT and clients doesn't support will not be using FT. Both will be able to associate without any problems. 

Also why use FT with PSK?

This will make you vulnerable to KRACK https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180809-wpa2

You will not gain any significant advantage (reducing roaming time between AP's) when used with PSK and most of the new devices are capable of roaming very fast between AP's.

[patoberli]

If you want FT to be used keep it on FT enabled, this way any clients support FT will be using FT and clients doesn't support will not be using FT. Both will be able to associate without any problems. 

Is that correct? In my memory, when enabling FT, clients not correctly supporting it will be unable to connect at all. 

[KevinR99]

I’ve tested FT enabled before and had issues with some clients.  I understood FT adaptive was to support those that can do FT on the same SSID as those who don’t.  It’s working that way at the moment.  I don’t think it’s relevant to the PSK issue because that seems clear that the MIC sent to the AP is not matching what the AP expects.

Kev.

[Haydn Andrews]

I have had clients not connect when FT was turned on, even in adaptive but they were older devices not a mobile/ tablet/ laptop style device.

I have also seen 802.11k or v sometimes cause issues with real legacy devices.

Couple things I would try:

Get the user to update their wireless driver if its a laptop. Or upgrade latest software version for phone/ tablet.

If that doesn't work, you could spin up a test SSID with FT disabled and see if that works for them (use the exact same PSK to rule out them not typing it correct).

If there still issues going to suggest they cant type the PSK or they should buy a new device.

[patoberli]

I had issues with various mobile devices with FT in adaptive. In the end I had to disable it. I tested it this year.

[Wes Schochet]

From a troubleshooting standpoint, I'd take a test client and enter the wrong key when trying to connect.  If the debugs come out the same, then that's you issue.  If not, yo can rule that out and proceed to further identify the issue.

Wes