Hi everyone:
We've set up a complex installation for one client based on 40 Cisco
1200 & 1100 APs working as parent-repeater (we have some branches with parent-repeater-repeater). We've deployed LEAP on APs and clients both. Everything is working fine until any client changes from one AP to another. When it starts to transmit traffic it gets blocked because of MIC encryption error. The situation remains for a few minutes, when suddenly encryption works again.
To minimize impact we have enables key-rotation every 20 seconds but the problem remains and users aro not able to work properly.
To validate users we have installed freeradius with leap support. Radius log shows that authentication is working fine (no errors)
This is a log excerpt of what happens when client 0040.96a7.c594 desassociates from AP 192.168.4.207 and associates to AP 192.168.4.200
Jun 30 22:39:15 192.168.4.207 6552: *Mar 4 05:44:24.542: %DOT11-6-DISASSOC:
Interface Dot11Ra
dio0, Deauthenticating Station 0040.96a7.c594
> Jun 30 09:08:25 192.168.4.200 7178: *Mar 5 14:45:29.753: %DOT11-6-ASSOC:
Interface Dot11Radio
0, Station ALMUDENAW2K 0040.96a7.c594 Associated KEY_MGMT[WPA]
> Jun 30 09:08:25 192.168.4.200 7179: *Mar 5 14:45:29.846:
%DOT11-4-TKIP_MIC_FAILURE_REPORT: Re
ceived TKIP Michael MIC failure report from the station 0040.96a7.c594 on the
packet (TSC=0x0)
encrypted and protected by pairwise key.
> Jun 30 09:08:25 192.168.4.200 7180: *Mar 5 14:45:30.090:
%DOT11-4-TKIP_MIC_FAILURE_REPORT: Re
ceived TKIP Michael MIC failure report from the station 0040.96a7.c594 on the
packet (TSC=0x0)
encrypted and protected by pairwise key.