WGB failed to connect to same SSID with same PSK in new WLC8540

[mmr99]

Hi Guys, I need a help regarding WGB. Before it was connected in WLC8540 (8.5.131.0) with root AP2802. Recently  i swapped root AP to catalyst AP9120, also migrated to new WLC8540(8.10.183). But WGB failed to connect to SSID PSK based. Though PSK is same in both WLC SSID. In New WLC, it was showing "Client 'f4:4e:05:aa:bb:cc (0.0.0.0)' which was associated with interface '802.11a/n/ac/ax' of AP 'APNAME' is excluded. The reason code is '4(802.1X Authentication failed 3 times.)'. But when i rolled back root AP to 2802 with old WLC, it connected automatically. I've checked WGB config, it is perfect. WGB is SAP2702.

Would be great to get your expert knowledge.

[marce1000]

 - Review this thread  : https://community.cisco.com/t5/wireless/1562-map-bridges-losing-connection-after-software-upgrade/m-p/4914640#M260198

[Rasika Nayanajith]

To begin with I will configure WLAN configuration of both WLC to see it exactly matches (ideally get CLI backup config and compare line by line).

If it is a PSK SSID, reason code you refer "802.1X Authentication Failed 3 times" makes no sense.

HTH
Rasika
*** Pls rate all useful responses ***

[mmr99]

have compared, no difference, "802.1X Authentication Failed 3 times" is coming because of the below logs, exclusion policy is set 3 times for auth fail

*Dot1x_NW_MsgTask_4: Sep 18 07:35:25.773: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client f4:4e:05:78:a9:7c may be using an incorrect PSK
*Dot1x_NW_MsgTask_4: Sep 18 07:31:50.865: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client f4:4e:05:78:a9:7c may be using an incorrect PSK
*Dot1x_NW_MsgTask_4: Sep 18 07:28:07.425: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client f4:4e:05:78:a9:7c may be using an incorrect PSK
*Dot1x_NW_MsgTask_4: Sep 18 07:24:28.813: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client f4:4e:05:78:a9:7c may be using an incorrect PSK

[mmr99]

while it is trying to connect new WLC, showing this logs, that client(WGB) may be using an incorrect PSK

*Dot1x_NW_MsgTask_4: Sep 18 07:39:03.297: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client f4:4e:05:ab:bb:cc may be using an incorrect PSK
*Dot1x_NW_MsgTask_4: Sep 18 07:35:25.773: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client f4:4e:05:78:a9:7c may be using an incorrect PSK
*Dot1x_NW_MsgTask_4: Sep 18 07:31:50.865: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client f4:4e:05:78:a9:7c may be using an incorrect PSK
*Dot1x_NW_MsgTask_4: Sep 18 07:28:07.425: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client f4:4e:05:78:a9:7c may be using an incorrect PSK
*Dot1x_NW_MsgTask_4: Sep 18 07:24:28.813: %DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:766 Client f4:4e:05:78:a9:7c may be using an incorrect PSK

[Rasika Nayanajith]

Did you configure the PSK correctly on WLC as well as on WGB itself?

Other than WGB, is there any other client having issues connecting to that SSID ? that will isolate issue related to WGB or configs on the WLAN

HTH
Rasika
*** Pls rate all useful responses ***

[mmr99]

Yes, PSK is defined perfectly. Both WLC have same SSID, PSK. there are many users using that with same PSK. These are tested already, only this WGB has failed to connect new WLC with the above logs, though it connects to old WLC properly.

[mmr99]

Hi, I've applied a workaround to stop roaming to outside Catalyst AP as there is Root AP2802 sitting next to WGB. Has put no mobile station in Radio interface as soon as it hooked up to AP2802(existing WLC) to stop roaming. Before it was joining to next AP, but after few minutes, it was roaming to new AP in new WLC. last 2 days it is working perfectly.

[Rich R]

- Ideally new WLC should be running current latest release 8.10.185.3 (link below) - next MR due out soon.
- Have you tried using the 2802 root AP with the new WLC.
- What mode is the 9120 set to?
- Is the 2702 software updated to the same version?
- If you're using mesh mode have you added the 2702 MAC address to the WLC's MAC filter?

[mmr99]

Thanks for joining thread

- Have you tried using the 2802 root AP with the new WLC- yes, didn't work.

- What mode is the 9120 set to? Local

- Is the 2702 software updated to the same version?  this is just acting as client of wifi, do we need it?

- If you're using mesh mode have you added the 2702 MAC address to the WLC's MAC filter? it's just PSK based, no mac filtering

I'll check your other things that you suggested