Hey, I feel your pain—this kind of intermittent WiFi gremlin (sudden drops, endless "connecting" spins, and random successes) is maddening, especially when it's hitting devices right next to the AP and no clear pattern. The "802.11 Poor Channel Conditions" flag in DNAC despite strong signals screams false positive or radio quirk, and tying it to your WLC upgrade is a solid hunch. I've dug into similar cases on Cisco setups, and while your exact combo (C9800-CL 17.12.4 with C9130AXI-H/3802AXI-E APs) isn't a headline bug, it's echoing some known headaches in 17.12.x. Let's troubleshoot step by step—start simple, escalate if needed.
### Quick Reality Check: Is It Widespread?
Not a massive outage wave right now, but yeah, others are griping about reconnection stalls and channel misreads post-upgrade in 17.12.x. Folks on Cisco Community report clients (especially mixed WiFi 6/AX) hanging in auth/handshake phases, with DNAC over-flagging "poor conditions" due to aggressive RRM (Radio Resource Management) tweaks. No ISE logs means it's likely pre-auth (association or probe response weirdness), not RADIUS.
### Likely Culprits (Post-Upgrade Vibes)
- **RRM/Channel Shenanigans**: 17.12.4 dialed up noise detection sensitivity—DNAC sees "poor" even on clean channels if there's micro-interference (e.g., microwave bleed or neighbor APs). Your 1m tests rule out distance, but it could be transient RF hiccups triggering deauths.
- **Client State Mismatch**: Devices get "stuck connecting" during re-assoc because the AP/WLC isn't clearing old state fast enough (seen in AX APs like yours).
- **Firmware Mismatch/Upgrade Glitch**: C9130/3802 APs on older images might not handshake cleanly with 17.12.4—check if AP FW is synced (should be 17.12.4.x).
- **Other Sneaks**: High client load, DFS channel hops (5GHz), or even IPv6 flapping (one thread pinned iPads losing v6 during stalls).
### Step-by-Step Fixes to Try (Start Here—No Downtime)
1. **Verify & Sync Firmware**:
- CLI on WLC: `show ap image all`—ensure APs are on 17.12.4 (or latest patch like 17.12.4a). If not, predownload: `ap name <AP-NAME> image predownload tftp://<SERVER>/17.12.4`.
- AP join issues? Run `show ap join stats summary` for errors (e.g., CAPWAP timeouts).
2. **Tune RRM for Sanity**:
- Disable auto-RRM temporarily: GUI > Configuration > Radio Resource Management > 802.11a/b > Set "Assignment Method" to Custom, pick fixed clean channels (e.g., 36/40/44 for 5GHz, 1/6/11 for 2.4GHz). Power to medium (not auto).
- CLI: `config 802.11a channel global 36,40,44` (test one AP first).
- Re-enable after a week if stable— this often kills false "poor conditions" flags.
3. **Client Reconnect Tweaks**:
- Bump client timeouts: GUI > Configuration > Tags & Profiles > Policy > WLAN Policy > Advanced > Set "Client Inactivity Timeout" to 3600s, "Aggressive Load Balancing" off.
- Enable "Fast Roaming" or "802.11r" if your clients support it (helps sticky reconns).
- Test: Force a deauth (`debug client <MAC>`) on a problem device and watch the assoc in `show wireless client mac <MAC> detail`.
4. **DNAC/WLC Debugs for Clues**:
- On WLC: `debug client <MAC>` + `debug capwap events enable` during a fail—look for "deauth reason 7" (class 3 frame from non-assoc) or heartbeat drops.
- DNAC Assurance: Run a Client Health test on the AP—filter for "Poor Channel" events and drill into spectrum (might show phantom interferers).
- No ISE hits? Good—focus on radio: `show ap dot11 24ghz/5ghz channel` for utilization spikes.
5. **Upgrade/Rollback Test**:
- 17.12.4 is solid but had reconn flakiness in early builds—jump to 17.12.5 or 17.13.1 (TAC rec for stability). Rollback to pre-upgrade version on one site for A/B testing if it's dire.
- Field Notice Check: Your APs aren't in the "fail to join" batch (FN72424), but confirm serials if manufactured post-Sept 2022.
### If That Doesn't Stick
- **Packet Capture**: Mirror AP switchport + Wireshark filter `wlan.fc.type_subtype == 0x00` (assoc reqs) during a stall—spot if probes get NAK'd.
- **Escalate to TAC**: Bundle `show tech wireless`, DNAC export, and a client Wireshark. Reference bug CSCwj07316 (sync issues) or CSCvw30043 (DHCP stalls, if IPv4 drops too). They've fixed similar in patches.
- **Workaround**: Seg a test SSID on fixed channels/power for affected areas.
This should get you 80% there—start with RRM tweaks, as that's the low-hanging fruit for "poor conditions" lies. What's the client mix (iOS? Android? Laptops?)? And any patterns on bands (2.4 vs 5GHz)? Drop more deets, and we'll narrow it. You've got this—hang in there!
