Windows PSK issue with AIR-AP2802I-E-K9 (managed by AIR-CT3504-K9)

[bmartins-EMCDDA]

Dear community,

I am posting here since I have already opened two TAC cases with no solution.

I have 20 APs and only one SSID (WPA2-PSK) in which we change the password every month.

Multiple Windows client versions (10 and 11) from different laptop brands (most of them using Intel Wi-Fi 6 AX201) are not able to connect to the network once the password changes because they are not warned that it changed and the new one is needed.

This results in the clients getting into the AP exclusion list:

•	*apfMsConnTask_1: May 25 13:58:16.665: d4:6a:6a:df:03:b3 Ignoring assoc request due to mobile in exclusion list or marked for deletion
•	*apfMsConnTask_1: May 25 13:58:16.665: d4:6a:6a:df:03:b3 Sending client blacklist entry to roamed AP 00:fc:ba:03:f4:40 with remaining time to be excluded 11sec
•	*apfOpenDtlSocket: May 25 13:58:17.749: d4:6a:6a:df:03:b3 Received management frame ASSOCIATION REQUEST  on BSSID 00:fc:ba:03:ee:a0 destination addr 00:fc:ba:03:ee:a0 slotid 0

The problem doesn't seem to affect mobile devices and only occurs when passwords change. The first-time connection works perfectly.

The wireless controller and APs are running version 8.10.171.0.

So far, the workaround has been to insist on trying to connect and reboot the client, and after that, we get prompted to enter the new password, but this is very frustrating for the users.

Do you have any advice that I should try?

Thank you!

[marce1000]

   - Perform full client debugging (the one you listed is only partial) ; you can have client debugs analyzed with : https://cway.cisco.com/wireless-debug-analyzer (look for problem patterns when analyzing different clients)
   As per https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html , use https://software.cisco.com/download/home/286312601/type/280926587/release/8.10.185.0 ; note that aireos and aireos based controllers are getting older , it is therefore becoming more and more advised to run the last (or latest) release available for the 3504 model (in your case) , 

 M.

[bmartins-EMCDDA]

Thanks for the tip!

This is the most interesting message I get after analysing the full client logs with that tool:

I have updated the infrastructure recently, but I'll also try the latest version you've mentioned.

[Flavio Miranda]

Hi

   I dont believe the Access Point will ever warn the client about the password change. What you can do, if those machine is managed from AD is run some GPO forcing the clients to forget the network before you change the password. Is the only way I believe they will ask to enter the password again. If they are not managed from AD, ask the user to do it manually. 

[bmartins-EMCDDA]

What I would expect is that, after the first connection attempt with the wrong password, Windows would immediately ask me for the new wireless password and not get marked as excluded because of multiple authentication failures.

[Rich R]

That you'll need to discuss with Microsoft ...

[Leo Laohoo]

---

@bmartins-EMCDDA wrote:

I have 20 APs and only one SSID (WPA2-PSK) in which we change the password every month.

Multiple Windows client versions (10 and 11) from different laptop brands (most of them using Intel Wi-Fi 6 AX201) are not able to connect to the network once the password changes because they are not warned that it changed and the new one is needed.

---

That's not a bug.  It is working as intended. 

Regularly changing PSK is very management intensive.   If someone wants to rotate the keys then use RADIUS.   

[bmartins-EMCDDA]

Since we use an MDM, I will also try to deploy the new password through a policy. The issue would then be only with unmanaged devices.

[Rich R]

Agreed with what @Flavio Miranda and @Leo Laohoo have already said.

All I can add is that there were MAJOR bugs in the early Intel drivers for those AX201 so make sure the drivers are fully up to date:
https://www.intel.com/content/www/us/en/download/19351/windows-10-and-windows-11-wi-fi-drivers-for-intel-wireless-adapters.html
And refer to TAC recommended code versions for WLC (below) - currently 8.10.185.0 which also has numerous bug fixes since 8.10.171.0 including some specific to your APs (Wave 2) - see also link to Leo's list below.

[bmartins-EMCDDA]

Thank you!

I noticed that some laptops with AX201 have older drivers and will be deploying the latest one you mentioned.

Hopefully, it improves something.

[bmartins-EMCDDA]

It looks like updating the driver to the latest release does not fix the problem.

[Flavio Miranda]

 The beharior you see would not be caused by driver. This is Operacional System behavior.  The solution would be forget the network and reconnect.  If you have this job to change the password once a month, would not be difficult to forget the password and reconnect.

  You need one command line:

netsh wlan delete profile name="WiFi network name"

If you have a Windows server, you can do this in a minute.