My current Setup:

  • Two SSIDs broadcasted
  • SSID 1 (airlan) is configured with dot1X and dynamic vlan association
  • SSID 2 (prv) with PSK and a static vlan

I've recognized, that every 60s the devices on the second SSID disconnected from the AP. After some investigation i found out, that 60s is the default activity timeout for non-aironet devices. Increasing this timeout increases the interval they disconnect as expected. This seems to solve the Problem with some devices that stopped reconnecting after some hours or days. But I don't think thats an ideal solution.

Devices connected to the first SSID (airlan) never had this problem and comparing the information given by "show dot11 association xxxx.xxxx.xxx" reveals, that on the second SSID the "Last Activity" counter constantly increases while on the first it resets when activity happens. The AP does not seem to recognize activity (whatever Cisco defines activity as).

Is this a firmware-bug or can I do something different to solve this situation?

Hardware Info

(I know, that there are two newer images, but I don't have access at the moment)

air4#show hardware
Cisco IOS Software, C1600 Software (AP1G2-K9W7-M), Version 15.2(2)JB, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 11-Dec-12 04:30 by prod_rel_team

ROM: Bootstrap program is C1600 boot loader
BOOTLDR: C1600 Boot Loader (AP1G2-BOOT-M) LoaderVersion 15.2(2)JAX, RELEASE SOFTWARE (fc1)

air4 uptime is 1 day, 7 hours, 16 minutes
System returned to ROM by power-on
System restarted at 14:11:45 MET-DST Fri Sep 20 2013
System image file is "flash:/ap1g2-k9w7-mx.152-2.JB/ap1g2-k9w7-mx.152-2.JB"
Last reload reason: 

cisco AIR-SAP1602E-E-K9    (PowerPC) processor (revision A0) with 98294K/32768K bytes of memory.
Processor board ID FGL1710ZCBU
PowerPC CPU at 533Mhz, revision number 0x2151
Last reset from power-on
1 Gigabit Ethernet interface
2 802.11 Radios

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:06:F6:21:XX:XX
Part Number                          : 73-14508-04
PCA Assembly Number                  : 000-00000-00
PCA Revision Number                  : 
PCB Serial Number                    : 
Top Assembly Part Number             : -01
Top Assembly Serial Number           : 
Top Revision Number                  : 
Product/Model Number                 : AIR-SAP1602E-E-K9   

Running Config

Current configuration : 5150 bytes
aaa session-id common
clock timezone met 1 0

clock summer-time MET-DST recurring last Sun Mar 2:00 last Sun Oct 3:00
no ip igmp snooping
ip cef
ip name-server
dot11 syslog
dot11 activity-timeout unknown default 3000
dot11 ssid airlan
   vlan 5
   authentication open eap eap_methods 
   authentication key-management wpa version 2
   accounting eap_acct_methods
   mbssid guest-mode
dot11 ssid prv
   vlan 60
   authentication open 
   authentication key-management wpa version 2
   mbssid guest-mode
   wpa-psk ascii 7 070E274A4B07125503080E1C163C
dot11 network-map
dot11 arp-cache optional
crypto pki token default removal timeout 0
username Cisco password 7 05280F1C2243
ip ssh version 2
bridge irb
interface Dot11Radio0
 no ip address
 encryption vlan 6 mode ciphers aes-ccm 
 encryption vlan 5 mode ciphers aes-ccm 
 encryption vlan 4 mode ciphers aes-ccm 
 encryption vlan 60 mode ciphers aes-ccm 
 encryption mode ciphers aes-ccm 
 ssid airlan
 ssid prv
 countermeasure tkip hold-time 0
 antenna gain 0
 beamform ofdm
 no preamble-short
 station-role root
 no dot11 extension aironet
 world-mode dot11d country-code DE both
interface Dot11Radio0.1
 encapsulation dot1Q 1 native
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
interface Dot11Radio0.4
 encapsulation dot1Q 4
 bridge-group 4
 bridge-group 4 subscriber-loop-control
 bridge-group 4 spanning-disabled
 bridge-group 4 block-unknown-source
 no bridge-group 4 source-learning
 no bridge-group 4 unicast-flooding
interface Dot11Radio0.5
 encapsulation dot1Q 5
 bridge-group 5
  • Did JasperWallace's answer solve your problem? Aug 30, 2014 at 17:11
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 19:50

1 Answer 1



broadcast-key vlan 1 change 60

for each of the vlans.

(Seen here: http://www.blueboxmoon.com/wordpress/?p=832).

I've got similar issues also with cisco access points in standalone mode.



Cisco IOS Software, C3500 Software (AP3G1-K9W7-M), Version 15.3(3)JAB, RELEASE SOFTWARE (fc1)

Things seem to be much better.

I also have:

dot11 activity-timeout unknown default 3600 dot11 activity-timeout client default 3600 maximum 3600 dot11 wpa handshake timeout 1000

in the general section

  • Could you expand your answer a bit to explain what this command does and how it can resolve the problem described by the OP?
    – YLearn
    Dec 3, 2013 at 19:43
  • Sorry for the late anwser, had some tough weeks. I'll try your suggestion the next weekend and kepp you tuned.
    – phhe
    Dec 11, 2013 at 21:44
  • @YLearn sorry, I should of been more detailed in my answer. I need to double check my setup and come up with a better test for this issue. Dec 28, 2013 at 12:56
  • @ JAsper: Hi Jasper i am facing the similar problem with the same kind of scenario. Can i use broadcast-key vlan 1 change 60 when my vlan 1 is my native vlan? Nov 24, 2014 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.