Preserving the Ability to Associate When You Upgrade Access Point Firmware

Introduction

This document describes why the client cannot associate to an Access Point (AP) under these conditions:

• Runs Lightweight Extensible Authentication Protocol (LEAP)/asynchronous communications server (ACS).

• The firmware on the AP is upgraded to 11.06 or later.

• The firmware on the client is upgraded to version 4.25.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on these software and hardware versions:

• AP340 firmware version 11.06, and PC340 firmware version 4.25.5.

• AP AIR-AP342E2R and Client Adapter AIR-PCM342.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Conventions

Refer to Cisco Technical Tips Conventions for more information on document conventions.

Problem 1

Firmware versions 11.06 and later on the AP conform to IEEE 802.1X Draft 10 standards. The Draft 8 standard was used prior to this release. Firmware version 4.25 on the clients conforms to Draft 10. On an AP that runs firmware 11.06, you can use either draft. If you want clients that run firmware 4.23 and earlier to associate, use Draft 8. A 4.25 client does not work with an 11.06 AP that uses the Draft 8 configuration, and a 4.25 client does not work with an 11.05 AP.

Solution 1

There are two options to solve this problem:

1. Use Draft 10 (11.06) on the AP and upgrade the firmware of the client cards to 4.25.

2. Use Draft 8 on the AP and use the AP with earlier firmware on the clients.

This table shows the IEEE 802.1X Draft Standards to which the different versions of the Client Adapter firmware (and Workgroup Bridge firmware) conform.

Problem 2

MAC Authentication with RADIUS Server is used. A few of the Aironet 1231G APs (APs from Cisco IOS® Release 12.3(7)JA1 to 12.3(7)JA3,) are having problems for user authentication.

This is a common problem if you upgrade from a later version of Cisco IOS to 12.3(7)JA3.

Solution 2

The first step to solve this problem is to test with configuration. Complete these steps:

1. Remove the Encryption key at SECURITY > Encryption Manager.

2. Click None and then Apply.

3. Go to the SSID Manager, highlight the SSID SSID_Name, and choose <NO ADDITION>.

4. From the Open Authentication menu, scroll down and click Apply.

   Once you have applied these changes, you can test with the client adapter.

   If it still fails, even without the encryption and authentication setting, it is better to reset the AP back to defaults and re-configure from scratch.

5. Complete these steps in order to reset the AP back to default:

   1. Choose System Software > System Configuration.

   2. Click Reset to Defaults (Except IP).

      Once it reboots, you can re-configure it again and test with the client adapter.

6. Check the MAC Authentication setting under Advance Security and set it to Server only. Complete these steps:

   1. Choose Security > Advance Security > MAC Authentication.

   2. Click Server only.

   3. Click the Save setting.

Related Information

• Wireless LAN Technical Tips
• Technical Support & Documentation - Cisco Systems