DOT1X Auth wifi - disconnects randomly for few clients in 9800 WLC

[networksupportiap]

Users getting disconnected randomly in the wi-fi 

some users stay connected but get nothing, Nothing works - internet, browsing, Teams, outlook.. but still says connected to SSID. 

2025/02/24 17:01:36.834450808 {wncd_x_R0-0}{2}: [client-orch-sm] [17158]: (note): MAC: 9065.84a9.c973 Client delete initiated. Reason: CO_CLIENT_DELETE_REASON_CLIENT_EAP_TIMEOUT_FAILURE, details: , fsm-state transition 00|00|00|00|00|00|00|00|00|00|00|00|00|01|07|15|16|17|15|1a|1b|2c|37|46|48|4a|4c|55|64|66|87|af|
2025/02/24 17:01:36.834503716 {wncd_x_R0-0}{2}: [client-orch-sm] [17158]: (note): MAC: 9065.84a9.c973 Delete mobile payload sent for BSSID: 889c.ad20.f8ee WTP mac: 889c.ad20.f8e0 slot id: 1
2025/02/24 17:01:36.834510637 {wncd_x_R0-0}{2}: [client-orch-state] [17158]: (note): MAC: 9065.84a9.c973 Client state transition: S_CO_RUN -> S_CO_DELETE_IN_PROGRESS
2025/02/24 17:01:36.834880270 {wncd_x_R0-0}{2}: [dpath_svc] [17158]: (note): MAC: 9065.84a9.c973 Client datapath entry deleted for ifid 0xa0000073
2025/02/24 17:01:36.835006083 {wncd_x_R0-0}{2}: [sanet-shim-translate] [17158]: (note): MAC: 9065.84a9.c973 Session manager disconnect event called, session label: 0x4c00035c
2025/02/24 17:01:36.835274709 {wncd_x_R0-0}{2}: [sisf-tdl] [17158]: (ERR): DAD Pending Rec Del Failed fe80::a9:6533:3f34:787a:-2147483631
2025/02/24 17:01:36.835401011 {wncd_x_R0-0}{2}: [client-orch-sm] [17158]: (ERR): MAC: 0000.0000.0000 Unable to determine vlan and switching mode. fsm_ctxt not found for client
2025/02/24 17:01:36.835475339 {wncd_x_R0-0}{2}: [client-orch-sm] [17158]: (ERR): MAC: 0000.0000.0000 Unable to determine vlan and switching mode. fsm_ctxt not found for client
2025/02/24 17:01:36.837418623 {wncd_x_R0-0}{2}: [client-orch-state] [17158]: (note): MAC: 9065.84a9.c973 Client state transition: S_CO_DELETE_IN_PROGRESS -> S_CO_DELETED
2025/02/24 17:01:36.837522010 {wncd_x_R0-0}{2}: [client-orch-sm] [17158]: (ERR): MAC: 9065.84a9.c973 Failed to receive dot11 disassoc or deauth request. Client FSM not exist, ignore the disassoc/deauth req
2025/02/24 17:01:36.837522350 {wncd_x_R0-0}{2}: [client-orch-sm] [17158]: (ERR): MAC: 9065.84a9.c973 Failed to get ewlc dot11 packet handler. Disassoc/Deauth request processing failed in CO. Dropping request
2025/02/24 17:01:36.841662725 {wncd_x_R0-0}{1}: [sisf-ha] [17472]: (ERR): Failed to find client 9065.84a9.c973 in db mac table with rc 2
2025/02/24 17:13:27.999162885 {wncd_x_R0-0}{2}: [client-orch-sm] [17158]: (note): MAC: 9065.84a9.c973 Association received. BSSID 889c.ad20.f8ee, WLAN FCA-WiFi, Slot 1 AP 889c.ad20.f8e0, rflciporaph4, Site tag FCA-CHN, Policy tag FCA-CHN, Policy profile FCA-CHN_WLANID_1, Switching Local, Socket delay 0ms
2025/02/24 17:13:27.999272982 {wncd_x_R0-0}{2}: [client-orch-state] [17158]: (note): MAC: 9065.84a9.c973 Client state transition: S_CO_INIT -> S_CO_ASSOCIATING
2025/02/24 17:13:27.999713536 {wncd_x_R0-0}{2}: [dot11] [17158]: (note): MAC: 9065.84a9.c973 Association success. AID 22, Roaming = False, WGB = False, 11r = False, 11w = True Fast roam = False
2025/02/24 17:13:27.999844505 {wncd_x_R0-0}{2}: [client-orch-state] [17158]: (note): MAC: 9065.84a9.c973 Client state transition: S_CO_ASSOCIATING -> S_CO_L2_AUTH_IN_PROGRESS
2025/02/24 17:13:27.999973835 {wncd_x_R0-0}{2}: [client-auth] [17158]: (note): MAC: 9065.84a9.c973 ADD MOBILE sent. Client state flags: 0x1 BSSID: MAC: 889c.ad20.f8ee capwap IFID: 0x90000065, Add mobiles sent: 1
2025/02/24 17:13:28.000167697 {wncd_x_R0-0}{2}: [client-orch-sm] [17158]: (note): MAC: 9065.84a9.c973 Association received. BSSID 889c.ad20.f8ee, WLAN FCA-WiFi, Slot 1 AP 889c.ad20.f8e0, rflciporaph4, Site tag FCA-CHN, Policy tag FCA-CHN, Policy profile FCA-CHN_WLANID_1, Switching Local, old BSSID 889c.ad20.f8ee, Socket delay 2ms
2025/02/24 17:13:28.000198338 {wncd_x_R0-0}{2}: [client-orch-state] [17158]: (note): MAC: 9065.84a9.c973 Client state transition: S_CO_L2_AUTH_IN_PROGRESS -> S_CO_L2_AUTH_IN_PROGRESS
2025/02/24 17:13:28.000425898 {wncd_x_R0-0}{2}: [dot11] [17158]: (note): MAC: 9065.84a9.c973 Association success. AID 22, Roaming = False, WGB = False, 11r = False, 11w = True Fast roam = False
2025/02/24 17:13:28.000501373 {wncd_x_R0-0}{2}: [client-orch-state] [17158]: (note): MAC: 9065.84a9.c973 Client state transition: S_CO_L2_AUTH_IN_PROGRESS -> S_CO_L2_AUTH_IN_PROGRESS
2025/02/24 17:13:28.005376629 {wncd_x_R0-0}{2}: [client-auth] [17158]: (note): MAC: 9065.84a9.c973 L2 Authentication initiated. method DOT1X, Policy VLAN 0, AAA override = 0 , NAC = 0
2025/02/24 17:13:28.006344886 {wncd_x_R0-0}{2}: [ewlc-infra-evq] [17158]: (note): Authentication Success. Resolved Policy bitmap:11 for client 9065.84a9.c973
2025/02/24 17:13:31.242092648 {wncd_x_R0-0}{2}: [sanet-shim-miscellaneous] [17158]: (ERR): authc policy update from SANet vlan 17
2025/02/24 17:13:31.242185316 {wncd_x_R0-0}{2}: [client-auth] [17158]: (note): MAC: 9065.84a9.c973 L2 Authentication Key Exchange Start. Resolved VLAN: 17, Audit Session id: C5046A0A000020EE37C4ECD7

[marce1000]

 - Have a look at stats from : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#toc-hId-866973845

 - You can debug a single client according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity
    these so called Radio Active traces can be analyzed with Wireless Debug Analyzer

 - Have a checkup of the 9800 WLC's configuration using the CLI command show tech wireless and
    feed the output from that into Wireless Config Analyzer

 - What software version is  the 9800 controller running , if older then go for 17.12.4 , the current
    recommended release,

 M.