Medical Devices and iPSK

[craiglebutt]

Hi

Currently migrating devices from PSK & MAC to iPSK & MAC.

Loads of medical scanners migrating no problem, but have some GE Logiq S8 that don't want to work with the iPSK.

Work fine with PSK and MAC.

Only thing can think of as lots of medical devices still running Windows 7 and drivers having trouble with iPSK with Radius possibly need upgrading,

Just wondering if anyone else has a work around?

Anyone 

[Scott Fella]

I have played around and still have iPSK in my test environment, and it was not as easy to get it working.  Now, I don't think you have an issue with your radius server, because you have all other devices working, so I will assume that the version you are using is supported. 

What controller, version, radius server and version are you running?  You might be able to just create a catch-all policy with the default psk and override the vlan id.

[craiglebutt]

WLC 5520 in HA, running 8.5.182 and ISE 2.7

[Haydn Andrews]

what happens if have these devices hit the default PSK for the iPSK SSID? Do they work.

I suspect its more to do with a timeout thing as with iPSK the auth now needs to wait for the RADIUS server to return to the WLC the correct PSK for that device.

Do a debug on the client whilst it tries to authenticate and post the result.

Ideally if you can get an OTA packet capture it would also help identify if any packets being sent that causing the issues.

As always try getting one of them upgraded to latest wireless drivers

[craiglebutt]

I did change the timeout to 8 seconds as was at the default of 2.  Checked he WLC to see if any other devices are connected to the same Radiology Policy and there was, also added a iphone to test the policy, this all worked.

When the scanner is going via ipsk it keeps getting excluded on the WC, no log attempts on the ISE.

I've attached client debug, not tried the OTA as not something ever had to do before, so I'll look at that.

Unfortunately as it is a medical device, we are limited to what we can do, it's lucky we have access to Network Config, so like normal, we need to prove 100% it's not a config issue on the wireless and it points to a driver issue specialty when it it running on a hacked version of what looks to be windows 7.

Cheers

[marce1000]

 - Below you find when your debugging file is parsed by : https://cway.cisco.com/wireless-debug-analyzer/    , you may want to run yourself and or toggle with available flags.

imeTaskTranslated

Feb 24 13:29:56.745	*apfMsConnTask_5	Client made new Association to AP/BSSID BSSID 6c:8b:d3:a1:a8:b9 AP
Feb 24 13:29:56.746	*apfMsConnTask_5	The WLC/AP has found from client association request Information Element that claims PMKID Caching support
Feb 24 13:29:56.746	*apfMsConnTask_5	The Reassociation Request from the client comes with 0 PMKID
Feb 24 13:29:56.746	*apfMsConnTask_5	Client expiration timer code set for 10 seconds. The reason: No response from radius server for mac filtering request
Feb 24 13:29:56.746	*apfReceiveTask	WLC/AP is sending an Association Response to the client with status code 1 = Unspecified failure. For example, when there is no ssid specified in the association request
Feb 24 13:29:56.746	*apfReceiveTask	Client expiration timer code set for 10 seconds. The reason: Delete request due to authentication error

[Rich R]

2 possibilities I can think of in addition to other suggestions above:

1. Are your APs in flexconnect mode - if not try enabling flex?  That changes the AP behaviour which can fix some of these types of problems if they're timer related (as I've mentioned on previous posts recommended by TAC and worked for us).

2. Is the new PSK something the devices can't handle - eg. too long or special characters they don't handle correctly?  Try a simpler PSK?