Enterprise Wi-Fi disconnection on C9800 | failure reason: Timeout

[rahulkanhirode]

Any clues for this issue ?

Cisco IOS XE Software, Version 17.09.03
Cisco IOS Software [Cupertino], C9800 Software (C9800_IOSXE-K9), Version 17.9.3, RELEASE SOFTWARE (fc6)

Nov 7 10:18:48.868: %DOT1X-5-FAIL: Chassis 2 R0/0: wncd: Authentication failed for client (8ce9.ee22.f047) with reason (Timeout) on Interface capwap_90000075 AuditSessionID 0464D00A0001D47805E9AA72 Username: host/zzzz
Nov 7 10:18:48.868: %SESSION_MGR-5-FAIL: Chassis 2 R0/0: wncd: Authorization failed or unapplied for client (8ce9.ee22.f047) on Interface capwap_90000075 AuditSessionID 0464D00A0001D47805E9AA72. Failure reason: Authc fail. Authc failure reason: Timeout.

[marce1000]

  - Have a look at https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5   , use these commands to get better insights
    If radius is being used , then check the logs on the radius server(s) for the particular authentication(s)

  + 17.9.x is EOL , consider upgrading to 17.12.3

   M.

[rahulkanhirode]

Could you please help me by sharing documents/links showing   is EOL or Vulnerabilities of + 17.9.x?

[marce1000]

       - FYI : https://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-xe-17/ios-xe-17-9-x-eol.html
          The problem could be related to bug(s) , yet for the time being I don't have any specific one to show for.
          Therefore the upgrade is only a strong advice
          Remember the other topics from my first reply too , such as checking radius authentications when being used.

  It's also always good practice to checkout the 9800 controller configuration using the CLI command
  show tech wireless   (not show tech) and feed the output from that into Wireless Config Analyzer
                                                                   Take care of all advisories!

 M.

[jagan.chowdam]

Start client debug and use WLC Debug Analyzer to process the output.

https://www.cisco.com/c/en/us/support/docs/wireless/standalone-controllers/220344-troubleshoot-with-wireless-debug-analyze.html

https://cway.cisco.com/tools/WirelessDebugAnalyzer/

Check radius logs too.

Here are couple of cases with similar issue. Please go through them

https://community.cisco.com/t5/wireless/dot1x-clients-can-t-get-authenticated-du-to-cred-fail-on-cisco/td-p/4755944

https://community.cisco.com/t5/wireless/reason-cred-fail-on-interface-capwap/td-p/4971126

Jagan Chowdam

/**Pls rate useful responses**/

[Leo Laohoo]

Reboot the APs.