topic Re: What reasons would there be for a PPSK to stop working on a handful of devices, while it works o in Aerohive Migrated Content

What reasons would there be for a PPSK to stop working on a handful of devices, while it works on others connected to the same AP?

tgmatula — Mon, 07 Oct 2019 20:00:21 GMT

Our campuses are experiencing chronic connectivity issues with one of the following symptoms:

1) Either the PPSK stops working on their device.

2) They are able to connect to the SSID and PPSK but no internet connectivity. Cannot ping DNS or Gateway.

Testing:

Rebooting the AP does nothing for the user. Moving closer to the AP or changing the connection preference between 2.4 and 5GHz has no effect.

The only solution... so far is to locate which RADSEC(proxy) the AP is connecting to and reboot it...

Oak-AP106#show idm

IDM client: Enabled Per SSID

IDM Proxy IP: 10.31.120.40

IDM proxy: Disabled

RadSec Certificate state: Valid

RadSec Certificate Issued: 2019-01-15 08:25:32 GMT

RadSec Certificate Expires: 2020-01-15 08:25:32 GMT

Is the IDM Proxy supposed to show "DIsabled" even though the IP is listed and it is using that particular proxy for PPSK authentication?

Anyone have any permanent solutions for the RADSEC issues???

Re: What reasons would there be for a PPSK to stop working on a handful of devices, while it works on others connected to the same AP?

samantha_lynn — Mon, 07 Oct 2019 20:35:20 GMT

Are you using cloud based PPSK credentials or locally stored PPSK credentials (if you're not sure you can see this in the PPSK user group object). If you're using cloud based PPSKs, you'll want the IDM proxy to say Enabled (on the AP that is acting as the IDM proxy).

Re: What reasons would there be for a PPSK to stop working on a handful of devices, while it works on others connected to the same AP?

tgmatula — Mon, 07 Oct 2019 20:44:01 GMT

I have verified we are using Cloud based PPSK authentication and the RADSEC servers do show enabled.

IDM proxy: Enabled

IDM server: cloud-va-idmauth.aerohive.com

Re: What reasons would there be for a PPSK to stop working on a handful of devices, while it works on others connected to the same AP?

samantha_lynn — Tue, 08 Oct 2019 00:03:48 GMT

Thank you for letting me know. In that case, would you be able to SSH in to the AP, enable auth debugs, replicate the issue, note the MAC address of the device you used to replicate the issue, and send me tech data pulled directly after replicating along with the MAC address used during the test? If you'd like to send that to me directly, my email is communityhelp@aerohive.com.

This guide reviews how to enable auth debugs: https://thehivecommunity.aerohive.com/s/article/Authentication-Auth-Debugs

Re: What reasons would there be for a PPSK to stop working on a handful of devices, while it works on others connected to the same AP?

tgmatula — Fri, 11 Oct 2019 01:29:46 GMT

We have turned on debugging on the APs near the most vocal residents. As soon as i receive a call that the issue is occurring i will download the logs and send them over. We have not been able to reproduce the issue at will or on the fly. It usually re-appears approximately 7-10 days after the last RADSEC AP reboot. Again, the devices it affects has been random. Usually a cell phone or tablet stops working on the PPSK while a laptop and a different tablet in the same area work fine with the same PPSK.

Re: What reasons would there be for a PPSK to stop working on a handful of devices, while it works on others connected to the same AP?

tgmatula — Wed, 16 Oct 2019 23:29:11 GMT

Logs uploaded.

Re: What reasons would there be for a PPSK to stop working on a handful of devices, while it works on others connected to the same AP?

samantha_lynn — Thu, 17 Oct 2019 00:06:47 GMT

Thank you for those files. Could you provide the MAC address of the client that wasn't able to connect when you pulled these logs?

Re: What reasons would there be for a PPSK to stop working on a handful of devices, while it works o

Chanson_Gong — Thu, 03 Apr 2025 01:19:33 GMT

I have come across the same, from the proxy server ap I can see the ap is getting ip add but no matter how many times I tried to reset the idm or revert to device to policy template. It is still saying RadSec Certificate state: Not exist, not sure if I should reboot the proxy server aps to see if that will resolve the issue?

RadSec Certificate state: Not exist

and

sh idm cert
RadSec certificate file is not installed.

Re: What reasons would there be for a PPSK to stop working on a handful of devices, while it works o

Shepherd — Thu, 22 May 2025 10:18:33 GMT

If PPSK stops working on some devices but not others on the same AP, it’s often due to RadSec proxy issues. High AP CPU usage can disrupt authentication exclude such APs from proxy roles. Firewall blocks on ports 2083 and 3000–3010, time sync problems, expired RadSec certificates, or MFP being enabled can also cause issues. Make sure the AP's time is correct, MFP is disabled, and devices have updated drivers. Running diagnostics and checking logs can help identify the problem. Rebooting the RadSec proxy often resolves the issue temporarily, but proper configuration is key for a permanent fix.