Invalid MIC from Mobile Device

Question

Hello guys,
i have two media tablets same hardware same driver. One is working proper and the other one is not able to associate with my ssid.
the debug out shows the follow:
*dot1xMsgTask: Feb 06 14:51:25.007: a8:54:b2:00:8b:34 Starting key exchange to mobile a8:54:b2:00:8b:34, data packets will be dropped*dot1xMsgTask: Feb 06 14:51:25.007: a8:54:b2:00:8b:34 Sending EAPOL-Key Message to mobile a8:54:b2:00:8b:34                                                                                                              state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00*Dot1x_NW_MsgTask_4: Feb 06 14:51:25.027: a8:54:b2:00:8b:34 Received EAPOL-Key from mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:25.027: a8:54:b2:00:8b:34 Ignoring invalid EAPOL version (1) in EAPOL-key message from mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:25.027: a8:54:b2:00:8b:34 Received EAPOL-key in PTK_START state (message 2) from mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:25.027: a8:54:b2:00:8b:34 Received EAPOL-key M2 with invalid MIC from mobile a8:54:b2:00:8b:34 version 2*osapiBsnTimer: Feb 06 14:51:26.173: a8:54:b2:00:8b:34 802.1x 'timeoutEvt' Timer expired for station a8:54:b2:00:8b:34 and for message = M2*dot1xMsgTask: Feb 06 14:51:26.173: a8:54:b2:00:8b:34 Retransmit 1 of EAPOL-Key M1 (length 121) for mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:26.257: a8:54:b2:00:8b:34 Received EAPOL-Key from mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:26.257: a8:54:b2:00:8b:34 Ignoring invalid EAPOL version (1) in EAPOL-key message from mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:26.257: a8:54:b2:00:8b:34 Received EAPOL-key in PTK_START state (message 2) from mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:26.257: a8:54:b2:00:8b:34 Received EAPOL-key M2 with invalid MIC from mobile a8:54:b2:00:8b:34 version 2*osapiBsnTimer: Feb 06 14:51:27.173: a8:54:b2:00:8b:34 802.1x 'timeoutEvt' Timer expired for station a8:54:b2:00:8b:34 and for message = M2*dot1xMsgTask: Feb 06 14:51:27.173: a8:54:b2:00:8b:34 Retransmit 2 of EAPOL-Key M1 (length 121) for mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:27.197: a8:54:b2:00:8b:34 Received EAPOL-Key from mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:27.197: a8:54:b2:00:8b:34 Ignoring invalid EAPOL version (1) in EAPOL-key message from mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:27.197: a8:54:b2:00:8b:34 Received EAPOL-key in PTK_START state (message 2) from mobile a8:54:b2:00:8b:34*Dot1x_NW_MsgTask_4: Feb 06 14:51:27.197: a8:54:b2:00:8b:34 Received EAPOL-key M2 with invalid MIC from mobile a8:54:b2:00:8b:34 version 2*osapiBsnTimer: Feb 06 14:51:28.173: a8:54:b2:00:8b:34 802.1x 'timeoutEvt' Timer expired for station a8:54:b2:00:8b:34 and for message = M2*dot1xMsgTask: Feb 06 14:51:28.173: a8:54:b2:00:8b:34 Retransmit failure for EAPOL-Key M1 to mobile a8:54:b2:00:8b:34, retransmit count 3, mscb deauth count 2*dot1xMsgTask: Feb 06 14:51:28.173: a8:54:b2:00:8b:34 Resetting MSCB PMK Cache Entry 0 for station a8:54:b2:00:8b:34*dot1xMsgTask: Feb 06 14:51:28.173: a8:54:b2:00:8b:34 Removing BSSID 34:db:fd:67:89:2a from PMKID cache of station a8:54:b2:00:8b:34*dot1xMsgTask: Feb 06 14:51:28.173: a8:54:b2:00:8b:34 Setting active key cache index 0 ---> 8*dot1xMsgTask: Feb 06 14:51:28.173: a8:54:b2:00:8b:34 Sent Deauthenticate to mobile on BSSID 34:db:fd:67:89:20 slot 1(caller 1x_ptsm.c:546)
config of the SSID:
(Cisco Controller) >show wlan 6WLAN Identifier.................................. 6Profile Name..................................... MedientechnikNetwork Name (SSID).............................. MedientechnikStatus........................................... EnabledMAC Filtering.................................... DisabledBroadcast SSID................................... DisabledAAA Policy Override.............................. DisabledNetwork Admission Control  Client Profiling Status ....................... Disabled   DHCP ......................................... Disabled   HTTP ......................................... Disabled  Radius-NAC State............................... Disabled  SNMP-NAC State................................. Disabled  Quarantine VLAN................................ 0Maximum number of Associated Clients............. 0Maximum number of Clients per AP Radio........... 200Number of Active Clients......................... 1Exclusionlist.................................... DisabledSession Timeout.................................. 86400 secondsUser Idle Timeout................................ 300 seconds--More-- or (q)uitUser Idle Threshold.............................. 0 BytesNAS-identifier................................... KPSS_WLC1CHD per WLAN..................................... EnabledWebauth DHCP exclusion........................... DisabledInterface........................................ medientechnikMulticast Interface.............................. Not ConfiguredWLAN IPv4 ACL.................................... unconfiguredWLAN IPv6 ACL.................................... unconfiguredmDNS Status...................................... DisabledmDNS Profile Name................................ default-mdns-profileDHCP Server...................................... DefaultDHCP Address Assignment Required................. DisabledStatic IP client tunneling....................... DisabledPMIPv6 Mobility Type............................. noneQuality of Service............................... SilverPer-SSID Rate Limits............................. Upstream      DownstreamAverage Data Rate................................   0             0Average Realtime Data Rate.......................   0             0Burst Data Rate..................................   0             0Burst Realtime Data Rate.........................   0             0Per-Client Rate Limits........................... Upstream      DownstreamAverage Data Rate................................   0             0Average Realtime Data Rate.......................   0             0--More-- or (q)uitBurst Data Rate..................................   0             0Burst Realtime Data Rate.........................   0             0Scan Defer Priority.............................. 4,5,6Scan Defer Time.................................. 100 millisecondsWMM.............................................. AllowedWMM UAPSD Compliant Client Support............... DisabledMedia Stream Multicast-direct.................... DisabledCCX - AironetIe Support.......................... DisabledCCX - Gratuitous ProbeResponse (GPR)............. DisabledCCX - Diagnostics Channel Capability............. DisabledDot11-Phone Mode (7920).......................... DisabledWired Protocol................................... NonePassive Client Feature........................... EnabledPeer-to-Peer Blocking Action..................... DisabledRadio Policy..................................... AllDTIM period for 802.11a radio.................... 1DTIM period for 802.11b radio.................... 1Radius Servers   Authentication................................ Disabled   Accounting.................................... Disabled   Dynamic Interface............................. Disabled   Dynamic Interface Priority.................... wlanLocal EAP Authentication......................... Disabled--More-- or (q)uitSecurity   802.11 Authentication:........................ Open System   FT Support.................................... Disabled   Static WEP Keys............................... Disabled   802.1X........................................ Disabled   Wi-Fi Protected Access (WPA/WPA2)............. Enabled      WPA (SSN IE)............................... Disabled      WPA2 (RSN IE).............................. Enabled         TKIP Cipher............................. Disabled         AES Cipher.............................. Enabled                                                               Auth Key Management         802.1x.................................. Disabled         PSK..................................... Enabled         CCKM.................................... Disabled         FT-1X(802.11r).......................... Disabled         FT-PSK(802.11r)......................... Disabled         PMF-1X(802.11w)......................... Disabled         PMF-PSK(802.11w)........................ Disabled      FT Reassociation Timeout................... 20      FT Over-The-DS mode........................ Enabled      GTK Randomization.......................... Disabled      SKC Cache Support.......................... Disabled--More-- or (q)uit      CCKM TSF Tolerance......................... 1000   WAPI.......................................... Disabled   Wi-Fi Direct policy configured................ Disabled   EAP-Passthrough............................... Disabled   CKIP ......................................... Disabled   Web Based Authentication...................... Disabled   Web-Passthrough............................... Disabled   Conditional Web Redirect...................... Disabled   Splash-Page Web Redirect...................... Disabled   Auto Anchor................................... Disabled   FlexConnect Local Switching................... Disabled   flexconnect Central Dhcp Flag................. Disabled   flexconnect nat-pat Flag...................... Disabled   flexconnect Dns Override Flag................. Disabled   FlexConnect Vlan based Central Switching ..... Disabled   FlexConnect Local Authentication.............. Disabled   FlexConnect Learn IP Address.................. Enabled   Client MFP.................................... Disabled   PMF........................................... Disabled   PMF Association Comeback Time................. 1   PMF SA Query RetryTimeout..................... 200   Tkip MIC Countermeasure Hold-down Timer....... 60AVC Visibilty.................................... Disabled--More-- or (q)uitAVC Profile Name................................. NoneFlow Monitor Name................................ NoneCall Snooping.................................... DisabledRoamed Call Re-Anchor Policy..................... DisabledSIP CAC Fail Send-486-Busy Policy................ EnabledSIP CAC Fail Send Dis-Association Policy......... DisabledKTS based CAC Policy............................. DisabledAssisted Roaming Prediction Optimization......... Disabled802.11k Neighbor List............................ Disabled802.11k Neighbor List Dual Band.................. DisabledBand Select...................................... DisabledLoad Balancing................................... DisabledMulticast Buffer................................. Disabled Mobility Anchor List WLAN ID     IP Address            Status -------     ---------------       ------802.11u........................................ DisabledMSAP Services.................................. Disabled
(Cisco Controller) >show sysinfoManufacturer's Name.............................. Cisco Systems Inc.Product Name..................................... Cisco ControllerProduct Version.................................. 7.4.110.0Bootloader Version............................... 1.0.1Field Recovery Image Version..................... 6.0.182.0Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27Build Type....................................... DATA + WPS
My understanding is that because of the invalid MIC the WLC interpret that the frames are corrupt ?
What could be the problem ?
Thanks for your help !!!!
Kind regards
Philip

Answer 1

802.11n and Apple iPad, Cisco Cius tablet, and Apple iPhone 4
Each Wi-Fi enabled phone and tablet that supports 802.11n has specific antenna and channel configurations. Specifications for each device are listed on the manufacturer's website. Because these devices are 802.11n-enabled, they can use 802.11n enhancements such as MIMO and frame aggregation to help improve their upstream and downstream performance. The specifications for the Apple iPad, Cisco Cius, and Apple iPhone 4 follow:
• The Apple iPad is a one-spatial stream (single antenna) 802.11n-enabled device that operates in 2.4- and 5-GHz spectrums using 20-MHz channels.
• The Cisco Cius tablet is a one-spatial stream (single antenna) 802.11n-enabled device that operates in the 2.4-GHz spectrum using 20-MHz channels and the 5-GHz spectrum using 20- or 40-MHz channels.
• The Apple iPhone 4 is a one-spatial stream 802.11n-enabled device that operates in only the 2.4-GHz spectrum using 20-MHz channels.
How to Optimize 802.11n WLANs to Support Wi-Fi Enabled Phones and Tablets
The following steps are recommended to help optimize a Cisco Unified Wireless Network 802.11n deployment to more effectively support the Apple iPad, Apple iPhone 4, Cisco Cius tablet, and other Wi-Fi phones, tablets, or clients with similar wireless profiles.