Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Client excluded 802.1x authentication failed

We had a wireless controller fail at one of our locations and thus our access points failed over to the controller at our other location, so far so good as my laptop continued to work fine.  Once we replaced the failed controller at my location my laptop will not connect to the access points, I see the following error for my laptop:

Client Excluded: MACAddress:xx:xx:xx:xx:xx:bd Base Radio MAC :yy:yy:yy:yy:yy:yy  Slot: 0 User Name: unknown Ip Address: unknown Reason:802.1x Authentication  failed 3 times. ReasonCode: 4

Just the past Friday I went to our other location and was able to successfully connect to the wireless network there (which is the same name as the wireless network at my location).  So here I thought everything was fine, but when I came back to my primary location still getting the same error and I'm unable to connect.

I've run these commands to remove the wifi profile from my laptop:

netsh show profiles

netsh delete="profile name"

I've looked at the setting in the controller and from what I can tell they are the same at both locations.

Any ideas as to what could be causing this??  It is very annoying.  No one else has an issue and my Android phone can connect just fine to this wifi network.

4 REPLIES

Hi guys,Any suggestion for a

Hi guys,

Any suggestion for a similar issue.

Here are the logs for my laptop when attempting to authenticate:

essSsidIE  ssid_done_flag is 0 finish_flag is 0

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 STA - rates (8): 130 132 139 150 36 48 72 108 12 18 24 96 0 0 0 0

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 suppRates  statusCode is 0 and gotSuppRatesElement is 1

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 STA - rates (12): 130 132 139 150 36 48 72 108 12 18 24 96 0 0 0 0

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 extSuppRates  statusCode is 0 and gotExtSuppRatesElement is 1

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 Processing RSN IE type 48, length 20 for mobile 70:18:8b:c6:8a:b8

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 Received RSN IE with 0 PMKIDs from mobile 70:18:8b:c6:8a:b8

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 Setting active key cache index 8 ---> 8

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 unsetting PmkIdValidatedByAp

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 0.0.0.0 8021X_REQD (3) Initializing policy

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 0.0.0.0 8021X_REQD (3) Change state to AUTHCHECK (2) last state 8021X_REQD (3)

 

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state AUTHCHECK (2)

 

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 0.0.0.0 8021X_REQD (3) DHCP required on AP 2c:3e:cf:73:a5:90 vapId 1 apVapId 1for this client

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 Not Using WMM Compliance code qosCap 00

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 0.0.0.0 8021X_REQD (3) Plumbed mobile LWAPP rule on AP 2c:3e:cf:73:a5:90 vapId 1 apVapId 1 flex-acl-name:

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 apfPemAddUser2 (apf_policy.c:333) Changing state for mobile 70:18:8b:c6:8a:b8 on AP 2c:3e:cf:73:a5:90 from Associated to Associated

 

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 apfPemAddUser2:session timeout forstation 70:18:8b:c6:8a:b8 - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is  0

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 Stopping deletion of Mobile Station: (callerId: 48)

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 Func: apfPemAddUser2, Ms Timeout = 0, Session Timeout = 0

 

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 Sending Assoc Response to station on BSSID 2c:3e:cf:73:a5:90 (status 0) ApVapId 1 Slot 0

*apfMsConnTask_3: Apr 28 12:47:56.397: 70:18:8b:c6:8a:b8 apfProcessAssocReq (apf_80211.c:7957) Changing state for mobile 70:18:8b:c6:8a:b8 on AP 2c:3e:cf:73:a5:90 from Associated to Associated

 

*dot1xMsgTask: Apr 28 12:47:56.399: 70:18:8b:c6:8a:b8 dot1x - moving mobile 70:18:8b:c6:8a:b8 into Connecting state

*dot1xMsgTask: Apr 28 12:47:56.399: 70:18:8b:c6:8a:b8 Sending EAP-Request/Identity to mobile 70:18:8b:c6:8a:b8 (EAP Id 1)

*Dot1x_NW_MsgTask_0: Apr 28 12:47:56.437: 70:18:8b:c6:8a:b8 Received EAPOL START from mobile 70:18:8b:c6:8a:b8

*Dot1x_NW_MsgTask_0: Apr 28 12:47:56.437: 70:18:8b:c6:8a:b8 dot1x - moving mobile 70:18:8b:c6:8a:b8 into Connecting state

*Dot1x_NW_MsgTask_0: Apr 28 12:47:56.437: 70:18:8b:c6:8a:b8 Sending EAP-Request/Iden

 

               Here is the SSID config:

 

show wlan 1

 

 

WLAN Identifier.................................. 1

Profile Name..................................... Ste-Internal

Network Name (SSID).............................. Ste

Status........................................... Enabled

MAC Filtering.................................... Disabled

Broadcast SSID................................... Enabled

AAA Policy Override.............................. Disabled

Network Admission Control

Client Profiling Status

    Radius Profiling ............................ Disabled

     DHCP ....................................... Disabled

     HTTP ....................................... Disabled

    Local Profiling ............................. Disabled

     DHCP ....................................... Disabled

     HTTP ....................................... Disabled

 Radius-NAC State............................... Disabled

  SNMP-NAC State................................. Disabled

  Quarantine VLAN................................ 0

Maximum number of Associated Clients............. 0

Maximum number of Clients per AP Radio........... 200

 

--More-- or (q)uit

Number of Active Clients......................... 5

Exclusionlist Timeout............................ 60 seconds

Session Timeout.................................. 1800 seconds

User Idle Timeout................................ Disabled

Sleep Client..................................... disable

Sleep Client Timeout............................. 12 hours

User Idle Threshold.............................. 0 Bytes

NAS-identifier................................... Cisco vWLC

CHD per WLAN..................................... Enabled

Webauth DHCP exclusion........................... Disabled

Interface........................................ management

Multicast Interface.............................. Not Configured

WLAN IPv4 ACL.................................... unconfigured

WLAN IPv6 ACL.................................... unconfigured

WLAN Layer2 ACL.................................. unconfigured

mDNS Status...................................... Disabled

mDNS Profile Name................................ unconfigured

DHCP Server...................................... Default

DHCP Address Assignment Required................. Disabled

Static IP client tunneling....................... Disabled

Quality of Service............................... Silver

Per-SSID Rate Limits............................. Upstream      Downstream

Average Data Rate................................   0             0

 

--More-- or (q)uit

Average Realtime Data Rate.......................   0             0

Burst Data Rate..................................   0             0

Burst Realtime Data Rate.........................   0             0

Per-Client Rate Limits........................... Upstream      Downstream

Average Data Rate................................   0             0

Average Realtime Data Rate.......................   0             0

Burst Data Rate..................................   0             0

Burst Realtime Data Rate.........................   0             0

Scan Defer Priority.............................. 4,5,6

Scan Defer Time.................................. 100 milliseconds

WMM.............................................. Allowed

WMM UAPSD Compliant Client Support............... Disabled

Media Stream Multicast-direct.................... Disabled

CCX - AironetIe Support.......................... Enabled

CCX - Gratuitous ProbeResponse (GPR)............. Disabled

CCX - Diagnostics Channel Capability............. Disabled

Dot11-Phone Mode (7920).......................... Disabled

Wired Protocol................................... None

Passive Client Feature........................... Disabled

Peer-to-Peer Blocking Action..................... Disabled

Radio Policy..................................... All

DTIM period for 802.11a radio.................... 1

DTIM period for 802.11b radio.................... 1

 

--More-- or (q)uit

Radius Servers

   Authentication................................ Global Servers

   Accounting.................................... Global Servers

      Interim Update............................. Disabled

      Framed IPv6 Acct AVP ...................... Prefix

   Dynamic Interface............................. Disabled

   Dynamic Interface Priority.................... wlan

Local EAP Authentication......................... Disabled

Security

 

   802.11 Authentication:........................ Open System

   FT Support.................................... Disabled

   Static WEP Keys............................... Disabled

   802.1X........................................ Disabled

   Wi-Fi Protected Access (WPA/WPA2)............. Enabled

      WPA (SSN IE)............................... Disabled

      WPA2 (RSN IE).............................. Enabled

         TKIP Cipher............................. Disabled

         AES Cipher.............................. Enabled

                                                               Auth Key Management

         802.1x.................................. Enabled

         PSK..................................... Disabled

         CCKM.................................... Disabled

 

--More-- or (q)uit

         FT-1X(802.11r).......................... Disabled

         FT-PSK(802.11r)......................... Disabled

         PMF-1X(802.11w)......................... Disabled

         PMF-PSK(802.11w)........................ Disabled

      FT Reassociation Timeout................... 20

      FT Over-The-DS mode........................ Disabled

      GTK Randomization.......................... Disabled

      SKC Cache Support.......................... Disabled

      CCKM TSF Tolerance......................... 1000

   WAPI.......................................... Disabled

   Wi-Fi Direct policy configured................ Disabled

   EAP-Passthrough............................... Disabled

   CKIP ......................................... Disabled

   Web Based Authentication...................... Disabled

   Web-Passthrough............................... Disabled

   Conditional Web Redirect...................... Disabled

   Splash-Page Web Redirect...................... Disabled

   Auto Anchor................................... Disabled

   FlexConnect Local Switching................... Enabled

   flexconnect Central Dhcp Flag................. Disabled

   flexconnect nat-pat Flag...................... Disabled

   flexconnect Dns Override Flag................. Disabled

   flexconnect PPPoE pass-through................ Disabled

 

--More-- or (q)uit

   flexconnect local-switching IP-source-guar.... Disabled

   FlexConnect Vlan based Central Switching ..... Disabled

   FlexConnect Local Authentication.............. Disabled

   FlexConnect Learn IP Address.................. Enabled

   Client MFP.................................... Optional

   PMF........................................... Disabled

   PMF Association Comeback Time................. 1

   PMF SA Query RetryTimeout..................... 200

   Tkip MIC Countermeasure Hold-down Timer....... 60

AVC Visibilty.................................... Disabled

AVC Profile Name................................. None

Flow Monitor Name................................ None

Split Tunnel (Printers).......................... Disabled

Call Snooping.................................... Disabled

Roamed Call Re-Anchor Policy..................... Disabled

SIP CAC Fail Send-486-Busy Policy................ Enabled

SIP CAC Fail Send Dis-Association Policy......... Disabled

KTS based CAC Policy............................. Disabled

Assisted Roaming Prediction Optimization......... Disabled

802.11k Neighbor List............................ Disabled

802.11k Neighbor List Dual Band.................. Disabled

Band Select...................................... Disabled

Load Balancing................................... Disabled

 

--More-- or (q)uit

Multicast Buffer................................. Disabled

 

Mobility Anchor List

WLAN ID     IP Address            Status

-------     ---------------       ------

 

802.11u........................................ Disabled

 

MSAP Services.................................. Disabled

 

 

               Here is some Radius info:

 

(Cisco Controller) >show radius summary

 

Vendor Id Backward Compatibility................. Disabled

Call Station Id Case............................. lower

Call Station Id Type............................. Mac Address

Auth Call Station Id Type........................ AP's Mac Address:SSID

Aggressive Failover.............................. Enabled

Keywrap.......................................... Disabled

Fallback Test:

    Test Mode.................................... Off

    Probe User Name.............................. cisco-probe

    Interval (in seconds)........................ 300

MAC Delimiter for Authentication Messages........ colon

MAC Delimiter for Accounting Messages............ hyphen

 

Authentication Servers

 

Idx  Type      Server Address        Port    State     Tout  MgmtTout  RFC3576  IPSec - AuthMode/Phase1/Group/Lifetime/Auth/Encr

---  ----  ----------------------   ------  --------  ----  --------  -------  ------------------------------------------------

1    NM    172.17.32.71             1812    Enabled   2     2         Enabled   Disabled - none/unknown/group-0/0 none/none

2    N     172.17.120.71            1812    Enabled   2     2         Enabled   Disabled - none/unknown/group-0/0 none/none

 

Accounting Servers

 

--More-- or (q)uit

 

Idx  Type      Server Address        Port    State     Tout  MgmtTout  RFC3576  IPSec - AuthMode/Phase1/Group/Lifetime/Auth/Encr

---  ----  ----------------------   ------  --------  ----  --------  -------  ------------------------------------------------

1      N     172.17.32.71             1813    Enabled   2     2         N/A       Disabled - none/unknown/group-0/0 none/none

2      N     172.17.120.71            1813    Enabled   2     2         N/A       Disabled - none/unknown/group-0/0 none/none

 

              

(Cisco Controller) >show radius auth statistics

Authentication Servers:

 

Server Index..................................... 1

Server Address................................... 172.17.32.71

Msg Round Trip Time.............................. 82 (msec)

First Requests................................... 136

Retry Requests................................... 0

Accept Responses................................. 11

Reject Responses................................. 117

Challenge Responses.............................. 8

Malformed Msgs................................... 0

Bad Authenticator Msgs........................... 0

Pending Requests................................. 0

Timeout Requests................................. 0

Unknowntype Msgs................................. 0

Other Drops...................................... 0

 

 

Server Index..................................... 2

Server Address................................... 172.17.120.71

Msg Round Trip Time.............................. 0 (msec)

First Requests................................... 0

 

--More-- or (q)uit

Retry Requests................................... 0

Accept Responses................................. 0

Reject Responses................................. 0

Challenge Responses.............................. 0

Malformed Msgs................................... 0

Bad Authenticator Msgs........................... 0

Pending Requests................................. 0

Timeout Requests................................. 0

Unknowntype Msgs................................. 0

Other Drops...................................... 0

 

Authentication Total:

 

First Requests................................... 36926

Retry Requests................................... 232

Accept Responses................................. 2488

Reject Responses................................. 23560

Challenge Responses.............................. 10862

 

               Some WLC info:

 

show>sysinfo

 

Manufacturer's Name.............................. Cisco Systems Inc.

Product Name..................................... Cisco Controller

Product Version.................................. 7.5.102.0

RTOS Version..................................... 7.5.102.0

Bootloader Version............................... 7.5.102.0

Emergency Image Version.......................... 7.5.102.0

 

Build Type....................................... DATA + WPS

 

System Name...................................... Cisco vWLC

System Location.................................. Bucharest

System Contact................................... florinb@Ste.com

System ObjectID.................................. 1.3.6.1.4.1.9.1.1631

IP Address....................................... 172.17.32.52

System Up Time................................... 10 days 5 hrs 29 mins 44 secs

System Timezone Location......................... (GMT +2:00) Jerusalem

System Stats Realtime Interval................... 5

System Stats Normal Interval..................... 180

 

Configured Country............................... Multiple Countries:BE,PL,RO

 

 

--More-- or (q)uit

State of 802.11b Network......................... Enabled

State of 802.11a Network......................... Enabled

Number of WLANs.................................. 3

Number of Active Clients......................... 37

 

Burned-in MAC Address............................ 00:50:56:81:62:34

Maximum number of APs supported.................. 15

 

New Member

What does your radiusserver

What does your radiusserver tell you in the logs?

Your WLC config seems to be fine.

 

Regards,

Erik

As usual the Window Server

As usual the Window Server runs on 2008 R2 and they said to me, there are no logs for the yesterday's outage.

 

I also have opened a TAC ticket and I will return with their answer. If you guys have any suggestion in the mean time....

New Member

Hi All,Is this case solved

Hi All,

Is this case solved.

Florin, can you inform us about your case?

I have the same problem:

*apfMsConnTask_4: Dec 29 10:31:38.962: 0c:37:dc:ed:65:92 Association received from mobile on AP 00:08:30:4a:16:70
*apfMsConnTask_4: Dec 29 10:31:38.962: 0c:37:dc:ed:65:92 0.0.0.0 START (0) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1621)
*apfMsConnTask_4: Dec 29 10:31:38.962: 0c:37:dc:ed:65:92 Applying site-specific IPv6 override for station 0c:37:dc:ed:65:92 - vapId 5, site 'ACS5_APGroup', interface 'ses'
*apfMsConnTask_4: Dec 29 10:31:38.962: 0c:37:dc:ed:65:92 Applying IPv6 Interface Policy for station 0c:37:dc:ed:65:92 - vlan 20, interface id 12, interface 'ses'
*apfMsConnTask_4: Dec 29 10:31:38.962: 0c:37:dc:ed:65:92 Applying site-specific override for station 0c:37:dc:ed:65:92 - vapId 5, site 'ACS5_APGroup', interface 'ses'
*apfMsConnTask_4: Dec 29 10:31:38.962: 0c:37:dc:ed:65:92 0.0.0.0 START (0) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1621)
*apfMsConnTask_4: Dec 29 10:31:38.963: 0c:37:dc:ed:65:92 STA - rates (8): 130 132 139 12 18 150 24 36 48 72 96 108 0 0 0 0
*apfMsConnTask_4: Dec 29 10:31:38.963: 0c:37:dc:ed:65:92 STA - rates (12): 130 132 139 12 18 150 24 36 48 72 96 108 0 0 0 0
*apfMsConnTask_4: Dec 29 10:31:38.963: 0c:37:dc:ed:65:92 apfProcessAssocReq (apf_80211.c:5122) Changing state for mobile 0c:37:dc:ed:65:92 on AP 00:08:30:4a:16:70 from Authenticated to AAA Pending

*apfMsConnTask_4: Dec 29 10:31:38.963: 0c:37:dc:ed:65:92 Scheduling deletion of Mobile Station:  (callerId: 20) in 10 seconds
*apfReceiveTask: Dec 29 10:31:38.970: 0c:37:dc:ed:65:92 Sending Assoc Response to station on BSSID 00:08:30:4a:16:70 (status 1) ApVapId 1 Slot 0
*apfReceiveTask: Dec 29 10:31:38.970: 0c:37:dc:ed:65:92 apfProcessRadiusAssocResp (apf_80211.c:2271) Changing state for mobile 0c:37:dc:ed:65:92 on AP 00:08:30:4a:16:70 from AAA Pending to Authenticated

1028
Views
0
Helpful
4
Replies