T43 / 2200BG / Access Connections 4.23 won't associate

[StoneCold]

We have installed a wireless network at my employer and I have been installing Access Connections client for users to connect.

The wireless network has the following characteristics: 802.1x, EAP-FAST, WPA2 AES encryption with CiscoSecure ACS as our RADIUS server authenticating against our Active Directory.

I have one laptop in particular that will NOT connect and I am at the end of my rope. It is a T43 with Intel 2200BG card with 9.0.4.26 driver (from IBM/Lenovo site) and Access Connections 4.23 (originally tried with 4.21).

I created the connection profile (like with all other laptops that have connected successfully) including auto provisioning of PAC. This laptop will NOT associate to an access point; it just dies there EVERY time. The client gives an error code 10 saying to check AES encryption (this is set correctly) or that the adapter may not be set to connect on the channel of our wireless network??? No clue why I am getting this error and I have Googled it and can't seem to find any info.

My laptop is this same model and configuration and it connects fine.

Obviously, this appears to be a laptop related issue.

I am at the end of my rope here. Can anyone provide any possible solutions?


Thanks,

Steve

[Ken Fox]

I am at the end of my rope here. Can anyone provide any possible solutions?


Thanks,

Steve

My response assumes no hardware faults, which I can't exclude based upon your post.

Look through the forums here, especially the general hardware/software forum, (or search with the the terms "AC" or Access Connections) and you will pull up a lot of threads. The problems appear to be due to certain network card drivers and versions of AC, and in which order they were installed.

There are people here who believe that AC is a worthwhile program and that it is worthwhile to jump through a bunch of hoops to get it to work. There are also people here like myself who regard current iterations of AC as being more trouble than they are worth.

If the laptop will be used in a whole host of locations and these locations will be constantly changing, then perhaps AC is worth bothering with. If on the other hand the laptop will be used only in a few places (even if these change a time or two or three per day) then you can probably get along a lot easier with the native Windows wireless program which does not have the software issues associated with AC these days. The windows application has been improved over the years and actually provides good functionality. If you decide to use the native windows application then you will need to uninstall Access Connections through the control panel, and then when the machine reboots you will probably also have to go into the windows wireless program on the advanced tab and check the box that tells Windows to manage the connection (AC seems to forget to do this when it is uninstalled so then you are left with NO wireless connection program, but it is easily fixed with a click).

I have received 3 new thinkpads over the last week and a half. I have not changed the drivers or the AC installation in any of these three laptops from what was loaded by Lenovo. I decided to give it a try, to see if the latest installation by Lenovo of these programs would work. I have ended up having to uninstall AC from two of these laptops already (my Z61T and my T43) because this dog won't hunt. Once uninstalled I've had no problems connecting with the native Windows wireless program. I am using Mac Address Filtering and WPA-PSK-AES encryption, with no problems whatsoever in the windows application.

Up until maybe 2 months ago I'd used AC without problems or issues for several years, but I now regard it as a quirky bloated program that has probably outlived its usefulness for most users.

[Kyocera]

Up until maybe 2 months ago I'd used AC without problems or issues for several years, but I now regard it as a quirky bloated program that has probably outlived its usefulness for most users.

I agree, I'm sort of a road warrior, on and off client networks and wherever I can find an unsecured connection I'll use it, I have never used AC, it's one program I uninstall immediately after a re-image or a new machine.

[StoneCold]

Ken,

Thanks for the information.

I agree that AC does seem to be buggy and bloaty, but for the most part, it has worked for us. We wanted to use the Cisco Secure Services Client (CSSC) but that was an absolute nightmare. When we installed it on the IBM laptops, boot time was 8-12 minutes. That obviously was totally unacceptable.

I don't think that the normal Windows client will support EAP-FAST, WPA2 and AES will it???

So, for now, we are stuck with AC.

[Ken Fox]

Ken,

Thanks for the information.

I agree that AC does seem to be buggy and bloaty, but for the most part, it has worked for us. We wanted to use the Cisco Secure Services Client (CSSC) but that was an absolute nightmare. When we installed it on the IBM laptops, boot time was 8-12 minutes. That obviously was totally unacceptable.

I don't think that the normal Windows client will support EAP-FAST, WPA2 and AES will it???

So, for now, we are stuck with AC.

I don't know about CSSC; you could certainly try it or you could see if Cisco has any updated drivers. It is my understanding (but I could be wrong) that AC is just an overlay on top of the windows wireless program, that memorizes location profiles and automatically connects to access points. If it worked, it would offer some increased functionality along those lines but I doubt it can connect to networks that the windows app cannot. Once again I might be wrong and the easiest way to find out would be to try the Windoze app and see if it works.

If you are having problems with AC you can go into taskmasker and look at processes that are running. You will likely find that AC is taking up 50 or more percent of the CPU cycles if it isn't working right, so there is some sort of head butting going on but I don't know exactly what it is.

[Wiz]

There is no native support in windows for EAP-FAST so that require AC or some other client like CSSC or Intel Proset (for Intel adapters). AC is not just a overlay on top of the windows wireless client. AC add several functions that you won't find using the built-in windows support like EAP-FAST, LEAP, PEAP-GTC, OTP, QoS and several other functions. I'm pretty sure that Windows do support WPA2/AES though. There been several bugs in AC, but i think the client works really good and add a lot of features. AC is one of the wireless clients available with most features. The Windows wireless client lack a lot of authentication types and functions and is very simple, but sometimes very stupid so i actually prefer the AC and think it's way better then the windows wlan client. Hopefully the wireless support in Windows Vista is better.

I work a lot with Cisco products and is actually using the same setup at home with 802.1x, EAP-FAST, WPA2 AES and a Cisco ACS integrated with AD on a 2003 server. It's not because i need the security and is more like a lab i can use at home. Also implemented similar solutions at customer sites and never seen a similar problem using a Thinkpad and AC. Of course there been lot of other issues so it's not like i never seen any wireless issues. If you enable other authentication types on the ACS like LEAP or PEAP and use WEP or TKIP instead of AES does it work fine then or is it the same problem for all 802.1x authentication types? Does it connect fine to open wireless networks or networks with static WEP?

What is the channel you are using on your WLAN? If you got several AP's i assume you also use several none overlapping channels. Some channels is available in some countries only and clients that doesn't support those channels won't be able to connect. Any channel equal to 11 or below should be fine. If you also use a Cisco access point you have lot of debug options, but not sure if those will help in this case. Is a re-image/reinstall of the OS an option on that computer? If you spend to much time without solvng the problem it might be faster to reinstall the OS.

[StoneCold]

Wiz,

We are only using EAP-FAST with WPA2 AES, so I don't know if it would work otherwise.

This user had 2 other profiles that he created after the fact, and I have verified that these connections are working (I think it was a home connection probably with just basic WEP and then a hotel connection).

We are using a Cisco 4402 WLC with (10) 1242 APs and (2) 1231 APs.

I really don't think that a reinstall is viable right now. One thing I haven't tried is to do a remove for the adapter, then reinstall the driver and AC. Maybe I will try that next. Do you know anything more about the error code 10 from within AC?

Thanks.

[Wiz]

I realize that you use EAP-FAST and AES, but it's really fast to configure a new SSID for testing on the WLC were you can use another authentication type and encryption. Then you might be able to narrow the problem and maybe found out if the problem is related to AES encryption or something else. Could be a problem with the PAC as well and that's why it could be interesting to see it other auth. types like LEAP work fine. You could try to delete the PAC as well.
Since it's only one client with a problem i don't think to debug on the WLC will be any help. As you said to uninstall AC and wlan driver and make sure everything is removed before a reinstall of the driver and then AC i guess would be natural as the first step.

Sorry, i never seen the error code 10 and don't know what that means.