New iPad Pro 6 + CCMK issues

[tobies]

We run thousands of different iPads, iPhones and Macs in our company over an 802.1X + CCKM SSID.

Now, we bought the first iPad Pro 6th generation and it fails to join the wireless network. If we disable CCKM it works just fine and also the combination of CCMK + FT is working. But we'd like to keep CCMK on and cannot enforce FT due to incompatible clients.

Did anyone here experience the same and perhaps found a solution?

[marce1000]

 - You are not telling much about the Wireless network-components such as  controller-model(s), ap-model(s) , software versions. You can ,for instance, do client debugging on controller and have these debugs analyzed with : https://cway.cisco.com/wireless-debug-analyzer/

 M.

[Leo Laohoo]

What type of APs?
What is the complete firmware of the WLC? 
What error messages appear when the iPad attempts to join the WiFi? 
Can the iPads join an SSID if it has an OPEN authentication?

[tobies]

Hi all!

iPad type is MP203FD/A running v16.1.
WLC is a 5520 with 8.10.171.0. APs are mostly 1702I.

OPEN auth and WPA2 PSK works flawlessly.

Debug schows us "Received invalid EAPOL-Key MIC" and later deauth reason 2 "Previous authentication no longer valid".
The iPad throws no message at all, just hanging in a loop trying to connect.

[Leo Laohoo]

Apple iOS 16.1.1 was released today and this release fixes a known WiFi issue observed in 16.1.

iOS 16.1 Causing Random Wi-Fi Disconnects for Some iPhone Users

[tobies]

We just tried that without success. The issue remains.

[Leo Laohoo]

Is this iPad have any special apps or something?  

[tobies]

Nope, nothing. We set it to factory default multiple times.

[JPavonM]

I did disabled CCKM from the begining as I noticed some issues with Android devices (CSCvr98394) and CCKM feature which were solved on IOS-XE 17.1.

Since then I rely on OKC for roaming and it's not going bad at all.

NOTE: I'm also not using FT as some devices on the network do not support it, not even at Optional level.

[JPavonM]

Have you tried to update them to iPadOS 16.1.1 just released?
there are multiple wirless connectivity issues been reported to Apple with version 16 and they could have fixed some here, but it's unclear if it is or not, and maybe all in the next release.

So this seems to be an Apple issue and not Cisco.

[tobies]

Yes, we tried 16.1.1 without success. The issue remains.

[Leo Laohoo]

---

@tobies wrote:
OPEN auth and WPA2 PSK works flawlessly.

---

This is suspicious.  
If Open auth and PSK works, then something in the authentication server is causing it.  
Too lazy to read, is FT disabled?  

[JPavonM]

This seems to be definitely an Apple issue on code 16.x so you need to ask Apple official support about it, as you told there are other Apple devices working perfectly on the same network.

Do not look for a Cisco issue only, and talk to the device vendor directly, plus its communities.

[tobies]

FYI: This issue seems to be related to CSCvp86276 (WLC M2 invalid MIC Mobile Client join failure with FT enabled/adaptive).

It only occurs with iPad OS 16.1. We are reaching out to Apple ATM.