Frequent client deauthentications with reason code 49

[michael.redert]

I am running a Catalyst 9105 access point with EWC 17.6.1. It has one SSID configured and associated with both bands. With this setup, I observe frequent client disconnects. For my iPhone SE 2, they often happen right after unlocking the device, but neither limited to this type of device nor to this situation. If I shutdown the 5GHz frequency, none of those disconnects happen anymore.

Logs show reason code 49, but I was unable to figure out what this means:.

c9105-ap#show dot11 clients deauthenticated
timestamp mac vap reason_code
Sun Nov 7 08:36:43 2021 60:7E:C9:xx:xx:xx 0 49
Sun Nov 7 08:36:52 2021 60:7E:C9:xx:xx:xx 0 49
Sun Nov 7 08:37:15 2021 60:7E:C9:xx:xx:xx 0 49

There is also some indication in the logs, that the disconnects might be related to roaming between slot 0 and 1 of the access point.

[*11/07/2021 08:36:43.3773] CLSM[60:7E:C9:xx:xx:xx]: DELETE_MOBILE payload is ignored - client roamed from slot 0 to slot 1 in the same AP

Any help to fix this is very much appreciated!

[Arshad Safrulla · Accepted solution]

I do not think most of the client devices are ready yet for WPA3, so unless there is an operation requirement I would recommend to disable Fast transition, WPA3 & PMF. This should help you overcome this problem. 

[michael.redert]

Thanks! - that really solved my problem. I did not observe any of those disconnects during the day. Unfortunately, I do not fully understand why. Isn't WPA2+WPA3 mixed mode supposed to be backward compatible, so that devices can choose depending on which one they support?

[Arshad Safrulla]

WPA3 implementation at client level is not yet perfect, still lot of issues are seen in wild. 

[morgan]

Is this still the issue?  I have a new system set up with WPA2+WPA3 and FT enabled as that should be ideal, but am seeing frequent client disconnects.  Should be resolved after 2 1/2 years, but...?

Using 9105-AXI-B APs with EWC 17.6.4.

[JPavonM]

If your clients are Windows then that is a real problem if you use WPA3 in whatever flavour.

There are lots of issues to be fixed in Windows related to WPA3 and are pending from MS to fix them all, but the problem is that they do not listen to customers nor prioritize this. I have done a lot of tests with WPA3-Transition mode and my recommendation is not to use it if Windows devices are using the access.

All engineers will recommend you not to use WPA3 mandatory unless you know ALL devices do support it, and they would be homogenous (from one vendor or couple of them at most,but all of them centrally managed by the company and using same OS releases and wMIC driver versions), otherwise you will have no way of knowing WPA3 support in advance on non-corporate unmanaged devices.

[morgan]

Any better behavior with a newer controller version?  Looks like many issues resolved, but likelihood for AP/EWC crashes on 9105s unresolved.