Scan guns not connecting to SSID after 9800 WLC firmware update

[ITDeptBYKAdditivesWidnes]

Hello All

We upgraded our 9800 WLC firmware Friday 1st March from version 17.3.6 to 17.9.4.

We have a variation of Access Point Models across site as shown below:

AIR-AP1542D-E-K9
C9105AXI-E
C9124AXI

Since this upgrade to 17.9.4 we are having issues with our Scan guns connecting to our Scanners SSID via the AIR-AP1542D-E-K9 APs.

The Scan guns seem to be able to connect to the Access Point Models C9105AXI-E & C9124AXI upon testing, but are having issues with connecting to the AIR-AP1542D-E-K9 Access Point when moving from certain areas, the network seems to drop and when trying to connect they don’t seem to be connecting, these model of access points are heavily located in the area where the scan guns are used/located . 

iPhones and PCs seem to connect fine to the AIR-AP1542D-E-K9 APs.

The scan guns are Honeywell CK65 and use an Android OS.

Thet connected fine to the APs fine prior to the update.

I will aim to upload content from the debug logs of the AP & Controller in due course but has anyone experienced this and found a solution please?

Thanks

Dan

[balaji.bandi]

If you have large site problem - i would suggest to Open a TAC case investigate with them is wise option, before it go critical in the environment.

or roleback to old version - and test in the test environment with the issue you encountered.

[marce1000]

               >We upgraded our 9800 WLC firmware Friday 1st March from version 17.3.6 to 17.9.4.
  - Go a step further to 17.9.4a + latest APSP (too) ; this is important in cases like this (17.9.4a is current advisory)

   Whether previously working or not , have a checkup of the 9800 WLC configuration with the CLI command show tech wireless and feed the output to : Wireless Config Analyzer

  For testing if you know to which AP a particular gun will connect (and or in a test setup) ; issue this command first on the AP:
                          show  ap client-trace events mac aa:bb:cc:01:02:03 (the latter mac address must of course be changed accordingly ). Then during the connecting process (and later) follow up on the outputs shown or check the logs on the AP

   - Further engage in full client debugging according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity , these debugs can be analyzed with Wireless Debug Analyzer

  - Outputs from the commands mentioned in https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#toc-hId-866973845 can also be useful

 - Review this thread for other hints : https://community.cisco.com/t5/wireless/disconnections-handheld-android-10-with-cisco-9800/td-p/4607901

 M.

[Rasika Nayanajith]

Hi Dan,

Based on your description, it is clearly looks like a 1542AP and 17.9.4 code related issues. Best to work with TAC and find out any specific bugs causing it. Sometime may be worth 17.9.5 code and see (TAC can advice if that helps)

HTH
Rasika
*** Pls rate all useful responses ***

[Leo Laohoo]

For the sake of consistency, please upgrade to 17.9.5 and try again.  

[ITDeptBYKAdditivesWidnes]

As an update we have updated the WLC to 17.9.5 and this has not solved the issue.

We have narrowed down the issue to the use of the scan gun SSID with the AIR-AP1542D-E-K9 APs.  Other findings:

1.) Corporate PC, Corporate Mobile Phone, and Guest Wireless SSIDs seem to work via the AIR-AP1542D-E-K9.

2.) The Scan gun SSID connects fine to the C9105AXI-E and C9124AXI APs (as do the Corporate PC, Corporate Mobile Phone, and Guest Wireless SSIDs)

The issue seems to be specific to the connection, from the scan guns, to the scan gun SSID via the AIR-AP1542D-E-K9.

One of teh Team ran a Radioactive trace on that MAC and the logs provided teh following:

MAC: a1b2.c3d4.e5f6  Client delete initiated. Reason: CO_CLIENT_DELETE_REASON_CLIENT_EAP_TIMEOUT_FAILURE

(Note: MAC does not reflect true address)

We are continuing to review and may review the AP firmware.

[marce1000]

        >....MAC: a1b2.c3d4.e5f6  Client delete initiated. Reason: CO_CLIENT_DELETE_REASON_CLIENT_EAP_TIMEOUT_FAILURE
                        FYI : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh36960
       You may for instance try to disable PMF  as mentioned in the workaround (if applicable)

                 As stated earlier for a the specific AIR-AP1542D-E-K9.model ; you can have a detailed debugging using :
                              show  ap client-trace events mac <gun-mac-address>
                Let the device (try) to join and observe the outputs

 M.
         

[ITDeptBYKAdditivesWidnes]

Hello All

Update

We believe we have managed to solve this now as all scan guns are able to connect to the required wireless SSID via the AIR-AP1542D-E-K9 APs.

It seems that during the upgrade the Layer 2 Security for the Scanners SSID was set to WPA2 + WPA3.  We changed this is WPA + WPA2 and the scan guns connect to the AIR-AP1542D-E-K9 APs now (see screen shot of before change).

On checking the AIR-AP1542D-E-K9 data sheet the APs don't seem to support WPA3 whereas the others do.  The scan guns were connecting to other APs, which support WPA2 and WPA3, without an issue.  Our AIR-AP1542D-E-K9 APs are deployed in the warehouse areas where the scan guns are primarily used so very inconvenient.

From Data Sheets:

Cisco Aironet 1540 Series Outdoor Access Points Data Sheet

Wireless Access

• 802.11i, Wi-Fi Protected Access 2 (WPA2), and WPA

Cisco Catalyst 9105 Series Access Points Data Sheet

Security:

• 802.11i, Wi-Fi Protected Access 2 (WPA2), WPA3

We believe that the scan guns are seemingly unable to transition between APs that are capable of running WPA2 + WPA3 and those that can only run WPA + WPA2 and hence our issue.

Thanks to all those that contributed.

Dan