IssueTracker

Just going to copy/paste what I put in the Nexus 5 bug page here too since it applies:

I think I figured out what the problem was at least on my end. I was able to create a few differently configured wireless networks to zero in on the culprit.

I tried a few different configurations but one setting consistently caused this issue, which was using AES as the encryption policy for the WPA2 network.

Creating a WEP network with the same name does not cause this issue, so I was able to rule out the similar network names being the cause. COMPANY_Employees, COMPANY_MobileDevices, COMPANY_Guest, etc will all connect as intended if they aren't using AES encryption.

It looks like Lollipop has an issue with WPA2 AES encryption. As soon as I switched to TKIP, I was able to connect quickly and without issue. Hopefully this helps someone else out there while we wait for this issue to be fixed in Lollipop.

Having the same problem TKIP works and AES no connection on my nexus 9

On the Nexus 9 this seems to be a different problem than the one reported in the preview. Here is the logcat output of the failure with verbose wifi logging enabled, I couldn't find a reference to explain what the return codes meant:

11-05 10:49:31.795 E/WifiConfigStore(  450): updateSavedNetworkHistory(): try "Guest"WPA_PSK SSID="Guest" Guest [WPA2-PSK-CCMP][ESS] ajst=128

11-05 10:49:31.795 E/WifiConfigStore(  450):         got known scan result c4:0a:cb:xx:xx:xx key : "Guest"WPA_PSK num: 19 rssi=-90 freq=2437

11-05 10:49:31.795 E/WifiAutoJoinController (  450): Portthru d2:0c:cf:vv:vv:vv rssi=-87 cap [IBSS] is not scored

11-05 10:49:31.795 E/WifiAutoJoinController (  450): ageScanResultsOut delay 40000 size 66 now 1415213371795

11-05 10:49:31.795 E/WifiAutoJoinController (  450): newSupplicantResults size=65 known=18 true

11-05 10:49:31.795 D/WifiNative-wlan0(  450): doString: [STATUS-NO_EVENTS]

11-05 10:49:31.795 D/wpa_supplicant( 5768): wlan0: Control interface command 'STATUS-NO_EVENTS'

11-05 10:49:31.795 D/WifiNative-wlan0(  450):    returned wpa_state=SCANNING p2p_device_address=52:2e:5c:yy:yy:yy address=50:2e:5c:ww:ww:ww uuid=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz

11-05 10:49:31.795 E/WifiAutoJoinController (  450): attemptAutoJoin() status=wpa_state=SCANNING

11-05 10:49:31.795 E/WifiAutoJoinController (  450): p2p_device_address=52:2e:5c:yy:yy:yy

11-05 10:49:31.795 E/WifiAutoJoinController (  450): address=50:2e:5c:ww:ww:ww

11-05 10:49:31.795 E/WifiAutoJoinController (  450): uuid=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz split=4

11-05 10:49:31.795 E/WifiAutoJoinController (  450): attemptAutoJoin() num recent config 1 ---> suppNetId=-1

11-05 10:49:31.796 E/WifiAutoJoinController (  450): attemptAutoJoin skip candidate due to auto join status 128 key "Guest"WPA_PSK reason 4

11-05 10:49:31.796 E/WifiAutoJoinController (  450): attemptRoam not associated

11-05 10:49:31.796 E/WifiAutoJoinController (  450): Done attemptAutoJoin status=0

Also experiencing this on N5 LRX21O, connecting to a WPA2 AES PSK corporate network using Cisco access points.

From what I've gathered online this largely seems to be happening to Cisco AP users. I have a Ubiquiti AP at home with a similar configuration that works fine.

This started happening for me on the second developer preview but I didn't look too far into it at the time given the preview status.

I am seeing the following in logcat:

I/wpa_supplicant( 9615): wlan0: Associated with 00:26:cb:ab:c2:a0
I/wpa_supplicant( 9615): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant( 9615): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant( 9615): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant( 9615): wlan0: CTRL-EVENT-DISCONNECTED bssid=00:26:cb:ab:c2:a0 reason=4

The issue seems to boil down to the EAPOL descriptor version being 3, which you can see in the verbose log:
D/wpa_supplicant( 9615): wlan0: RX EAPOL from 00:26:cb:ab:c2:a0
D/wpa_supplicant( 9615): wlan0: IEEE 802.1X RX: version=2 type=3 length=117
D/wpa_supplicant( 9615): wlan0:   EAPOL-Key type=2
D/wpa_supplicant( 9615): wlan0:   key_info 0x8b (ver=3 keyidx=0 rsvd=0 Pairwise Ack)
D/wpa_supplicant( 9615): wlan0:   key_length=16 key_data_length=22

This has potential to be a fairly significant issue for us. Thanks

Wanted to contribute that this issue is only occurring on Cisco APs/AES/Lollipop for me. My connection at home is also WPA2 with AES on a non-Cisco AP and the connection is stable.

I confirm the same problem on Nexus 5 with Lollipop release.
My home wifi network with Asus router connection is OK.
My work wifi connection does not connect. It stays "Saved".

Confirm, same problem with Nexus 5.

Confirm the same issue on Nexus 5 (LRX21O)

logcat:
E/WifiStateMachine(  742): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0,00 rxSuccessRate=0,00 delta 1000 -> 1000
E/WifiStateMachine(  742): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=2 roam=3
E/WifiConfigStore(  742): saveWifiConfigBSSID Setting BSSID for "BSSID"WPA_EAP to any
E/WifiStateMachine(  742): CMD_AUTO_CONNECT will save config -> "BSSID" nid=2E/WifiConfigStore(  742): will read network variables netId=2
E/WifiStateMachine(  742): CMD_AUTO_CONNECT did save config ->  nid=2E/WifiConfigStore(  742): will read network variables netId=2
I/wpa_supplicant(31426): wlan0: Trying to associate with 00:3a:99:92:38:f3 (SSID='BSSID' freq=2462 MHz)
E/WifiConfigStore(  742): setLastSelectedConfiguration -1
I/wpa_supplicant(31426): wlan0: Associated with 00:3a:99:92:38:f3
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-STARTED EAP authentication started
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=pdc2.XXX.XX'
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=pdc2.XXX.XX'
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=pdc2.XXX.XX'
I/wpa_supplicant(31426): EAP-MSCHAPV2: Authentication succeeded
I/wpa_supplicant(31426): EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
I/wpa_supplicant(31426): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(31426): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2

It happens also to me on N5 LRX21O
Home Network is ok
company-guest with WPA2 PSK
company with PEAP
both are failing.
With 4.4.4 was working

Same problem here, in my case it could be related to https://code.google.com/p/android-developer-preview/issues/detail?id=1620 because we have such similarly named networks here (MYCOMPANY and MYCOMPANY-GUEST and I'm trying to connect to the 2nd one).
Worked fine at 4.4.4

11-13 12:48:30.167  3813  3813 I wpa_supplicant: wlan0: CTRL-EVENT-SCAN-STARTED
11-13 12:48:31.726   744  1145 E WifiStateMachine: WifiStateMachine shouldSwitchNetwork  txSuccessRate=0,00 rxSuccessRate=0,00 delta 1000 -> 1000
11-13 12:48:31.727   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
11-13 12:48:31.727   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANY-GUEST"WPA_PSK to any
11-13 12:48:31.731   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT will save config -> "MYCOMPANY-GUEST" nid=0
11-13 12:48:31.777   744  1145 E WifiConfigStore: will read network variables netId=0
11-13 12:48:31.783   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT did save config ->  nid=0
11-13 12:48:31.784   744  1145 E WifiConfigStore: will read network variables netId=0
11-13 12:48:31.790  3813  3813 I wpa_supplicant: wlan0: Trying to associate with xx:xx:xx:xx:xx:xx (SSID='MYCOMPANY-GUEST' freq=2437 MHz)
11-13 12:48:31.844   744  1145 E WifiConfigStore: setLastSelectedConfiguration -1
11-13 12:48:31.993  3813  3813 I wpa_supplicant: wlan0: Associated with xx:xx:xx:xx:xx:xx
11-13 12:48:31.993  3813  3813 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 12:48:32.296   744  1146 E WiFiServiceImpl : CONNECT  nid=0 uid=1000
11-13 12:48:32.296   744  1146 D WifiService: Connect with networkId0
11-13 12:48:32.298   744  1145 E WifiStateMachine: CONNECT_NETWORK id=0 config="MYCOMPANY-GUEST" cnid=0 supstate=HandshakeState my state DisconnectedState uid = 1000 skipped
11-13 12:48:32.298   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANY-GUEST"WPA_PSK to any
11-13 12:48:32.299   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANY-GUEST"WPA_PSK to any
11-13 12:48:32.300   744  1145 E WifiAutoJoinController : updateConfigurationHistory found 1 networks
11-13 12:48:32.301   183   876 D audio_hw_primary: out_set_parameters: enter: usecase(1: low-latency-playback) kvpairs: routing=2
11-13 12:48:32.304   744  1145 E WifiConfigStore: setLastSelectedConfiguration 0
11-13 12:48:32.305   744  1145 E WifiConfigStore: will read network variables netId=0
11-13 12:48:32.319  8715  8747 D OpenGLRenderer: endAllStagingAnimators on 0x9ebc8e00 (RippleDrawable) with handle 0xa1610870
11-13 12:48:33.001  3813  3813 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 12:48:34.001  3813  3813 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 12:48:35.002  3813  3813 I wpa_supplicant: wlan0: CTRL-EVENT-DISCONNECTED bssid=xx:xx:xx:xx:xx:xx reason=15

Having the same issues with my work WiFi.  Nexus 5 LRX21O

Same Issue. Nexus 5 LRX21O

5GHz
----
I/wpa_supplicant(  897): wlan0: CTRL-EVENT-SCAN-STARTED
E/WifiStateMachine(  780): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
E/WifiStateMachine(  780): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
E/WifiConfigStore(  780): saveWifiConfigBSSID Setting BSSID for "work-guest"WPA_PSK to any
E/WifiStateMachine(  780): CMD_AUTO_CONNECT will save config -> "work-guest" nid=0
E/WifiConfigStore(  780): will read network variables netId=0
E/WifiStateMachine(  780): CMD_AUTO_CONNECT did save config ->  nid=0
E/WifiConfigStore(  780): will read network variables netId=0
I/wpa_supplicant(  897): wlan0: Trying to associate with 00:27:0d:5f:65:6c (SSID='work-guest' freq=5180 MHz)
E/WifiConfigStore(  780): setLastSelectedConfiguration -1
I/wpa_supplicant(  897): wlan0: Associated with 00:27:0d:5f:65:6c
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
E/wpa_supplicant(  897): PNO: In assoc process
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: Authentication with 00:27:0d:5f:65:6c timed out.
I/wpa_supplicant(  897): wlan0: CTRL-EVENT-DISCONNECTED bssid=00:27:0d:5f:65:6c reason=3 locally_generated=1

2.4GHz
------
I/wpa_supplicant(  897): wlan0: CTRL-EVENT-SCAN-STARTED
E/WifiStateMachine(  780): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
E/WifiStateMachine(  780): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
E/WifiConfigStore(  780): saveWifiConfigBSSID Setting BSSID for "work-guest"WPA_PSK to any
E/WifiStateMachine(  780): CMD_AUTO_CONNECT will save config -> "work-guest" nid=0
E/WifiConfigStore(  780): will read network variables netId=0
E/WifiStateMachine(  780): CMD_AUTO_CONNECT did save config ->  nid=0
E/WifiConfigStore(  780): will read network variables netId=0
I/wpa_supplicant(  897): wlan0: Trying to associate with 00:27:0d:5f:65:63 (SSID='work-guest' freq=2462 MHz)
E/WifiConfigStore(  780): setLastSelectedConfiguration -1
I/wpa_supplicant(  897): wlan0: Associated with 00:27:0d:5f:65:63
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: Authentication with 00:27:0d:5f:65:63 timed out.
I/wpa_supplicant(  897): wlan0: CTRL-EVENT-DISCONNECTED bssid=00:27:0d:5f:65:63 reason=3 locally_generated=1

This issue does NOT present on LRX21P on my Nexus 7 (2013) and works as intended, but continues to be a problem on Nexus 5 LRX21O 100% of the time as others have stated. Relevant bug capture data below.

11-13 09:04:14.513   744  1145 E WifiStateMachine: CONNECT_NETWORK id=1 config="MYCOMPANYWIFI" cnid=1 supstate=ScanState my state DisconnectedState uid = 1000
11-13 09:04:14.513   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANYWIFI"WPA_PSK to any
11-13 09:04:14.514   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANYWIFI"WPA_PSK to any
11-13 09:04:14.515   744  1145 E WifiAutoJoinController : updateConfigurationHistory found 0 networks
11-13 09:04:14.516   744  1145 E WifiConfigStore: setLastSelectedConfiguration 1
11-13 09:04:14.523   744  1145 E WifiConfigStore: will read network variables netId=1
11-13 09:04:14.529  9724  9724 I wpa_supplicant: wlan0: Trying to associate with 00:26:cb:f4:75:cd (SSID='MYCOMPANYWIFI' freq=5180 MHz)
11-13 09:04:14.653  9724  9724 I wpa_supplicant: wlan0: Associated with 00:26:cb:f4:75:cd
11-13 09:04:14.653  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:15.692  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:16.692  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:17.688  9724  9724 I wpa_supplicant: wlan0: CTRL-EVENT-DISCONNECTED bssid=00:26:cb:f4:75:cd reason=15
11-13 09:04:24.848  9724  9724 I wpa_supplicant: wlan0: CTRL-EVENT-SCAN-STARTED
11-13 09:04:25.520   744  1145 E WifiStateMachine: WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
11-13 09:04:25.524   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=1 roam=3
11-13 09:04:25.524   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANYWIFI"WPA_PSK to any
11-13 09:04:25.532   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT will save config -> "MYCOMPANYWIFI" nid=1
11-13 09:04:25.579   744  1145 E WifiConfigStore: will read network variables netId=1
11-13 09:04:25.586   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT did save config ->  nid=1
11-13 09:04:25.587   744  1145 E WifiConfigStore: will read network variables netId=1
11-13 09:04:25.594  9724  9724 I wpa_supplicant: wlan0: Trying to associate with 00:26:cb:f4:75:cd (SSID='MYCOMPANYWIFI' freq=5180 MHz)
11-13 09:04:25.650   744  1145 E WifiConfigStore: setLastSelectedConfiguration -1
11-13 09:04:25.720  9724  9724 I wpa_supplicant: wlan0: Associated with 00:26:cb:f4:75:cd
11-13 09:04:25.720  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:26.890  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:27.892  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:28.889  9724  9724 I wpa_supplicant: wlan0: CTRL-EVENT-DISCONNECTED bssid=00:26:cb:f4:75:cd reason=15

Can confirm this occurs on the 5.0 (LRX21O) build for the Nexus 5. Unable to connect to EAP-PEAP network at my office. The network is saved, but never connects. This occurs 100% of the time. My office also uses Cisco access points like comment #4 and #5 mentioned.

I can confirm the same issue on a Nexus 9 with build LRX21L; we have EAP-PEAP with MSCHAPv2 authentication and Cisco access points, ssid is "Data," WPA/WPA2 (TKIP/CCMP) encryption. Confirmed with multiple distinct APs located in separate buildings (in fact, some are miles apart).

Both a Nexus 7 (2013 LTE) and a Nexus 5 running 4.4.4 connect to this network without trouble, as does a 2012 MacBook Pro running Yosemite.

Seeing the same as above when connecting to a WPA2/AES enterprise wifi network:

I/wpa_supplicant( 9209): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2

I'm on the factory image (LRX21O) for Nexus 5, and this happens 100% of the time.

(If all AES encryption is really affected, this bug should be upgraded from 'small', but that's just my sysadmin non-developer perspective).

Same issue as described above. Happening on my company network using WPA2-PSK with AES, as well as PEAP-MSCHAPv2

Same as above for everyone else on this issue but mine is affected on the Nexus 7 2012 Wifi model.  
Went back to 4.4.4 and it works great, went back to 5.0 and no go.

I am also experiencing this at our company.  WPA/AES is not working correctly on our NEXUS 7 wifi models, switching to TKIP works on our CISCO AP's but the network is currently setup as AES.  This is a major problem how did this get through testing?

Also our devices are now running 5.0 when this problem started.  4.4.4 is fine.

Confirming same issue at my institution using factory image Nexus 5.  Logs look identical to what everyone else has already posted.

At the moment, I think it's useless for everyone to say "me too", it's obvious there is a bug crippling the wifi on android 5 since the 2nd preview and which, incredibly, made it into production.
It would be more useful if someone would be able to raise the priority of this bug because for now, it's at Priority-Small.

I think the interesting part of the logs is here:
11-13 09:04:14.653  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2

For info:
Value 1 indicates HMAC-MD5 for data integrity and ARC4 for key wrapping. MIC is 16 octets
Value 2 indicates HMAC-SHA1 for data integrity and AES Key Wrap (RFC 3394) for key wrapping. MIC is 16 octets.
Value 3 indicates AES-CMAC for data integrity and AES Key Wrap (RFC 3394) for key wrapping. MIC is 16 octets.

I can confirm the same. Here are my observations while recreating the issue on LRX210.

It occurs with FACTORY IMAGES, NOT with OTA. (I flashed and it didn't work and my friend did OTA and he is able to connect).

It seems to be an issue with CISCO routers(using EAP).(I have belkin in my home(WPA2), and able to connect.)

will go back to 4.4.4 and do OTA....

and finally someone change the priority.

We are NOT using EAP here and is still an issue with WPA2/AES  I will also try going back to 4.4.4 and OTA unfortunately my devices weren't getting the OTA yet, thus why I had to force flash.

[Comment deleted]

I can confirm that if you roll back to 4.4.4 and then upgrade to 5.0 from OTA the wireless holds good with WPA2/AES.  I now have no problem connecting to networks.  Google has a link for the 5.0 from 4.4.4 update ZIPs available so I was able to sideload and test.

My CISCO equipment is as follows:

WLAN Controller: AIR-WLC4402-25-K9

AP's:  AIR-LAP1131AG-A-K9

Interesting update:

The network I'm having issues connecting with is actually configured for either AES or TKIP.

When I look at it in the Network Analyzer app, the security shows up as [WPA2-PSK-CCMP+TKIP].

So now I'm wondering is it's the supplicant not picking TKIP is AES doesn't work, or if it's something on Cisco's side that isn't allowing the TKIP connection.

[Comment deleted]

#29

Its most likely getting stuck on the choosing of AES or TKIP to authenticate with.  I also tested this by having a network with both enabled and was getting the same result.  It seems to get stuck if AES is offered in any fashion, which again goes to show the Factory image is screwed up with WPA2/AES.

Nexus Help Forumer Here...

My best friend noted these observations on his Nexus 5.

The factory image won't connect to the corporate network from initial setup -- the "connect to wifi" stage must be skipped.

If I use the 4.4.4 factory image, run through the setup there, it connects. Then if I use the OTA to update to 5.0, it will still connect.  However, if I flash 4.4.4 then update to 5.0 with the OTA without setting the device up/connecting to the corporate wifi (meaning 5.0's setup will run after the OTA), it will not connect.  So yes, kitkat > setup device (incl connect to wifi) > OTA works.  5.0 factory image > setup does not.  kitkat > OTA > setup device does not work.  Additionally, kitkat > skip setup > connect to wifi > OTA works, but then if I force the setup wizard to run with

adb shell am start -n com.google.android.setupwizard/.SetupWizardTestActivity

I can no longer connect.

So these observations seem to point to the setup corrupting something.

Interesting so if I forget the corporate or WPA2/AES networks it will corrupt again, good to know!  Thanks #32!

Could someone who can reproduce the issue that results in "wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2" showing up in the debug log send me a more complete extract of logcat with wpa_supplicant debug level increased (or alternatively, a wireless capture showing the frames exchanged between the AP and the Android device)? Feel free to email that directly to me (j@w1.fi) for some added privacy.

This looks like an interoperability issue with the AP selecting incorrect EAPOL-Key descriptor version for the specific AKM that was negotiated. I have not been able to reproduce this, but as soon as I'll confirm my suspicions, I can add a workaround to wpa_supplicant to avoid the issue.

I'm also having issues similar to those described. I've been able to connect to all wifi networks except the corporate network at work since flashing the newest 5.0 from two days ago on my Nexus 5. This issue was also happening after flashing the last two L previews. I was working with my IT manager yesterday to diagnose the issue. My home network is WPA2 as is the corporate network. APs at the office are Cisco. No certificates, just WPA2. We noticed that no matter what I did when trying to connect, including manually adding the network and specifying WPA2 encryption, the phone would repeatedly try to authenticate using 802.1x, until my device was added to an exclusion list after too many failed attempts.

Here's a dump.  I don't really know what I'm looking at, but it appears to be trying to connect at 5GHz and 2.4GHz.  Let me know if there are any more logs I can dump.

I/wpa_supplicant(  855): wlan0: CTRL-EVENT-SCAN-STARTED
E/WifiStateMachine(  716): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
E/WifiStateMachine(  716): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
E/WifiConfigStore(  716): saveWifiConfigBSSID Setting BSSID for "LibertyLake"WPA_PSK to any
E/WifiStateMachine(  716): CMD_AUTO_CONNECT will save config -> "LibertyLake" nid=0
E/WifiConfigStore(  716): will read network variables netId=0
E/WifiStateMachine(  716): CMD_AUTO_CONNECT did save config ->  nid=0
E/WifiConfigStore(  716): will read network variables netId=0
I/wpa_supplicant(  855): wlan0: Trying to associate with 00:26:cb:a0:80:5f (SSID='LibertyLake' freq=5200 MHz)
E/WifiConfigStore(  716): setLastSelectedConfiguration -1
I/wpa_supplicant(  855): wlan0: Associated with 00:26:cb:a0:80:5f
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: Authentication with 00:26:cb:a0:80:5f timed out.
I/wpa_supplicant(  855): wlan0: CTRL-EVENT-DISCONNECTED bssid=00:26:cb:a0:80:5f reason=3 locally_generated=1
I/wpa_supplicant(  855): wlan0: CTRL-EVENT-SCAN-STARTED
E/WifiStateMachine(  716): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
E/WifiStateMachine(  716): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
E/WifiConfigStore(  716): saveWifiConfigBSSID Setting BSSID for "LibertyLake"WPA_PSK to any
E/WifiStateMachine(  716): CMD_AUTO_CONNECT will save config -> "LibertyLake" nid=0
E/WifiConfigStore(  716): will read network variables netId=0
E/WifiStateMachine(  716): CMD_AUTO_CONNECT did save config ->  nid=0
E/WifiConfigStore(  716): will read network variables netId=0
I/wpa_supplicant(  855): wlan0: Trying to associate with c4:0a:cb:df:62:f0 (SSID='LibertyLake' freq=2462 MHz)
E/WifiConfigStore(  716): setLastSelectedConfiguration -1
I/wpa_supplicant(  855): wlan0: Associated with c4:0a:cb:df:62:f0
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: CTRL-EVENT-DISCONNECTED bssid=c4:0a:cb:df:62:f0 reason=15

#35

what kind of authentication is your corporate network using?  WPA2 TKIP or AES or BOTH?  right now its only AES or MIXED that is not working.  TKIP alone on WPA2 seems to be fine.

#34 This is my logcat with the following filter: "wpa_supplicant:V *:S"

http://pastebin.com/qXDEGS1t

For the debug log, I would need to get more verbose logging enabled for Wi-Fi events than what shows up in logcat by default. I'm not completely sure what is needed for that in the official Android builds, but it may be possible to increase verbosity from the Settings app "Developer options" with the "Enable Wi-Fi Verbose Logging" option.

While I have not yet been able to reproduce the reported issue myself or confirm that this change addresses this with the APs mentioned here, I would expect this upstream wpa_supplicant change to resolve this interoperability issue for the case where "WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2" is shown in logcat:
http://w1.fi/cgit/hostap/commit/?id=9f6a7cddc42811883d6035032854089475f2fc65

[Comment deleted]

#39 just sent you logs at debug level at your email you provided

#41 Thanks. To record more details of the issue here, this was a Cisco AP configured with WPA+WPA2-PSK CCMP+TKIP mode without PMF being enabled. SHA1-based AKM was used and the AP ended up selecting incorrect descriptor version. Difficult to say why, but I guess that could have been triggered by the MFPC=1 (Management Frame Protection Capable) indication in the RSN element from the station.

I have a dual frequency router that broadcasts two separate, individually-named 2.4 and 5 GHz networks. In Lollipop, but also in KitKat, I've experienced quirks connecting to this setup which are possibly related to this overall issue. I had a single frequency 2.4GHz router prior to KitKat, so I can't comment on this issues existence before then.
The issue I've noticed is related to establishing a WiFi connection using different frequencies on my Nexus devices (N4 and N7-2013). It will not connect to either frequency unless I save both the 2.4 GHz and 5 GHz network profiles. In other words, if I started from scratch, with no WiFi networks saved, I can't connect to the 2.4 GHz network unless I *also* save the profile/password of the 5 GHz too.
Note: These SSID is hidden for these networks, so that's why I'm connecting manually.

[Comment deleted]

Nexus 5 with LRX21O

Also exhibits problem with Open Source router: DD-WRT v24-sp2 (05/27/13) running on Linksys E3000 router.

WPA2 PSK or Enterprise networks with AES cannot connect.

Reverted to 4.4.4 and connected fine.

Same issues as the others on LRX210. Hard to believe this is still marked "Priority-Small".

Just wanted to add that on the day I was trying to connect the problem network I had to force power down my phone after it locked up. Don't know if it's related, but it's the only time I can recall it locking up in the last year.

Just want to add thatbi flashed 4.4.4 and then OTA via adb sideload and now it works

Same issue.. I can't connect WPA2PSK cisco wifi network. I'm on the factory image, but somebody say OTA upgrade is working well. Does it mean the factory image and OTA version is different?

probably the OTA doesn't overwrite completely something...

Thank you #49..
I go back 4.4.4 and try to OTA upgrade using sideload..
yeah.. it's working..

I'm sure that factory image has some wifi connection bug?!!

[Comment deleted]

This "WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2" issue is not really a bug in Android; it is a bug in the AP. This get triggered by enabling of PMF (management frame protection) which was done in Android 5.0. It sounds like OTA upgrade does not end up changing wpa_supplicant configuration file for this which explains why there is a difference between OTA upgrade and clean factory image flashing (or factory reset).

This AP bug can be worked around in couple of ways to avoid interoperability issues with deployed APs. The change I noted above would be the cleanest way. I just do not happen to have an AP that shows this issue (or well, I think I'm running with a newer version of Cisco software on the AP and that has the issue resolved) and I have not yet received a clear confirmation that the workaround avoids the issue completely with the APs that have been reported here. I'd assume that the wpa_supplicant change gets pulled into Android once such confirmation is available. Or alternatively, if that change is not enough to avoid the full issue, the other workarounds can be considered.

Um.. but my case, after OTA sideload update working well, I made factory reset using option menu in lollipop, I can't connect the same wifi again.

#53: That would match the expected behavior. OTA update did not modify wpa_supplicant configuration to enable PMF; factory reset replaced wpa_supplicant configuration with the L default (which does enable PMF).

This upstream wpa_supplicant change:

http://w1.fi/cgit/hostap/commit/?id=9f6a7cddc42811883d6035032854089475f2fc65

was confirmed to work around the issue with Cisco AP. As such, I'd recommend merging that into the following Android update.

I was experiencing similar issues since updating to 5.0 (LRX21O), but I was having wifi connectivity issues at home and not at work.

Home setup is a dual-band TP-Link Archer C7. Both networks are hidden, and security on both bands was WPA2-PSK with AES mandated. The wireless connection would establish on either network ("connected" in the network list), but the exclamation point would remain. At the same time, my full-strength LTE signal would disable (gaining its own exclamation point). I would have no data until wifi was disabled, at which point mobile data would immediately resume. Manually disabling mobile data, rebooting, toggling wifi on/off, forgetting and re-configuring wifi networks: none of it made a difference.

I reconfigured my router to automatic encryption (either TKIP or AES) on both bands, and my problems were resolved...full wifi connection on both networks that persists after reboot.

Got Lollipop OTA for my Nexus 5. Wifi doesnot connect at all. It says connecting and saved. But nothing happens. Please help. I tried factory reset still no use.

I have updated my Nexus from the factory image, and the connection is not working, so is not an OTA bug, but a release one.

I have experienced similar issues, which I could work around by assigning a
fixed IP address for the Wifi connection in question.

There is the off-chance that this might help some of you too...

2014-11-18 8:50 GMT+01:00 <android@googlecode.com>:

I have dirty-flashed (factory image) my Nexus 5 to LRX21O and the WiFi connection to our corporate wifi still works fine. On my Nexus 9 with LRX21Q (also dirty-flashed from LRX21L), the connection DOESN'T work (didn't work before) with that "CCMP is used, but EAPOL-Key descriptor version (3) is not 2" error.

Comparing both /data/misc/wifi/wpa_supplicant.conf files:

Nexus 5 (WORKS):
------------8<----------------8<-----------------8<-------------------8<------------
disable_scan_offload=1
update_config=1
device_name=hammerhead
manufacturer=LGE
model_name=Nexus 5
model_number=Nexus 5
serial_number=0123456789abcdef
device_type=10-0050F204-5
config_methods=physical_display virtual_push_button
p2p_disabled=1
external_sim=1
wowlan_triggers=any

network={
ssid="Mobile"
key_mgmt=WPA-EAP IEEE8021X
eap=PEAP
identity="myidentity"
password="mypassword"
priority=187
proactive_key_caching=1
}
------------8<----------------8<-----------------8<-------------------8<------------

Nexus 9 (DOESN'T WORK):
------------8<----------------8<-----------------8<-------------------8<------------
disable_scan_offload=1
driver_param=use_p2p_group_interface=1p2p_device=1
update_config=1
device_name=volantis
manufacturer=htc
model_name=Nexus 9
model_number=Nexus 9
serial_number=REDACTED
device_type=10-0050F204-5
config_methods=physical_display virtual_push_button
p2p_no_go_freq=5170-5740
pmf=1
external_sim=1
wowlan_triggers=any
p2p_search_delay=0

network={
ssid="Mobile"
scan_ssid=1
key_mgmt=WPA-EAP IEEE8021X
eap=PEAP
identity="myidentity"
password="mypassword"
priority=516
proactive_key_caching=1
}
------------8<----------------8<-----------------8<-------------------8<------------

I switched off wifi, removed the "pmf=1" line from the N9's config, rebooted immediately and voila: Connection works.

So if you are rooted, try this fix.

#60 - really works. tnx a lot! :) Nexus 5 + LRX21O (factory image with full wipe)

Now hopefully, someone could raise the prio on this bug or create a new one with higher prio to get someone from google noticing.

Thanks for the fix! Worked for me!

Another confirmation that removing the pmf=1 from the .conf file fixed the issue. You do have to reboot immediately though. Don't re-enable wifi until you reboot. I learned that the hard way.

Hi,

I'm sending this post to thanks #60. After applying the fix i've successfully connected to my wifi network (what a couldn't before the fix). Now i can use Lollipop.

Thanks,

Today I downgraded my Nexus 5 to the KTU84P build, then updated via OTA to the last build of Android 5. All is functioning.

Does the #60 fix work on anything other than a Nexus 5?  (I.E. Nexus 7 2012)

For anyone attempting the fix in #60, make sure the permissions for wpa_supplicant.conf are set to rw-rw----, the owner is system and the group is wifi otherwise your WiFi will not turn on.

I was able to fix this problem via a third party app:https://play.google.com/store/apps/details?id=com.brilliapps.wifiandmorefixer

I don't know if it's relevant but I ran into this (or a similar) bug when my Nexus 5 updated to KitKat.

I tried doing the edit to wpa_supplicant from #60, but the bit about checking the permissions mentioned in #68 hadn't been posted yet.

Ended up flashing 4.4.4 (KTU84P) and sideloading the 5.0 OTA. WiFi works, now, finally.  

App suggested in #69 did not work for me

Using the release Ota version for the nexus 5 and can confirm the wifi issue happens at free WiFi restaurants in Ontario Canada (restaurants like McDonald's free WiFi) saves but never connects. This issue is affecting public wifi as well as corporate and school wifi.

So this issue is anything but small

Same problem.  I received this phone from google play 1 week ago.  Got the Android 5.0 OTA today.  After 5.0 update, wifi was connected and working fine at work.  It will not connect now that I am at home (WPA Personal with AES) will not connect and my network just indicates as Saved.

Can confirm that #60's fix works (Nexus 5 + LRX21O)

This is failing on UC Berkeley's campus WiFi, which is "Airbears2", an 802.1x EAP / TTLS + PAP network

https://kb.berkeley.edu/sharedservices/page.php?id=33823

Confirmed on both Nexus 5 and Nexus 7

Hi can you please provide instructions on how to fix this issue, I'm having the same exact problem

Consider this a "seconding" of asking for instructions on how to fix this. I've searched and searched and can't figure out how to "edit wpa_supplicant.conf" as mentioned in #60 anywhere.

/data/misc/wifi/wpa_supplicant.conf can be edited using any text editor (I used ES File Explorer). The exact steps I took:

1. Turn off WiFi
2. Copy /data/misc/wifi/wpa_supplicant.conf to /sdcard
3. Rename /data/misc/wifi/wpa_supplicant.conf to /data/misc/wifi/wpa_supplicant.conf.old
4. Copy /sdcard/wpa_supplicant.conf to /data/misc/wifi
5. Edit /data/misc/wifi/wpa_supplicant.conf (using ES File Explorer) and remove the pmf=1 line
6. Save the file and make sure the permissions are appropriately set as in #68
7. Reboot
8. Turn on WiFi

Now my corporate network (PEAP MSCHAPv2) connects without any issues.

I have a Nexus 5 it has 4.4.2 version of android earlier and there were no issues connecting to public wifi. Now with Loolipop even though I get the sign-in required bar in the status screen it does not open the browser and show the login page.

Following the instructions in Comment #78 fixed my wifi issue as well.

If there any solution that does not involve having root? Kind of reluctant to root just for this =/

Is it possible to access the above .conf file from a PC/MAC if we have the full Android SDK installed?

I aren't rooted, and can't root as I rely on the a few apps with good root detection (even using cloak + xposed)

This needs fixing ASAP - Going to have to return to 4.4.4!

Oh boy. Just got the OTA and now nervous about downloading. Are people that got the OTA still having issues? I want Lollipop really bad. LOL
Let me know what you think.

OTA or Sideload OTA it makes zero difference

Towni...my concern is it
 OK to download safely.

Don't if your corporate wifi uses Cisco AP's

FWIW my corporate uses Cisco APs and it was the WPA_supplicant.conf edit that got it working.

Can it be done without root?

No, editing wpa_supplicant requires root. Hopefully Google chimes in on this issue soon.

If you have a custom recovery then you can use adb to pull the file, edit it on your PC, then push it back with adb. Thus not requiring root, but requiring an unlocked bootloader.

oooh i have custom TWRP recovery and also unlocked bootloader - Is there anywhere I can see all commands I would need?

Such as copying file to PC, sending it back, moving file, setting permission etc.

I used ES File Manager to edit the file with its built in text editor. Worked like a charm.

adb pull and adb push are the commands you're looking for. You might also need to mount data in recovery. Permissions shouldn't be an issue from recovery. If there are I believe twrp has a built in file manager that allows you to check permissions.

[Comment deleted]

Got the file off using adb pull, but I don't have the line pmf=1 in the .conf file ... here is what I have

disable_scan_offload=1
update_config=1
device_name=hammerhead
manufacturer=LGE
model_name=Nexus 5
model_number=Nexus 5
serial_number=031c777f08e6c41c
device_type=10-0050F204-5
config_methods=physical_display virtual_push_button
p2p_disabled=1
external_sim=1
wowlan_triggers=any

network={
        ssid="clinical"
        key_mgmt=WPA-EAP IEEE8021X
        eap=PEAP
        identity="xxxxxx"
        password="xxxxxx"
        phase2="auth=MSCHAPV2"
        priority=100040
        proactive_key_caching=1
}

I upgraded my phone to lollypop yesterday once I got it as OTA. Since then I am unable to connect to WiFi network. It says connected but unable to browse through the internet. My build is LXR210

Welcome to the club, have you confirmed if you have the line that says pmf=1 in the .conf file and removed it as per instructions in post #78

I confirm that Wi-Fi issue is actual for me too :'-(

How do we get this to the attention of Google to get an official response?

I got new lollipop today and also have an issue now with WiFi which perfectly works on 4.4.4
Device is connected, but there is no internet connection.
WiFi icon is with exclamation mark

I can confirm that solution from #60 works fine for Nexus 5 on LXR210. The only thing you should have is rooted device and ES Commander. But still waiting for official fix from Google.

I am having the same issue (PEAP with MSCHAPv2 on Cisco AP) on my Nexus 6.   Whats the over/under on how long it will take Google to address the issue?

Just installed the OTA on Nexus 5. Absolutely no problems whatsoever. Loving the new OS. Connected to my home wifi no problem. I will be going out later and I'll see if I connect to other WiFi's

Thanks Google.

Nexus 7 LRX21P build.  Sideloaded the OTA and it was connecting to the corporate guest network without an issue.  Performed a factory reset (just to start fresh) and now I can't connect to the corporate guest network.  When I go to the saved networks, the two corporate guest networks have no security (WPA/WPA2 PSK) associated with the networks.My N5 LRX210 build has no issues connecting to the networks.  I have a friend with a N5 that received the OTA and performed a factory reset and now he can't connect to the corporate guest network either.  The common denominator for my N7 and his N5 is the factory reset after the update.

Yes, a factory reset also resets the wpa_supplicant.conf I mentioned in #60 and in the new default file, there's the "pmf=1" line which borks EAP networks. If you did a normal OTA or dirty-flash (i.e. you kept all your data from KitKat), your wpa_supplicant.conf is also kept and KitKat didn't have the "pmf=1" line in it.

Update to my #103 post. Stopped by McDonald's and connected to WiFi. So far no problems with Lollipop. Working as it should.

McDonalds don't use use PEAP/MSCHAPv2 and certainly not Cisco AP's which seems to be the biggest culprit so you're not going to run in to any issues.

pmf=1 isnt even there for some of us, so removing it doesn't make a difference.

I have this issue on my N9, and I just received the update notice for my
N5. Just so I understand the last two posts correctly, if I update my N5
with the official OTA and do a factory reset, will I end up with the broken
wifi bug? We are using WPA2 with AES on Cisco routers at the office, so the
issue affects my N9, and I don't want to end up losing wifi connection on
my N5 as well.

As I told before, I had 4.4.4 with no wifi issues at work. But after official OTA update without factory reset - I loose it.
After I made factory reset - nothing changed - wifi doesn't work.

Same issue. Nexus 6 cannot connect to work WiFi network (Cisco router)

I have a Nexus 5 and recently updated to Lollipop (LRX210). Had the same issue where I wasn't able to connect over wifi for either home or work. Tapping the connect button multiple times didn't work. I kept tapping that connect button. Forgot the connection and re-entered my creds multiple times. Nothing worked.

Solution:
Power off. Power On.

Now my work's wifi is working fine. Oldest trouble shooting solution in the book and I had forgotten it.

I had the similar problem with my OnePlus One running the CM12 beta version and would not connect to Corporate network based on Cisco APs. Following the #60 and removing the pmf=1, the WiFi on phone would keep turning OFF.

So I tried changing the value from 1 to 0 i.e. set pmf=0, and voila it's working great now.

Guys. Something wierd happened. I have been facing the wifi issue at office since last 4 days - i.e. since I got OTA LRX210 on my Nexus 5. Did a factory reset and still no help. This was the case until last night. Today morning I got some app updates over wifi at home and I did not bother to check which ones got updated and dismissed the notification. Then I came in to office and voila - the wifi at office connected without any problem. So looks like the issue is gone. Great news for me. But please remember I did not get a sw update. So no clue how this got fixed and my phone has never been rooted.

@#112 sumit.gr...@gmail.com

Interesting that removing pmf=1 didnt change anything but forcing it to pmf=0 which essentially should turn off pmf worked!

Might give it a try over the weekend and report back Monday!

If i enable Airplane on and off it always connects fine, it's when I roam between AP's mine has an issue (exclamation mark over WIFI icon etc)

same problem like everyone. can someone suggest me a solution without rooting the phone..also I don't know how we can go back to an update, few people here seemed to have gone back to kitkat to solve the problem. please help me in layman language. My id. rushilshah13@gmail.com

If you're not rooted then you can use adb to pull the file, edit, and send it back. There is no official way to go back, you''ll have to re-flash the 4.4.4 KitKat image which will do a full wipe of everything.

There are plenty of guides on the web how to do it, no need to fill this thread with info already on there, we need to keep this clean so Google pull their finger out and sort it!

i had an issue with my work wifi. in the past on my nexus 5, it would prompt me to sign-in to network like a hotel wifi. i would click on it and an error about how it might be unsafe since the ip address it was sending me to was not actually https and might be unsafe. usually i could click on proceed anyways and it would redirect me to the login site and be done with. after i upgraded to L, the (android built-in)  sign-in to network splash page stays blank. i assume it thinks its unsafe but does not let me proceed. luckelly i had the reroute (internal) ip address to the company's sign-in page on my chrome history but it wouldn't let me continue. i messed with the settings and eventually shut off my mobile internet, loaded the sign-in page. got the usually this is not safe do you want to continue, clicked hells yes, signed in then enjoyed free internet. NOTE: my mms wasn't working without mobile internet on and i believe its my network administrator's doing but i keep getting logged off having to do this several times a day. it gets old. i remember the old android settings let you configure if you wanted strict wifi or automatically the best connection (between mobile and wifi)

I'll confirm above that on LRX210 I cannot connect to the cisco APs at work, getting the same logging error as everyone:
 E/WifiMonitor(1949): WifiMonitor:wlan0 cnt=2028 dispatchEvent: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2

One difference, I'm using the brand new Nexus 6

I tried this pmf=1 line delete and edit to pmf=0 ,set permission and reboot but not worked,wifi is now too buged and no turn on...any other idea?

I have Xperia SP LBL and use the LBL version of CM12

Confirming the same issue on Nexus 4, flashed factory image - LRX21T. It says 'Connecting..' then changes to 'Connected', and I can see the Wifi connected symbol in the notification area. Then it just disconnects. Further attempts at connecting results in a toast - 'Failed to connect to Network', unless switching the Wifi off and on again, which results in the connect-disconnect again.
This is on Home WPA and WPA2 PSK on TKIP and AES.
On just WEP, the status just says 'Saved', not even 'Connecting'.
Tried removing line containing pmf=1 and setting pmf=0. Still no change.

Confirming the same issue on Nexus 5.
Due to weak wifi signal (switched to using 5GHz frequency band, as to many connections on 2.5GHz making my wifi slow). My wifi disconnects once in a while due to this reason and once it does,the new os does not reconnect automatically but pushes my wifi to a "Saved" status and starts using my mobile data.

Having the same issue. Nexus 5 latest factory image. Cisco AP. Wpa2 Aes. So waiting for fix. Dont want to root phone at the moment

WPA/WPA2 PSK on nexus5 LRX21O does not work. Connected, but there is no internet.
With 4.4.4 was ok in same network

LG G3 with unofficial CM 12 ROM, same problem. Can't connect to our work PEAP/MSCHAPV2 network, but can connect to normal WPA2 networks just fine. Adding pmf=0 to wpa_supplicant.conf doesn't change anything, the line actually disappears automatically after a while.

I know this is probably not the best place, but I upgraded my LG G3 to Lollipop and I'm having this issue too.

And the file indicated on post #60 does not exist here.

[Comment deleted]

[Comment deleted]

I'm having a similar problem with my n5 running lrx210.but the problem is not with the wpa.. It's wps push button. Everytime I have to connect to my WiFi network by switching on that wps button on my router.. But in KitKat there was no problem like this.. Once I had connect my WiFi network with wps push button the login detains would get saved on my phone and I didn't had to everytime use that wps push button when I wanted to connect.. But now I've to use that wps push everytime I want to connect in lollipop

There is a new fix for fix this problem :D
http://forum.xda-developers.com/xperia-sp/general/guide-fix-connectivity-android-5-0-t2951677

Nexus 6. Mixture of Cisco AP's. Same issue.

-Please fix.

Sadly all these fix'es (requiring root or alternative kernel) might be a security breach (no one confirmed the safety yet).
If you use your phone for everyday duty but not for experimental development better choose going back to KitKat until there is an upstream fix.

Requesting elevation of issue priority.

@#129 - that fix does not apply to people here, that's to solve the bigger issue of having no wifi/cellular at all, only effects countries like India and a few others, which is why Google stopped rolling out 5.0 to those!

You do not need to be rooted to apply the fix in post 60 by the way, you can easily grab the .conf file and put it back with the pmf changes, and fix permissions using ADB however, I changed pmf to 0 and it made no difference for me, so it's not a guaranteed fix!

Nexus 4. I have the same issue on LRX21T change the channel on the router to something other than 12 or 13 fixes the problem temporarily - https://www.youtube.com/watch?v=8NGd50iJ83w

Nexus running Android 5.0, same issu.

Same WIFI issue with Android 5.0 | IRX21O | Cisco

Same issue here on my wife's Nexus 5 / LRX21O.

But, after 15-20 minutes trying, she figured out a way to make it connect to any WPA/WPA2 PSK . The steps that she is taking are still not really clear for me, but she said that it always work in the moment that she plug the Nexus 5 in a USB port. Probably, there is a race condition that make it work or it is actually a bug on the new build.

Here is a dump when it worked:

adb logcat wpa_supplicant:V *:S
--------- beginning of system
--------- beginning of main
I/wpa_supplicant( 3784): Successfully initialized wpa_supplicant
E/wpa_supplicant( 3784): Line 566: Invalid WEP key length 10 - this network block will be ignored
E/wpa_supplicant( 3784): Line 3268: Invalid WEP key length 14 - this network block will be ignored
E/wpa_supplicant( 3784): Line 3539: Invalid WEP key length 11 - this network block will be ignored
E/wpa_supplicant( 3784): Line 6250: Invalid WEP key length 15 - this network block will be ignored
I/wpa_supplicant( 3784): rfkill: Cannot open RFKILL control device
I/wpa_supplicant( 3784): rfkill: Cannot open RFKILL control device
I/wpa_supplicant( 3784): CTRL_IFACE: Detach monitor /data/misc/wifi/sockets/wpa_ctrl_719-4\x00 that cannot receive messages
I/wpa_supplicant( 3784): CTRL_IFACE: Detach monitor /data/misc/wifi/sockets/wpa_ctrl_719-2\x00 that cannot receive messages
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): p2p0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
I/wpa_supplicant( 3784): p2p0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
I/wpa_supplicant( 3784): p2p0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
I/wpa_supplicant( 3784): p2p0: CTRL-EVENT-REGDOM-CHANGE init=BEACON_HINT type=UNKNOWN
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: Trying to associate with 00:1d:d5:5a:10:90 (SSID='ThiLau' freq=2462 MHz)
I/wpa_supplicant( 3784): wlan0: Associated with 00:1d:d5:5a:10:90
I/wpa_supplicant( 3784): wlan0: WPA: Key negotiation completed with 00:1d:d5:5a:10:90 [PTK=CCMP GTK=TKIP]
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-CONNECTED - Connection to 00:1d:d5:5a:10:90 completed [id=1595 id_str=]
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): p2p0: CTRL-EVENT-REGDOM-CHANGE init=USER type=COUNTRY alpha2=US
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-DISCONNECTED bssid=00:1d:d5:5a:10:90 reason=0
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-REGDOM-CHANGE init=USER type=UNKNOWN
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: Reject scan trigger since one is already pending
W/wpa_supplicant( 3784): wlan0: Failed to initiate AP scan
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-REGDOM-CHANGE init=USER type=COUNTRY alpha2=US
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: Trying to associate with 00:1d:d5:5a:10:90 (SSID='ThiLau' freq=2462 MHz)
I/wpa_supplicant( 3784): wlan0: Associated with 00:1d:d5:5a:10:90
I/wpa_supplicant( 3784): wlan0: WPA: Key negotiation completed with 00:1d:d5:5a:10:90 [PTK=CCMP GTK=TKIP]
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-CONNECTED - Connection to 00:1d:d5:5a:10:90 completed [id=1596 id_str=]
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
xI/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED
I/wpa_supplicant( 3784): wlan0: CTRL-EVENT-SCAN-STARTED

Nexus 6. Ran Chainfire's auto root method and the wifi "broke". Flashed factory image (LRX21O) didn't help. It will connect, say it's connected, but connection isn't usable (whether mobile data is on or not). I thought it might have had something to do with the root modifying the stock kernel, but the factor image didn't change anything. I also tried using the FXR wifi fixer mentioned in another post, unfortunately it didn't change anything either.

Doesn't work on our Cisco Wireless LAN controller using Microsoft Network Policy Server.  If upgraded from KitKat the network will be untouched and work, if its a new connection it fails.

My Nexus 5 received OTA update to LRX21O and I can confirm that I CAN still connect to network at work (Cisco with WPA2-AES). Note: I did NOT do a factory reset after getting the update.

My Nexus 9 received the update to LRX21R however I still CANNOT connect to the work network, I continue to get the "Connecting/Saved" state, but never connects.

I just called Google Play customer support to complain, as it is technically an issue that affects consumer usage of a product, and should constitute ground for a return if there is no fix forthcoming. It's kind of a big issue, imo, since anyone trying to use a Nexus 9 for work on a network with this configuration will not be able to.

I have the same problem with my Nexus 4 on my corporate network using Ubiquiti.
The network settings are correct and other devices connect without problems , only my Nexus 4 with andriod 5.0 does not connect.

INFO
Version Andriod 5.0
Build LRX21T

After I updated it came to connect but after five minutes the connection closed and did not connect any more.
In my home connects without problems after using a D-Link access point.

I'm still waiting for a solution, I will not change any configuration files on my phone.

I can do nothing but wait ...

[Comment deleted]

Cannot connect to corporate wifi (Meru routers) on my Nexus 5. I was successfully using wifi for about a week after upgrade, but today it stopped working. We have three different networks in my office an I am unable to connect to any of them. It says networks are 'Saved' but there is no wifi symbol appearing in the top menu bar.

If at any point after an OTA update you 'forget network' and then recreate it you will be unable to login.  The 'fix' is to roll back to KitKat setup the wireless network then update to Lollipop.

Same issue Nexus 4, work wifi looks like it connects successfully, says it's saved but there is no wifi connection icon in the menu bar

burned through a lot of my carrier data because of this :p

when the new release planned? I guess the priority of issue not so small, when you are unable to connect to 90% of corporate networks.

Can you please fix this??? I lost all my data plan because of this!!!
how the hell do you roll out something that's so buggy??
And how do I get kit kat back now? I can't use L until this is fixed!

My Moto X just got it OTA upgrade to the L release. Now it refuses to connect to our home wi-fi. The phone is "authenticating," but not connecting. I tried turning wi-fi on and off, airplane mode on and off. Still no wi-fi.

I am also having trouble with my Nexus 5 and Lollipop (unlike Kit Kat).

My Nexus 5 fails to connect:

Work: MSCHAPV2 PEAP via an Enterasys AP.
Home: Linksys E3000 AP with WPA/WPA2 Mixed.
Gym: No idea what AP it uses

The error I see is "Authentication problem"

I can get my Nexus 5 to connect if I manually reconnect, restart WiFi, or restart the phone.

I don't disable my WiFi in sleep mode.

For #145.

"If at any point after an OTA update you 'forget network' and then recreate it you will be unable to login.  The 'fix' is to roll back to KitKat setup the wireless network then update to Lollipop."

How to roll back to Kitkat from Lollipop?. I have root access now and unlocked the bootloader, if I roll back to Kitkat, will it remove the root access?.

You've rooted but dont know how to flash? I suggest you stop rooting lol

Seems to be fixed in 5.0.1: https://android.googlesource.com/platform/external/wpa_supplicant_8/+/android-5.0.1_r1

Fixed and tested in android 5.0.1.

when on nexus5?

I can see factory image for 5.0.1 on for the Nexus 6 and 9 so hopefully they will be out for Nexus 5 within the week yay!

When is 5.0.1 OTA coming to Nexus 5?

Factory image isn't even out yet on Nexus 5 let alone OTA lol

Glad its fixed. I didn't have the issue until I added a range extender to my home wifi, then my nvidia shield stopped being able to connect!

Why is it taking so long to release 5.0.1 for the N5? It's been out for a week now on other devices for crying out loud!

I have 5.0.1 Build LRX22C and the problem is now showing on my Nexus 7 2013. It did not exist with KitKat on this device.

#60 works on Nexus 7 Wifi, LRX22C, sideloaded. Thank you so much!

#60 works on Nexus 5 (LRX21O)...thanks a lot! was looking for a solution for over a month now, finally!