MR42 Authentication failures

[GeorgeLeeman]

we keep seeing these errors throughout the district. we do not use radius. 

we have firmware 26.8.1 which is up to date

any ideas?

Tue Sep 15, 2020, 12:59:15	Aydins-iPhone	EHUFSD	Authentication	Client failed during the authentication step.type='WPA-PSK auth fail' associated='false' radio='0' vap='1'
Tue Sep 15, 2020, 12:58:55	Android-5	EHUFSD	Authentication	Client failed during the authentication step.type='WPA-PSK auth fail' associated='false' radio='0' vap='1'
Tue Sep 15, 2020, 12:58:45	4c:7c:d9:dd:43:4e	EHUFSD	Authentication	Client failed during the authentication step.type='WPA-PSK auth fail' associated='false' radio='0' vap='1'
Tue Sep 15, 2020, 12:57:45	fc:18:3c:82:c7:b1	EHUFSD	Authentication	Client failed during the authentication step.type='WPA-PSK auth fail' associated='false' radio='1' vap='1'
Tue Sep 15, 2020, 12:57:45	danielas-iphone	EHUFSD	Authentication	Client failed during the authentication step.type='WPA-PSK auth fail' associated='false' radio='1' vap='1'
Tue Sep 15, 2020, 12:57:45	ec:2c:e2:01:ab:c9	EHUFSD	Authentication	Client failed during the authentication step.type='WPA-PSK auth fail' associated='false' radio='1' vap='1'
Tue Sep 15, 2020, 12:57:45	iPhone	EHUFSD	Authentication	Client failed during the authentication step.type='WPA-PSK auth fail' associated='false' radio='0' vap='1'
Tue Sep 15, 2020, 12:57:35	c0:9a:d0:83:92:7f	EHUFSD	Authentication	Client failed during the authentication step.type='WPA-PSK auth fail' associated='false' radio='1' vap='1'
Tue Sep 15, 2020, 12:56:45	84:ab:1a:2a:fb:7e	EHUFSD	Authentication	Client failed during the authentication step.type='WPA-PSK auth fail' associated='true' radio='1' vap='1'
Tue Sep 15, 2020, 12:55:55	d7079713-1d53-4974-84e4-dd057609ae0d1	EHUFSD	Authentication	Client failed during the authentication step.

[PhilipDAth]

It means you have a bunch of clients using the wrong PSK.  It could even be students trying random keys.

[Ahoste]

Hi George,

I was having the same issue lately.

using MR42's as well on firmware MR 26.8.1

Password didn't change or anything, we also push the password via our management system (Jamf Pro) and we haven't changed anything there either.

so this problem came out of nowhere (so it seems).

we have it across all our +60 sites.

are you still experiencing this?

[PDSKturley]

Same Issue here on School campus, It has progressively gotten worse, We also push SSID and Key, so nothing changed, Even rebuilt laptops with issues to see if it was a windows issue, no change, and it is about a 30% failure, and causes a disconnect of wireless devices when it happens. Come on Meraki, lets pull some data logs and figure this out.

[GeorgeLeeman]

yes we are. it's approaching 40-50% failure. the password is for our open byod network. it is known by all students and hasn't changed.

[Supercato]

Same thing here, this started a few weeks ago, and it just getting worse.

Any solution guys?

[Ahoste]

We upgraded our MR42's to 27.5.

so now we're waiting patiently for tickets to (not) come in. 

[GeorgeLeeman]

Just upgraded firmware to 27.5.

Will continue to monitor the ap performance

[abdunin]

@Ahoste,

Did those tickets stop coming in?

Same exact issue. Same exact symptoms. 

[Supercato]

same problems with the downgrade, i start to thinking to ubiquiti now, this is so annoying.

[WB]

So your users are actually reporting failures to authenticate as well as what Wireless Health shows? 27.5 changelog has the following Known Issue:

'Under certain conditions, successful WPA2-PSK connections are reported as failed under Wireless Health event logs (All MRs)'

I have the same 'mass auth' failures showing in wireless health for clients connecting to MR45s still running v26.6.1 but I've had confirmation that there are no auth issues occurring at the site (80 MRs and hundreds of clients!)

[Ahoste]

hi @abdunin 

I still see the authentication error in wireless health, but like someone said above, this is in the release notes that successful ones might show up as failed ones. even in the new firmware.

however on 1 site where they were having lots of issues they told me that it's been more stable lately.

I haven't noticed any drawback from the latest firmware upgrade either so it might be worth it to push and try the update.

Cheers

[TechBusAnalyst]

We have 2 MR45 AP's in our building an have began to notice an issue like this as well.  The devices will constantly disconnected and reconnect.  However, we have mainly noticed it on Dell laptops with Intel wireless cards.  We have also noticed that if the laptops are on battery, there are issues, but if the laptop is plugged into power, the issues go away.  Seems to be some type of power issue with the wireless card talking to the AP.

[cmr]

@TechBusAnalyst as mentioned in the other thread, change the power saving setting on the wireless adapter

[AndyR]

We are also getting tons of these lately. Going to push the latest radio firmware (MR33 radios) and see if that helps.  I've tried about everything else I can think of.

[Supercato]

i just downgrade, and the problems are still presents. I install another access point from another brand, and they detect a lot of interferences.. Dont know if that has an impact....

[TechBusAnalyst]

One thing I've been testing with today is to add an MR33 into our environment.  So we have 2 MR45's and an MR33.  To do that, I had to follow the steps in this Meraki article because the MR33's aren't Wi-Fi 6.  So I'm wondering if maybe this is a Wi-Fi 6 issue?  Things have been way better since I put the MR33 in.  Even when connecting to the MR45's.

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Network-Based_Application_Recogniti...

Also, here's a link to another thread with similar issues:

https://community.meraki.com/t5/Wireless-LAN/Getting-low-connectivity-MR45-Meraki/m-p/99872/highligh...

[TechBusAnalyst]

Quick update to my previous post on this.  It actually didn't help to put the MR33 in the environment.  Connections were still bad when connecting to the MR45's.  It seems that it's an issue with the power management on the wireless network card.  Changing the the MIMO Power Save Mode setting to No SMPS helped with this issue.  Meraki support has escalated my ticket on this to development to find a permanent fix.  Changing the MIMO setting was recommended by Meraki Support as a workaround.

[GeorgeLeeman]

we've upgraded all 144 mr42's to the latest firmware. issue still persists around 30-40% failure. clients still complain about connectivity problems (mostly Chromebook and imac's).

[cmr]

@GeorgeLeeman is there any option on the iMacs to change wireless nic settings?  I'm guessing not, but if you haven't already it might be worth looking at this article

https://www.macissues.com/2015/01/15/sleep-and-power-settings-possibly-behind-wi-fi-dropouts-in-yose...

It may also apply to newer versions.

[Marc_V]

Also the same issues (around 40% to 50% authentication failures) on MR42 and MR52 access points since few weeks.

Users are complaining a lot and we can't do anything for the moment tried to change the access point with no effect).

Seems that it affects access points that are having a lot of other "noise" around them (even if not overlapping on the channels used by the access points).

[JelkoRutherford]

I've been off and on troubleshooting intermittent issues with our wireless, as I get off and on reports from the skeleton crew we have onsite. We have about 11 MR42's all running the 27.5 firmware. I did a couple resets on some of the WAPs that were reporting more issues a day or two ago, and we're clocking in at about 60% success over the last 24 hours, up from 30% over the last month. Primarily authentication issues according to health monitor.

Just reporting that this seems to still be an issue, and looking to keep updated if there are any solutions. I'll continue troubleshooting and monitor this thread.

[TechBusAnalyst]

@JelkoRutherford , I would suggest trying to change those network adapter power options as listed in my previous post or maybe even try having the laptops plug into power while on the wireless.  Those were the options that we found that help.  We were getting the same kind of authentication issues and these both fixed them.  Meraki has told me they have their engineering department working on this as they've seen it from others as well.  No ETA on a resolution.  Hope that helps!

[GeorgeLeeman]

still seeing 35% failure even with the recommended mac power settings.chromebook do not have the settings as mentioned.

any news from meraki?

[cmr]

@GeorgeLeeman are you running the recently released 27.6 firmware?

[GeorgeLeeman]

no is that a beta? 

[cmr]

@GeorgeLeeman it is a stable release candidate which means full release quality, just not been deployed by enough people yet.  I'd highly recommend it with your issues.

[zfrangi]

Ive been seeing similar issues with our mr-34's. They are running 27.5.1

I have also been seeing strange dns issues im not sure if its due to latency or what.

[GeorgeLeeman]

you should update to 27.6 just came out 1/22/21. i updated this past weekend. i'm waiting for student/staff to return so  i can determine if issue is resolved.

[TechBusAnalyst]

I updated to the new 27.6 firmware and it appears to have resolved the issue.  I tested on Friday and it worked well.  Hoping it stays good!  It was very nice that Meraki followed up on this with me after having the ticket open for so long.  

[zfrangi]

Thanks im going to update the firmware this evening.  

[zfrangi]

I know this may sound like a dumb question but how can I apply or schdule fimrware thats available as a release candidate?  Is there a setting somewhere? or does support need to do this?

[PhilipDAth]

https://documentation.meraki.com/General_Administration/Firmware_Upgrades/Managing_Firmware_Upgrades 

[cmr]

@zfrangi select the network that needs upgrading and click on the schedule upgrade button, on the next screen you should have the choice of the stable release, a release candidate and a beta, depending on which exist.

 

[ajcamacho]

we use EAP-TLS (802.1x) , running version 27.7.1 and I see the same BAD PASSWORD ERROR which does not make sense for this authentication protocol.

[cmr]

@ajcamacho is there a reason you are running out of date firmware?  28.6 is a good stable release candidate, with 28.5 the stable release.

[GeorgeLeeman]

connectivity is a little more stable. still seeing 40-45% authentication errors with the new 27.6 firmware

[TNelson]

Has anyone figured this out, We are getting an increase of this on our network.