Getting disconnected randomly (5508 controller, 3300 series LAPs)

Question

I am at one of our remote offices and I am noticing my laptop, despite excellent signal strength is periodically losing IP connectivity on the wireless network.  When it drops, all of my IP connectivity stops (pings fail, RDP sessions "await reconnection", etc...).  The lower right corner still shows I'm connected to the hidden WPA2 Enterprise SSID.  The only way to reconnect is to select disconnect on it, then click connect again.  Immediately everything IP based starts working.
There is a 5508 controller in the headquarters.  The site I am at has a 30mbps fiber point to point WAN to the headquarters.  This site has 2 x 3300 series LAPs which are very good coverage.  H-REAP mode is on so traffic terminates at the local office because it is more efficient than traversing the LAN twice for things like local file and print sharing, dhcp, proper active directory sites and services mapping, etc...
The 5508 has a 2008 R2 server running NPS to do radius authentication and it verifies a domain certificate.  To be on the wireless you have to be a member of the domain.
Seems to not give me any problems at the home office so any idea's?
On the 5508 I see this around the times I lose IP connectivity:
*Dot1x_NW_MsgTask_4: Jan 08 14:00:53.599: #DOT1X-3-INVALID_WPA_KEY_MSG_STATE: 1x_eapkey.c:861 Received invalid EAPOL-key M2 msg in START  state - invalid secure bit; KeyLen 24, Key type 1, client 88:53:2e:xx:xx:xx
*Dot1x_NW_MsgTask_4: Jan 08 14:00:52.551: #DOT1X-3-INVALID_WPA_KEY_MSG_STATE: 1x_eapkey.c:861 Received invalid EAPOL-key M2 msg in START  state - invalid secure bit; KeyLen 24, Key type 1, client 88:53:2e:xx:xx:xx
*Dot1x_NW_MsgTask_4: Jan 08 14:00:52.387: #DOT1X-3-ABORT_AUTH: 1x_bauth_sm.c:447  Authentication Aborted for client 88:53:2e:xx:xx:xx
I have 0 (unlimited) as the max for user login policies so not sure why Authentication Aborted message appears.
WLC Software version
7.4.100.0
On the NPS server (2008 R2) I just see my username granted access because it matches the network health policy.
Laptop Sony VAIO SE2
Intel Centrino Advanced-N 6230
Driver version 15.1.1.1 Date: 3/12/2012

Answer 1

Well I'm going to try to move the EAP-Broadcast Key Interval back.  It was set to 3600 which in seconds equals 1 hour.  Seems like not only my laptop but others now have been reporting that every hour on the dot, they stop passing IP traffic.  The regular users just reboot, while people "in the know" disconnect and reconnect, and they are good for an hour.
Towards the bottom of this thread here:
https://discussions.apple.com/thread/3753111?start=0&tstart=0
They suggested this.
I ran this
(Cisco Controller) >config advanced eap bcast-key-interval 86400
Now when I show advanced eap I get this:
EAP-Identity-Request Timeout (seconds)........... 30
EAP-Identity-Request Max Retries................. 2
EAP Key-Index for Dynamic WEP.................... 0
EAP Max-Login Ignore Identity Response........... enable
EAP-Request Timeout (seconds).................... 30
EAP-Request Max Retries.......................... 2
EAPOL-Key Timeout (milliseconds)................. 1000
EAPOL-Key Max Retries............................ 4
EAP-Broadcast Key Interval....................... 86400
I just will take note if this fixes the problem or  not.  If it does not maybe I will return it back to the default 3600.
Your idea of a hidden SSID in the clear to rule out auth issues is a good one, but security wise I don't want an open SSID - hidden or not for an hour in public places.  Sure I could throw it on a VLAN with just one server and run a continuous ping... but I'm at the home office now which never has this issue.
Seems like when it's time for the key to be renewed, I'm thinking the renewal handshake at remote sites is just not making it back to the controller.  However the initial key handshake when you first boot up or associate to the SSID goes over the WAN no issue.  I only say this because at the home office where the WLC is physically located, there is no issue.
The WANs are a minimum of 10mbps over a Ethernet Virtual Private Line which is a busness level service provided by Verizon.
Some WLC info:
Product Version.................................. 7.4.100.0
Bootloader Version............................... 1.0.16
Field Recovery Image Version..................... 6.0.182.0
Firmware Version................................. FPGA 1.7, Env 1.8, USB console 2.2
Build Type....................................... DATA + WPS