Users disconnect constantly

[Diana Karolina Rojas]

Hello!

I have a Cisco 2504 WLC with 5 APs and 3 SSID. I have a problem with some users, the WLC disconnects them constantly and when I see my logs I obtain the next error:

Thu Feb 23 14:31:06 2017 WPA MIC Error counter measure activated on Radio with MAC 00:3a:98:7c:8d:70 and Slot ID 0. Station MAC Address is 74:df:bf:b0:5f:dc and WLAN ID is 3.

and in the users logs I see this kind of logs:

10:29:03, Thu, Feb 23, 17 Successfully joined network with BSSID 00:3a:98:77:c6:12
10:59:14, Thu, Feb 23, 17 Received Deauth from 00:3a:98:77:c6:12 with Reason 1
10:59:14, Thu, Feb 23, 17 Successfully joined network with BSSID 00:3a:98:77:c6:12
11:08:57, Thu, Feb 23, 17 Received Deauth from 00:3a:98:77:c6:12 with Reason 14
11:09:10, Thu, Feb 23, 17 Searching for networks with ssid Onsite
11:09:11, Thu, Feb 23, 17 Searching for networks with ssid Onsite
11:09:15, Thu, Feb 23, 17 Searching for networks with ssid Onsite
11:09:15, Thu, Feb 23, 17 Searching for networks with ssid Onsite
11:09:22, Thu, Feb 23, 17 Received Deauth from 00:3a:98:7c:a1:32 with Reason 15
11:09:22, Thu, Feb 23, 17 Potential passphrase mismatch. Please try a different one...
11:10:23, Thu, Feb 23, 17 Searching for networks with ssid Onsite
11:10:23, Thu, Feb 23, 17 Searching for networks with ssid Onsite
11:10:27, Thu, Feb 23, 17 Successfully joined network with BSSID 00:3a:98:77:c6:12

Why is this happen? Take into account that the behavior ONLY occur in ONE of the 3 SSIDs, I actually have 4 users and 3 of them have the problem. Thank you for any support you can give me.

Regards,

[ahakels]

1.Check the password of the user they are using to connect to the SSID:

2. For the error:

   Received Deauth from 00:3a:98:7c:a1:32 with Reason 15

   Check the following link for Deauth(Deauthetication) error Reason code :

https://supportforums.cisco.com/document/141136/80211-association-status-80211-deauth-reason-codes#Deauth_Reason_Codes

[Diana Karolina Rojas]

Thanks for you response, but I don't think that is the problem, because the users connect to the network and the desconnection occur after minutes or even hours.

[Sandeep Choudhary]

Paste the output of your ye command:

 sh wlan <id >

Regards

[Freerk Terpstra]

The Message Integrity Check (MIC) incorporated in Wi-Fi Protected Access (WPA) includes a frame counter which prevents a man-in-the-middle attack. This error means someone in the network is trying to replay the message that was sent by the original client, or it might mean that the client is faulty.

If a client repeatedly fails the MIC check, the controller disables the WLAN on the AP interface where the errors are detected for 60 seconds. That explains that the client does get access again after a minute or so. Read more about this here.

Have you already tried to update all of the wireless drivers of your clients to the most recent version? Also check if you have WPA1 and WPA2 enabled on the WLAN, this might also cause problems.

Please rate useful posts... :-)

[Diana Karolina Rojas]

I solved the problem doing a change in my configuration recommended by: Sandeep Choudhary in another post, but you are right it was a WPA2 bad configuration.

Thanks! :)

[212580283]

Can you paste the like?thanks.

[Diana Karolina Rojas]

Hello,

Here is the other Discussion:   https://supportforums.cisco.com/discussion/13232841/users-disconnect-constantly

Regards!

[itopswingify6267]

me to