Wireless Access

Scenario: I connect to my work wpa2 ssid (via my RAP at home) just fine. I then switch over to my local home wireless ssid. I then try and come back to my wpa2 work ssid (saved profile in Win10), and I cannot connect. It just attempts and fails, and fails multiple times.  If I forget the network and reconnect from scratch - it connects just fine.

 

Windows wireless logs show repeated failures:

 

I have my client setup for debug on the controllers. I am finding this issue:

 

May 15 13:18:08 :522289: <3605> <DBUG> |authmgr| Auth GSM : MAC_USER mu_delete publish for mac 30:24:32:f7:51:2a bssid c8:b5:ad:1e:0a:50 vlan 2260 type 1 data-ready 0 deauth-reason 52 HA-IP n.a
May 15 13:18:08 :526162: <4241> <DBUG> |dot1x-proc:2| send_client_event_notify_to_main_auth 13:18:10.725313 message sent to auth event 10
May 15 13:18:08 :501106: <5512> <NOTI> |stm| Deauth to sta: 30:24:32:f7:51:2a: Ageout AP 100.64.16.118-c8:b5:ad:1e:0a:50-RAP-189ce0 wifi_deauth_sta
May 15 13:18:08 :522296: <5324> <DBUG> |authmgr| Auth GSM : USER_STA delete event for user 30:24:32:f7:51:2a age 0 deauth_reason 52
May 15 13:18:08 :522036: <5324> <INFO> |authmgr| MAC=30:24:32:f7:51:2a Station DN: BSSID=c8:b5:ad:1e:0a:50 ESSID=UCCS-Wireless VLAN=960 AP-name=RAP-189ce0 reason=52 at 13:18:10.725715
May 15 13:18:08 :522234: <5324> <DBUG> |authmgr| Setting idle timer for user 30:24:32:f7:51:2a to 14400 seconds (idle timeout: 14400 ageout: 0).
May 15 13:18:08 :522004: <5324> <DBUG> |authmgr| auth_gsm_change_repkey_for_channels: publish_list 7 repkey -1 macuser VALID ipuser NULL
May 15 13:18:08 :501080: <5512> <NOTI> |stm| Deauth to sta: 30:24:32:f7:51:2a: Ageout AP 100.64.16.118-c8:b5:ad:1e:0a:50-RAP-189ce0 Ptk Challenge Failed
May 15 13:18:08 :522004: <5324> <DBUG> |authmgr| auth_gsm_change_sta_repkey: STA repkey change failed for mac 30:24:32:f7:51:2a result error_invalid_object_pointer
May 15 13:18:08 :522004: <5324> <DBUG> |authmgr| auth_gsm_change_mac_user_repkey: Failed sta publish: result 0
May 15 13:18:08 :501000: <5512> <DBUG> |stm| Station 30:24:32:f7:51:2a: Clearing state
May 15 13:18:08 :522328: <5324> <DBUG> |authmgr| Auth GSM : MAC USER change repkey Success for mac 30:24:32:f7:51:2a -1
May 15 13:18:08 :522004: <5324> <DBUG> |authmgr| auth_gsm_publish_cluster_sta_section: csta_section_update success for mac 30:24:32:f7:51:2a stby_ip = 128.198.8.53
May 15 13:18:08 :522326: <5324> <DBUG> |authmgr| Auth GSM : USER repkey change Success for mac 30:24:32:f7:51:2a 001a1e0203280000004c7580 -1
May 15 13:18:08 :522004: <4241> <DBUG> |dot1x-proc:2| handle_dot1x_abort called
May 15 13:18:08 :522152: <5324> <DBUG> |authmgr| station free: bssid=c8:b5:ad:1e:0a:50, mac=30:24:32:f7:51:2a.
May 15 13:18:08 :501105: <NOTI> |AP RAP-189ce0@100.64.16.118 stm| Deauth from sta: 30:24:32:f7:51:2a: AP 100.64.16.118-c8:b5:ad:1e:0a:50-RAP-189ce0 Reason Ptk Challenge Failed
May 15 13:18:08 :501000: <DBUG> |AP RAP-189ce0@100.64.16.118 stm| Station 30:24:32:f7:51:2a: Clearing state

 

What is deauth code 52?

What could be causing it?

What else can I check?

Not conclusive.

 

- Try to connect

- After it fails, on the controller type "show auth-tracebuf mac <mac address of client>"

- Paste that output here.

 

Has this client ever worked?

Authbuff output attached. This client has worked fine in the past.

I would forget the SSID and recreate it from scratch.

 

It looks like the client is not responding to key1

 

May 15 14:20:14  wpa2-key1             <-  30:24:32:f7:51:2a  c8:b5:ad:1e:0a:50  -      117
May 15 14:20:15  wpa2-key1             <-  30:24:32:f7:51:2a  c8:b5:ad:1e:0a:50  -      117
May 15 14:20:16  wpa2-key1             <-  30:24:32:f7:51:2a  c8:b5:ad:1e:0a:50

I would also see if the radius server says anything.

Seems to only happen on my RAP. Couldn't reproduce on a Win10 client on campus switching between campus AP ssid and a test xfinity wireless AP ssid I have on site. I have other clients (on RAPs) exhibiting this behavior as well.

 

ClearPass doesnt show any entries in the access tracker for the failed attempts to connect.

Please open a Technical Support case so that they can drill down into your log information.

Thanks @cjoseph for your suggestions and help. Might have to break down and open a TAC case. Appreciate your input.

You should still ask questions here, but only TAC will be able to see all of your logs and be able to make proper determinations.

 

Did you test the RAP SSID with a phone or some other OS besides Windows 10?

My iPhone seems to work fine.

 

I have a mac user reporting similar issue. I need to debug them, and a few others... and see if they are failing similarly (failing to reply to key1).

Any timeout settings to look at (as it pertains to wpa2 and EAP working over a RAP)?

 I would forget the SSID on the mac and try to reconnect from scratch.

Hi guys, I know this thread is old but I'd like to give some feedback from my end.

SHORT VERSION: Reloading the controller fixed the issue.

LONGER VERSION:
Today I got the same or very similar issue with a 3400 controller running old 6.4 code.

Users couldn't connect to the WLAN using a WPA2 Enterprise or WPA2-PSK network, only Open  WLANs were OK.
This issue happened from one day to another, no changes, no upgrades from devices, simple and pure sorcery.

From the debug side I got three lines that were my suspects:


Since this HW wasn't on a valid support contract anymore I couldn't do much. So after some test here and there, changing settings, creating test WLANs I gave up and ended reloading the controller and 'Voila', the magic reboot.

Hope this helps in any way to someone.
Best regards!

------------------------------
Javier Valdes
------------------------------

Original Message:
Sent: May 15, 2020 05:30 PM
From: Colin Joseph
Subject: Cant connect to ssid deauth reason 52

 I would forget the SSID on the mac and try to reconnect from scratch.