Cisco AP send deauth to our device once a 30 mins when enable FT-PSK in WPA2-Personal

[212580283]

Dear All:

      When i use WPA2-Personal and enable FT-PSK, then our device connects with the AP correctly.

But the ap will send the deauth message once a 30mins to our device.

The deauthentication reason code is 15 :  4-way handshake timeout

We haven't enable session timeout.

The DS is disable.

I'd like to get some help to solve this problem.

Thanks.

Here is the config of the wlan ID

WLAN Identifier.................................. 9

Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Client Profiling Status ....................... Disabled
DHCP ......................................... Disabled
HTTP ......................................... Disabled
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Maximum number of Clients per AP Radio........... 20
Number of Active Clients......................... 0
Exclusionlist.................................... Disabled
Session Timeout.................................. 86400 seconds
User Idle Timeout................................ 300 seconds

--More-- or (q)uit
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... 5500_GE_Test
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ unity
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
mDNS Status...................................... Enabled
mDNS Profile Name................................ default-mdns-profile
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
PMIPv6 Mobility Type............................. none
Quality of Service............................... Platinum
Per-SSID Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-Client Rate Limits........................... Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0

--More-- or (q)uit
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Scan Defer Priority.............................. 0,1,2,3,4,5,6,7
Scan Defer Time.................................. 10000 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
Passive Client Feature........................... Enabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
Authentication................................ 172.16.100.220 1812
Accounting.................................... Global Servers
Interim Update............................. Disabled
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan

--More-- or (q)uit
Local EAP Authentication......................... Disabled
Security

802.11 Authentication:........................ Open System
FT Support.................................... Enabled
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Enabled
WPA (SSN IE)............................... Disabled
WPA2 (RSN IE).............................. Enabled
TKIP Cipher............................. Disabled
AES Cipher.............................. Enabled
Auth Key Management
802.1x.................................. Disabled
PSK..................................... Disabled
CCKM.................................... Disabled
FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Enabled
PMF-1X(802.11w)......................... Disabled
PMF-PSK(802.11w)........................ Disabled
FT Reassociation Timeout................... 20
FT Over-The-DS mode........................ Disabled
GTK Randomization.......................... Disabled

--More-- or (q)uit
SKC Cache Support.......................... Disabled
CCKM TSF Tolerance......................... 1000
WAPI.......................................... Disabled
Wi-Fi Direct policy configured................ Disabled
EAP-Passthrough............................... Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web-Passthrough............................... Disabled
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
Auto Anchor................................... Disabled
FlexConnect Local Switching................... Disabled
flexconnect Central Dhcp Flag................. Disabled
flexconnect nat-pat Flag...................... Disabled
flexconnect Dns Override Flag................. Disabled
FlexConnect Vlan based Central Switching ..... Disabled
FlexConnect Local Authentication.............. Disabled
FlexConnect Learn IP Address.................. Enabled
Client MFP.................................... Optional
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60

--More-- or (q)uit
AVC Visibilty.................................... Disabled
AVC Profile Name................................. None
Flow Monitor Name................................ None
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled
Multicast Buffer................................. Disabled

Mobility Anchor List
WLAN ID IP Address Status
------- --------------- ------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

We have investigated this problem for several weeks.

Can anyone give us some info to solve this problem?

Thanks very much.

[marce1000]

 - You'd better post this question in : Wireless - Mobility -> Other subjects.

M.

[212580283]

Thanks, marce.

    I have moved this question in Wireless-Mobility->Other subjects.

[George Stefanick]

I wonder if this is a roaming issue. I know there is a 4 way handshake bug ..

CSCvb93189

[pardeepk]

Hi George,

It could be but to match the exact symptom we need to verify the above outputs.

Regards

Pardeep

[George Stefanick]

A debug and OTAC is in order! 

:)

[212580283]

I see that the 

CSCvb93189 happend on the IOS system.

while our system is Linux system.

[pardeepk]

Did you try upgrading the client driver ?

Attach show tech-support

 from AP and controller.

Debug client mac<mac> when it kicks of the deuath 

show logging from the AP.

SHow running-config from controller

using unii2 or unii2 extended channels or not ?

[212580283]

hi ,pardeepk, dose any previous version client driver occurs the same problem before?

[pardeepk]

It further depends on the device type , model number , os of the device , nic card of the device.

Device should support 802.11 r standard for the FT feature. Please attach the above and the datasheet of the device. did you try a ping test as connection drop and ping drop are different.

debug client mac <> will give you the exact background process

Please attach the above for further investiation

[212580283]

hi ,pardeepk,yes, our device supports 802.11r standard for the FT feature.

We can see that our device connects the AP successfully. But after run about 30mins, the AP sends deauth message to our device.After about several seconds, our device connects the AP successfully again.

Here is the AP and software version info.

[pardeepk]

can you share show running-config

and with which SSID you are having the problem

[pardeepk]

What i meant by device is your end device accessing wifi.

Please attach

show logging from the AP 

[pardeepk]

Furthermore , you are running on deferred code .

please update the code on the controller.

http://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-TAC-Recommended-AireOS.html

http://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

[212580283]

And i will do the ping test right now.