Cisco C9800-L-F-K9 and iPhone 12 reconnection

[Wasiliy]

Greetings to all,
we have a Wi-Fi system in a building based on Cisco C9800-L-F-K9 and AIR-AP1815I-R-K9 access points. Periodically one client, Apple iPhone 12, loses connection with SSID and it cannot connect. We have enabled Radioactive Trace by its MAC address. In the file, I received some messages that seem suspicious to me. Could you tell me if these messages are normal client operation, or if there is a problem at this point?
Below are some excerpts from the log files:

*********************

2021/06/01 09:20:40.166652 {wncd_x_R0-0}{1}: [sisf-packet] [17010]: (debug): RX: ARP from interface capwap_900000a2 on vlan 2504 Source MAC: 222e.72f8.a3c2 Dest MAC: ffff.ffff.ffff ARP REPLY, ARP sender MAC: 222e.72f8.a3c2 ARP target MAC: 0000.0000.0000 ARP sender IP: 10.238.40.170, ARP target IP: 10.238.40.170,

2021/06/01 09:20:58.529624 {wncd_x_R0-0}{1}: [auth-mgr-feat_dsensor] [17010]: (info): [222e.72f8.a3c2:capwap_900000a2] Skipping DHCP TLVs for further processing. DHCP based classification isn't enabled

2021/06/01 09:20:58.529733 {wncd_x_R0-0}{1}: [sisf-packet] [17010]: (info): RX: DHCPv4 from interface capwap_900000a2 on vlan 2504 Src MAC: 222e.72f8.a3c2 Dst MAC: bc4a.56ed.ca61 src_ip: 10.238.40.170, dst_ip: 10.221.138.17, BOOTPREQUEST, SISF_DHCPREQUEST, giaddr: 0.0.0.0, yiaddr: 0.0.0.0, CMAC: 222e.72f8.a3c2

2021/06/01 09:20:58.531026 {wncd_x_R0-0}{1}: [sisf-packet] [17010]: (info): RX: DHCPv4 from interface capwap_900000a2 on vlan 2504 Src MAC: bc4a.56ed.ca61 Dst MAC: 222e.72f8.a3c2 src_ip: 10.221.138.17, dst_ip: 10.238.40.170, BOOTPREPLY, SISF_DHCPACK, giaddr: 0.0.0.0, yiaddr: 10.238.40.170, CMAC: 222e.72f8.a3c2

2021/06/01 09:21:11.462305 {wncd_x_R0-0}{1}: [dot11-validate] [17010]: (ERR): MAC: 222e.72f8.a3c2  Validate dot11 ie for samsung payloads. Invalid ie type Received ouiType 10 Expected ouiType 34 Received oui 0x0, 0x17, 0xf2, Expected oui 0x0, 0x0, 0xf0

2021/06/01 09:21:11.462310 {wncd_x_R0-0}{1}: [dot11] [17010]: (ERR): MAC: 222e.72f8.a3c2  Dropping the disassoc or deauth request. 11w not enabled

*************************

2021/06/02 09:13:20.601847 {wncd_x_R0-0}{1}: [client-keymgmt] [17010]: (info): MAC: 222e.72f8.a3c2 EAP key M5 sent successfully
2021/06/02 09:13:20.601849 {wncd_x_R0-0}{1}: [client-keymgmt] [17010]: (info): MAC: 222e.72f8.a3c2 Client key-mgmt state transition: S_PTKINITDONE -> S_REKEYNEGOTIATING
2021/06/02 09:13:21.602008 {wncd_x_R0-0}{1}: [client-keymgmt] [17010]: (info): MAC: 222e.72f8.a3c2 Keymgmt: resend eapol key m5. Retrasmitting EAP key packet M5
2021/06/02 09:13:21.602099 {wncd_x_R0-0}{1}: [client-keymgmt] [17010]: (info): MAC: 222e.72f8.a3c2 Client key-mgmt state transition: S_REKEYNEGOTIATING -> S_REKEYNEGOTIATING
2021/06/02 09:13:22.602502 {wncd_x_R0-0}{1}: [client-keymgmt] [17010]: (info): MAC: 222e.72f8.a3c2 Keymgmt: resend eapol key m5. Retrasmitting EAP key packet M5
2021/06/02 09:13:22.602590 {wncd_x_R0-0}{1}: [client-keymgmt] [17010]: (info): MAC: 222e.72f8.a3c2 Client key-mgmt state transition: S_REKEYNEGOTIATING -> S_REKEYNEGOTIATING
2021/06/02 09:13:23.603077 {wncd_x_R0-0}{1}: [client-keymgmt] [17010]: (ERR): MAC: 222e.72f8.a3c2 Keymgmt: Failed to eapol key m5 retrasmit failure. Max retries for M5 over
2021/06/02 09:13:23.603081 {wncd_x_R0-0}{1}: [client-keymgmt] [17010]: (info): MAC: 222e.72f8.a3c2 Keymgmt: eapol key failure. Sending client key exchange failure to auth fsm,reason code: 16
2021/06/02 09:13:23.603094 {wncd_x_R0-0}{1}: [client-keymgmt] [17010]: (info): MAC: 222e.72f8.a3c2 Client key-mgmt state transition: S_REKEYNEGOTIATING -> S_PTKINITDONE
2021/06/02 09:13:23.603145 {wncd_x_R0-0}{1}: [client-auth] [17010]: (info): MAC: 222e.72f8.a3c2 Client auth-interface state transition: S_AUTHIF_PSK_AUTH_DONE -> S_AUTHIF_PSK_AUTH_DONE
2021/06/02 09:13:23.603159 {wncd_x_R0-0}{1}: [client-orch-sm] [17010]: (note): MAC: 222e.72f8.a3c2 Client move to idle state, delete reason: CO_CLIENT_DELETE_REASON_GROUP_KEY_UPDATE_TIMEOUT, BSSID MAC: ac4a.5645.a08c, WTP MAC: ac4a.5645.a080
2021/06/02 09:13:23.603257 {wncd_x_R0-0}{1}: [client-orch-state] [17010]: (note): MAC: 222e.72f8.a3c2 Client state transition: S_CO_RUN -> S_CO_IDLE
2021/06/02 09:13:33.603809 {wncd_x_R0-0}{1}: [ewlc-infra-evq] [17010]: (ERR): 222e.72f8.a3c2CLIENT_STAGE_TIMEOUT State = IDLE, WLAN profile = TatAIS_INET, Policy profile = TatAIS_INET, AP name = TN_2_AP_8_fl_4
2021/06/02 09:13:33.603810 {wncd_x_R0-0}{1}: [client-orch-sm] [17010]: (info): MAC: 222e.72f8.a3c2 Deleting the client, reason: 16, CO_CLIENT_DELETE_REASON_GROUP_KEY_UPDATE_TIMEOUT, Client state S_CO_IDLE
2021/06/02 09:13:33.603861 {wncd_x_R0-0}{1}: [client-orch-sm] [17010]: (note): MAC: 222e.72f8.a3c2 Client delete initiated. Reason: CO_CLIENT_DELETE_REASON_GROUP_KEY_UPDATE_TIMEOUT, fsm-state transition 82|8a|13|17|18|28|33|42|44|46|48|4d|5c|5e|7f|82|8a|13|17|18|28|33|42|44|46|48|4d|5c|5e|7f|26|55|

*******************

[marce1000]

 - Check if resolving-reply from this thread can help :

         https://community.cisco.com/t5/wireless/catalyst-9800-cl-client-losing-connectivity/td-p/4269460

 M.

[Wasiliy]

marce1000

Thanks for the answer.
Now we are collecting statistics on a problem client using a radioactive trace.
We will take note of your information.

[dlross001]

Did you find a resolution for this? I am experiencing a similar issue where iPhones will get a blank white page instead the ISE Guest Portal. See the similar logs below.

2021/10/29 12:27:10.139371 {wncd_x_R0-4}{1}: [dot11-validate] [26555]: (ERR): MAC: fc4e.a4c3.9af3 Validate dot11 ie for samsung payloads. Invalid ie type Received ouiType 10 Expected ouiType 34 Received oui 0x0, 0x17, 0xf2, Expected oui 0x0, 0x0, 0xf0
2021/10/29 12:27:10.139588 {wncd_x_R0-4}{1}: [dot11] [26555]: (ERR): MAC: fc4e.a4c3.9af3 Dropping the disassoc or deauth request. 11w not enabled

[Wasiliy]

Our problem was solved after upgrading the software controller and access points to version 17.3.4.

[Arshad Safrulla]

disable PMF (Protected Management Frame)

disable or enable fast transition, don't use adaptive. If you are using enabled use only over the air FT.