End devices saying "incorrect password" when connecting to WIFI

[ts7575]

Hello,

I am using a WLC 9800 and I recently replaced my Aironet 2702's with Aironet 3802's. With the 2702's we had no issues and little downtime. However, since replacing them with 3802's, we're having a problem where randomly during the day, all of our end users disconnect from the wifi and when they try to log back in, it says "incorrect password". There is no indication as to why this is happeneing. It happens on all devices including iPhones and windows PC's. Resetting all of the AP's fixes the issue until it inevitably occurs again a couple days later. Could this be a bug, or could it be a configuration or hardware issue?

Thankyou for the help. 

[Leo Laohoo]

What firmware is the controller running on?

[marce1000]

 - Use https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity  when this happens , you can  have radioactive traces from clients analyzed with : https://cway.cisco.com/tools/WirelessDebugAnalyzer/   also check the logs for these failed connections on your authenticating environment, such as radius logs  2) Have a checkup of the controller configuration with the CLI command show tech wireless , have the output analyzed with https://cway.cisco.com/tools/WirelessAnalyzer/       
                                       3) Go for IOS-XE 17.9.3 (which also has support for Wave1 APs)

 M.

[ts7575]

The controller's software version is 16.12.08.

[Leo Laohoo]

---

@ts7575 wrote:

The controller's software version is 16.12.08.

---

Uhhhh ... Wut?  And WHY?  16.12.X is well accepted and well known to be buggy, unreliable and unstable across all Technologies:  Wired, Wireless, Routing.

Upgrade to 17.9.3.

[ts7575]

According to the debug analyzer, all the clients are getting this error, "Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_KEY_XCHNG_TIMEOUT. Code means: Maximum retransmissions of M1 during 4-Way Handshake".

[marce1000]

 - FYI : https://bst.cloudapps.cisco.com/bugsearch?pf=prdNm&kw=CO_CLIENT_DELETE_REASON_KEY_XCHNG_TIMEOUT&bt=custV&sb=anfr  , upgrade to IOS-XE 17.9.3 and try again   , 

 M.

[Rich R · Accepted solution]

Agreed with @marce1000 - you really need to get that IOS upgraded!

16.12 is already past the end of security fixes milestone (last year):
https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-16/eos-eol-notice-c51-744154.html
So you're already running at risk and you will not get any more bug fixes for it so you need to move to a fully supported version of code.  17.9.3 is the latest extended support release and includes support for your 2702 APs. (17.3 is already going end of life so stay away from that).

The TAC recommended list (below) hasn't been updated with 17.9.3 yet but will be soon.  You can check the release notes:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/release-notes/rn-17-9-9800.html#whats-new-1793
But also note that you will need to upgrade to 17.3.5 or 17.6 before upgrading to 17.9.3 so I'd upgrade to 17.6.5 and then to 17.9.3:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/release-notes/rn-17-9-9800.html#Cisco_Concept.dita_59a2987f-2633-4630-8c7b-a8e8aecdeaf7

[ts7575]

I successfully upgraded today, but didn’t fully read your reply and missed the link for the bug about older AP’s remaining in the downloading state. Since we are still using a couple of 2700’s in our network, I had to roll back to 16.12 for now. I will attempt the upgrade again next week and implement the work around, so we can keep our 2700’s online. Then I will have to wait a couple days to see if we get the authentication issue again or not. 

Also, an additional question. Under Wireless>Access Points>General, it says our boot version for the 3800’s is 1.1.2.4. What exactly is the “boot version”? 

[marce1000]

 - Note that 17.9.3  will support the 2700 and other older Wave APs again. It was done because of many customers having those.

 M.

[Rich R]

What version did you try to upgrade to?
17.3.7 and 17.9.3 both have the fix integrated already.

[t3rebello]

I would like to report that I am also having this problem on my Catalyst 9800 WLC. Code is 17.12.1

I have all Catalyst 9130 WAP's in my environment. 

[marce1000]

@t3rebello Start a new thread , describe the problem(s) as you are experiencing it/them , and don't forget to include the mentioned wireless environment parameters (models , software versions).

 M.

[t3rebello]

I will do that, thank you