Wifi disconnect troubleshooting help

[Brewder]

wireHello,

We have a Cisco based wireless enterprise based on 5508 WLC's (Firmware: 8.5.171.4).  We are struggling with periodic "disconnects" of Windows based clients.  I'm not a cisco expert, but am fairly well versed in WLAN's in general and Windows environments.  One thing I see on my Windows 10 machine when disconnected, is the error below from the event log.  About 15-30 seconds later I automatically reconnect to the wireless network.

Any idea where to even begin looking?

Wireless 802.1x authentication was restarted.

Network Adapter: Intel(R) Wi-Fi 6 AX201 160MHz
Interface GUID: {42bfef80-8bda-47b4-887e-77d97e5f4b4d}
Local MAC Address: 60:E3:2B:C4:CA:11
Network SSID: <removed>
BSS Type: Infrastructure
Eap Information: Type 25, Vendor ID 0, Vendor Type 0, Author ID 0
Restart Reason: Peer Initiated

[Flavio Miranda]

Hi

 Debug on the wlc would be good but I know is difficult as you dont know when the client will drop.  And the debug is per mac address.

"Wireless 802.1x authentication was restarted." Do you use Cisco ISE?  Anything on the ISE logs? is that´s the case. 

802.1x  happen between Client and radius.

[Brewder]

I assume Cisco ISE is an authentication mechanism.. We use Windows RADIUS....

[Flavio Miranda]

ISE is a radius just like NPS.   I just mentioned ISE because it pretty common.

But I am pretty sure the windows radius also can show logs right?

[balaji.bandi]

You need to collect more information : follow below troubleshooting tips :

https://docs.microsoft.com/en-us/windows/client-management/advanced-troubleshooting-802-authentication

[ammahend]

Is it only windows device disconnecting or all devices. 
can you share this output from controller : 

show advanced 802.11a channel

[Haydn Andrews]

there were a few bugs with the Intel AX201 driver - try updating the driver 

[Brewder]

Hmm I've done that a few times. I think the radius server gets too busy to
respond to reauthentication requests...

[Leo Laohoo]

Use the command "netsh wlan show drivers" and find out what drivers the AX20x is on.

What model of APs are there? 

Is this issue happening to other OSes like iOS, Apple, Android? 

[Brewder]

My site is part of a large corporate enterprise environment.  Globally we have well over 65,000 windows 10 client machines... I would say 60-70% of them running the same OS and Intel driver version as me.  In each of our sites around the world, we have locally installed WLC's (and RADIUS servers) that have had MANY MANY hands in the configuration over the years.  To complicate matters, we outsourced infrastructure operations to a 3rd party so although my team and I have the skills to check things, we don't necessarily have the permissions to...

So I'm kinda stuck "force feeding" logs to direct our vendor to the proper fix in most situations.

At this point, we got a log capture from an access point when I was disconnected, and it appears the RADIUS server rejected the re-authentication request so I'm now pushing the RADIUS team to figure out why.  From the log, these entries for my client's MAC address stood out:

EAP_ID_RES MESSAGE_RECEIVED
AAA_AUTH AAA_MESSAGE_CREATION_FAILED
ACCESS_ACCEPT MESSAGE_RECEIVED
AUTH_DOT1X WLAN_REQUIRES_802_1X_AUTH
EAP_ID_RES PACKET_SENT_TO_CLIENT
PEM_EVENT_MSG WEB_AUTH_MAX_RETRY_EXCEEDED

[Brewder · Accepted solution]

Apparently, I never posted what our actual solution was... Turns out, the policy in our NPS setup (Windows) was configured to require re-authentication every 20 minutes instead of every 1440 minutes as designed for our site.  The policy wasn't applied to our local NPS server properly.  Once that was fixed, it solved all of our "disconnect" issues.