Surface Pro 3 is not able to connect to standalone aironet

Question

Hello,
we are having issues with several Surface Pro 3 device connecting to a standalone Aironet. Other Device connect to this AP no problem. SP3 connect to other APs (not cisco) no problem. So there seems to be an issue between the two devices. When I look in the logs of the AP I get the following message:
Jan 15 19:59:52.513: %DOT11-7-AUTH_FAILED: Station 501a.c5e5.aeff Authentication failed
I tried to run aaa debug but nothing shows up but that message above. We use WPA2 AES/TKIP.
I proceeded to run debug all on the AP and this is what I got. Keep in mind that we are troubleshooting 501a.c5e5.aeff 
Jan 15 19:55:19.646: Setting client MAC 501a.c5e5.aeff radio slotunit 0 address 0x7E2CE90
Jan 15 19:55:19.646:  Adding client 501a.c5e5.aeff client->reap_flags_1 0
Jan 15 19:55:19.646: Dot11Radio0: Adding client 501a.c5e5.aeff aid 6
Jan 15 19:55:19.646: dot11_mgmt: drv add resp for client 501a.c5e5.aeff aid 6
Jan 15 19:55:19.646: dot11_mgmt: dot11_mgmt_sta_ref (ref=2, sta_ptr=0x7530010, mac=501a.c5e5.aeff)
Jan 15 19:55:19.646: SM: ---Open Authentication 0x7530010: Drv Add Resp (8)
Jan 15 19:55:19.646: SM:    Drv_Add_InProg (8) --> DONT CHANGE STATE (255)
Jan 15 19:55:19.646: dot11_mgmt: [168D368F] response from driver for client 501a.c5e5.aeff
Jan 15 19:55:19.646:  Setting global apsd config before assoc rsp
Jan 15 19:55:19.646:  dot11_driver_client_apsd_settings Client(501a.c5e5.aeff) not found for APSD settings
Jan 15 19:55:19.646: about to perform cac before cac resp
Jan 15 19:55:19.646:  dot11_tsm_delete_ts_not_reassociated:Clean streams not in REASSOC 
Jan 15 19:55:19.646: dot11_mgmt: [168D36F5] send assoc resp, status[0] to dst=501a.c5e5.aeff, aid[6] on Dot11Radio1
Jan 15 19:55:19.646: There is nothing to add from qosie_set in ASSOC Rsp
Jan 15 19:55:19.646: Dot11Radio1: Tx AssocResp client 501a.c5e5.aeff
Jan 15 19:55:19.646: dot11_aaa_auth_request: Received dot11_aaa_auth_request for client 501a.c5e5.aeff
Jan 15 19:55:19.646: dot11_aaa_auth_request: SSID: Executive, Mac Address: 501a.c5e5.aeff, auth_algorithm 0, key_mgmt 1027074
Jan 15 19:55:19.646: AAA/API(00000000): aaa_util_unique_id_alloc(), pc 0x185F920, enter {
Jan 15 19:55:19.646: AAA/ID(NA): DOT11 allocating
Jan 15 19:55:19.646: AAA/ID(00000023): Call started 14:55:19 -0500 Jan 15 2015
Jan 15 19:55:19.646: AAA/DB(00000023): add Intf/7D3D488
Jan 15 19:55:19.646: AAA/DB(00000023): add DB 7E2910C
Jan 15 19:55:19.646: AAA/ID(00000023): DOT11 allocated
Jan 15 19:55:19.646: AAA/API(00000023): } aaa_util_unique_id_alloc()
Jan 15 19:55:19.646: dot11_mgr_disp_wlccp_update_auth:  unknown auth type 0x1
Jan 15 19:55:19.646: dot11_aaa_add_dot11_client_entry: AAA Client entry (501a.c5e5.aeff, 4106500) is added to the client list
Jan 15 19:55:19.646: dot11_aaa_start_auth_sequence: dot11_aaa_start_auth_sequence for client 501a.c5e5.aeff [key_mgmt] = FAC02
Jan 15 19:55:19.646: dot11_aaa_start_auth_sequence: dot11_aaa_start_auth_sequence for client 501a.c5e5.aeff [key_mgmt] = FAC02
Jan 15 19:55:19.646: dot11_mgr_sm_start_wpav2_psk: Starting wpav2 4-way handshake for PSK or pmk cache supplicant 501a.c5e5.aeff
Jan 15 19:55:19.646: dot11_mgr_sm_send_wpav2_ptk_msg1: Starting wpav2 ptk msg 1 to supplicant 501a.c5e5.aeffCould not find station pointer for client 501a.c5e5.aeff. Using vlan number from aaa_client 
Jan 15 19:55:19.646: dot11_dot1x_send_ssn_eapol_key: wpav2 msg 1 pak_size 121
Jan 15 19:55:19.646: dot11_dot1x_send_ssn_eapol_key: eapol->length 117
Jan 15 19:55:19.646: dot11_dot1x_build_ptk_handshake: building PTK msg 1 for 501a.c5e5.aeff
Jan 15 19:55:19.646: dot11_dot1x_build_ptk_handshake: ptk key len 16
Jan 15 19:55:19.646: dot11_dot1x_build_ptk_handshake: ptk key data len 22
Jan 15 19:55:19.646: dot11_dot1x_build_ptk_handshake: wpav2 pmkid[DOT1X]: 0CBC860AAF0DBBA764ED9D51BB113194
Jan 15 19:55:19.646: dot1x-registry:registry:dot1x_ether_macaddr called
Jan 15 19:55:19.646: dot11_mgr_disp_client_send_eapol: sending eapol to client 501a.c5e5.aeff on BSSID c025.5ca5.3c40
Jan 15 19:55:19.646: dot11_mgr_sm_send_wpav2_ptk_msg1: [1] Sent PTK msg 1 to 501a.c5e5.aeff, no timer set
Jan 15 19:55:19.650: dot11_mgmt: dot11_mgmt_sta_deref (ref=3, sta_ptr=0x7530010, mac=501a.c5e5.aeff)
Also, on windows end I checked the Event Viewer and I see that SP3 is not getting any response back from the AP. 
Any help would be greatly appreciated. Thanks.

Answer 1

I rolled out a batch of these to our wireless network a couple of months back.  A couple of tips:
- From a wireless perspective these devices are extremely buggy out of the box (I'm not exaggerating).  They basically won't function using the built in wireless with anything other than the most very basic wireless setup of a home router until you apply ALL of the patches and updates for them in Windows Update.  In my case I had to install all the updates via ethernet dongle and/or a Linksys USB Wireless dongle (the drivers were much better for the USB dongle and allowed connectivity to work).  The built in Marvell adaptor looks to be good from a features perspective but poor from a driver perspective.  Once the updates were applied it mostly worked.
- I experienced a similar problem with FT (Fast Transition) enabled - the SP3 will not connect with FT enabled.  In my view there were two issues - (1) the devices won't even connect if FT is enabled and (2) they don't support the FT feature for seamless roaming.
I took it up with Microsoft and they acknowledged the problem but wouldn't commit to fixing the buggy behaviour (allowing the connection and ignoring the FT attribute like many older clients do) nor would they commit to when they will support the FT feature (fast roaming).
These tips might not be the cause of your problem but hopefully they will help you get it up and running.
Fortunately all of these problems can be fixed with driver updates, so maybe in the future they may end up being pretty good wireless clients afterall :-)