Apple iOS Devices getting DEAUTH'd after approx 5 minutes

tim.johnson@uss.co.uk · ‎03-28-2017

Hi,

We have an issue where mobile devices (mostly Apple iPhones and iPads running a variety of OS versions) are getting de-authenticated from our guest wi-fi solution (using ForeScout) after around 5 minutes of inactivity on the lock screen. These devices seem to put their Wi-fi into some kind of sleep mode while they are on the lock screen. We initially believed that this could be due to the User Idle Timeout value and the Session Timeout values but after changing these to 8 hours we have not seen any difference. We've tried everything in these forums and the Cisco guides for iOS devices but to no avail.

We did a client debug on the 5508 controller against the phone and found the following happened:

*apfMsConnTask_6: Mar 22 11:37:49.522: 2c:33:61:0f:f7:fc Got action frame from this client.
*apfMsConnTask_4: Mar 22 11:40:52.288: dot1xDoesPmkIdMatchPmk2, Received 11w Flag: 0

(Cisco Controller) >*apfMsConnTask_6: Mar 22 11:41:18.277: dot1xDoesPmkIdMatchPmk2, Received 11w Flag: 0
*apfMsConnTask_5: Mar 22 11:41:36.319: Ms with adaptive capability found

(Cisco Controller) >*apfMsConnTask_4: Mar 22 11:42:13.026: Ms with adaptive capability found

*apfMsConnTask_4: Mar 22 11:42:31.371: dot1xDoesPmkIdMatchPmk2, Received 11w Flag: 0

(Cisco Controller) >
(Cisco Controller) >*apfMsConnTask_6: Mar 22 11:42:50.095: dot1xDoesPmkIdMatchPmk2, Received 11w Flag: 0
*apfMsConnTask_5: Mar 22 11:43:25.420: dot1xDoesPmkIdMatchPmk2, Received 11w Flag: 0
*apfMsConnTask_5: Mar 22 11:43:33.769: dot1xDoesPmkIdMatchPmk2, Received 11w Flag: 0
*apfMsConnTask_4: Mar 22 11:43:44.453: dot1xDoesPmkIdMatchPmk2, Received 11w Flag: 0

(Cisco Controller) >*apfMsConnTask_4: Mar 22 11:43:50.937: dot1xDoesPmkIdMatchPmk2, Received 11w Flag: 0
*SNMPTask: Mar 22 11:44:08.808: 2c:33:61:0f:f7:fc apfMsDeleteByMscb Scheduling mobile for deletion with deleteReason 6, reasonCode 252

*SNMPTask: Mar 22 11:44:08.808: 2c:33:61:0f:f7:fc Scheduling deletion of Mobile Station: (callerId: 30) in 1 seconds
*osapiBsnTimer: Mar 22 11:44:09.723: 2c:33:61:0f:f7:fc apfMsExpireCallback (apf_ms.c:637) Expiring Mobile!
*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc apfMsExpireMobileStation (apf_ms.c:7521) Changing state for mobile 2c:33:61:0f:f7:fc on AP 6c:99:89:a6:84:60 from Associated to Disassociated

*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc apfSendDisAssocMsgDebug (apf_80211.c:3541) Changing state for mobile 2c:33:61:0f:f7:fc on AP 6c:99:89:a6:84:60 from Disassociated to Disassociated

*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc Sent Disassociate to mobile on AP 6c:99:89:a6:84:60-1 (reason 1, caller apf_ms.c:7614)
*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc Sent Deauthenticate to mobile on BSSID 6c:99:89:a6:84:6b slot 1(caller apf_ms.c:7616)
*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc Setting active key cache index 8 ---> 8
*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc Deleting the PMK cache when de-authenticating the client.
*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc Global PMK Cache deletion failed.
*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc apfMsAssoStateDec
*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc apfMsExpireMobileStation (apf_ms.c:7657) Changing state for mobile 2c:33:61:0f:f7:fc on AP 6c:99:89:a6:84:60 from Disassociated to Idle

*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc pemApfDeleteMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0.
*apfReceiveTask: Mar 22 11:44:09.724: 2c:33:61:0f:f7:fc 172.30.137.17 START (0) Deleted mobile LWAPP rule on AP [6c:99:89:a6:84:60]
*apfReceiveTask: Mar 22 11:44:09.725: 2c:33:61:0f:f7:fc Deleting mobile on AP 6c:99:89:a6:84:60(1)
*spamApTask7: Mar 22 11:44:09.728: 2c:33:61:0f:f7:fc Delete Mobile request sent to the AP 172.50.67.45:40762

Can anyone please help us? we are getting nowhere with our support provider and cannot find what reasoncode 252 means in order to help us work out what is happening here.

Thanks,

Tim

Alexey Belousov · ‎03-28-2017

Hello

if you use web-auth, you can try to use sleep client feature.

tim.johnson@uss.co.uk · ‎03-28-2017

Hi,

We don't use the inbuilt Web Auth - we use an external Radius server of the Forescout NAC appliance.

I've tried adjusting the web auth timeout anyway with no luck - but thank you for the suggestion.

Tim

Alexey Belousov · ‎03-28-2017

May be something with MFP? Try to disable it ( if enabled).

Here is another Deauth frame captured. This is triggered when I enable client management frame protection on a SSID. This time AP sending deauth to client with reason code 6 – Class 2 frame received from nonauthenticated station.

https://mrncciew.com/2014/10/11/802-11-mgmt-deauth-disassociation-frames/

er17martin · ‎03-28-2017

Hey,

I've experienced a very similar issue. Do you mind posting some additional info?

Can you run the following command "Show wlan <Wlan ID>"?

Please post the output of these lines from the show command

Number of Active Clients......................... 115
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 28800 seconds
User Idle Timeout................................ 28800 seconds
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
User Idle Threshold.............................. 0 Bytes

.....

Auth Key Management

FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Disabled
PMF-1X(802.11w)......................... Disabled
PMF-PSK(802.11w)........................ Disabled
FT Reassociation Timeout................... 20
FT Over-The-DS mode........................ Disabled

...

Client MFP.................................... Optional but inactive (WPA2 not configured)
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60

I know you mentioned the Idle/session timeouts were adjust to eight hours.

tim.johnson@uss.co.uk · ‎03-29-2017

Hi

Thanks for your reply! Here are our values:

Number of Active Clients......................... 4
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 28800 seconds
User Idle Timeout................................ 14400 seconds
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
User Idle Threshold.............................. 0 Bytes

We don't seem to have the other values so here is the whole section:

WLAN Identifier.................................. 4
Profile Name..................................... FunkyWifi
Network Name (SSID).............................. FunkyWifi
Status........................................... Enabled
MAC Filtering.................................... Enabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Enabled
Network Admission Control
Client Profiling Status
Radius Profiling ............................ Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Local Profiling ............................. Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Radius-NAC State............................... Enabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum Clients Allowed.......................... Unlimited
Maximum number of Clients per AP Radio........... 200

--More-- or (q)uit
ATF Policy....................................... 0
Number of Active Clients......................... 4
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 28800 seconds
User Idle Timeout................................ 14400 seconds
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... none
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ nac-guest
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
WLAN URL ACL..................................... unconfigured
mDNS Status...................................... Disabled
mDNS Profile Name................................ unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Enabled
Static IP client tunneling....................... Disabled
Tunnel Profile................................... Unconfigured

--More-- or (q)uit
PMIPv6 Mobility Type............................. none
PMIPv6 MAG Profile........................... Unconfigured
PMIPv6 Default Realm......................... Unconfigured
PMIPv6 NAI Type.............................. Hexadecimal
PMIPv6 MAG location.......................... AP
Quality of Service............................... Silver
Per-SSID Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-Client Rate Limits........................... Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled

--More-- or (q)uit
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... 802.1P (Tag=0)
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Drop
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
Authentication................................ 172.10.25.31 1812 *
Authentication................................ 172.10.65.32 1812 *
Authentication................................ 172.10.65.30 1812
Accounting.................................... 172.10.65.37 1813 *
Accounting.................................... 172.10.65.34 1813 *
Accounting.................................... 172.10.65.33 1813
Interim Update............................. Enabled
Interim Update Interval.................... 0
Framed IPv6 Acct AVP ...................... Prefix
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Radius NAI-Realm................................. Disabled
Mu-Mimo.......................................... Enabled

--More-- or (q)uit
Security

802.11 Authentication:........................ Open System
FT Support.................................... Disabled
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Disabled
Wi-Fi Direct policy configured................ Disabled
EAP-Passthrough............................... Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web Authentication Timeout.................... 14400
Web-Passthrough............................... Disabled
Mac-auth-server............................... 0.0.0.0
Web-portal-server............................. 0.0.0.0
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
Auto Anchor................................... Disabled
FlexConnect Local Switching................... Enabled
FlexConnect Central Association............... Disabled
flexconnect Central Dhcp Flag................. Disabled
flexconnect nat-pat Flag...................... Disabled
flexconnect Dns Override Flag................. Disabled

--More-- or (q)uit
flexconnect PPPoE pass-through................ Disabled
flexconnect local-switching IP-source-guar.... Disabled
FlexConnect Vlan based Central Switching ..... Disabled
FlexConnect Local Authentication.............. Disabled
FlexConnect Learn IP Address.................. Enabled
Client MFP.................................... Optional but inactive (WPA2 not configured)
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60
Eap-params.................................... Not Applicable
AVC Visibilty.................................... Disabled
AVC Profile Name................................. None
Flex Avc Profile Name............................ None
Flow Monitor Name................................ None
Split Tunnel Configuration
Split Tunnel................................. Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled

--More-- or (q)uit
802.11k Neighbor List............................ Enabled
802.11k Neighbor List Dual Band.................. Disabled
802.11v Directed Multicast Service............... Enabled
802.11v BSS Max Idle Service..................... Enabled
802.11v BSS Transition Service................... Disabled
802.11v BSS Transition Disassoc Imminent......... Disabled
802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40
DMS DB is empty
Band Select...................................... Disabled
Load Balancing................................... Disabled
Multicast Buffer................................. Disabled
Universal Ap Admin............................... Disabled
Broadcast Tagging................................ Disabled

Mobility Anchor List
WLAN ID IP Address Status Priority
------- --------------- ------ --------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

--More-- or (q)uit
Local Policy
----------------
Priority Policy Name
-------- ---------------

Lync State ...................................... Disabled
Audio QoS Policy................................. Silver
Video QoS Policy................................. Silver
App-Share QoS Policy............................. Silver
File Transfer QoS Policy......................... Silver
QoS Fastlane Status.............................. Disable

(Cisco Controller) >?

Carl Burton · ‎04-30-2018

You probably already solved this one but we had the same issue and found that if we disable infrastructure management frame protection (not client) if 802.11v transition support is enabled or disable 802.11v have infrastructure MFP enabled.

Infrastructure MFP is a global setting and is located in Security -> Wireless Protection Policies - AP Authentication.