WLC 5508 problem

Question

Hi
I have one 5508 and about 70 Cisco1140 AP and spred around in to about 5 sites.
We use a Microsoft IAS server as radius server with auth from the AD with dot1x and certificate in the clinents to verify the clientents
The clients are IBM and Dell laptops
Some clients loses the connection to the network time to time
I have some errors in the WLC logg
dot1xMsgTask: Jan 18 11:23:34.254: %DOT1X-3-MAX_EAP_RETRANS: 1x_ptsm.c:426 Max EAP retransmissions
exceeded for client 00:24:d7:22:0e:e0
*apfMsConnTask_3: Jan 18 11:21:13.118: %APF-3-CHECK_SUPP_RATES_FAILED: apf_utils.c:273 Could not che
ck supported rates. Missing Supported Rate. Length :0. Mobile MAC: b8:ff:61:8f:df:25.
*Dot1x_NW_MsgTask_0: Jan 18 11:15:31.521: %DOT1X-3-INVALID_WPA_KEY_MSG_STATE: 1x_eapkey.c:708 Receiv
ed invalid EAPOL-key M2 msg in START state - invalid secure bit; len 40, key type 1, client 00:21:6a
:50:21:80
*spamApTask0: Jan 18 11:14:34.630: %LWAPP-3-VALIDATE_ERR: spam_lrad.c:9090 Validation of SPAM Vendor
Specific Payload failed - AP  30:37:a6:c9:53:20
*dot1xMsgTask: Jan 18 11:14:19.850: %DOT1X-3-MAX_EAP_RETRIES: 1x_auth_pae.c:2914 Max EAP identity re
quest retries (14) exceeded for client 00:1f:3b:16:aa:ef
Decrypt error occurred for clienten 00:24:d7:69:fb:7c using WPA2 key on 802.11a interface of AP e8:04:62:60:a0:10
Any sugestions ?

Answer 1

Looking at the error messages, they don't point to a singlular fault with the WLC, more like a client issue.  Below I'll explain the messages you are seeing.
dot1xMsgTask: Jan 18 11:23:34.254: %DOT1X-3-MAX_EAP_RETRANS: 1x_ptsm.c:426 Max EAP retransmissions
exceeded for client 00:24:d7:22:0e:e0
      This means, the WLC has sent an EAP request to the client, and has not received a response.  This could be because either the cleint didn't hear the request, or the AP didn't hear the response.  It could also be the client ignored the request.  You may want to take a look at the following document and see if you want to change the EAP timer values
.   https://supportforums.cisco.com/docs/DOC-12110
*apfMsConnTask_3: Jan 18 11:21:13.118: %APF-3-CHECK_SUPP_RATES_FAILED: apf_utils.c:273 Could not che
ck supported rates. Missing Supported Rate. Length :0. Mobile MAC: b8:ff:61:8f:df:25.
   The WLC was reading a message from the client, and the client did not tell the WLC what rates it could support.  This could happen because the packet from the client wasn't heard fully.  As well, some clients will see the WLC that they are associated to, and not the individual AP.  In this case, it is possible that the client didnt' send the supported rates, as it didn't see a change in BSSID>
*Dot1x_NW_MsgTask_0: Jan 18 11:15:31.521: %DOT1X-3-INVALID_WPA_KEY_MSG_STATE: 1x_eapkey.c:708 Receiv
ed invalid EAPOL-key M2 msg in START state - invalid secure bit; len 40, key type 1, client 00:21:6a
:50:21:80
   The client tried to send a key, when the PEM state on the WLC was START.  More than likely the client thought it could roam, but the WLC thought differently
*spamApTask0: Jan 18 11:14:34.630: %LWAPP-3-VALIDATE_ERR: spam_lrad.c:9090 Validation of SPAM Vendor
Specific Payload failed - AP  30:37:a6:c9:53:20
   Bad packet.
*dot1xMsgTask: Jan 18 11:14:19.850: %DOT1X-3-MAX_EAP_RETRIES: 1x_auth_pae.c:2914 Max EAP identity request retries (14) exceeded for client 00:1f:3b:16:aa:ef
   WLC is sending EAP Identity request to the client, and it is not repsonding. 
Decrypt error occurred for clienten 00:24:d7:69:fb:7c using WPA2 key on 802.11a interface of AP e8:04:62:60:a0:10
Couldn't decrypt the packet.  Could be a bad key, or could be we didnt' get the full packet, thus making the decrypt fail.
    For the most part, these are commonly seen issues.  Could be the result of RF issues, so you may want to take a look and make sure the coverage at the site is clean.   Some of these can also be caused by WZC, which likes to ignore EAP messages, and has a tendancy to use the login credentials that get cached.  Which if these are not domain credentials can cause issues as well.
Cheers,
Steve
If  this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.