Problem with flexconnect clients disconnecting

[Henrik Josefsson]

Hello,

We have a situation where our flexconnect clients (mostly ipads and chromebooks) gets disconnected shortly from the network every hour after connecting to our Wi-Fi.

When I'm checking our DNA-C I can clearly see we have problems. We have 4 different models out there 2702i, 3702i, 2802i and 9120i.

I haven't seen the problems yet on our 2702 or 3702 yet.
We are in a lifecycle where we switching our 2/3702i to 9120i so we are getting more and more of these problems out there.

When checking event viewer in DNA-C, clients are failing on Broadcast Rekey but successfully gets a new key after 3 minutes of failing. (Showing in the pictures I attached here).

When I check the messege logs from GUI in our WLC it says the following:

*dot1xMsgTask: Jun 13 09:01:59.838: %DOT1X-3-WPA_SEND_STATE_ERR: [PA]1x_kxsm.c:1742 Unable to send EAPOL-key msg - invalid WPA state (5) - client 00:00:00:00:00:00

and when I debug a client from CLI, I get this:

*Dot1x_NW_MsgTask_2: Jun 12 11:42:58.858: [PA] 1x: EAPOL frame with dst MAC 11:11:11:11:11:11 and BSSID 22:22:22:22:22:22 discarded

Where MAC 11:11 and 22:22 are 2 different AP:s.

Our WLC 8540 are running the newest software version: 8.10.185.0

The iPads and chromebooks are different models aswell.

The SSID that they are connecting to is a flexconnect with a PSK key. We do have 802.1x activated inside our network but not on SW trunkport towards the accesspoints.

Any idéa what it can be?

Thanks in advanced
Best Regards

Henrik Josefsson

[marce1000]

                                    >...and when I debug a client from CLI, I get this:...
 Perform full client debugging according to https://www.cisco.com/c/en/us/support/docs/wireless/aironet-1200-series/100260-wlc-debug-client.html  , you can have client debugs analyzed with :
                                          https://cway.cisco.com/wireless-debug-analyzer

 M.

[JPavonM]

I have also suffered this but this time with Windows laptops and Mediatek chipset on certain versions.

The issue seems to be that the driver cannot manage GTK rekeying so the association is dropped, and after a period of time set on the driver (in windows you can tweak this) that seems to be 18 seconds on iPads, the device reconnects.

In C9800 I solved this increasing the timer for group-key renewal to 15 hours with this command:

wireless security dot1x group-key interval 54000

In AireOS try this command:

config advanced eap bcast-key-interval 54000

[Rich R]

Also discussed by @JPavonM on this thread https://community.cisco.com/t5/wireless/dna-center-wireless-clients-show-broadcast-rekey-failed-messages/td-p/4699102
In that case Philip said "The thing is I upgraded one of these devices with a new firmware, and I don't see them anymore on that device." confirming that it's a device issue.  So make sure the device OS and drivers are totally up to date and if still seeing the problem then you'll have to use the workaround to extend the timer.

[Henrik Josefsson]

Okej, I will check and see if there are any new updates for the devices.

Otherwise I try to extend the timer and see if that works.

Thanks