Wireless Access

Good morning,

Multiple wireless devices that use MPSKs created within Aruba Clearpass have started exhibiting disconnections from the wireless network. If the MPSK is re-entered into the device, it will usually reconnect but disconnect again sometime shortly afterwards. When the AP and client events are reviewed within Aruba Central, multiple instances of the following occurs:

Event Type:
802.11 De-authentication to Client
Description:

Age-out means that the client has not been sending traffic for a certain amount of time. It probably has gone out of range, sleep or switched off.

Age-out's are normal and expected.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Original Message:
Sent: Dec 01, 2022 12:10 PM
From: Kevin Kirch
Subject: De-authentication sent to client | Reason: Age-out

Good morning,

Multiple wireless devices that use MPSKs created within Aruba Clearpass have started exhibiting disconnections from the wireless network. If the MPSK is re-entered into the device, it will usually reconnect but disconnect again sometime shortly afterwards. When the AP and client events are reviewed within Aruba Central, multiple instances of the following occurs:

Event Type:
802.11 De-authentication to Client
Description:

De-authentication sent to client [CLIENT_MAC] from BSSID [AP_MAC] on channel 36+ of AP hostname [AP_NAME]. Reason: Age-out

I have not been able to find any details online with what 'Age-out' is referring to. I'd appreciate any insight that someone could provide on what this issue might be caused by.

Environment details:
AP managed by: Aruba Central
AP Firmware: 8.9.0.3_83448
AP Model: AP-515
Aruba Clearpass Version: 6.10.5.185484

Thank you for the explanation on what Age-outs mean.

I've confirmed that Aruba Central will report log events when an incorrect PSK is applied on the client. A client connects to an AP-515 access point using a MPSK and will sometimes disconnect in as little as a couple of minutes. I now suspect that the client's MPSK is sometimes not being reauthenticating successfully due to an issue either with the IAP infrastructure or because Clearpass is not providing the correct MPSK information for the client through RADIUS.
Original Message:
Sent: Dec 02, 2022 09:37 AM
From: Herman Robers
Subject: De-authentication sent to client | Reason: Age-out

Age-out means that the client has not been sending traffic for a certain amount of time. It probably has gone out of range, sleep or switched off.

Age-out's are normal and expected.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Dec 01, 2022 12:10 PM
From: Kevin Kirch
Subject: De-authentication sent to client | Reason: Age-out

Good morning,

Multiple wireless devices that use MPSKs created within Aruba Clearpass have started exhibiting disconnections from the wireless network. If the MPSK is re-entered into the device, it will usually reconnect but disconnect again sometime shortly afterwards. When the AP and client events are reviewed within Aruba Central, multiple instances of the following occurs:

Event Type:
802.11 De-authentication to Client
Description:

De-authentication sent to client [CLIENT_MAC] from BSSID [AP_MAC] on channel 36+ of AP hostname [AP_NAME]. Reason: Age-out

I have not been able to find any details online with what 'Age-out' is referring to. I'd appreciate any insight that someone could provide on what this issue might be caused by.

Environment details:
AP managed by: Aruba Central
AP Firmware: 8.9.0.3_83448
AP Model: AP-515
Aruba Clearpass Version: 6.10.5.185484

Hi Herman,

But why the client is sending the authentication request to CPPM when wakes up, even though the idle time out is set to high value say for 24 hours and reauth as well for 3 days.

Original Message:
Sent: Dec 02, 2022 09:37 AM
From: Herman Robers
Subject: De-authentication sent to client | Reason: Age-out

Age-out means that the client has not been sending traffic for a certain amount of time. It probably has gone out of range, sleep or switched off.

Age-out's are normal and expected.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Dec 01, 2022 12:10 PM
From: Kevin Kirch
Subject: De-authentication sent to client | Reason: Age-out

Good morning,

Multiple wireless devices that use MPSKs created within Aruba Clearpass have started exhibiting disconnections from the wireless network. If the MPSK is re-entered into the device, it will usually reconnect but disconnect again sometime shortly afterwards. When the AP and client events are reviewed within Aruba Central, multiple instances of the following occurs:

Event Type:
802.11 De-authentication to Client
Description:

De-authentication sent to client [CLIENT_MAC] from BSSID [AP_MAC] on channel 36+ of AP hostname [AP_NAME]. Reason: Age-out

I have not been able to find any details online with what 'Age-out' is referring to. I'd appreciate any insight that someone could provide on what this issue might be caused by.

Environment details:
AP managed by: Aruba Central
AP Firmware: 8.9.0.3_83448
AP Model: AP-515
Aruba Clearpass Version: 6.10.5.185484

You should have a closer look to what exactly happens, but one reason could be that when a device wakes up, not only the AP, but also the client needs to re-authenticate the connection. The idle/reauth timers apply to clients that are continuously connected, clients that go in sleep are likely to disconnect.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Original Message:
Sent: Jan 11, 2024 04:31 AM
From: Urkavalan
Subject: De-authentication sent to client | Reason: Age-out

Hi Herman,

But why the client is sending the authentication request to CPPM when wakes up, even though the idle time out is set to high value say for 24 hours and reauth as well for 3 days.

Original Message:
Sent: Dec 02, 2022 09:37 AM
From: Herman Robers
Subject: De-authentication sent to client | Reason: Age-out

Age-out means that the client has not been sending traffic for a certain amount of time. It probably has gone out of range, sleep or switched off.

Age-out's are normal and expected.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Dec 01, 2022 12:10 PM
From: Kevin Kirch
Subject: De-authentication sent to client | Reason: Age-out

Good morning,

Multiple wireless devices that use MPSKs created within Aruba Clearpass have started exhibiting disconnections from the wireless network. If the MPSK is re-entered into the device, it will usually reconnect but disconnect again sometime shortly afterwards. When the AP and client events are reviewed within Aruba Central, multiple instances of the following occurs:

Event Type:
802.11 De-authentication to Client
Description:

De-authentication sent to client [CLIENT_MAC] from BSSID [AP_MAC] on channel 36+ of AP hostname [AP_NAME]. Reason: Age-out

I have not been able to find any details online with what 'Age-out' is referring to. I'd appreciate any insight that someone could provide on what this issue might be caused by.

Environment details:
AP managed by: Aruba Central
AP Firmware: 8.9.0.3_83448
AP Model: AP-515
Aruba Clearpass Version: 6.10.5.185484