802.1X Authentication failed without 802.1X authentication enabled

Question

Hi,
we are using 2 WISMs, with version 4.2.207 and a WCS to control them.
It seemed to work fine for about 2 weeks, and now we detected the following problem in some users. They were connected to the wireless without problems, and then they lost the connection. For authentication we use WPA2, we also use mac-filter.
When they lost the connection we can see the following error:
Message:
Client 'mac address' which was associated with AP 'mac address', interface '1' is excluded. The reason code is '4(802.1X Authentication failed 3 times.)'.
Message:
Client 'mac' which was associated with AP 'mac', interface '0' is excluded. The reason code is '4(802.1X Authentication failed 3 times.)'.
I also attach an output of the troubleshoot mac address...
Can some help me with this?
Thank you.
Best regards,

Answer 1

Hi Kirbus,
we open a TAC and we were advised for now to do the following changes:
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin:0cm;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman","serif";}
1.       please make sure to disable Aironet extensions (if present)  , on the WLAN advanced configuration
2.       disable management frame protection (MFP) signature generation (if present) , MFP also on the WLAN advanced configuration
3.       on the WLC general configuration , can you please disable aggressive load balancing
4.       on the security tab on the WLC , please wireless protection policies > disable client exclusion policies
5.       on the AP network configuration please disable short preamble the original standard was long preambles
6.       Wireless -> disable auto-RRM channel & power assignment & try "on demand"
7.       apply these modification on the WLC CLI
Config advanced eap identity-request-timeout 20
Config advanced eap identity-request-retries 10
Config advanced eap request-timeout 20
Config advanced eap request-retries 10
Save config, and see if you still face the problem.
We are still monitoring the solution, but until now we didn't face the problem again.
Let me now how it goes for you.
Thank you.
Best regards,