AES Encryption No Longer Working

Question

Last week we had users complaining that they could no longer connect to wireless.  They were receiving a limited or no connectivity message.  Upon researching the issue, I found that if I removed the AES encryption, from WPA2, users were able to connect again with TKIP.  In speaking to a few admins, they stated that TKIP was the preferred method that was chosen years ago.  My first question is this.....In our WLAN's, we had the options for WPA/TKIP-AES, and WPA2/TKIP-AES.  I'm assuming this would allow the PC to use whichever encryption method was preferred.  However, this doesn't seem to be the case.  The PC chose AES, which caused the issue that they were having.  Would this be something PC based?   I'm assuming the controller only gives the ability.  It won't actually dictate which encryption method is used, unless one of the options is turned off (like we did with AES).  My second question is this....TKIP, being a weaker encryption method, isn't what I want our users using.  How could I migrate to AES?  Are there specific instructions to move from TKIP to AES?  Is it more than just putting a check mark on the AES options, under WLAN security?  Thanks for any help!

Answer 1

Its best to only use either WPA/TKIP or WPA2/AES, not both or a mix of either.  This does cause issues with devices so its hit or miss.  If you had configured everything for WPA2/TKIP, well... your stuck with a non standard IEEE setting, and you will have to just configure that on the WLC.  It's the same if you were using WPA/AES.  
The best way to move to a standard, is if your devices were domain machines and you can push out a GPO.  Non domain machines, you would need to manually enter those unless you had a tool that manages them.