Curious, once it was working on SSID2, could you re-associate to SSID1 and it still fails to get out? I'm assuming the client associated to SSID1, and you saw it connected? It showed up on the Network Wide > Clients page and you saw it connected to the SSID? And if you click into the clients page, there's no policy that might be impacting it? Likewise, compare those things when connected to SSID2, and again when going back to SSID1. Look through your Network Wide > Event log for any differences or clues when failing on SSID1 versus succeeding on SSID2. Maybe bump the firmware if not on the latest stable. Beyond that, I'd open a case with support to ihelp nvestigate.