No Internet, Secured

[JDemmi]

First....I am NOT a network technician, so - some of the information you all may want may not be included below. So, if you need some more details I can ask my network team. I am posting on this community because I am the primary person who has been testing the various "fixes" for this problem.

On to the details....

We are experiencing issues with Wi-Fi connections on Windows 10. Please read the issue behavior, configuration, and things we have tried before responding.

Note - we believe that there is an issue with the authentication process, on the client side. I am curious what triggers the device to attempt a re-auth.

Configuration: Options not specified here are not selected

• Corporate Network, CISCO Access Points (ISE enabled) - models, 1552h and 3702
• Windows 10 1909
• Devices in question are not part of a domain (AD)
• Broadcom 802.11agbn Wireless SDIO adapter and Intel Dual Band Wireless-AC 8265 (2 different hardware devices)
• SSID is non-broadcasting; settings:
  • Connect automatically when network is in range - checked
  • Connect even if the network is not broadcasting its name - checked
  • Security = WPA2-Enterprise
  • Encryption - AES
  • Authentication mode - Microsoft: Smart Card or other certificate
    • Use a certificate on this computer - selected
    • Use simple certificate selection - checked
  • Authentication Mode: USER AUTHENTICATION
• Wi-Fi Properties
  • Client for Microsoft Networks
  • File and Print Sharing for Microsoft Networks
  • QoS Packet Scheduler
  • Reliable Multicast Protocol
  • IP v4
  • Microsoft LLDP Protocol Driver
  • Link-Layer Topology Discovery Responder
  • Link-Layer Topology Discovery Mapper I/O Driver

Behavior:

The device will connect to the wireless upon boot.  When device is left idle (whether it goes to sleep or not) for some time, the device will "disconnect" from the network. When we remove the device from an idle state the connection status is "No Internet, Secured".  In this state we have an IP address, gateway and DNS value but cannot access the network (internet).  It is as if the device did not attempt to re-authenticate to the access point. Logging in and out of the device has no effect. Obviously, if we "disconnect" (via Wi-Fi menu) and reconnect, the status will change to "Connected, secured". When we check the access point logs the device appears in a connected and authenticated status (which is clearly, not the case). So, to be clear - we can manually rectify the problem, which treats the symptom. What we are looking for is a solution that prevents the problem (a true fix).

Attempted:

• Updating NIC drivers - no effect
• Removed NIC from device manager and reinstalled - no effect
• Making IPv4 priority over IPv6 - no effect
• Disabled IPv6 - looked promising, but problem still experienced
• Disabled power settings on NIC - no effect
• Turned off all sleep settings - no effect
• Tested device on an home wi-fi network - behavior not experienced
• Walked with device in the "No Internet, Secured" status until I reached a point where it would grab another AP (with the same SSID) - status automatically changes to "Connected, Secured" (no intervention)
• Pretty much every solution offered in the first 2 pages of a Google search

[mykhuzaimi]

Same problem, windows 10 user 5ghz can'get ip but 2.4ghz user in same AP can use normal.

If windows, get No internet, secured.

If mac, get No internet connection.

When moving that user device to another AP location in same group, the wifi can connected secured.

Other solution, restart AP or capwap restart on that AP.

Solution: rest

[Grendizer]

Two questions:

1- What’s the WLC image/code?

2- Can you please list the SSID settings that have been configured.

[JDemmi]

1. Our current image is 8.0.152.0.  But, it was not when I originally posted this. So, I am not certain this is the issue.

2. We don't make any special connection settings. I am asking for details from a user with the device because I do not have one available for me to review. I can tell you we:

• Set the device's local group policy - enabling turn off Windows Network Connectivity status indicator active tests
• Install a user certificate locally (.pfx) 
• Setup a manual Wi-Fi connection
• WPA2 Enterprise security
• Security key = BLANK
• Start Connection automatically = CHECKED
• Connect even if not broadcasting = CHECKED
• Network authentication mode = Microsoft: Smart Card or other certificate 
• Verify the server’s identity by validating the certificate = UNCHECKED
• Specify authentication mode = USER AUTHENTICATION

[Grendizer]

This is really an old code and many many many vulnerabilities have been discovered thru the years that are not fixed with this code because it reached end of life and end of support, I really don't think it's a client issue rather it's a code issue/bugs, first thing to do is to upgrade the code after checking the Compatibility Matrix https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

[mykhuzaimi]

WLC 8540 (8.10.130.0)

WLAN Identifier.................................. 1
Profile Name..................................... USMSecure
Network Name (SSID).............................. USMSecure
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Enabled
Network Admission Control
Client Profiling Status
Radius Profiling ............................ Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Local Profiling ............................. Enabled
DHCP ....................................... Enabled (Auto)
HTTP ....................................... Enabled (Auto)
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum Clients Allowed.......................... Unlimited
Security Group Tag............................... Unknown(0)
Maximum number of Clients per AP Radio........... 200
ATF Policy....................................... 0
Number of Active Clients......................... 5745
Exclusionlist Timeout............................ 10 seconds
Session Timeout.................................. 86400 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
Sleep Client Auto Auth Feature................... Enabled
Web Auth Captive Bypass Mode..................... None
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... none
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ default-ssid
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
WLAN URL ACL..................................... unconfigured
mDNS Status...................................... Disabled
mDNS Profile Name................................ default-mdns-profile
DHCP Server...................................... Default
Central NAT Peer-Peer Blocking................... Unknown
DHCP Address Assignment Required................. Enabled
Static IP client tunneling....................... Disabled
Tunnel Profile................................... Unconfigured
EoGRE Override VLAN state........................ disable
EoGRE Override VLAN ID........................... 0
PMIPv6 Mobility Type............................. none
PMIPv6 MAG Profile........................... Unconfigured
PMIPv6 Default Realm......................... Unconfigured
PMIPv6 NAI Type.............................. Hexadecimal
PMIPv6 MAG location.......................... WLC
Quality of Service............................... Silver
Per-SSID Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-Client Rate Limits........................... Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Disabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... 802.1P (Tag=0)
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
Authentication................................ 10.202.12.191 1812 *
Authentication................................ 10.202.12.192 1812 *
Accounting.................................... Global Servers
Interim Update............................. Enabled
Interim Update Interval.................... 0
Framed IPv6 Acct AVP ...................... Prefix
Authorization ACA............................. Disabled
Accounting ACA................................ Disabled
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Radius NAI-Realm................................. Disabled
Radius Authentication caching.................... Disabled
Mu-Mimo.......................................... Enabled
Security

802.11 Authentication:........................ Open System
FT Support.................................... Disabled
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2/WPA3)........ Enabled
WPA (SSN IE)............................... Disabled
WPA2 (RSN IE).............................. Enabled
WPA3 (RSN IE).............................. Disabled
WPA2/WPA3 Encryption Ciphers
TKIP Cipher............................. Disabled
CCMP128/AES Cipher...................... Enabled
CCMP256 Cipher.......................... Disabled
GCMP128 Cipher.......................... Disabled
GCMP256 Cipher.......................... Disabled
OSEN IE.................................... Disabled
Auth Key Management
802.1x.................................. Enabled
802.1x-SHA2............................. Disabled
PSK..................................... Disabled
PSK-SHA2................................ Disabled
CCKM.................................... Disabled
FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Disabled
OSEN-1X................................. Disabled
SUITEB-1X............................... Disabled
SUITEB192-1X............................ Disabled
OWE..................................... Disabled
SAE..................................... Disabled
OWE Transition Mode........................ Disabled
OWE Transition Mode WLAN id................ 0
Auto Key PSK .............................. Disabled
FT Reassociation Timeout................... 20
FT Over-The-DS mode........................ Disabled
GTK Randomization.......................... Disabled
SKC Cache Support.......................... Disabled
CCKM TSF Tolerance......................... 1000
Wi-Fi Direct policy configured................ Disabled
EAP-Passthrough............................... Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web Authentication Timeout.................... 300
Web-Passthrough............................... Disabled
Mac-auth-server............................... 0.0.0.0
Web-portal-server............................. 0.0.0.0
qrscan-des-key................................
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
Auto Anchor................................... Disabled
FlexConnect Local Switching................... Disabled
FlexConnect Central Association............... Disabled
flexconnect Central Dhcp Flag................. Disabled
flexconnect nat-pat Flag...................... Disabled
flexconnect Dns Override Flag................. Disabled
flexconnect PPPoE pass-through................ Disabled
flexconnect local-switching IP-source-guar.... Disabled
FlexConnect Vlan based Central Switching ..... Disabled
FlexConnect Local Authentication.............. Disabled
FlexConnect Learn IP Address.................. Enabled
Flexconnect Post-Auth IPv4 ACL................ Unconfigured
Flexconnect Post-Auth IPv6 ACL................ Unconfigured
Client MFP.................................... Optional
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60
Eap-params.................................... Disabled
AVC Visibilty.................................... Enabled
AVC Profile Name................................. None
OpenDns Profile Name............................. None
OpenDns Wlan Mode................................ ignore
OpenDns Wlan Dhcp Option 6....................... enable
Flow Monitor Name................................ sentinel
Split Tunnel Configuration
Split Tunnel................................. Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
802.11v Directed Multicast Service............... Disabled
802.11v BSS Max Idle Service..................... Enabled
802.11v BSS Transition Service................... Disabled
802.11v BSS Transition Disassoc Imminent......... Disabled
802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40
802.11v BSS Transition Neigh List Dual Band...... Disabled
DMS DB is empty
Band Select...................................... Disabled
Load Balancing................................... Disabled
Multicast Buffer................................. Disabled
Universal Ap Admin............................... Enabled
Broadcast Tagging................................ Disabled
PRP.............................................. Disabled
Fast Receive..................................... Disabled
11ax Downlink MU-MIMO............................ Enabled
11ax Uplink MU-MIMO.............................. Enabled
11ax Downlink OFDMA.............................. Enabled
11ax Uplink OFDMA................................ Enabled
Wifi Alliance Multiband Operation................ Disabled
11ax Target Wake Time............................ Enabled

Mobility Anchor List
WLAN ID IP Address Status Priority
------- --------------- ------ --------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

Local Policy
----------------
Priority Policy Name
-------- ---------------

Lync State ...................................... Disabled
Audio QoS Policy................................. Silver
Video QoS Policy................................. Silver
App-Share QoS Policy............................. Silver
File Transfer QoS Policy......................... Silver
Lync State ...................................... Disabled
Audio QoS Policy................................. Silver
Video QoS Policy................................. Silver
App-Share QoS Policy............................. Silver
File Transfer QoS Policy......................... Silver
File Transfer QoS Policy......................... Silver
QoS Fastlane Status.............................. Disable
Selective Reanchoring Status..................... Disable
Lobby Admin Access............................... Disabled

Fabric Status
--------------

Fabric status.................................... Disable
Vnid Name........................................
Vnid............................................. 0
Applied SGT Tag.................................. 0
Peer Ip Address.................................. 0.0.0.0
Flex Acl Name....................................
Flex IPv6 Acl Name...............................
Flex Avc Policy Name.............................

U3-Interface................................... Disable

U3-Reporting Interval.......................... 30

[Scott Fella]

A few things that I see. You should have idle timeout set to default of 300. Also you should have the user provide you with the wlan report and analyze that output in which the user will need to send you.

https://support.microsoft.com/en-us/windows/analyze-the-wireless-network-report-76da0daa-1db2-6049-d154-7bb679eb03ed

You also have two ISE nodes, you do not have any other nodes that are doing radius besides the two defined? What does the log in ISE show for the client? Any failed?
I ran into issue with the Broadcom where the device didn’t like if the channel width was set to anything other than 20mhz. Maybe look at that. What users and I saw was the device was connected but you couldn’t ping the gateway or reach any resources after some time. Some time was 5 minutes or longer.
If other devices are working, this does point to the client device(s), am also assuming it’s all devices with that same NIC, driver and wireless profile.

[mykhuzaimi]

Client user idle timeout(15-100000) or Enable Session Timeout ?

maybe for wlan report i must see client face to face to get or after user laptop success connected. because they can't send the report when have real time problem (No internet, secured).

yes we have 2 radius (NPS Proxy 2, NPS Auth 2). no error on NPS events

you can refer from debug client attachment at rows 2336 (Received DHCP ACK, assigning IP Address 10.213.67.120) success when i ask user to change adapter wireless Preferred Band value 2.4ghz. before that time user can't get dhcp ack for 5ghz

i also read from some article internet when they lower band channel. now i use 20mhz for 5ghz.

[Scott Fella]

Idle timeout needs to be less than the session timeout.  It's best to keep the idle timeout default, from your output, it shows disabled.  The wlan report is a must to see what the device tcp/ip stack is showing.  So are you using 20mhz when these issues are happening on 5GHz or did you just change this?  If other devices are working, then you might have to look at providing them with a USB adapter and see if the issue still happens.  We also had a set of older laptops that would no longer connect or have stability issues.  Ended up being an issue with the NIC on many identical devices.  We ended up providing them with USB options that we tested that worked.

[mykhuzaimi]

- 5ghz 20mhz still problem. for wlan checked for DHCP Addr. Assignment

- new temp solution(restart radio 5ghz) because student urgent to take online exam. then all 5ghz client on that cube AP successful.

- some student try to use usb wireless ac. no problem. maybe it join for 2.4 or 5ghz

Windows 10 (No Internet, secured)

5ghz problem for AP2802i

Network Adapter Problem:

TP-LINK Wireless USB Adapter

Qualcomm Atheros QCA61x4A Wireless Network Adapter

Qualcomm QCA61x4A 802.11ac Wireless Adapter

Realtek 8821AE Wireless LAN 802.11ac PCI-E NIC

Realtek 8821CE Wireless LAN 802.11ac PCI-E NIC

Realtek 8822CE Wireless LAN 802.11ac PCI-E NIC

Realtek RTL8821CE 802.11ac PCIe Adapter

Intel(R) Wireless-AC 9461

Intel(R) Wireless-AC 9560 160MHz

Intel(R) Wi-Fi 6 AX200 160MHz

Intel(R) Wi-Fi 6 AX201 160MHz

Intel(R) Dual Band Wireless-AC 8265

Intel(R) Dual Band Wireless-AC 3168

[Grendizer]

You have DHCP Proxy enabled from CONTROLLER > Advanced > DHCP > Enable DHCP Proxy
What you need to do to test this is to create another interface with (DHCP Proxy Mode = Disabled) and assign it to the WLAN but with that you will need to have a proxy from the switch side to direct the clients DHCP packets to the DHCP (like configuring ip helper address or similar command if you have different Switch manufacture)

[Grendizer]

All your settings are good and normal, one thing you can try is to upgrade to 8.10 MR5 (8.10.151.0) or wait for 8.10 MR6 which will be released soon.