Does anyone have problems with MacBooks and /or iPad joining guest network that uses CWP and ID Manager?

[msauriol]

We are constantly having issues with Apple products joining our Guest wireless after they have successful joined the same wireless guest network on a previous day. We have AP230s and I giving out individual Access Keys with ID Manager. We've also enabled "Prevent Apple CNA (Captive Network Assistant) application from requesting credentials" under the CWP configuration. We've also tried removing the wireless network from the device and restarting the MacBook or iPad. Nothing works.

Thx!

[samantha_lynn]

Would you be able to SSH in to an AP, run the following debugs, replicate the issue (It would actually be best if we could do this twice, once during a first time connection that works and once the next day when they can't connect again, but at least once when we can't connect is fine), then pull tech data from the AP? Please also note the MAC address of the device used to replicate the issue so we can find the right data within the tech data.

Debugs:

_debug auth basic

_debug auth verbose

To get tech data using HiveManager Classic (myhive.aerohive.com) go to 

Monitor> Select the check box next to the AP> Utilities> Get Tech Data. 

  

This guide reviews how to get tech data from the CLI of the AP in case that's easier: 

https://thehivecommunity.aerohive.com/s/article/Collecting-Tech-Data-via-CLI 

If you'd rather email the data directly to me instead of posting it, please feel free to send it to communityhelp@aerohive.com.

[msauriol]

Hi Sam,
We are running into both of those issues. I prompts them for the password and it doesn’t accept private PSK password we provide so they can’t connect. It eventually Locks them out. We see that in the Authentication Logs under ID Manager. We have the Private PSK password setup to be good for 12 hours after initial login, but it never gets to that point. Let me know if you need anything else.
Thanks!

[samantha_lynn]

When the Apple clients come back after having connected the previous day, what kind of issues do they have? Are they unable to connect at all? If they are unable to connect, could we run a client monitor to see where the connection is failing? Or are they prompted to re-enter their credentials, and if they are is this expected with how you've set up the cache ageout settings or should the clients be in the cache for longer than a day? The "Prevent Apple CAN" setting should just stop any CWPs from coming up automatically on Apple devices (as opposed to needing to open a browser to get to the CWP), so that shouldn't block any Apple clients from connecting.