Macbook with M1 & M2 chips can't connect to our staff Wi-Fi wth Radius

[it-group]

Good day all,

We have a staff Wi-Fi that authenticate with Radius and all machines(Windows and older Macbooks) are able to connect/associate successfully without any issues. But the newer Apple MacBooks with M1 and M2 chips are not able to connect/associate at all. Hoever, they are able to connect to our guest Wi-Fi that uses WPA2/PSK for authentication. 

Please see below errors that we managed to capture on our Cisco WLC 2504(8.5.161.0). We are wondering what could be the cause.

ASSOCIATION REQUEST

(Cisco Controller) >*apfOpenDtlSocket: May 23 19:58:11.088: aa:aa:aa:aa:aa:aa Received management frame ASSOCIATION REQUEST  on BSSID ff:ff:ff:ff:ff:ff destination addr ff:ff:ff:ff:ff:ff

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Updating 11r vendor IE

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Processing assoc-req station:aa:aa:aa:aa:aa:aa AP:cc:cc:cc:cc:cc:cc-01 ssid :  wifi-staff thread:1b82f998

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Station:  aa:aa:aa:aa:aa:aa  11v BSS Transition not enabled on the AP  cc:cc:cc:cc:cc:cc

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Updating location for mobile on same AP cc:cc:cc:cc:cc:cc-1

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Client AVC Roaming context transfer needed? NO

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Setting RTTS enabled to 0

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Association received from mobile on BSSID ff:ff:ff:ff:ff:ff AP AP17

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Station:  aa:aa:aa:aa:aa:aa  11v BSS Transition not enabled on the AP  cc:cc:cc:cc:cc:cc

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Global 200 Clients are allowed to AP radio

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Max Client Trap Threshold: 0  cur: 2

*apfMsConnTask_2: May 23 19:58:11.089: aa:aa:aa:aa:aa:aa Rf profile 600 Clients are allowed to AP wlan

*apfMsConnTask_2: May 23 19:58:11.090: aa:aa:aa:aa:aa:aa Deleting client immediately since WLAN has changed

*apfMsConnTask_2: May 23 19:58:11.090: aa:aa:aa:aa:aa:aa Scheduling deletion of Mobile Station:  (callerId: 50) in 1 seconds

*apfOpenDtlSocket: May 23 19:58:11.402: aa:aa:aa:aa:aa:aa Received management frame ASSOCIATION REQUEST  on BSSID ff:ff:ff:ff:ff:ff destination addr xx:xx:f0:xx:45:xx

*apfMsConnTask_2: May 23 19:58:11.402: aa:aa:aa:aa:aa:aa Updating 11r vendor IE

*apfMsConnTask_2: May 23 19:58:11.402: aa:aa:aa:aa:aa:aa Processing assoc-req station:aa:aa:aa:aa:aa:aa AP:cc:cc:cc:cc:cc:cc-01 ssid :  wifi-staff thread:1b 82f998

*apfMsConnTask_2: May 23 19:58:11.402: aa:aa:aa:aa:aa:aa Ignoring 802.11 assoc request from mobile pending deletion

*apfMsConnTask_2: May 23 19:58:11.402: aa:aa:aa:aa:aa:aa Sending assoc-resp with status 12 station:aa:aa:aa:aa:aa:aa AP:cc:cc:cc:cc:cc:cc-01 on apVapId 1

*apfMsConnTask_2: May 23 19:58:11.402: aa:aa:aa:aa:aa:aa VHT Operation IE: width 20/0 ch 36 freq0 0 freq1 0 msc0 0x3f msc1 0x3f

*apfMsConnTask_2: May 23 19:58:11.402: aa:aa:aa:aa:aa:aa Sending Assoc Response (status: 'Assoc denied unspecified') to station on AP AP17 on BSSID gg:gg:gg:gg:gg:gg ApVapId 1 Slot 1, mobility role 1

*apfOpenDtlSocket: May 23 19:58:11.416: aa:aa:aa:aa:aa:aa Received management frame ASSOCIATION REQUEST  on BSSID ee:ee:ee:ee:ee:ee destination addr xx:xx:xx:xx:xx:xf

*apfMsConnTask_2: May 23 19:58:11.417: aa:aa:aa:aa:aa:aa Updating 11r vendor IE

*apfMsConnTask_2: May 23 19:58:11.417: aa:aa:aa:aa:aa:aa Processing assoc-req station:aa:aa:aa:aa:aa:aa AP:dd:dd:dd:dd:dd:dd-01 ssid :  wifi-staff thread:1b 82f998

*apfMsConnTask_2: May 23 19:58:11.417: aa:aa:aa:aa:aa:aa Ignoring 802.11 assoc request from mobile pending deletion

*apfMsConnTask_2: May 23 19:58:11.417: aa:aa:aa:aa:aa:aa Sending assoc-resp with status 12 station:aa:aa:aa:aa:aa:aa AP:cc:cc:cc:cc:cc:cc-01 on apVapId 1

*apfMsConnTask_2: May 23 19:58:11.417: aa:aa:aa:aa:aa:aa VHT Operation IE: width 20/0 ch 40 freq0 0 freq1 0 msc0 0x3f msc1 0x3f

*apfMsConnTask_2: May 23 19:58:11.417: aa:aa:aa:aa:aa:aa Sending Assoc Response (status: 'Assoc denied unspecified') to station on AP AP9 on BSSID hh:hh:hh:hh:hh:hh ApVapId 1 Slot 1, mobility role 1

*apfOpenDtlSocket: May 23 19:58:11.701: aa:aa:aa:aa:aa:aa Received management frame ASSOCIATION REQUEST  on BSSID ff:ff:ff:ff:ff:ff destination addr ii:ii:ii:ii:ii:ii

*apfMsConnTask_2: May 23 19:58:11.702: aa:aa:aa:aa:aa:aa Updating 11r vendor IE

*apfMsConnTask_2: May 23 19:58:11.702: aa:aa:aa:aa:aa:aa Processing assoc-req station:aa:aa:aa:aa:aa:aa AP:cc:cc:cc:cc:cc:cc-01 ssid :  wifi-staff thread:1b  82f998

*apfMsConnTask_2: May 23 19:58:11.702: aa:aa:aa:aa:aa:aa Ignoring 802.11 assoc request from mobile pending deletion

*apfMsConnTask_2: May 23 19:58:11.702: aa:aa:aa:aa:aa:aa Sending assoc-resp with status 12 station:aa:aa:aa:aa:aa:aa AP:cc:cc:cc:cc:cc:cc-01 on apVapId 1

*apfMsConnTask_2: May 23 19:58:11.702: aa:aa:aa:aa:aa:aa VHT Operation IE: width 20/0 ch 36 freq0 0 freq1 0 msc0 0x3f msc1 0x3f

*apfMsConnTask_2: May 23 19:58:11.702: aa:aa:aa:aa:aa:aa Sending Assoc Response (status: 'Assoc denied unspecified') to station on AP AP17 on BSSID jj:jj:jj:jj:jj:jj ApVapId 1 Slot 1, mobility role 1

*apfOpenDtlSocket: May 23 19:58:11.822: aa:aa:aa:aa:aa:aa Received management frame ASSOCIATION REQUEST  on BSSID hh:hh:hh:hh:hh:hh destination addr 70:xf:6x:fx:1x:ex

*apfMsConnTask_4: May 23 19:58:11.822: aa:aa:aa:aa:aa:aa Updating 11r vendor IE

*apfMsConnTask_4: May 23 19:58:11.822: aa:aa:aa:aa:aa:aa Processing assoc-req station:aa:aa:aa:aa:aa:aa AP:hh:hh:hh:hh:hh:hh-00 ssid :  wifi-staff thread:1b 830198

*apfMsConnTask_4: May 23 19:58:11.823: aa:aa:aa:aa:aa:aa Ignoring 802.11 assoc request from mobile pending deletion

*apfMsConnTask_4: May 23 19:58:11.823: aa:aa:aa:aa:aa:aa Sending assoc-resp with status 12 station:aa:aa:aa:aa:aa:aa AP:cc:cc:cc:cc:cc:cc-01 on apVapId 1

*apfMsConnTask_4: May 23 19:58:11.823: aa:aa:aa:aa:aa:aa Sending Assoc Response (status: 'Assoc denied unspecified') to station on AP AP12 on BSSID kk:kk:kk:kk:kk:kk ApVapId 1 Slot 0, mobility role 1

*apfOpenDtlSocket: May 23 19:58:11.886: aa:aa:aa:aa:aa:aa Received management frame ASSOCIATION REQUEST  on BSSID cc:cc:cc:cc:cc:cc destination addr 78:0c:f0:bb:45:c0

*apfMsConnTask_2: May 23 19:58:11.886: aa:aa:aa:aa:aa:aa Updating 11r vendor IE

*apfMsConnTask_2: May 23 19:58:11.886: aa:aa:aa:aa:aa:aa Processing assoc-req station:aa:aa:aa:aa:aa:aa AP:cc:cc:cc:cc:cc:cc-00 ssid :  wifi-staff thread:1b 82f998

*apfMsConnTask_2: May 23 19:58:11.886: aa:aa:aa:aa:aa:aa Ignoring 802.11 assoc request from mobile pending deletion

*apfMsConnTask_2: May 23 19:58:11.886: aa:aa:aa:aa:aa:aa Sending assoc-resp with status 12 station:aa:aa:aa:aa:aa:aa AP:cc:cc:cc:cc:cc:cc-01 on apVapId 1

*apfMsConnTask_2: May 23 19:58:11.886: aa:aa:aa:aa:aa:aa Sending Assoc Response (status: 'Assoc denied unspecified') to station on AP AP17 on BSSID ll:ll:ll:ll:ll:ll ApVapId 1 Slot 0, mobility role 1

*osapiBsnTimer: May 23 19:58:11.961: aa:aa:aa:aa:aa:aa apfMsExpireCallback (apf_ms.c:650) Expiring Mobile!

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa apfMsExpireMobileStation (apf_ms.c:7894) Changing state for mobile aa:aa:aa:aa:aa:aa on AP ll:ll: ll:ll:ll:ll from Associated to Disassociated

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa Succesfully freed AID 3, slot 1 on AP cc:cc:cc:cc:cc:cc, #client on this slot 1

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa apfSendDisAssocMsgDebug (apf_80211.c:3831) Changing state for mobile aa:aa:aa:aa:aa:aa on AP 78:0 c:f0:bb:45:c0 from Disassociated to Disassociated

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa Sent Disassociate to mobile on AP cc:cc:cc:cc:cc:cc-1 on BSSID bb:bb:bb:bb:bb:bb(reason 1, caller apf_ms.c:7978)

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa Resetting MSCB PMK Cache Entry @index 0 for station aa:aa:aa:aa:aa:aa

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa Removing BSSID bb:bb:bb:bb:bb:bb from PMKID cache of station aa:aa:aa:aa:aa:aa

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa Setting active key cache index 0 ---> 8

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa Deleting the PMK cache when de-authenticating the client.

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa DOT11R: Sending cache delete

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa Removing PMK cache entry for station aa:aa:aa:aa:aa:aa

*apfReceiveTask: May 23 19:58:11.962: aa:aa:aa:aa:aa:aa Sent Deauthenticate to mobile on BSSID bb:bb:bb:bb:bb:bb slot 1(caller apf_ms.c:7986)

*apfReceiveTask: May 23 19:58:11.963: aa:aa:aa:aa:aa:aa apfMsAssoStateDec

*apfReceiveTask: May 23 19:58:11.963: aa:aa:aa:aa:aa:aa apfMsWepPskStateDec

*apfReceiveTask: May 23 19:58:11.963: aa:aa:aa:aa:aa:aa apfMsExpireMobileStation (apf_ms.c:8044) Changing state for mobile aa:aa:aa:aa:aa:aa on AP ll:ll:ll:ll:ll:ll from Disassociated to Idle

More Authentication Logs

(Cisco Controller) >*apfReceiveTask: May 23 19:28:11.349: aa:aa:aa:aa:aa:aa Initiating Accounting request(2) update for mobile

*apfReceiveTask: May 23 19:28:11.349: aa:aa:aa:aa:aa:aa PemLocationConfigured [1]Adding VSA with NAS update and Role[1] with state[0]

*apfMsConnTask_2: May 23 19:28:16.587: aa:aa:aa:aa:aa:aa Created Cisco-Audit-Session-ID for the mobile: ac1f0a1d0001466b646d13d0

*aaaQueueReader: May 23 19:28:16.589: aa:aa:aa:aa:aa:aa Returning AAA Success for mobile aa:aa:aa:aa:aa:aa

*aaaQueueReader: May 23 19:28:16.589: aa:aa:aa:aa:aa:aa processing avps[0]: attribute 6

*aaaQueueReader: May 23 19:28:16.589: aa:aa:aa:aa:aa:aa processing avps[1]: attribute 1

*aaaQueueReader: May 23 19:28:16.589: aa:aa:aa:aa:aa:aa User authentication Success with File DB on WLAN ID :3

*apfReceiveTask: May 23 19:28:16.589: aa:aa:aa:aa:aa:aa Applying new AAA override for station aa:aa:aa:aa:aa:aa

*apfReceiveTask: May 23 19:28:16.589: aa:aa:aa:aa:aa:aa Override values for station aa:aa:aa:aa:aa:aa source: 2, valid bits: 0x100000 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1

*apfReceiveTask: May 23 19:28:16.589: aa:aa:aa:aa:aa:aa Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1 vlanIfName: '', vlanId:0, aclName: ', ipv6AclName: , avcProfileName: '

*apfReceiveTask: May 23 19:28:16.590: aa:aa:aa:aa:aa:aa Unable to apply override policy for station aa:aa:aa:aa:aa:aa - VapAllowRadiusOverride is FALSE.

*apfReceiveTask: May 23 19:28:30.785: aa:aa:aa:aa:aa:aa Created Cisco-Audit-Session-ID for the mobile: ac1f0a1d0001466c646d13de

*DHCP Proxy Task: May 23 19:28:33.496: aa:aa:aa:aa:aa:aa Initiating Accounting request(0) update for mobile

*DHCP Proxy Task: May 23 19:28:33.496: aa:aa:aa:aa:aa:aa PemLocationConfigured [1]Adding VSA with NAS update and Role[1] with state[0]

*apfReceiveTask: May 23 19:31:09.177: aa:aa:aa:aa:aa:aa Unable to apply override policy for station aa:aa:aa:aa:aa:aa - VapAllowRadiusOverride is FALSE.

*aaaQueueReader: May 23 19:31:11.702: bb:bb:bb:bb:bb:bb radiusServerFallbackPassiveStateUpdate: RADIUS server is ready 192.168.1.44 port 1812 index 0 active 1

*aaaQueueReader: May 23 19:31:11.702: 00:00:00:00:00:00 Found a server : 192.168.1.44 from the WLAN server list of radius server index 1

*aaaQueueReader: May 23 19:31:11.702: bb:bb:bb:bb:bb:bb Send Radius Auth Request with pktId:40 into qid:2 of server at index:0

*aaaQueueReader: May 23 19:31:11.702: bb:bb:bb:bb:bb:bb Sending the packet to v4 host 192.168.1.44:1812 of length 309

*aaaQueueReader: May 23 19:31:11.702: bb:bb:bb:bb:bb:bb Successful transmission of Authentication Packet (pktId 40) to 192.168.1.44:1812 from server queue 2, proxy state bb:bb:bb:bb:bb:bb-05:00

*radiusTransportThread: May 23 19:31:12.552: bb:bb:bb:bb:bb:bb Access-Challenge received from RADIUS server 192.168.1.44 (qid:2) with port:1812, pktId:40

*aaaQueueReader: May 23 19:31:12.577: bb:bb:bb:bb:bb:bb radiusServerFallbackPassiveStateUpdate: RADIUS server is ready 192.168.1.44 port 1812 index 0 active 1

*aaaQueueReader: May 23 19:31:12.577: 00:00:00:00:00:00 Found a server : 192.168.1.44 from the WLAN server list of radius server index 1

*aaaQueueReader: May 23 19:31:12.577: bb:bb:bb:bb:bb:bb Send Radius Auth Request with pktId:41 into qid:2 of server at index:0

*aaaQueueReader: May 23 19:31:12.577: bb:bb:bb:bb:bb:bb Sending the packet to v4 host 192.168.1.44:1812 of length 576

*aaaQueueReader: May 23 19:31:12.577: bb:bb:bb:bb:bb:bb Successful transmission of Authentication Packet (pktId 41) to 192.168.1.44:1812 from server queue 2, proxy state bb:bb:bb:bb:bb:bb-05:01

*radiusTransportThread: May 23 19:31:12.605: bb:bb:bb:bb:bb:bb Access-Challenge received from RADIUS server 192.168.1.44 (qid:2) with port:1812, pktId:41

*aaaQueueReader: May 23 19:31:12.626: bb:bb:bb:bb:bb:bb radiusServerFallbackPassiveStateUpdate: RADIUS server is ready 192.168.1.44 port 1812 index 0 active 1

*aaaQueueReader: May 23 19:31:12.626: 00:00:00:00:00:00 Found a server : 192.168.1.44 from the WLAN server list of radius server index 1

*aaaQueueReader: May 23 19:31:12.626: bb:bb:bb:bb:bb:bb Send Radius Auth Request with pktId:42 into qid:2 of server at index:0

*aaaQueueReader: May 23 19:31:12.627: bb:bb:bb:bb:bb:bb Sending the packet to v4 host 192.168.1.44:1812 of length 319

*aaaQueueReader: May 23 19:31:12.627: bb:bb:bb:bb:bb:bb Successful transmission of Authentication Packet (pktId 42) to 192.168.1.44:1812 from server queue 2, proxy state bb:bb:bb:bb:bb:bb-05:02

*radiusTransportThread: May 23 19:31:12.628: bb:bb:bb:bb:bb:bb Access-Challenge received from RADIUS server 192.168.1.44 (qid:2) with port:1812, pktId:42

*aaaQueueReader: May 23 19:31:12.641: bb:bb:bb:bb:bb:bb radiusServerFallbackPassiveStateUpdate: RADIUS server is ready 192.168.1.44 port 1812 index 0 active 1

*aaaQueueReader: May 23 19:31:12.641: 00:00:00:00:00:00 Found a server : 192.168.1.44 from the WLAN server list of radius server index 1

*aaaQueueReader: May 23 19:31:12.641: bb:bb:bb:bb:bb:bb Send Radius Auth Request with pktId:43 into qid:2 of server at index:0

*aaaQueueReader: May 23 19:31:12.641: bb:bb:bb:bb:bb:bb Sending the packet to v4 host 192.168.1.44:1812 of length 464

*aaaQueueReader: May 23 19:31:12.641: bb:bb:bb:bb:bb:bb Successful transmission of Authentication Packet (pktId 43) to 192.168.1.44:1812 from server queue 2, proxy state bb:bb:bb:bb:bb:bb-05:03

*radiusTransportThread: May 23 19:31:12.645: bb:bb:bb:bb:bb:bb Access-Challenge received from RADIUS server 192.168.1.44 (qid:2) with port:1812, pktId:43

*aaaQueueReader: May 23 19:31:12.658: bb:bb:bb:bb:bb:bb radiusServerFallbackPassiveStateUpdate: RADIUS server is ready 192.168.1.44 port 1812 index 0 active 1

*aaaQueueReader: May 23 19:31:12.658: 00:00:00:00:00:00 Found a server : 192.168.1.44 from the WLAN server list of radius server index 1

*aaaQueueReader: May 23 19:31:12.658: bb:bb:bb:bb:bb:bb Send Radius Auth Request with pktId:44 into qid:2 of server at index:0

*aaaQueueReader: May 23 19:31:12.658: bb:bb:bb:bb:bb:bb Sending the packet to v4 host 192.168.1.44:1812 of length 319

*aaaQueueReader: May 23 19:31:12.658: bb:bb:bb:bb:bb:bb Successful transmission of Authentication Packet (pktId 44) to 192.168.1.44:1812 from server queue 2, proxy state bb:bb:bb:bb:bb:bb-05:04

*radiusTransportThread: May 23 19:31:12.659: bb:bb:bb:bb:bb:bb Access-Challenge received from RADIUS server 192.168.1.44 (qid:2) with port:1812, pktId:44

*aaaQueueReader: May 23 19:31:12.665: bb:bb:bb:bb:bb:bb radiusServerFallbackPassiveStateUpdate: RADIUS server is ready 192.168.1.44 port 1812 index 0 active 1

*aaaQueueReader: May 23 19:31:12.665: 00:00:00:00:00:00 Found a server : 192.168.1.44 from the WLAN server list of radius server index 1

*aaaQueueReader: May 23 19:31:12.665: bb:bb:bb:bb:bb:bb Send Radius Auth Request with pktId:45 into qid:2 of server at index:0

*aaaQueueReader: May 23 19:31:12.665: bb:bb:bb:bb:bb:bb Sending the packet to v4 host 192.168.1.44:1812 of length 388

*aaaQueueReader: May 23 19:31:12.665: bb:bb:bb:bb:bb:bb Successful transmission of Authentication Packet (pktId 45) to 192.168.1.44:1812 from server queue 2, proxy state bb:bb:bb:bb:bb:bb-05:05

*radiusTransportThread: May 23 19:31:12.666: bb:bb:bb:bb:bb:bb Access-Challenge received from RADIUS server 192.168.1.44 (qid:2) with port:1812, pktId:45

*aaaQueueReader: May 23 19:31:12.671: bb:bb:bb:bb:bb:bb Successful transmission of Authentication Packet (pktId 46) to 192.168.1.44:1812 from server queue 2, proxy state bb:bb:bb:bb:bb:bb-05:06

*DHCP Proxy Task: May 23 19:31:12.758: aa:aa:aa:aa:aa:aa Initiating Accounting request(0) update for mobile

*DHCP Proxy Task: May 23 19:31:12.758: aa:aa:aa:aa:aa:aa PemLocationConfigured [1]Adding VSA with NAS update and Role[1] with state[0]

*radiusTransportThread: May 23 19:31:13.194: bb:bb:bb:bb:bb:bb Radius AVP MPPE recv key: keylen: 32

*radiusTransportThread: May 23 19:31:13.194: bb:bb:bb:bb:bb:bb Access-Accept received from RADIUS server 192.168.1.44 (qid:2) with port:1812, pktId:49

*Dot1x_NW_MsgTask_2: May 23 19:31:13.195: bb:bb:bb:bb:bb:bb Applying new AAA override for station bb:bb:bb:bb:bb:bb

*Dot1x_NW_MsgTask_2: May 23 19:31:13.195: bb:bb:bb:bb:bb:bb Override values for station bb:bb:bb:bb:bb:bb source: 4, valid bits: 0x0 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1

*Dot1x_NW_MsgTask_2: May 23 19:31:13.195: bb:bb:bb:bb:bb:bb Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1 vlanIfName: '', vlanId:0, aclName: ', ipv6AclName: , avcProfileName: '

*Dot1x_NW_MsgTask_2: May 23 19:31:13.195: bb:bb:bb:bb:bb:bb Override values for station bb:bb:bb:bb:bb:bb source: 4, valid bits: 0x0 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1

*Dot1x_NW_MsgTask_2: May 23 19:31:13.195: bb:bb:bb:bb:bb:bb Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1 vlanIfName: '', vlanId:0, aclName: ', ipv6AclName: , avcProfileName: '

*Dot1x_NW_MsgTask_2: May 23 19:31:13.195: bb:bb:bb:bb:bb:bb Override values for station bb:bb:bb:bb:bb:bb source: 256, valid bits: 0x100000 qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1

*Dot1x_NW_MsgTask_2: May 23 19:31:13.195: bb:bb:bb:bb:bb:bb Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1 vlanIfName: '', vlanId:0, aclName: ', ipv6AclName: , avcProfileName: '

*Dot1x_NW_MsgTask_2: May 23 19:31:13.236: bb:bb:bb:bb:bb:bb Initiating Accounting request(1) update for mobile

*Dot1x_NW_MsgTask_2: May 23 19:31:13.237: bb:bb:bb:bb:bb:bb PemLocationConfigured [1]Adding VSA with NAS update and Role[1] with state[0]

[Flavio Miranda]

Hi

  Start by disabling feature like "BSS Transition" and "11k". Both are on the WLAN config, Advanced Tab. 

[marce1000]

  - As per https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html , use and or upgrade to https://software.cisco.com/download/specialrelease/8f166c6d88b9f77aabb63f78affa9749 because aireos is nowadays getting old and it is better to have an aireos-controller use the lastest and or last advisory release for it.

 I had your debugging output analyzed with https://cway.cisco.com/wireless-debug-analyzer/ (see output below) , I advice to run that again with native debugs you have to determine  a pattern for different clients (consider this an example only, the output is probably incomplete and not exactly correct) :

Select a client MAC Address and connection to see logs.

Download CSV

Lines 1-13 of 13

•  
•  
• 1
•  
•  

---

Show Time

Show Task

Show Translated

Show Original

Show Prior First Connection

Show All

---

TimeTaskTranslated

Connection attempt #1
Connection attempt #2
May 23 19:58:11.089	*apfMsConnTask_2	Client made new Association to AP/BSSID BSSID ff:ff:ff:ff:ff:ff AP AP17
May 23 19:58:11.090	*apfMsConnTask_2	Client expiration timer code set for 1 seconds. The reason: Client deleted due to wlan change (fast SSID is disabled)
May 23 19:58:11.402	*apfMsConnTask_2	WLC/AP is sending an Association Response to the client with status code 12 = Unknown or disabled SSID
May 23 19:58:11.417	*apfMsConnTask_2	WLC/AP is sending an Association Response to the client with status code 12 = Unknown or disabled SSID
May 23 19:58:11.702	*apfMsConnTask_2	WLC/AP is sending an Association Response to the client with status code 12 = Unknown or disabled SSID
May 23 19:58:11.823	*apfMsConnTask_4	WLC/AP is sending an Association Response to the client with status code 12 = Unknown or disabled SSID
May 23 19:58:11.886	*apfMsConnTask_2	WLC/AP is sending an Association Response to the client with status code 12 = Unknown or disabled SSID
May 23 19:58:11.962	*apfReceiveTask	Client session has timed out
May 23 19:58:11.962	*apfReceiveTask	Client disassociation event has occured. Possible reasons may be due to AP Radio Reset usually due to channel change or wlan was manually disabled or Client unable to get valid DHCP IP for WLAN using DHCP required
May 23 19:58:11.962	*apfReceiveTask	Client has been deauthenticated
May 23 19:58:11.963	*apfReceiveTask	Client session has timed out