MS Surface (gen 1 and 4) - management frame protection

[Hennes_Hoffmann]

Microsoft Surface (not 2 and 3) and several Sony ultrabooks do not connect to SSID with active management frame protection. This issue was supposed to be fixed with v9.21.16.0013. Apparently this is not the case. MFP has to stay disabled, even with the most recent firmware on controllers and APs.

[Jason1]

Hi Hennes,

We are aware of a current issue in 10.11 firmware with MFP enabled and WPA2-PSK. It has been re-created in our labs on certain devices and is under investigation.

https://gtacknowledge.extremenetworks.com/articles/Solution/Certain-devices-not-connecting-to-WPA2-P...
Can you please contact GTAC and open a case with a tech support file and we can track the fix for you.

Regards,
Jason

[Jason1]

My apologies, I had originally addressed that to Chris, but I had intended to reply to Hennes!

[Hennes_Hoffmann]

What kind of additional information is required?
The broad setup: SSID1 - radius authentication (works as there is no need for an "external MFP)
SSID2 - WPA2-PSK

The "surfaces" can see the SSID, try to connect but fail to do so. If an incorrect passphrase is entered this is detected. This issue was not only reported for surfaces but also for SONY sff laptops. Not sure if there are also Marvell Avastars involved. One user reported the issue was only present with Windows but not under linux. If true it might be a driver issue (or as MFP was only optional but not enforced by the controller the linux driver opted to ignore it).

[Chris_H]

I am aware that it was reported that in 10.11 there are issues when trying to connect to 5Ghz radios using WPA2-PSK with MFP enabled.

This is under investigation by Engineering at this moment, but without knowing more information about your setup it's a bit difficult to say if these are the same.