user is disconnecting from wi-fi [access-point]

[AshokJat]

our user is disconnecting from wi-fi frequently, I am attaching debug logs also, kindly assist anyone here.

we r using cisco AIR-AP3802I-D-K9 access points and 5500 series WLC and user is using windows OS

Thanks in advance 

Ashok Chaudhary

[Sandeep Choudhary]

Is this AP in local mode or Flex connect mode ?

[AshokJat]

Hi Sandeep,

Thanks for your response, our access point  is in flex connect mode.

[Sandeep Choudhary]

are only few clients are having issue or all of them ?

Can you narrow down...which kind of devices(exa: apple /android/windows) are having issue ?

Which software version you are running on WLC ?

is your WAN connectivity stable ?

If FT is enabled then disable it!

[AshokJat]

Hi Sandeep,

There r almost 4k+ clients on our WLC but only some of them facing this issue and the logs which I uploaded earlier this user is getting disconnection frequently,

User is using Windows OS

WAN connectivity is stable.  

I am not familiar with FT what does it meant for, explain little bit.

Software version which we r using in our WLC:--8.5.161.0

[marce1000]

                        >I am not familiar with FT what does it meant for, explain little bit.

   FYI : https://www.cisco.com/c/dam/en/us/td/docs/wireless/controller/technotes/80211r-ft/b-80211r-dg.html#task_2C619E3A576D474F80D6CB4BA8B4DBA6

 M.

[AshokJat]

Hi Sandeep,

FT is already disabled, and only few user facing these type issue 

[marce1000]

                          Ref : https://cway.cisco.com/tools/WirelessDebugAnalyzer/

 -  Feeding your log file into the tool results in  the below output, for the time being not observing fundamental issues , you may want to run that again. Also toggle with the available flags in the app. There is this one which can be seen : WLC cannot find a valid PMKID to match the one provided by the client  You may want to try disable fast roaming (FT) , if being used and check if that can help.

TimeTaskTranslated

Nov 22 14:07:37.311	*apfMsConnTask_6	Client roamed to AP/BSSID BSSID 28:6f:7f:ff:a1:e9 AP BAL-NCR-3802-2F-C-AP08
Nov 22 14:07:37.312	*apfMsConnTask_6	The WLC/AP has found from client association request Information Element that claims PMKID Caching support
Nov 22 14:07:37.312	*apfMsConnTask_6	The Reassociation Request from the client comes with 1 PMKID
Nov 22 14:07:37.312	*apfMsConnTask_6	The Reassociation Request from the client comes with 1 PMKID
Nov 22 14:07:37.313	*apfMsConnTask_6	WLC cannot find a valid PMKID to match the one provided by the client. However, if the client performs OKC and not SKC, the WLC computes a new PMKID based on the information gathered (the cached PMK, the client MAC address, and the new AP MAC address)
Nov 22 14:07:37.313	*apfMsConnTask_6	A new PMKID is computed and validated to match the one provided by the client, which is also computed with the same information. Hence, the fast-secure roam is possible.
Nov 22 14:07:37.314	*apfMsConnTask_6	Client is entering the 802.1x or PSK Authentication state
Nov 22 14:07:37.315	*apfMsConnTask_6	WLC/AP is sending an Association Response to the client with status code 0 = Successful association
Nov 22 14:07:37.322	*Dot1x_NW_MsgTask_1	WLC initiates a Robust Secure Network association with this client-and AP pair with the cached PMK found. Hence, EAP is avoided.
Nov 22 14:07:37.323	*Dot1x_NW_MsgTask_1	Client has completed PSK Dot1x or WEP authentication phase
Nov 22 14:07:37.323	*Dot1x_NW_MsgTask_1	Client has entered RUN state

[AshokJat]

Hi Marce,

I also notice this line WLC cannot find a valid PMKID to match the one provided by the client

But my question is that where is the actual problem in access point side or on user system side, bcz there r almost 4k+ user but only some of them is facing issue like this so it can't be access point side issue, 

[Sandeep Choudhary]

Hi Ashok,

I suspect its the issue on client side and specially while roaming.

1. Try to upgrade the drive on client side and test again.

Regards

Dont forget to rate helpful posts

[AshokJat]

HI Sandeep,

OK.

one more thing if u need I can capture logs for the same maybe that will helpful to understand issue, last time I attached logs which indicating  WLC cannot find a valid PMKID to match the one provided by the client

Thanks

Ashok

[Sandeep Choudhary]

ok, first upgrade the driver and then run this command "debug client <mac address>" on wlc and paste the logs here.

Regards

Dont forget to rate helpful posts

[JPavonM · Accepted solution]

As Sandeep said this sseems a client side issue as from the logs, the client is entering into RUN status with a valid IP address, but then the AP receives a REASSOCIATION REQUEST (seen on 3 different sections in your log).

Check Windows drivers from the manufacturer (if Intel go there for latest ones) and check Windows log (netsh wlan show wlanreport) but this sometimes drives you to noway due to the way windows interprets the internal issues with drivers.

*Dot1x_NW_MsgTask_1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 10.12.79.236 L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP 28:6f:7f:ff:a1:e0 vapId 7 apVapId 6 flex-acl-name: 
*Dot1x_NW_MsgTask_1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 apfMsRunStateInc
*Dot1x_NW_MsgTask_1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 10.12.79.236 L2AUTHCOMPLETE (4) Change state to RUN (20) last state L2AUTHCOMPLETE (4)

*spamApTask1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 Add SGT:0 to AP 28:6f:7f:ff:a1:e0
*spamApTask1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 Add CTS mobile SGT - Encoded the capwap payload for the mobile with SGT 0
*Dot1x_NW_MsgTask_1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 10.12.79.236 RUN (20) Reached PLUMBFASTPATH: from line 7157, null
*Dot1x_NW_MsgTask_1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 Accounting disabled on WLAN. NOT initiating radius accounting update(1) for mobile
*spamApTask1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 Successful transmission of LWAPP Add-Mobile to AP 28:6f:7f:ff:a1:e0
*Dot1x_NW_MsgTask_1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 10.12.79.236 RUN (20) No 11v BTM 
*Dot1x_NW_MsgTask_1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 10.12.79.236 RUN (20) NO release MSCB
*spamApTask1: Nov 22 14:07:38.059: [SA] 08:d2:3e:d9:0f:e9 Setting ADD_MOBILE (idx 31, action 0, last count 218) ack state for STA on AP 28:6f:7f:ff:a1:e0
*apfProbeThread: Nov 22 14:07:38.079: [SA] Looking up local blacklist 9c32ce94e8ce

*apfReceiveTask: Nov 22 14:07:38.108: [SA] 08:d2:3e:d9:0f:e9 Recieved MS IPv4 Addr= 10.12.79.236 
*apfReceiveTask: Nov 22 14:07:38.108: [SA] 08:d2:3e:d9:0f:e9 Recieved IPv6 addresses count: 0
*apfOpenDtlSocket: Nov 22 14:07:38.837: [SA] 08:d2:3e:d9:0f:e9 Received management frame REASSOCIATION REQUEST on BSSID 28:6f:7f:ff:a1:ea destination addr 28:6f:7f:ff:a1:ea.
 

[Divakar Swamy]

@AshokJat How you resolved this issue ?, Is this issue happen because of client drivers ?

[AshokJat]

@Divakar Swamy we changed user's system