Intel Dual Band Wireless-AC 8260 unable to associate WPA2-PEAP PMF(Required) + FT(802.11r)

[JunLiu]

Hi,

We here at the Extermenetworks.com wireless division experienced the issue with Intel Dual Band Wireless-AC 8260.
When Protected Management Frames(PMF) set to "Required" and FT(802.11r) enable, the client Lenov E560 laptop with Wireless-AC 8260
is unable to associate our access point.

The Windows 10 runs Window10/64bit Enterprise Version: 21H OS Build 19043.1110).

The capture shows that Association request failed to include AKM suite(00:0f:ac:3, FT over air)
in the RSN IE and as such failed the IE checking. See the attached png file.

To our best knowledge from tests, Samsung S10 phone works fine; Also, this Windows 10 client works fine
as long as the WPA2-PEAP setup is not PMF(Required)+FT(802.11r) combination.

Can someone look into this please? The detail is in the attachment.

Thanks.

[David_G_Intel]

Hello JunLiu

Thank you for posting on the Intel️® communities. Please share with us the following information:

• Does this happen with different access points?
• Did you test different drivers?
• Make sure to update the BIOS to the latest version, contact the manufacturer for instructions.
• Is this issue happening at home, office environment or both?
• Is this a new computer?
• Is this the original adapter that came pre-installed in your system or have you changed/installed a new adapter recently?
• Have you checked if this issue happens on different networks?
• Were you able to have you wireless connection in a normal/expected performance before?

Regards, 

David G 

Intel Customer Support Technician 

[JunLiu]

David, thank you moving the conversation forward, If you need more information, let me know.

>>>Does this happen with different access points?
Yes.

>>>Did you test different drivers?
Yes. The same setup works fine for iPhone11 and Samsung S10.
However, most of laptop based on Intel Wifi card failed.
There is one laptop Windows 10 (version 21H1, Intel AX210 driver version 22.50.1.1) actually worked, other with the same config did not.

>>>Make sure to update the BIOS to the latest version, contact the manufacturer for instructions.
I will try that.

>>>Is this issue happening at home, office environment or both?
At the office lab.

>>>Is this a new computer?
No. Old Lenovo E560.

>>>Is this the original adapter that came pre-installed in your system or have you changed/installed a new adapter recently?
Yes, it is pre-installed.

>>>Have you checked if this issue happens on different networks?
You mean networks provided by different vendor's AP? No, I did not.

>>>Were you able to have you wireless connection in a normal/expected performance before?
Yes, as long as network setting is not PMF=Required+FT combination.

[David_G_Intel]

Let us know once the BIOS is updated, we are currently working on this request and the updates will be posted on this thread.

Regards, 

David G 

Intel Customer Support Technician 

[JunLiu]

Hi, David,

1) I did update BIOS for Lonovo E560 to latest dated 2017, the issue is still there. The upgrade does not help

2) I then upgraded to latest Intel AC8260 driver version 20.70.25.2 6/22/2021; Windows 10 (version 21H1), it does not work either.

Having looked at the traffic capture, the ASSOC Request is missing AKM entry for FT in RSN IE and MDIE is present(should be there for FT)

We go back to double check specification, AKM  00-0F-AC:3 is required to be in RSN for FT where it is missing in our Intel Intel AC8260 driver when pmf=Required+FT combination.

If an MDIE is present in the (Re)Association Request frame and the contents of the RSNIE do not indicate a negotiated AKM of Fast BSS Transition (suite type 00-0F-AC:3 or 00-0F-AC:4), the AP shall reject the (Re)Association Request frame with status code 43 (i.e., Invalid AKMP).

in section 11A.4.2 FT initial mobility domain association in an RSN

1. MUST This word, or the terms "REQUIRED" or "SHALL", mean that the
definition is an absolute requirement of the specification.

[David_G_Intel]

To continue with the investigation, we sent you an e-mail to the e-mail address associated with your community profile requesting some documents that may contain sensitive information. Please remember to reply privately.

Regards, 

David G 

Intel Customer Support Technician 

[David_G_Intel]

Hello @JunLiu

Thank you for the reports and information provided. Using SHA256 with PMF is broken in some Windows versions (20H1, 20H2, 21H1), the issue may be fixed on 21H2. The test has been done in newer adapters like the AX200, however customers still may experience the problem when using the 8260 as it was not validated for this old adapter so there are a lot of chances that this combination will never work.

Users could try SHA1, upgrade to 21H2, and test but you will also need to confirm with Microsoft for the fix coming in 21H2.

Regards, 

David G 

Intel Customer Support Technician 

[SondreSandberg]

Hi David,

Do you know if this issue was fixed in 21H2?

[David_G_Intel]

We have not heard back from you, so we will close this thread. If you need any additional information, please submit a new question as this thread will no longer be monitored.   

Best regards,  

David G. 

Intel Customer Support Technician