Hi community,
I'm suffering lack of connectivity when configuring WPA/WPA2 or WPA2/WPA3 WLAN profile with PMF optional or enabled, plus 802.1X-SHA1 plus 802.1X-SHA256 simultaneously.
Packet captures shows EAPOL failing on sending 4-way handshake M3 packet from client to AP.
However, with that same config, Intel AC8265 chipsets are sucessfully connecting but not Intel AC3165's. Different mobile devices are able to connect as well: iPad, iPhone 7, Xiaomi Mi8, Samsung S9.
Interesting enough, no Intel chipset I've tested is able to connect using only SHA256 (Intel 3165, 8265 and AX200).
The issue is reproducible with Cisco's latest code because in the previous ones there were many bugs affecting the use of SHA256. This is also reproducible with all of them AP models listed before
Conditions:
Cisco WLAN Infrastructure: Catalyst 9800 running IOS-XE 17.3.1 and different AP Models (AP3700, AP3800, AP4800, C9120, C9130). It also happen on Cisco AireOS 8.10.130 (same as before, previous versions has some bugs when using SHA256).
Laptop: Windows 10 version 2004 (OS Build 19041.264)
wNIC: Intel AX200
Driver: Intel PROSet Wireless 21.110 (also tested with version 21.90)
This is the output on the failure in the controller debug that shows MIC validation failed:
2020/08/18 09:41:03.306370 {wncd_x_R0-0}{1}: [client-orch-sm] [25343]: (info): MAC: aabb.ccdd.eeff Deleting the client, reason: 91, CO_CLIENT_DELETE_REASON_KEY_MGMT_MIC_VALIDATION, Client state S_CO_L2_AUTH_IN_PROGRESS
2020/08/18 09:41:03.306374 {wncd_x_R0-0}{1}: [tdllib] [25343]: (debug): ewlc/client/client_orch/_gen_lib_tpp_x86_64_cge7/client_orch_stats.c:2184:5: ewlc_client_orch_libctxt->client_orch_stats_rec->field_st_client_orch_stats_ptr->client_del_reason.co_client_delete_reason_key_mgmt_mic_validation_ctr++: db=WNCD_DB, tid=0, obj_ptr=0x808098fe48, write_ptr=0x808098ffc0, size=4
2020/08/18 09:41:03.306378 {wncd_x_R0-0}{1}: [client-orch-sm] [25343]: (debug): Search wlan client stats record exists for given wlan id: 39
2020/08/18 09:41:03.306379 {wncd_x_R0-0}{1}: [tdllib] [25343]: (debug): ewlc/client/client_orch/_gen_lib_tpp_x86_64_cge7/client_orch_wlan_client_stats.c:2942:5: rec->field_wlan_client_stats_ptr->client_del_reason.co_client_delete_reason_key_mgmt_mic_validation_ctr++: db=WNCD_DB, tid=0, obj_ptr=0x8080e84718, write_ptr=0x8080e84890, size=4
2020/08/18 09:41:03.306383 {wncd_x_R0-0}{1}: [client-orch-sm] [25343]: (debug): MAC: aabb.ccdd.eeff local ipv6 deletemmif_role_status: 0, Success, client role: Unassoc
2020/08/18 09:41:03.306396 {wncd_x_R0-0}{1}: [client-ipv6-client] [25343]: (debug): MAC: aabb.ccdd.eeff Failed to find client in mgid table
2020/08/18 09:41:03.306407 {wncd_x_R0-0}{1}: [client-orch-sm] [25343]: (debug): transition buffer: written 96 position 5
2020/08/18 09:41:03.306408 {wncd_x_R0-0}{1}: [client-orch-sm] [25343]: (note): MAC: aabb.ccdd.eeff Client delete initiated. Reason: CO_CLIENT_DELETE_REASON_KEY_MGMT_MIC_VALIDATION, fsm-state transition 00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|01|07|13|1a|23|Is there any one who has sucessfully configured 802.1X with SHA256 and managed to connect an Intel AX200? And what about 802.1X with SHA1+SHA256?
NOTE: I have a discussion open on Intel Community if you want to add additional data:
Intel-AX200-fails-to-connect-using-SHA256
Regards
