Hello,
I am troubleshooting a problem where users are experiencing random disconnects while connected to my 802.1x campus network. I am running physical controllers using AOS 8.12.0.5. I also use Clearpass as my NAC and Airwave for log collection. I've found some interesting data points, but don't know where to go with it. I've opened a support case, but thought I would also see if I can get an answer quicker here. I am also running a user debug on my own device, but it's unpredictable when the disconnect will occur so I don't know if that will capture anything useful.
Here's what I found:
At the time that the disconnect is reported, I see a RADIUS Accounting Issue with the Event "Accounting server request timed out for clearpass". I looked up that error and found a thread that describes the behavior I'm seeing almost exactly, but doesn't have a solution. "This client intermittently faces 4–5 request timeouts (RTOs) while pinging global FQDNs like google.com, followed by disconnection from Wi-Fi and then reconnection to the SSID."
I also see a log for an IDS event of a StationDisconnectAttack at the exact timestamp. It's unclear to me if this is an actual attack, or if it's a response to the client unexpectedly disconnecting.
wlsxNDisconnectStationAttack wlsxTrapAPMacAddress.0: AA:BB:CC:C3:A6:D2,
wlsxTrapSnr.0: 31, wlsxTrapAPBand.0: 5GHz, wlsxTrapAPLocation.0:
correlated-AP.B.32, wlsxTrapAPChannel.0: 149, wlsxTrapTargetAPBSSID.0:
98:8F:00:0D:67:F1, wlsxTrapAPRadioNumber.0: 1, wlsxTrapTargetAPSSID.0:
eduroam, wlsxTrapTime: 12/9/2025 10:44:36 UTC-5, wlsxTrapSourceMac.0:
AA:BB:CC:93:D2:5D
Appreciate any help, and happy to provide any other details that could be useful!
-------------------------------------------