We have an AIR-AP1131G-A-K9 configured as a workgroup bridge for a network with EAP-TLS configured. The client AP works fine while configured, but as soon as it is restarted, it gives the error:
*Mar 1 00:00:21.937: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: EAP authenticating
*Mar 1 00:00:28.414: %IDMGR-3-INVALID_ID: bad id in id_to_ptr (id: 0x150537700005376) -Traceback= 0x5DBF8 0x775F30 0x7D26DC 0x7D2FB4 0x198850
and never authenticates. If an administrator logs on and runs:
interface Dot11Radio0
shutdown
no shutdown
the AP connects as normal. Sanitized configuration is below:
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname cap-pyxis
!
enable secret 5 ******************
!
no aaa new-model
ip domain name ******.LOCAL
!
!
!
dot11 ssid ABC-Automation
authentication open eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa version 2
dot1x credentials jsmith-tls
dot1x eap profile jsmith-tls
infrastructure-ssid
!
power inline negotiation prestandard source
eap profile jsmith-tls
method tls
!
!
crypto pki trustpoint 2012-jsmith-user
revocation-check crl
rsakeypair 2012-jsmith-user
!
!
crypto pki certificate chain 2012-jsmith-user
certificate 17E40E0500000000008B
! additional certificate information snipped
quit
certificate ca 3881F9AA60B025A242EEDB2D4510A613
! additional certificate information snipped
quit
dot1x credentials jsmith-tls
username jsmith
pki-trustpoint 2012-jsmith-user
!
username Cisco password 7 ***********
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption mode ciphers aes-ccm
!
ssid ABC-Automation
!
station-role workgroup-bridge
bridge-group 1
bridge-group 1 spanning-disabled
!
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
!
interface BVI1
ip address 10.2.3.200 255.255.255.0
no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
login local
!
The device is running c1130-k9w7-mx.124-10b.JA and is using certificates from a Microsoft Server 2008 R2 enterprise CA with NPA used for radius. The AP that the client is joining to is controlled by a Cisco WLC, the exact model and version of which escapes me.
