Cisco ME 8.10.142.0 and Ring Doorbells and Cameras

[ryan.rose]

I recently upgraded my Cisco ME environment to 8.10.142.0, 3802 and 2702 APs. Apparently, when I did that my Ring Doorbell and Stick Camera both stopped associating to the network. I was unaware until a week ago I tried to view them and their battery had died, I didn't receive the alert because they weren't on the network. I have been trying for a couple of days to get them back on the WiFi but no matter what I did, they kept failing to connect to the internet. I finally got the doorbell to work today but only if I use Open authentication, no security. This is obviously a problem that I need to solve. I am using PSK with only the WPA 2 button turned on and they won't connect.

Has anyone ran into this and how did you fix it?

[Rasika Nayanajith]

Did you try to create a new PSK SSID and test it?

Rasika

[ryan.rose]

Yes as well as deleting my current one and recreating it. Neither one worked. The only way I can get the ring devices to join is if I have an SSID with open authentication. 

That is an obvious issue.

[ryan.rose · Accepted solution]

Finally was able to figure this out after much research between cisco and ring. The issue was having 802.11r on the WLAN, although it was set to Adaptive. I had to create a new WLAN and disable 802.11r. Now the Ring doorbell is connected and working fine on it's own secure WLAN.

[fry282]

I’ve recently purchased a ring door bell v2 and am experiencing this problem on ME 8.10.162.0 with my AIR-AP1852I-E-K9. 

New dedciated WPA2 Personal SSID with no special characters, a simple password, 2.4GHz only, and 802.11r disabled. Yet, the ring door bell won’t connect!

The doorbell is connecting to other non Cisco AP’s. 

No idea why ?

This is what I'm seeing in the Client Event Logs on Mobility Express. The RING clients seems to connect and then looses association with the AP:

Time Stamp	Module	Severity	Message Type	Message Subtype	Details
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	Dot11	INFO	ASSOC_REQ	MESSAGE_RECEIVED	None
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	Dot11	INFO	ASSOC_REQ	INVALID_RSN_IE	None
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	IP_ACQUIRED_AND_AUTH_NOT_REQ_OR_STATIC_DYNAMIC_WEP_SUPPORTED	None
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	Dot11	INFO	ASSOC_REQ	CLIENT_MOVED_TO_ASSOCIATED_STATE	None
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	Dot1x	ERROR	AUTH_DOT1X	WLAN_REQUIRES_802_1X_AUTH	None
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	WEB_AUTH_MAX_RETRY_EXCEEDED	None
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	ADDING_WGB_CLIENT	None
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	CALL_TERMINATED	from Unassociated to Local Peer = 0.0.0.0, Old Anchor = 0.0.0.0, New Anchor = REMOVED IP FOR SECURITY
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	CALL_DURATION	State Update from Mobility-Incomplete to Mobility-Complete, mobility role=Local, client state=APF_MS_STATE_ASSOCIATED
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	WEB_AUTH_FAILED	None
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	WEB_AUTH_SUCCESS	None
Fri Jul 15 2022 16:38:00 GMT+0100 (British Summer Time)	Dot11	INFO	IP_AADR_MSG	IP_ADDR_CLEARED	None
Fri Jul 15 2022 16:40:25 GMT+0100 (British Summer Time)	Dot11	INFO	ASSOC_REQ	MESSAGE_RECEIVED	None
Fri Jul 15 2022 16:40:25 GMT+0100 (British Summer Time)	Dot11	INFO	ASSOC_REQ	INVALID_RSN_IE	None
Fri Jul 15 2022 16:40:25 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	WLAN_SUPPORTS_STATIC_DYNAMIC_WEP	None
Fri Jul 15 2022 16:40:25 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	IP_ACQUIRED_AND_AUTH_NOT_REQ_OR_STATIC_DYNAMIC_WEP_SUPPORTED	None
Fri Jul 15 2022 16:40:25 GMT+0100 (British Summer Time)	Dot11	INFO	ASSOC_REQ	CLIENT_MOVED_TO_ASSOCIATED_STATE	None
Fri Jul 15 2022 16:40:25 GMT+0100 (British Summer Time)	Dot1x	ERROR	AUTH_DOT1X	WLAN_REQUIRES_802_1X_AUTH	None
Fri Jul 15 2022 16:40:25 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	WEB_AUTH_MAX_RETRY_EXCEEDED	None
Fri Jul 15 2022 16:40:25 GMT+0100 (British Summer Time)	PEM	INFO	PEM_EVENT_MSG	WEB_AUTH_SUCCESS	None

Anyone else managed to work this out? 

thanks 

[fry282]

Only way I could get this working:

PRE-REQ

1. Setup dedicated RING 2.4Ghz Wi-Fi network on Cisco Mobility express, with all band steering and 802.11r etc disabled.

2. Turn off broadcast of the SSID for added security.

3. Make sure SIP ALG is disabled on any firewalls being used. Example on Palo Alto: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEsCAK

4. Make sure no AV scanning etc in firewall rule and all ports etc allowed out (See below).

INITIAL SETUP OF RING DOORBELL

5. Press orange button on ring doorbell to perform Ring doorbell set-up - Associate with any AP other than Cisco (For example, a mobile 4g router which doesn't have any enterprise filtering etc).

6. Upon successful connection and RING doorbell updating (~15 mins), change Wi-Fi to the correct one which goes through the Cisco AP and the Firewall

NB: Ports and protocols used by RING: https://support.ring.com/hc/en-gb/articles/205385394-The-protocols-and-ports-used-by-Ring-devices