Some users cant see open SSID with OWE transition

[Boort]

Hi there,

I encountered a strange problem today with OWE in transition mode.
Suddenly a handfull of users could not see the OPEN SSID at all. But when they moved to another section of the office they got the OPEN SSID and were able to connect. After that they could move freely in the office space without issues.
Through out the day the SSID could be seen at various spots in the office space.

Some Windows users reported that they had two hidden SSIDs, and if they typed in the SSID name they could connect.

The other users report that it works flawlessly. They can see and connect everywhere so i know that the setup is in working order. Even wierder is that last week we had 300+ clients on the same setup that could connect. Many of these clients were the ones who had issues today with the OPEN ssid.

This is the setup:
Corp-guest = WPA2 OPEN
Corp-guest-transition = WPA3 OWE linked to Corp-guest

After connecting there is a web redirect to Cisco ISE and a hotspot splash page.

WLC 9800-C-F running 17.9.4a
Access points = Mixed bag of 9120 and 9166. Mostly 9166. in total its about 150 APs.

This is in a SDA deployment with fabric enabled wireless. WLC is managed by DNAC running 2.3.5

2,4 Ghz is turned off on RF-TAG level. That leaves 5Ghz on WPA2 OPEN and 5 + 6 Ghz on WPA3 OWE.

Has anyone encountered this issue before?

[marce1000]

   Start with a checkup the controller configuration using the  CLI command show tech wireless and feed the output from  that into : Wireless Config Analyzer

 M.

[Boort]

Went through the output and i see nothing that would cause this issue. I checked the AP as well and it has all the configurations from the controller.

[Haydn Andrews]

Are the wireless drivers updated? 

[Boort]

Since its a guest network i dont have control over all devices. But i got one user to run "netsh wlan show wirelesscapabilities" on their laptop and it states that OWE transition is supported. On that note i will check if i can get one user to run the driver utility update tool.

"OWE Authentication                          : Supported"

[Boort · Accepted solution]

Update:
After a quick TAC session it turns out that this is a known issue on 17.9.4a.
It is supposedly fixed in 17.9.5 and 17.12.X but i have yet to verify that.

The issue also has a work around. When/if this starts occuring, just log on to the WLC and disable OWE transition on the OPEN SSID. On the OWE transition ID flip the broadcast radio to ON. Verify that you see both OPEN and OWE transition SSID.
After that log back in to the WLC and revert the changes you made so that OWE is enabled again and the OWE transition SSID is not broadcasted anymore. After that clients should be able see the SSID and connect.

As for exactly why it occurs we are not sure. But it looked like the OWE transition field in the BEACON frame was missing before we did the change. After the change it was broadcasted again.

[JPavonM]

@Boort has TAC provided you the bug id?

[Boort]

Yes, but it is not published yet.

CSCwf95559

[Rich R]

Suggest you chase TAC for why it is still not published @Boort .
Sometimes they will quote PSIRT related (seems unlikely in this case) and we've also had them quote "hardware vendor proprietary" (eg when bug is in 3rd party chipset they use).  More often it's just because the bug has not been reviewed by everyone it should be before publishing and they just need a kick to get them moving.

[Boort]

Hi, just wanted to give you a heads up. The bug ID is now customer visible.