Client disconnection due to Incorrect PMKID

[AnilKumar95946]

Hello Everyone,

We are facing client disconnection specially during Teams calls. It is happening when user is stationed as well as roaming. We captured the RA traces and found out the it is happening due to PMKID sent during the reassociation event is not the correct one. Currently 802.11r is set to "adaptive" mode. Cisco TAC is suggesting to turn it "OFF" which is a kind of workaround. We don not want to turn it off as it is good feature and helps in faster roaming experience. Is there a way we can resolve disconnection issue while keeping 802.11r in adaptive mode.

WLC: C9800-40 IOS: 17.3.5a  SSID: BYOD  Client Device: Iphone

Regards

Anil

[Flavio Miranda]

Hi

 Not a difficult decision. Disable 802.11r, as TAC suggest and observe for a while if the problem with clients disconnecting desapear.

You have almost nothing to lose with this action as 802.11r impact in not significante.  Actually, those features most of times brings more problem then solution.

  I myself prefer slow clients roaming then clients dropping from the network when stationed. This cause a lot of stress and and turn wifi into a responsible for every network problem.

[sanmar26]

Hello Anil,

You can also try 802.11r mix mode where it will present both authentication modes (non-FT and FT auth) to the clients. If you are able to tests this, it might help.

Additionally, the link below goes a bit more in detail on the differences of each mode in the event you are not fully aware.

https://www.youtube.com/watch?v=vnauH3QCI2I

[MHM Cisco World]

Use two different ssid  

One with ft for iphone and other non-ft for other user.

[patrice-paul29]

Hi Anil,

I had a similar issue with DELL Optiplex stations running Windows 10: the DELL station was reusing the same PMKID when roaming from one AP to another AP , or when switching between the 5 GHz and 2.4 GHz spectrums on the same AP.
This behavior does not meet the 802.11 standards and was causing client disconnections and reconnections for a few seconds with incident in APs logs Invalid PMKID and the client was disconnected (correct behavior is : AP#1 PMKID #1, AP#2 PMKID#2, if client roam back from AP# 2 to AP# 1 it can reuse the PMK#1,  then from AP#1 to AP#2 it can reuse PMKID#2 )

After upgrading the same station to Windows 11, the issue was resolved. The PMKIDs were different while roaming, as expected.

Hope this helps.

Patrice