Samsung Galaxy note, Android 4.1.2, stock + rooted can not connect

[Rosa Ladeira]

I am working on tunneling a wireless network with the following components:

wlan-controller-14-4 impa-wireless4 --> AIR-WLC2106-K9
wlan-controller-14-2 impa-wireless2 --> AIR-WLC2106-K
11 AIR-LAP1131AG-A-K9
10 AIR-LAP1252AG-T-K9

They are geographically distributed on four floors in the same building.

I have configured RRM feature on both 802.11 a/n and 802.11 b/g/n

A Samsung Galaxy note, Android 4.1.2, stock + rooted can not connect,
although having a high level sign.

I have been seen messages like above

Mar 27 12:43:04 wlan-controller-14-4 impa-wireless4: *dot1xMsgTask:
Mar 27 12:42:57.710: %DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444
Max EAPOL-key M3 retransmissions exceeded for client
50:cc:f8:86:80:7e
Mar 27 13:28:44 wlan-controller-14-2 impa-wireless2: *dot1xMsgTask:
Mar 27 13:28:37.526: %DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444
Max EAPOL-key M1 retransmissions exceeded for client
50:cc:f8:86:80:7e
Mar 27 13:30:03 wlan-controller-14-2 impa-wireless2: *dot1xMsgTask:
Mar 27 13:29:56.714: %DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444
Max EAPOL-key M1 retransmissions exceeded for client
50:cc:f8:86:80:7e
Mar 27 14:00:34 wlan-controller-14-4 impa-wireless4:
*apfMsConnTask_0: Mar 27 14:00:27.740: %APF-4-ASSOCREQ_PROC_FAILED:
apf_80211.c:3240 Failed to process an association request from
50:cc:f8:86:80:7e. WLAN:1, SSID:impa-nwl. mobile in database timed
out.

Any idea?

[Rasika Nayanajith]

What AireOS version running on these two controllers ?

Are they in the same mobility group & mobility configured each other ?

Attach the "show wlan <wlan-id>" output to see how you configure the SSID.

HTH

Rasika

*** Pls rate all useful resposnes ****

[Rosa Ladeira]

impa-wireless4 : Software Version 7.0.235.0

impa-wireless2 : Software Version 7.0.235.0

Yes both controller are on Local Mobility Group impa-wl-novo

Keep Alive Count 3

Keep Alive Interval 10s

Symmetric Mobility Tunneling mode    Enabled

WLAN Identifier.................................. 1
Profile Name..................................... impa-nwl
Network Name (SSID).............................. impa-nwl
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control

  Radius-NAC State............................... Disabled
  SNMP-NAC State................................. Disabled
  Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Number of Active Clients......................... 134
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 1800 seconds
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ wifi-clients
Multicast Interface.............................. Not Configured

WLAN ACL......................................... unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Quality of Service............................... Silver (best effort)
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Disabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
IPv6 Support..................................... Disabled
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ Disabled

   Accounting.................................... Disabled
   Dynamic Interface............................. Disabled
Local EAP Authentication......................... Disabled
Security

   802.11 Authentication:........................ Open System
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
   Auth Key Management
         802.1x.................................. Disabled
         PSK..................................... Enabled
         CCKM.................................... Disabled
         FT(802.11r)............................. Disabled
         FT-PSK(802.11r)......................... Disabled
FT Reassociation Timeout......................... 20
FT Over-The-Air mode............................. Enabled

FT Over-The-Ds mode.............................. Enabled
CCKM tsf Tolerance............................... 1000
   CKIP ......................................... Disabled
   Web Based Authentication...................... Disabled
   Web-Passthrough............................... Disabled
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   H-REAP Local Switching........................ Disabled
   H-REAP Local Authentication................... Disabled
   H-REAP Learn IP Address....................... Enabled
   Client MFP.................................... Optional
   Tkip MIC Countermeasure Hold-down Timer....... 60
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled

 Mobility Anchor List
 WLAN ID     IP Address            Status
 -------     ---------------       -----

DSCP Value 0

no Mutlicast config

[Rasika Nayanajith]

Hi

Try this with disabling WPA/AES option highlighed below. Just leave WPA2/AES under WLAN security settings

  Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled

If that does not succeed please provide "show mobility summary" output as well just to confirm mobility is working fine.

HTH

Rasika

*** Pls rate all useful responses ****

[Rosa Ladeira]

I have already done

   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Disabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
                                                               Auth Key Management
         802.1x.................................. Disabled
         PSK..................................... Enabled
         CCKM.................................... Disabled
         FT(802.11r)............................. Disabled
         FT-PSK(802.11r)......................... Disabled

mobility status is up

let's wait and see what goes on