Surface Pro 3 is not able to connect to standalone aironet

[Ignat Sitnikov]

Hello,

we are having issues with several Surface Pro 3 device connecting to a standalone Aironet. Other Device connect to this AP no problem. SP3 connect to other APs (not cisco) no problem. So there seems to be an issue between the two devices. When I look in the logs of the AP I get the following message:

Jan 15 19:59:52.513: %DOT11-7-AUTH_FAILED: Station 501a.c5e5.aeff Authentication failed

I tried to run aaa debug but nothing shows up but that message above. We use WPA2 AES/TKIP.

I proceeded to run debug all on the AP and this is what I got. Keep in mind that we are troubleshooting 501a.c5e5.aeff 

Jan 15 19:55:19.646: Setting client MAC 501a.c5e5.aeff radio slotunit 0 address 0x7E2CE90
Jan 15 19:55:19.646:  Adding client 501a.c5e5.aeff client->reap_flags_1 0
Jan 15 19:55:19.646: Dot11Radio0: Adding client 501a.c5e5.aeff aid 6
Jan 15 19:55:19.646: dot11_mgmt: drv add resp for client 501a.c5e5.aeff aid 6

Jan 15 19:55:19.646: dot11_mgmt: dot11_mgmt_sta_ref (ref=2, sta_ptr=0x7530010, mac=501a.c5e5.aeff)
Jan 15 19:55:19.646: SM: ---Open Authentication 0x7530010: Drv Add Resp (8)
Jan 15 19:55:19.646: SM:    Drv_Add_InProg (8) --> DONT CHANGE STATE (255)
Jan 15 19:55:19.646: dot11_mgmt: [168D368F] response from driver for client 501a.c5e5.aeff
Jan 15 19:55:19.646:  Setting global apsd config before assoc rsp
Jan 15 19:55:19.646:  dot11_driver_client_apsd_settings Client(501a.c5e5.aeff) not found for APSD settings
Jan 15 19:55:19.646: about to perform cac before cac resp
Jan 15 19:55:19.646:  dot11_tsm_delete_ts_not_reassociated:Clean streams not in REASSOC 
Jan 15 19:55:19.646: dot11_mgmt: [168D36F5] send assoc resp, status[0] to dst=501a.c5e5.aeff, aid[6] on Dot11Radio1
Jan 15 19:55:19.646: There is nothing to add from qosie_set in ASSOC Rsp
Jan 15 19:55:19.646: Dot11Radio1: Tx AssocResp client 501a.c5e5.aeff
Jan 15 19:55:19.646: dot11_aaa_auth_request: Received dot11_aaa_auth_request for client 501a.c5e5.aeff
Jan 15 19:55:19.646: dot11_aaa_auth_request: SSID: Executive, Mac Address: 501a.c5e5.aeff, auth_algorithm 0, key_mgmt 1027074
Jan 15 19:55:19.646: AAA/API(00000000): aaa_util_unique_id_alloc(), pc 0x185F920, enter {
Jan 15 19:55:19.646: AAA/ID(NA): DOT11 allocating
Jan 15 19:55:19.646: AAA/ID(00000023): Call started 14:55:19 -0500 Jan 15 2015
Jan 15 19:55:19.646: AAA/DB(00000023): add Intf/7D3D488
Jan 15 19:55:19.646: AAA/DB(00000023): add DB 7E2910C
Jan 15 19:55:19.646: AAA/ID(00000023): DOT11 allocated
Jan 15 19:55:19.646: AAA/API(00000023): } aaa_util_unique_id_alloc()
Jan 15 19:55:19.646: dot11_mgr_disp_wlccp_update_auth:  unknown auth type 0x1
Jan 15 19:55:19.646: dot11_aaa_add_dot11_client_entry: AAA Client entry (501a.c5e5.aeff, 4106500) is added to the client list
Jan 15 19:55:19.646: dot11_aaa_start_auth_sequence: dot11_aaa_start_auth_sequence for client 501a.c5e5.aeff [key_mgmt] = FAC02

Jan 15 19:55:19.646: dot11_aaa_start_auth_sequence: dot11_aaa_start_auth_sequence for client 501a.c5e5.aeff [key_mgmt] = FAC02

Jan 15 19:55:19.646: dot11_mgr_sm_start_wpav2_psk: Starting wpav2 4-way handshake for PSK or pmk cache supplicant 501a.c5e5.aeff
Jan 15 19:55:19.646: dot11_mgr_sm_send_wpav2_ptk_msg1: Starting wpav2 ptk msg 1 to supplicant 501a.c5e5.aeffCould not find station pointer for client 501a.c5e5.aeff. Using vlan number from aaa_client 
Jan 15 19:55:19.646: dot11_dot1x_send_ssn_eapol_key: wpav2 msg 1 pak_size 121
Jan 15 19:55:19.646: dot11_dot1x_send_ssn_eapol_key: eapol->length 117
Jan 15 19:55:19.646: dot11_dot1x_build_ptk_handshake: building PTK msg 1 for 501a.c5e5.aeff
Jan 15 19:55:19.646: dot11_dot1x_build_ptk_handshake: ptk key len 16
Jan 15 19:55:19.646: dot11_dot1x_build_ptk_handshake: ptk key data len 22
Jan 15 19:55:19.646: dot11_dot1x_build_ptk_handshake: wpav2 pmkid[DOT1X]: 0CBC860AAF0DBBA764ED9D51BB113194
Jan 15 19:55:19.646: dot1x-registry:registry:dot1x_ether_macaddr called
Jan 15 19:55:19.646: dot11_mgr_disp_client_send_eapol: sending eapol to client 501a.c5e5.aeff on BSSID c025.5ca5.3c40
Jan 15 19:55:19.646: dot11_mgr_sm_send_wpav2_ptk_msg1: [1] Sent PTK msg 1 to 501a.c5e5.aeff, no timer set
Jan 15 19:55:19.650: dot11_mgmt: dot11_mgmt_sta_deref (ref=3, sta_ptr=0x7530010, mac=501a.c5e5.aeff)

Also, on windows end I checked the Event Viewer and I see that SP3 is not getting any response back from the AP. 

Any help would be greatly appreciated. Thanks.

[Reuben Farrelly]

I rolled out a batch of these to our wireless network a couple of months back.  A couple of tips:

- From a wireless perspective these devices are extremely buggy out of the box (I'm not exaggerating).  They basically won't function using the built in wireless with anything other than the most very basic wireless setup of a home router until you apply ALL of the patches and updates for them in Windows Update.  In my case I had to install all the updates via ethernet dongle and/or a Linksys USB Wireless dongle (the drivers were much better for the USB dongle and allowed connectivity to work).  The built in Marvell adaptor looks to be good from a features perspective but poor from a driver perspective.  Once the updates were applied it mostly worked.

- I experienced a similar problem with FT (Fast Transition) enabled - the SP3 will not connect with FT enabled.  In my view there were two issues - (1) the devices won't even connect if FT is enabled and (2) they don't support the FT feature for seamless roaming.

I took it up with Microsoft and they acknowledged the problem but wouldn't commit to fixing the buggy behaviour (allowing the connection and ignoring the FT attribute like many older clients do) nor would they commit to when they will support the FT feature (fast roaming).

These tips might not be the cause of your problem but hopefully they will help you get it up and running.

Fortunately all of these problems can be fixed with driver updates, so maybe in the future they may end up being pretty good wireless clients afterall :-)

[Ignat Sitnikov]

Yeah I am aware of the WIFI issues with Surface. I think I was able to connect to this AP at some point but not any longer. And i went through re-installing drivers and etc. Just weird that it is able to connect to everything else but this one 2600 aironet. I was hoping somebody can help me out with reading that debug. These APs have a decent amount of features so maybe something needs to be enabled.

[George Stefanick]

What I do in situations like this since you were able to narrow this down to this model ap. Unwrap the complexity. Create an open SSID see if it connects. Then start adding on the layers. 

[Ignat Sitnikov]

Well there is not whole lot of layers here. It can connect to the Open SSID, but not WPA/WPA2.

[George Stefanick]

There is actually .. Tkip vs aes, wpa vs wap2, are Aironet extensions enable so on. I have a lot of these on our network running wpa2 aes and on an older ssid wpa tkip with no problem. Are you on the latest driver from October or the driver from June ? 

[Ignat Sitnikov]

Latest update from October. Issue has been resolved. Combination of WPA and AES worked. I guess SP3 has problem deciding which cipher to use when both AES and TKIP is enabled on the AP. Now, I hope that other devices will be able to connect...

[George Stefanick]

Not surprised apple has similar issues .. So u configured wpa aes ? 

[Ignat Sitnikov]

Yup. I had to try all encyprion/cipher combinations. The only one that worked was WPA/AES. Mixed mode doesn't work neither. 

[tonyp8581]

Hi Ignat,

If you don't mind, I would like to join the conversation.  We recently purchased 3 Surface Pro tablet.  Like yourself, I 'm also experiencing some Wifi issue.

So far, randomly, the tablet doesn't get an IP address.  What I've seen with tdebug on is I get an IP address when the Machine auth gets processed.  However, as the user logs in, the tablet doesn't initiate a DHCP request, so  the device ends up with no IP address.

2 Tablets have the latest NIC drivers - December 2014 v 15.68.30.73.151.

Also, if I put the NIC on 5Ghz only, it works well, but If I select auto, then I get the issue.  I tried 2.4 Ghz and the problem persist. So it seems to be pointing toward the 2.4 Ghz range.

The 3rd Tablet has the October driver and the only choice is 2.4 Ghz.  This one seems to be behaving properly.

So far, I'm thinking it may be a bug with latest driver.

Have you seen any strange behaviour with this version of NIC ?

Thanks !

Tony

[Ignat Sitnikov]

I made small progress. changed from WPA2 to WPA and now I can authenticate but SP3 not getting an IP address. When I punch in a static IP I can not ping default gateway and it doesn't look like AP is passing any traffic for SP3.

[Qousai Edelbi]

I know this post is old and maybe someone else found a solution but I had issue with surface pro 7 and I was able to narrow down the problem to NIC card adapter setting on the surface pro

Click on the control panel --> Network and internet --> Network connection

Choose your wi-fi NIC card --> right click --> go to properties --> configure

Under Advance --> Click on 802.11n/ac/ax ---> change the value to 802.11n from 802.11ax 

Thanks. Please test and let me know your result or if you have fixed the problem on another way