MS Surface Laptop Can't Connect to Cisco WLAN with WPA2-PSK

[InquiringTech]

Hi, I really need help here, since my boss decided he wanted a different computer than all the rest of ours, and got a brand new Surface Laptop Studio, which is having problems connecting to just our network specifically.

Some information:

• The Surface Laptop is on Windows 11 Pro, latest version

• The wireless card for the laptop is an Intel Wi-Fi 6 AX200 160MHz, and up to date

• We use a Cisco Embedded Wireless LAN Controller on Catalyst access points.

• The network authentication for our WLAN is set to WPA + WPA2, with AES(CCMP128) encryption and PSK-SHA256 for authentication key management.

• The APs are ax capable, and have 5GHz and 2.4GHz networks, with the vast majority of our devices using the 5

• All the rest of our computers as well as various phones/tablets can join the office WiFi networks with no problem.

• His Surface Laptop could connect to most other networks from what I can see, including a basic home router and my wireless iPhone hotspot

• It just has a problem with our office network. When attempting to connect, all we get is the generic and unhelpful "Can't connect to this network", with no other options or troubleshooting prompts

• If I try to go to Control Panel > Network and Sharing Center > Set Up a Connection or Network > Manually connect to a wireless network, and input the correct information, with the correct security type, it just stays stuck on connecting and shows "Attempting to authenticate", but can't go past that. So clearly it's some authentication issue. Changing the network type to b/g or ac or whatnot on the adapter makes no difference, as expected.

• As a test, I also tried temporarily setting our network to no/open authentication, and his Surface was able to successfully join the network

• And yes, I've uninstalled/reinstalled the driver, rebooted, updated, etc.

• Hardwired ethernet connection also works fine

I posted this in Microsoft forums and they say the problem is most likely on the Cisco end, although it is unusual that all of our other Dell laptops and other devices have no problem connecting. They say there are other problems with the AX200 and Cisco gear, and it may be similar to this issue: https://community.cisco.com/t5/wireless/unable-to-connect-ssid-with-wpa2-authentication/td-p/4577593

I'm seeing that some people said that Fast Transition on the wireless network is the culprit, but that has always been disabled on our controller, so I'm not sure what it is:

I can't seem to get good logs for this either, in my syslog or locally. If I specify the mac address of the problematic Surface's Wifi card, I don't get anything, because it never completes the authentication.

The only command that seemed to give me some relevant output was 'show wireless stats client delete reasons | ex 0' after trying to connect from the device a few times.

Any advice for this situation to at least get more info on it? Has anyone seen this issue before?

[Leo Laohoo]

What firmware is the controller on?

What firmware is the wireless NIC on?

[Scott Fella]

Create a test SSID and make sure you use PSK not PSK-SHA256 and that should fix it.  

[InquiringTech]

Interesting, that worked... I had to make the PSK Unencrypted. But the question is why do all our other devices have no problem with it being SHA256 and this one does? It also lowers our security a bit making the network like that.

[InquiringTech]

Is this because we're using a self-signed certificate locally on the controller and not a higher outside CA?

[Scott Fella]

No… certificates is not a part of PSK. The default for PSK is what I mentioned. The other option is for use with WPA3-PSK.  As you can see, device manufacturers build their standards differently, but PSK is what you should be using. 

[Arshad Safrulla]

Hi

Please login to CMD and capture the output for below commands from the affected PC.

• netsh wlan show drivers
• netsh wlan show capabilities

As I can recall that when you enable PSK+SHA256 it needs to have PMF enabled to work, may be if your end device supports this you try enabling it and check. If you are more security concerned, your option would be to move to WPA3. However please note that you might have lot of issues with your device side, as some client drivers are not yet written properly to handle WPA3. So moving to DOT1X with EAP-TLS would be the best option as of today, and you can move to WPA3 with the same after testing.

If you are worried more on compatibility then as @Scott Fella suggested move to PSK only as this will enable WPA2 with PSK (AES), as long as you use a password more than 16 characters (complex better, not mandatory) you should be safe. 

[InquiringTech]

Ugh, the password was right at 15. Now I gotta add a couple of characters, the users ain't gonna like that. But it is what it is. Thanks though. The netsh wlan show drivers indicated pretty standard stuff, the same results as my Dell laptop that isn't having a problem. Netsh wlan show capabilities didn't seem to work as a command.

Thanks for the info though, that is useful to know.

[Scott Fella]

There are good guides out there in regard to the netsh wlan command.

https://lazyadmin.nl/it/netsh-wlan-commands/

There is also a netsh command where you can create a batch file to configure a wireless profile with the psk.  That way you can put the file in a share or email them and all they have to do is double click on the file.  You build the profile on one device and then you export that.  I'm assuming that these devices are not managed via GPO or an mdm where you can push the profiles.

https://www.windowscentral.com/how-manage-wireless-networks-using-command-prompt-windows-10

[Rich R]

"I had to make the PSK Unencrypted!

That's a contradiction - PSK *is* encrypted.  Open SSID (no PSK) in unencrypted!

Also you never bothered to reply with WLC software version or the driver version.

Make sure WLC is up to date as per TAC recommended below and Intel driver version should be at least 22.200.0.6 https://www.intel.com/content/www/us/en/download/19351/windows-10-and-windows-11-wi-fi-drivers-for-intel-wireless-adapters.html

[InquiringTech]

Intel driver version is at 22.50.1.1 so that may need to be updated. WLC is at 17.6.4.56 so I think that's good.

And sorry I didn't mean, of course, that PSK is not encrypted, I meant that SHA 256 adds extra hashing to the pre-shared key I believe. In the menu there is the option to select AES or Unencrypted for PSK, and I had to select the latter when switching out of the PSK-SHA256 mode for some reason. and at first got an error saying unable to decrypt key. Anyway it's working okay for now. Might either increase password length or see if upgrading relevant drivers/versions will help.

[Scott Fella]

You always need to decrypt the psk every time you change it.  Keep in mind that the device can present the psk in the config and can pass that around.

[Rich R · Accepted solution]

Yep get that Intel driver updated - there were some dreadful bugs in the early versions of that driver (and it took them quite a few revisions to get it into a fit state to use) - that might solve your problem.