cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1397
Views
2
Helpful
7
Replies

wireless security question

Bekzod
Visitor

Hi, SSID has wpa2+wpa3 security, when pc connects which one will be used first and then if it doesnt work fails to second? 

 

7 Replies 7

Leo Laohoo
Hall of Fame
Hall of Fame

Theoretically, WPA3 will take precedence and then WPA2.  

In reality, it is dependent on the wireless NIC and wireless NIC driver.  

we have macbook its failing 802.1x and then passing MAB , we checked certificates are good, and he can connect to meraki which only difference is using wpa 2  while cisco ap using wpa2+wpa3 . then i saw many users were complaining with macbook to wpa 3 and thinking maybe this is the problem

Rich R
VIP
VIP

- What model of WLC?
- What version of software?
Note:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvv35000
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvs75741 (marked as duplicate but no reference to what bug it's a duplicate of - you'd have to ask TAC).

Also make sure device OS and drivers are fully up to date.

------------------------------
Please click Helpful if this post helped you and Accept as Solution if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's   and   TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's,   Best Practices for 9800 WLC's   and   Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
Field Notice: FN74383 APs Running 17.12.4/5/6/6a May Run Out of Flash Space Preventing Upgrades
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

wlc- 9800, version 17.9.4 , logs in ISE shows that endpoint is starting new session AAA  without finishing the previous one and then fails.

Then you definitely need debugs on WLC and client at the same time and ideally OTA packet capture to understand why/where it's going wrong.  Then you know whether it's an Apple or Cisco problem and raise it with the respective vendor.  Do you have APSP installed on 17.9.4? (refer TAC recommended link below)

------------------------------
Please click Helpful if this post helped you and Accept as Solution if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's   and   TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's,   Best Practices for 9800 WLC's   and   Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
Field Notice: FN74383 APs Running 17.12.4/5/6/6a May Run Out of Flash Space Preventing Upgrades
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs
Default AP console baud rate from 17.12.x is 115200 - introduced by CSCwe88390

yes, apsp was installed . will try get debugs,  its not easy , he is big executive ))

thank you 

Please upgrade to 17.12.3 and try again.

Review Cisco Networking for a $25 gift card