Stuck with Repeater on AIR-CAP2702i

tomnick · ‎11-06-2022

Hi everybody, I am trying to use one AIR-CAP2702i as an AP and another one as a repeater. The AP works like a charme but trying to login into the repeater with e.g. a smartphone ends with :

Interface Dot11Radio1, Station fe40.54b0.b45c Associated KEY_MGMT[WPAv2 PSK]
Interface Dot11Radio1, Deauthenticating Station fe40.54b0.b45c Reason: Previous authentication no longer valid 
Packet to client fe40.54b0.b45c reached max retries, removing the client

and getting no IP. I already changed "Max. Data retries" to 128 but no affect at all. Any ideas what might could be wrong? Thanks for some help.

Product/Model Number:	AIR-CAP2702I-E-K9
Top Assembly Serial Number:	FCW1917NCEK
System Software Filename:	ap3g2-k9w7-xx.153-3.JI5
System Software Version:	15.3(3)JI5
Bootloader Version:	BOOTLDR: C2700 Boot Loader (AP3G2-BOOT-M) LoaderVersion 15.2(4)JB5m, RELEASE SOFTWARE (fc2)

Rich R · ‎11-07-2022

Does the smartphone connect ok to the same SSID on the other AP?
Is the SSID configured identically on both APs?
We'd probably need to see the full config (show run) for both APs to have a better chance of identifying any issues in the config as it's not possible to guess from a few screenshots.

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

tomnick · ‎11-07-2022

Config of AP:

!
! Last configuration change at 01:01:55 +0100 Wed Mar 3 1993
version 15.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname AIR-CAP2702i-E-K9
!
!
logging rate-limit console 9
enable password 7 0005170B0D55
!
no aaa new-model
clock timezone +0100 1 0
no ip source-route
no ip cef
!
!
!
!
dot11 pause-time 100
dot11 syslog
dot11 vlan-name Home vlan 1
dot11 vlan-name IOT vlan 45
!
dot11 ssid Home
   vlan 1
   authentication open 
   authentication key-management wpa version 2
   guest-mode
   infrastructure-ssid
   wpa-psk ascii 7 0211015206071D20424B1B4B545A425E41567A7B7D6D
!
dot11 ssid IoT
   vlan 45
   authentication open 
   authentication key-management wpa version 2
   guest-mode
   wpa-psk ascii 7 020F0B4F111308204249
!
!
!
no ipv6 cef
!
!
username admin privilege 15 password 7 15010E00102F3975786370
!
!
bridge irb
!
!
!
interface Dot11Radio0
 no ip address
 !
 encryption mode ciphers aes-ccm tkip 
 !
 encryption vlan 45 mode ciphers aes-ccm 
 !
 ssid IoT
 !
 antenna gain 0
 stbc
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.45
 encapsulation dot1Q 45
 bridge-group 45
 bridge-group 45 subscriber-loop-control
 bridge-group 45 spanning-disabled
 bridge-group 45 block-unknown-source
 no bridge-group 45 source-learning
 no bridge-group 45 unicast-flooding
!
interface Dot11Radio0.451
!
interface Dot11Radio1
 no ip address
 !
 encryption mode ciphers aes-ccm tkip 
 !
 encryption vlan 1 mode ciphers aes-ccm 
 !
 ssid Home
 !
 antenna gain 0
 peakdetect
 no dfs band block
 stbc
 speed  basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23. a1ss9 a2ss8 a3ss9
 packet retries 128
 channel dfs
 station-role root
!
interface Dot11Radio1.1
 encapsulation dot1Q 1 native
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.11
!
interface GigabitEthernet0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0.1
 encapsulation dot1Q 1 native
 bridge-group 1
 bridge-group 1 spanning-disabled
 no bridge-group 1 source-learning
!
interface GigabitEthernet0.11
!
interface GigabitEthernet0.45
 encapsulation dot1Q 45
 bridge-group 45
 bridge-group 45 spanning-disabled
 no bridge-group 45 source-learning
!
interface GigabitEthernet0.451
!
interface GigabitEthernet1
 no ip address
 shutdown
 duplex auto
 speed auto
 bridge-group 1
 bridge-group 1 spanning-disabled
 no bridge-group 1 source-learning
!
interface BVI1
 mac-address 5897.bdf3.6328
 ip address 192.168.1.176 255.255.255.0
 ipv6 address dhcp
 ipv6 address autoconfig
 ipv6 enable
!
ip default-gateway 192.168.1.1
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
!
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 login local
 transport input all
!
end

Config of Repeater:

!
! Last configuration change at 00:27:31 UTC Mon Mar 1 1993
version 15.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ap1
!
!
logging rate-limit console 9
enable secret 5 $1$kqL7$C0iGzeoBGlUBFJ8K7MWl/0
!
no aaa new-model
no ip source-route
no ip cef
!
!
!
!
dot11 pause-time 100
dot11 syslog
!
dot11 ssid Home
   vlan 1
   authentication open 
   authentication key-management wpa version 2
   guest-mode
   infrastructure-ssid
   wpa-psk ascii 7 0718244543080B041917195E55677B71656165724A42
!
!
!
no ipv6 cef
!
!
username Cisco password 7 106D000A0618
!
!
bridge irb
!
!
!
interface Dot11Radio0
 no ip address
 shutdown
 !
 encryption mode ciphers aes-ccm 
 antenna gain 0
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio1
 no ip address
 !
 encryption mode ciphers aes-ccm 
 !
 encryption vlan 1 mode ciphers aes-ccm 
 !
 ssid Home
 !
 antenna gain 0
 peakdetect
 stbc
 speed  basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15. m16. m17. m18. m19. m20. m21. m22. m23. a1ss9 a2ss8 a3ss9
 packet retries 128
 station-role repeater
!
interface Dot11Radio1.1
 encapsulation dot1Q 1 native
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface GigabitEthernet0
 no ip address
 duplex auto
 speed auto
!
interface GigabitEthernet0.1
 encapsulation dot1Q 1 native
 bridge-group 1
 bridge-group 1 spanning-disabled
 no bridge-group 1 source-learning
!
interface GigabitEthernet1
 no ip address
 shutdown
 duplex auto
 speed auto
 bridge-group 1
 bridge-group 1 spanning-disabled
 no bridge-group 1 source-learning
!
interface BVI1
 mac-address a46c.2a88.e3e0
 ip address 192.168.1.85 255.255.255.0
 ipv6 address dhcp
 ipv6 address autoconfig
 ipv6 enable
!
ip default-gateway 192.168.1.1
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
!
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 login local
 transport input all
!
end