;)
Tuesday
Dec292009
Configure TKIP Countermeasure Holdoff Timer on Autonomous
Tuesday, December 29, 2009 at 6:48PM 
After having worked on countless Cisco WLAN VoIP deployments a general rule of thumb from Cisco TAC is to disable TKIP countermeasure on ALL voice WLANs and lessen the timer for DATA WLANs. Again this is all subject to your comfort level and performance requirements. Personally, I can't say I have ever seen this to be an issue or had an issue that was directly related to the countermeasure. But something to chew on!
TKIP countermeasure mode can occur if the Access Point receives 2 message integrity check (MIC) errors 
within a 60 second period. When this occurs, the Access Point will de-authenticate ALL TKIP clients associated to that 802.11 radio and holdoff any clients for the countermeasure holdoff time (default = 60 seconds).
within a 60 second period. When this occurs, the Access Point will de-authenticate ALL TKIP clients associated to that 802.11 radio and holdoff any clients for the countermeasure holdoff time (default = 60 seconds).
ap#config t
ap(config)#interface dot11Radio 0
Note: This is radio specific on autonomous access points
ap(config-if)#countermeasure tkip 0
Note: Configures TKIP MIC countermeasures hold-down timer (0-65535 seconds), unlike the WLC which is (0-60 seconds)
Reader Comments