Windows 8 Tablet authenticates to wireless network: Disconnects 3 seconds later

Question

The wireless network is secured with WPA2 enterprise and has been in production for some time. Recently, we have had several Windows 8 clients that have been having a hard time joining the network. I have one in my possession now, and looking at the wireless logs, it connects, authenticates, and 3 seconds later disconnects. It then gives the error message in the log

The Computer is Roaming too often. Post security was not completed after 5 seconds

The event log source is WLAN-AutoConfig and EventID 8002. The same 3 entries appear before this one every time,

Wireless 802.1x authentication started. EventID 12011

Wireless 802.1x authentication succeeded. EventID 12012

Wireless security stopped. (Security Hint: The operation was successful) EventID 11004

The only thing google has turned up is a technet page with reason codes, nothing useful. Since authentication is successful, and the tablet is not physically moving while authenticating, I don't know what could be causing this. My next course of action is a driver update, although this is a Dell Latitude 10 with no external configuration other than joining to a domain. Has anyone seen this before? Any idea what could be causing this?

Answer 1

Okay, so this boils down to a bug in Cisco's MFP implementation. Taken from Microsoft's Support Page:

The issue is due to Cisco’s MFP implementation. The Cisco reference for this issue is CSCua29504. There are 2 known resolutions for this issue:

1. Update the Controller to updated Firmware Image: Cisco has fixed the issue in an update release. You can download the updated software from https://supportforums.cisco.com/docs/DOC-27213. This option is highly recommended. This image has a fix for reporting correct “Key descriptor version” for M1 of 4 way handshake messages. 4 way handshakes complete successfully thus establishing a successful connection. This will resolve the connectivity issue described above and also allow you to use all Windows WLAN 8 features.

2. Roll Back to Pre-Windows 8 Drivers. Another option is to roll back to pre-Windows 8 drivers. These drivers can be obtained from the hardware manufacturer or their website.

Note that this approach will disable all Windows 8 specific WLAN features and user experience will be equivalent to capabilities supported by pre-Windows 8 drivers.

There is a Cisco Support Page for this as well. I can confirm that updating the wireless AP firmware resolves the issue.