Wireless Access

 View Only
  • 1.  Clients not connecting: "authenticate fail because integrity check failure in encrypted message"

    Posted Apr 13, 2023 04:34 PM

    Hi there fellas, how are you?

    I've been a member for some time now and I've gotten interesting solutions here so, thanks in advance.
    I'm having a trouble in a controlerless wireless solution, 56 iaps (515, 303, 315 and 303h) in standalone mode (VC).

    So, in times of dense use, like, 50 connected devices in a single ap like 303h, sometimes the clients can't connect to the wifi. The message they receive is "Can't connect to the network" or something like that. Rebooting that AP solves it.

    I've tried several configurations, removed 802.11 roaming standards, changed SLB from radio+channel to only channel (not that would help authenticate), I've tried to create a test ssid with internal dhcp and the problem is the same.

    Memory and cpu usage is considerably high at those moments, like, 90%. So, my intuitive not so great mind tells me that it's a hardware issue because they restart the AP and it comes to life but I can't go to the customer and say lets change the ap because my intuitive not so great mind tells me to. 

    We've done a site survey with Ekahau connect and there is some interference but nothing to be worried about (see attached jpg)

    So, any thoughts? Attached there are two logs with several lines of debug (dhcp, system and errors).

    Thanks my friends! Best regards.

    Attachment(s)

    TXT
    UM.TXT   997 KB 1 version
    txt
    UM2.txt   50 KB 1 version


  • 2.  RE: Clients not connecting: "authenticate fail because integrity check failure in encrypted message"

    Posted Apr 13, 2023 08:07 PM

    The integrity check makes me think its a client driver issue, or your running into a lot of contention on the connection. Having 50 clients on the 303H is a lot. You would want to see that down around 30 or less.




    ------------------------------
    Dustin Burns

    Lead Mobility Engineer @Worldcom Exchange, Inc.

    ACCX 1271| ACMX 509| ACSP | ACDA | MVP Guru 2022-2023
    If my post was useful accept solution and/or give kudos
    ------------------------------



  • 3.  RE: Clients not connecting: "authenticate fail because integrity check failure in encrypted message"

    Posted Apr 14, 2023 09:49 AM

    It may be best to open a TAC case for this. The Check sum mismatch messages show up in cases where there are connectivity issues between the APs, like missing VLANs or specific AP overrides. Have you checked that all of your APs have the exact same firmware version (version + build)?
    Also, do you have a separate client VLAN and broadcast filtering enabled? If you have the clients and AP management in the same VLAN, escpecially when there is a lot of broadcast traffic it can be that the control traffic between the APs is overloaded. Best practice is to have a dedicated management VLAN (untagged to the AP) and put your client traffic in one or more client VLANs (802.1q VLAN tagged to the AP).



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 4.  RE: Clients not connecting: "authenticate fail because integrity check failure in encrypted message"

    Posted Apr 17, 2023 09:10 AM

    Hi Herman, DB86, how are you?

    Thanks for the answer. Actually, if I can remember correctly, the missmatch checksum is from when I changed configuration in the master and the master didn't send the config until 6 missmatch checksum messages went on. I don't know if it was always because of that. On the other hand, the management network address of all devices is 10.2.0.0/16. 
    I already opened a TAC case but for now they didn't answer.
    It could be caused because of high density or something in the configuration? 

    Thanks