I've been seeing that error on my setup for Flex APs and clients using dot1X (this time they were Win10) and users were complaining about disconnections. After doing multiple debugs in all sides (WLC, AP, OTA, Win10) I saw that every time they reported the issue with the "Connecting" status they were connected, but they weren't finishing the roaming process between APs. What I mean is that they were sucessfully connected to AP1, and then moving to AP2 they were re-authenticationg with that AP, but then win10 triggers DHCP client to re-validate IP address, and that was failing, and after 3 minutes when Win10 re-authenticates, it worked.
What I have found in my setup with AP in flexconnect mode is that the '***RSN Error' wasn't associated to any of the previous bugs as there weren't any radio crash following the error. Along with that error I was receiving another alerting about 'CAPWAP HW tunnel params changing'.
At the end I have found that adapting the MTU on the site's router to a lower value (that been tested to be working without fragmentation) solved the issue. (I have Meraki MX's in some remote offices and the valid MTU on that end was 1360). Now none of the errors are seen in AP's logs and users are not experiencing any issue.
PD: I have a TAC case open about this, as CAPWAP MTU was constantly changing so reconfiguring CAPWAP tunnel and maybe missing all tunneled traffic such as dot1X frames and that was affecting users during initial connection or roaming.
HTH
-Jesus
*** Please rate helpful responses ***
