cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2410
Views
0
Helpful
11
Replies

Some laptops unable to join WPA2 SSID

Jagan1976
Level 1
Level 1

Hi guys,

I have a problem here with many laptops unable to join my guest Wifi network.

Strangely mobile phones all work ok.

Unable to pinpoint which model of laptops as they are random. I tried with Thinkpad and it works but not on Surface Pro.

How do I trace this issue?

I am using 3802i AP (China H domain).

I am using WPA2 with a 8540 WLC controller.

11 Replies 11

1. what is the frequency you are configured in SSID. is it 2.4GHz or 5GHz. or both?

 

2. Are those laptops able to see SSID? or cannot see SSID

 

3. Are you have enough DHCP addresses to lease

 

4. is this new issue or, is that was there from beginning?

Please rate this and mark as solution/answer, if this resolved your issue
Good luck
KB

Both frequency are broadcast. 

Laptops can see SSID.

Yes only used few from scope. There are thousands more DHCP avail. 

This is a new site setup. Brand new APs.

SSIDs are used elsewhere worldwide via same WLC, so only difference is flexgroup, apgroup, RF group and AP is Chinese model.

Which IP address have you used for the virtual-interface?
I hope not an internet routable like 1.1.1.1? You must use a private one there, like 192.168.245.10.

For virtual I am using 192.168.255.33

Sandeep Choudhary
VIP Alumni
VIP Alumni

please check if you are using WPA2+AES or WPA2+TKIP ?

 

or paste the output of the command here from WLC.

sh wlan <id>

 

Regards

Dont forget to rate helpful posts

 

 

Here is my sh wlan output for that SSID below.

Please note that this SSID is used in many countries without any issues. I noticed this problem only in a new office setup in China.

 

WLAN Identifier.................................. 12
Profile Name..................................... GuestWork WPA2
Network Name (SSID).............................. GuestWork
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Client Profiling Status
Radius Profiling ............................ Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Local Profiling ............................. Enabled
DHCP ....................................... Enabled
HTTP ....................................... Enabled
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Maximum number of Clients per AP Radio........... 200

ATF Policy....................................... 0
Number of Active Clients......................... 2675
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 28000 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... none
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ management
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
mDNS Status...................................... Disabled
mDNS Profile Name................................ unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Enabled
Static IP client tunneling....................... Disabled
Tunnel Profile................................... Unconfigured
PMIPv6 Mobility Type............................. none

PMIPv6 MAG Profile........................... Unconfigured
PMIPv6 Default Realm......................... Unconfigured
PMIPv6 NAI Type.............................. Hexadecimal
PMIPv6 MAG location.......................... AP
Quality of Service............................... Silver
Per-SSID Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-Client Rate Limits........................... Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled

Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... 802.1P (Tag=1)
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Drop
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 3
DTIM period for 802.11b radio.................... 3
Radius Servers
Authentication................................ Disabled
Accounting.................................... Disabled
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Radius NAI-Realm................................. Disabled
Mu-Mimo.......................................... Enabled
Security

802.11 Authentication:........................ Open System
FT Support.................................... Enabled
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Enabled
WPA (SSN IE)............................... Disabled

WPA2 (RSN IE).............................. Enabled
TKIP Cipher............................. Disabled
AES Cipher.............................. Enabled
OSEN IE.................................... Disabled
Auth Key Management
802.1x.................................. Disabled
PSK..................................... Enabled
CCKM.................................... Disabled
FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Enabled
PMF-1X(802.11w)......................... Disabled
PMF-PSK(802.11w)........................ Disabled
OSEN-1X................................. Disabled
FT Reassociation Timeout................... 20
FT Over-The-DS mode........................ Disabled
GTK Randomization.......................... Disabled
SKC Cache Support.......................... Disabled
CCKM TSF Tolerance......................... 1000
Wi-Fi Direct policy configured................ Disabled
EAP-Passthrough............................... Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web Authentication Timeout.................... 300

Web-Passthrough............................... Disabled
Mac-auth-server............................... 0.0.0.0
Web-portal-server............................. 0.0.0.0
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
Auto Anchor................................... Disabled
FlexConnect Local Switching................... Enabled
FlexConnect Central Association............... Disabled
flexconnect Central Dhcp Flag................. Disabled
flexconnect nat-pat Flag...................... Disabled
flexconnect Dns Override Flag................. Disabled
flexconnect PPPoE pass-through................ Disabled
flexconnect local-switching IP-source-guar.... Disabled
FlexConnect Vlan based Central Switching ..... Disabled
FlexConnect Local Authentication.............. Disabled
FlexConnect Learn IP Address.................. Enabled
Client MFP.................................... Optional
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60
Eap-params.................................... Disabled
AVC Visibilty.................................... Disabled

AVC Profile Name................................. None
Flex Avc Profile Name............................ None
Flow Monitor Name................................ None
Split Tunnel Configuration
Split Tunnel................................. Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
802.11v Directed Multicast Service............... Disabled
802.11v BSS Max Idle Service..................... Enabled
802.11v BSS Transition Service................... Enabled
802.11v BSS Transition Disassoc Imminent......... Disabled
802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40
DMS DB is empty
Band Select...................................... Enabled
Load Balancing................................... Disabled
Multicast Buffer................................. Disabled

Universal Ap Admin............................... Disabled

Mobility Anchor List
WLAN ID IP Address Status Priority
------- --------------- ------ --------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

Local Policy
----------------
Priority Policy Name
-------- ---------------

Lync State ...................................... Disabled
Audio QoS Policy................................. Silver
Video QoS Policy................................. Silver
App-Share QoS Policy............................. Silver
File Transfer QoS Policy......................... Silver

Can you install wireshark on a client and run a capture while you connect to the SSID?
I wonder if it just fails for DHCP, or something else.
A "show client detail macaddress" might also show more.

Ok will try to get that capture, but from what I noticed, the moment the password is keyed in, it immediately responds as "unable to join this network". It is almost immediate, does not seem to be even trying to get past the AAA state.

As per your ouput, you enabled FT-PSK.

 

FT-PSK(802.11r)......................... Enabled

 

Please disable it and use only PSK then give a try again.

 

Regards

Dont forget to arte helpful posts

 

 

 

 

I am unable to change that as this is standard config we use worldwide and there are no problems elsewhere.
Will try to capture debug on client mac address..

Really? Because 802.11r is known to cause a variety of issues, mostly with older Wi-Fi Adapter drivers.
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: