Wireless Access

last person joined: 20 hours ago 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

User got "wrong replay counter" error for wpa2-key2 during authentication

This thread has been viewed 7 times

  • 1.  User got "wrong replay counter" error for wpa2-key2 during authentication

    Posted Apr 21, 2020 09:52 AM

    Hi,

     

    We had a user that keep on dropping with his wireless connection behind a RAP. And we notice the below error in auth-tracebuf of the user. Then we run a debug of the user and we got the "did not match the replay" error. So we tried to adjust the wpa-key-period from default to 2000 miliseconds but same we still see the issue and we tried 3000 miliseconds and same result. Do you have someone has the same issue and we only found this issue in just on user on same controller.

     

    Logs:

    Apr 21 13:30:46 authmgr[4113]: <132093> <4113> <ERRS> |authmgr| WPA2 Key message 2 from Station 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 CON64146_RAP3WNP did not match the replay counter 012 vs 014
    Apr 21 13:30:46 authmgr[4113]: <132093> <4113> <ERRS> |authmgr| WPA2 Key message 2 from Station 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 CON64146_RAP3WNP did not match the replay counter 012 vs 014
    Apr 21 13:30:46 authmgr[4113]: <132093> <4113> <ERRS> |authmgr| WPA2 Key message 2 from Station 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 CON64146_RAP3WNP did not match the replay counter 013 vs 015
    Apr 21 13:30:46 authmgr[4113]: <132093> <4113> <ERRS> |authmgr| WPA2 Key message 2 from Station 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 CON64146_RAP3WNP did not match the replay counter 013 vs 015


    Apr 21 13:30:46 wpa2-key1 <- 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 - 117
    Apr 21 13:30:46 wpa2-key2 -> 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 - 167 wrong replay counter
    Apr 21 13:30:46 wpa2-key1 <- 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 - 117
    Apr 21 13:30:46 wpa2-key2 -> 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 - 167 wrong replay counter
    Apr 21 13:30:46 wpa2-key1 <- 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 - 117
    Apr 21 13:30:46 wpa2-key2 -> 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 - 167
    Apr 21 13:30:46 wpa2-key3 <- 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 - 151
    Apr 21 13:30:46 wpa2-key4 -> 3c:f0:11:90:b3:ac 6c:f3:7f:ce:4e:30 - 95

     

    Then we found the below article. 

    https://arubanetworkskb.secure.force.com/pkb/articles/Troubleshooting/R-450



  • 2.  RE: User got "wrong replay counter" error for wpa2-key2 during authentication

    EMPLOYEE
    Posted Apr 21, 2020 10:19 AM

    Whether or not you would change the timers in the linked article depend on what type of device is losing connectivity?  The first thing I would do  is make sure that device has the most up to date drivers.  The second thing I would do is ensure there is no interference that is interfering with connectivity.  Changing timers would be something that we did in the past, but not something that we do much anymore and is typically a last resort...