Client roaming issue between APs

[abdelouahab.brahim1]

hello,

I have a wireless network built with Cisco WLC 5520 (in HA), AP 2800. WLC is running code 8.3.133.0.

Randomly, client roaming goes wrong, all I can found in the debug client is this :

xx:xx:xx:xx:xx:xx : MAC of client

yy:yy:yy:yy:yy:yy : BSSID

*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-Key from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Ignoring invalid EAPOL version (1) in EAPOL-key message from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx key Desc Version FT - 0

*Dot1x_NW_MsgTask_2: Nov 22 09:53:52.366: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key message in invalid state from mobile xx:xx:xx:xx:xx:xx

*apfOpenDtlSocket: Nov 22 09:55:08.983: [PA] xx:xx:xx:xx:xx:xx Recevied management frame REASSOCIATION REQUEST on BSSID yy:yy:yy:yy:yy:yy destination addr yy:yy:yy:yy:yy:y2

Every time it's the same debug, and loss of connection until the client reasscoates with the AP with reassociation request.

As you can see in this debug, about 1 minute and 16 seconde of loss of ping.

We use [WPA2][Auth(802.1X + CCKM)] with a remote radius server (ACS) a cross the WAN.

Any help is much appreciated.

regards,

Brahim,

[abdelouahab.brahim1]

hello,

I think somehow the client send eapol pkt with the key version 1 that's ignored by the controller (version 2).

is there a way to ignore the version check in the controller ?

*dot1xSocketTask: Nov 22 09:53:52.365: [PA] xx:xx:xx:xx:xx:xx validating eapol pkt: key version = 2

*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-Key from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Ignoring invalid EAPOL version (1) in EAPOL-key message from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx key Desc Version FT - 0

*Dot1x_NW_MsgTask_2: Nov 22 09:53:52.366: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key message in invalid state from mobile xx:xx:xx:xx:xx:xx

*apfOpenDtlSocket: Nov 22 09:55:08.983: [PA] xx:xx:xx:xx:xx:xx Recevied management frame REASSOCIATION REQUEST on BSSID yy:yy:yy:yy:yy:yy destination addr yy:yy:yy:yy:yy:y2

Thanks in advance,

[Rich R · Accepted solution]

8.3.133.0 is very old and with no software maintenance support - see https://www.cisco.com/c/en/us/products/collateral/wireless/8500-series-wireless-controllers/bulletin-c25-742339.html
If you *must* run 8.3 for some reason then you should be running 8.3.150.x Escalation code which TAC will still support - see https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc11
If you don't have to stay on 8.3 (eg. for very old APs) then you should seriously consider moving to 8.5 or later.

[abdelouahab.brahim1]

Hello,
Thank you for your reply, we moved to 8.5.151.0 recommanded by cisco.
We are in observation period.
Regards,

[OddievenInc]

Hi
Any update on this, please?

[abdelouahab.brahim1]

Hello,

The upgrade solved the problem.

Regards,