;)
Tuesday
Dec292009
Configure TKIP Countermeasure Holdoff Timer on WLC
Tuesday, December 29, 2009 at 6:24PM 
After having worked on countless Cisco WLAN VoIP deployments a general rule of thumb from Cisco TAC is to disable TKIP countermeasure on ALL voice WLANs and lessen the timer for DATA WLANs. Again this is all subject to your comfort level and performance requirements. Personally, I can't say I have ever seen this to be an issue or had an issue that was directly related to the countermeasure. But something to chew on!
TKIP countermeasure mode can occur if the Access Point receives 2 message integrity check (MIC) errors 
within a 60 second period. When this occurs, the Access Point will de-authenticate ALL TKIP clients associated to that 802.11 radio and holdoff any clients for the countermeasure holdoff time (default = 60 seconds).
within a 60 second period. When this occurs, the Access Point will de-authenticate ALL TKIP clients associated to that 802.11 radio and holdoff any clients for the countermeasure holdoff time (default = 60 seconds).
(Cisco Controller)config wlan security <tkip> hold-down <seconds> <wlan id>
Note: Configures TKIP MIC countermeasures hold-down timer (0-60 seconds)
The following command disables TKIP countermeasure on WLAN 1
(Cisco Controller) >config wlan security tkip hold-down 0 1
Reader Comments (1)
Thanks for the command we are getting ready to implement VoIP on the WLAN and this just saved me some time. Thanks!