IssueTracker

Just going to copy/paste what I put in the Nexus 5 bug page here too since it applies:

I think I figured out what the problem was at least on my end. I was able to create a few differently configured wireless networks to zero in on the culprit.

I tried a few different configurations but one setting consistently caused this issue, which was using AES as the encryption policy for the WPA2 network.

Creating a WEP network with the same name does not cause this issue, so I was able to rule out the similar network names being the cause. COMPANY_Employees, COMPANY_MobileDevices, COMPANY_Guest, etc will all connect as intended if they aren't using AES encryption.

It looks like Lollipop has an issue with WPA2 AES encryption. As soon as I switched to TKIP, I was able to connect quickly and without issue. Hopefully this helps someone else out there while we wait for this issue to be fixed in Lollipop.

Having the same problem TKIP works and AES no connection on my nexus 9

On the Nexus 9 this seems to be a different problem than the one reported in the preview. Here is the logcat output of the failure with verbose wifi logging enabled, I couldn't find a reference to explain what the return codes meant:

11-05 10:49:31.795 E/WifiConfigStore(  450): updateSavedNetworkHistory(): try "Guest"WPA_PSK SSID="Guest" Guest [WPA2-PSK-CCMP][ESS] ajst=128

11-05 10:49:31.795 E/WifiConfigStore(  450):         got known scan result c4:0a:cb:xx:xx:xx key : "Guest"WPA_PSK num: 19 rssi=-90 freq=2437

11-05 10:49:31.795 E/WifiAutoJoinController (  450): Portthru d2:0c:cf:vv:vv:vv rssi=-87 cap [IBSS] is not scored

11-05 10:49:31.795 E/WifiAutoJoinController (  450): ageScanResultsOut delay 40000 size 66 now 1415213371795

11-05 10:49:31.795 E/WifiAutoJoinController (  450): newSupplicantResults size=65 known=18 true

11-05 10:49:31.795 D/WifiNative-wlan0(  450): doString: [STATUS-NO_EVENTS]

11-05 10:49:31.795 D/wpa_supplicant( 5768): wlan0: Control interface command 'STATUS-NO_EVENTS'

11-05 10:49:31.795 D/WifiNative-wlan0(  450):    returned wpa_state=SCANNING p2p_device_address=52:2e:5c:yy:yy:yy address=50:2e:5c:ww:ww:ww uuid=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz

11-05 10:49:31.795 E/WifiAutoJoinController (  450): attemptAutoJoin() status=wpa_state=SCANNING

11-05 10:49:31.795 E/WifiAutoJoinController (  450): p2p_device_address=52:2e:5c:yy:yy:yy

11-05 10:49:31.795 E/WifiAutoJoinController (  450): address=50:2e:5c:ww:ww:ww

11-05 10:49:31.795 E/WifiAutoJoinController (  450): uuid=zzzzzzzz-zzzz-zzzz-zzzz-zzzzzzzzzzzz split=4

11-05 10:49:31.795 E/WifiAutoJoinController (  450): attemptAutoJoin() num recent config 1 ---> suppNetId=-1

11-05 10:49:31.796 E/WifiAutoJoinController (  450): attemptAutoJoin skip candidate due to auto join status 128 key "Guest"WPA_PSK reason 4

11-05 10:49:31.796 E/WifiAutoJoinController (  450): attemptRoam not associated

11-05 10:49:31.796 E/WifiAutoJoinController (  450): Done attemptAutoJoin status=0

Also experiencing this on N5 LRX21O, connecting to a WPA2 AES PSK corporate network using Cisco access points.

From what I've gathered online this largely seems to be happening to Cisco AP users. I have a Ubiquiti AP at home with a similar configuration that works fine.

This started happening for me on the second developer preview but I didn't look too far into it at the time given the preview status.

I am seeing the following in logcat:

I/wpa_supplicant( 9615): wlan0: Associated with 00:26:cb:ab:c2:a0
I/wpa_supplicant( 9615): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant( 9615): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant( 9615): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant( 9615): wlan0: CTRL-EVENT-DISCONNECTED bssid=00:26:cb:ab:c2:a0 reason=4

The issue seems to boil down to the EAPOL descriptor version being 3, which you can see in the verbose log:
D/wpa_supplicant( 9615): wlan0: RX EAPOL from 00:26:cb:ab:c2:a0
D/wpa_supplicant( 9615): wlan0: IEEE 802.1X RX: version=2 type=3 length=117
D/wpa_supplicant( 9615): wlan0:   EAPOL-Key type=2
D/wpa_supplicant( 9615): wlan0:   key_info 0x8b (ver=3 keyidx=0 rsvd=0 Pairwise Ack)
D/wpa_supplicant( 9615): wlan0:   key_length=16 key_data_length=22

This has potential to be a fairly significant issue for us. Thanks

Wanted to contribute that this issue is only occurring on Cisco APs/AES/Lollipop for me. My connection at home is also WPA2 with AES on a non-Cisco AP and the connection is stable.

I confirm the same problem on Nexus 5 with Lollipop release.
My home wifi network with Asus router connection is OK.
My work wifi connection does not connect. It stays "Saved".

Confirm, same problem with Nexus 5.

Confirm the same issue on Nexus 5 (LRX21O)

logcat:
E/WifiStateMachine(  742): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0,00 rxSuccessRate=0,00 delta 1000 -> 1000
E/WifiStateMachine(  742): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=2 roam=3
E/WifiConfigStore(  742): saveWifiConfigBSSID Setting BSSID for "BSSID"WPA_EAP to any
E/WifiStateMachine(  742): CMD_AUTO_CONNECT will save config -> "BSSID" nid=2E/WifiConfigStore(  742): will read network variables netId=2
E/WifiStateMachine(  742): CMD_AUTO_CONNECT did save config ->  nid=2E/WifiConfigStore(  742): will read network variables netId=2
I/wpa_supplicant(31426): wlan0: Trying to associate with 00:3a:99:92:38:f3 (SSID='BSSID' freq=2462 MHz)
E/WifiConfigStore(  742): setLastSelectedConfiguration -1
I/wpa_supplicant(31426): wlan0: Associated with 00:3a:99:92:38:f3
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-STARTED EAP authentication started
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=25
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=pdc2.XXX.XX'
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=pdc2.XXX.XX'
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-PEER-CERT depth=0 subject='/CN=pdc2.XXX.XX'
I/wpa_supplicant(31426): EAP-MSCHAPV2: Authentication succeeded
I/wpa_supplicant(31426): EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed
I/wpa_supplicant(31426): wlan0: CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully
I/wpa_supplicant(31426): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(31426): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2

It happens also to me on N5 LRX21O
Home Network is ok
company-guest with WPA2 PSK
company with PEAP
both are failing.
With 4.4.4 was working

Same problem here, in my case it could be related to https://code.google.com/p/android-developer-preview/issues/detail?id=1620 because we have such similarly named networks here (MYCOMPANY and MYCOMPANY-GUEST and I'm trying to connect to the 2nd one).
Worked fine at 4.4.4

11-13 12:48:30.167  3813  3813 I wpa_supplicant: wlan0: CTRL-EVENT-SCAN-STARTED
11-13 12:48:31.726   744  1145 E WifiStateMachine: WifiStateMachine shouldSwitchNetwork  txSuccessRate=0,00 rxSuccessRate=0,00 delta 1000 -> 1000
11-13 12:48:31.727   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
11-13 12:48:31.727   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANY-GUEST"WPA_PSK to any
11-13 12:48:31.731   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT will save config -> "MYCOMPANY-GUEST" nid=0
11-13 12:48:31.777   744  1145 E WifiConfigStore: will read network variables netId=0
11-13 12:48:31.783   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT did save config ->  nid=0
11-13 12:48:31.784   744  1145 E WifiConfigStore: will read network variables netId=0
11-13 12:48:31.790  3813  3813 I wpa_supplicant: wlan0: Trying to associate with xx:xx:xx:xx:xx:xx (SSID='MYCOMPANY-GUEST' freq=2437 MHz)
11-13 12:48:31.844   744  1145 E WifiConfigStore: setLastSelectedConfiguration -1
11-13 12:48:31.993  3813  3813 I wpa_supplicant: wlan0: Associated with xx:xx:xx:xx:xx:xx
11-13 12:48:31.993  3813  3813 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 12:48:32.296   744  1146 E WiFiServiceImpl : CONNECT  nid=0 uid=1000
11-13 12:48:32.296   744  1146 D WifiService: Connect with networkId0
11-13 12:48:32.298   744  1145 E WifiStateMachine: CONNECT_NETWORK id=0 config="MYCOMPANY-GUEST" cnid=0 supstate=HandshakeState my state DisconnectedState uid = 1000 skipped
11-13 12:48:32.298   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANY-GUEST"WPA_PSK to any
11-13 12:48:32.299   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANY-GUEST"WPA_PSK to any
11-13 12:48:32.300   744  1145 E WifiAutoJoinController : updateConfigurationHistory found 1 networks
11-13 12:48:32.301   183   876 D audio_hw_primary: out_set_parameters: enter: usecase(1: low-latency-playback) kvpairs: routing=2
11-13 12:48:32.304   744  1145 E WifiConfigStore: setLastSelectedConfiguration 0
11-13 12:48:32.305   744  1145 E WifiConfigStore: will read network variables netId=0
11-13 12:48:32.319  8715  8747 D OpenGLRenderer: endAllStagingAnimators on 0x9ebc8e00 (RippleDrawable) with handle 0xa1610870
11-13 12:48:33.001  3813  3813 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 12:48:34.001  3813  3813 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 12:48:35.002  3813  3813 I wpa_supplicant: wlan0: CTRL-EVENT-DISCONNECTED bssid=xx:xx:xx:xx:xx:xx reason=15

Having the same issues with my work WiFi.  Nexus 5 LRX21O

Same Issue. Nexus 5 LRX21O

5GHz
----
I/wpa_supplicant(  897): wlan0: CTRL-EVENT-SCAN-STARTED
E/WifiStateMachine(  780): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
E/WifiStateMachine(  780): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
E/WifiConfigStore(  780): saveWifiConfigBSSID Setting BSSID for "work-guest"WPA_PSK to any
E/WifiStateMachine(  780): CMD_AUTO_CONNECT will save config -> "work-guest" nid=0
E/WifiConfigStore(  780): will read network variables netId=0
E/WifiStateMachine(  780): CMD_AUTO_CONNECT did save config ->  nid=0
E/WifiConfigStore(  780): will read network variables netId=0
I/wpa_supplicant(  897): wlan0: Trying to associate with 00:27:0d:5f:65:6c (SSID='work-guest' freq=5180 MHz)
E/WifiConfigStore(  780): setLastSelectedConfiguration -1
I/wpa_supplicant(  897): wlan0: Associated with 00:27:0d:5f:65:6c
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
E/wpa_supplicant(  897): PNO: In assoc process
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: Authentication with 00:27:0d:5f:65:6c timed out.
I/wpa_supplicant(  897): wlan0: CTRL-EVENT-DISCONNECTED bssid=00:27:0d:5f:65:6c reason=3 locally_generated=1

2.4GHz
------
I/wpa_supplicant(  897): wlan0: CTRL-EVENT-SCAN-STARTED
E/WifiStateMachine(  780): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
E/WifiStateMachine(  780): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
E/WifiConfigStore(  780): saveWifiConfigBSSID Setting BSSID for "work-guest"WPA_PSK to any
E/WifiStateMachine(  780): CMD_AUTO_CONNECT will save config -> "work-guest" nid=0
E/WifiConfigStore(  780): will read network variables netId=0
E/WifiStateMachine(  780): CMD_AUTO_CONNECT did save config ->  nid=0
E/WifiConfigStore(  780): will read network variables netId=0
I/wpa_supplicant(  897): wlan0: Trying to associate with 00:27:0d:5f:65:63 (SSID='work-guest' freq=2462 MHz)
E/WifiConfigStore(  780): setLastSelectedConfiguration -1
I/wpa_supplicant(  897): wlan0: Associated with 00:27:0d:5f:65:63
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  897): wlan0: Authentication with 00:27:0d:5f:65:63 timed out.
I/wpa_supplicant(  897): wlan0: CTRL-EVENT-DISCONNECTED bssid=00:27:0d:5f:65:63 reason=3 locally_generated=1

This issue does NOT present on LRX21P on my Nexus 7 (2013) and works as intended, but continues to be a problem on Nexus 5 LRX21O 100% of the time as others have stated. Relevant bug capture data below.

11-13 09:04:14.513   744  1145 E WifiStateMachine: CONNECT_NETWORK id=1 config="MYCOMPANYWIFI" cnid=1 supstate=ScanState my state DisconnectedState uid = 1000
11-13 09:04:14.513   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANYWIFI"WPA_PSK to any
11-13 09:04:14.514   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANYWIFI"WPA_PSK to any
11-13 09:04:14.515   744  1145 E WifiAutoJoinController : updateConfigurationHistory found 0 networks
11-13 09:04:14.516   744  1145 E WifiConfigStore: setLastSelectedConfiguration 1
11-13 09:04:14.523   744  1145 E WifiConfigStore: will read network variables netId=1
11-13 09:04:14.529  9724  9724 I wpa_supplicant: wlan0: Trying to associate with 00:26:cb:f4:75:cd (SSID='MYCOMPANYWIFI' freq=5180 MHz)
11-13 09:04:14.653  9724  9724 I wpa_supplicant: wlan0: Associated with 00:26:cb:f4:75:cd
11-13 09:04:14.653  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:15.692  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:16.692  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:17.688  9724  9724 I wpa_supplicant: wlan0: CTRL-EVENT-DISCONNECTED bssid=00:26:cb:f4:75:cd reason=15
11-13 09:04:24.848  9724  9724 I wpa_supplicant: wlan0: CTRL-EVENT-SCAN-STARTED
11-13 09:04:25.520   744  1145 E WifiStateMachine: WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
11-13 09:04:25.524   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=1 roam=3
11-13 09:04:25.524   744  1145 E WifiConfigStore: saveWifiConfigBSSID Setting BSSID for "MYCOMPANYWIFI"WPA_PSK to any
11-13 09:04:25.532   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT will save config -> "MYCOMPANYWIFI" nid=1
11-13 09:04:25.579   744  1145 E WifiConfigStore: will read network variables netId=1
11-13 09:04:25.586   744  1145 E WifiStateMachine: CMD_AUTO_CONNECT did save config ->  nid=1
11-13 09:04:25.587   744  1145 E WifiConfigStore: will read network variables netId=1
11-13 09:04:25.594  9724  9724 I wpa_supplicant: wlan0: Trying to associate with 00:26:cb:f4:75:cd (SSID='MYCOMPANYWIFI' freq=5180 MHz)
11-13 09:04:25.650   744  1145 E WifiConfigStore: setLastSelectedConfiguration -1
11-13 09:04:25.720  9724  9724 I wpa_supplicant: wlan0: Associated with 00:26:cb:f4:75:cd
11-13 09:04:25.720  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:26.890  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:27.892  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
11-13 09:04:28.889  9724  9724 I wpa_supplicant: wlan0: CTRL-EVENT-DISCONNECTED bssid=00:26:cb:f4:75:cd reason=15

Can confirm this occurs on the 5.0 (LRX21O) build for the Nexus 5. Unable to connect to EAP-PEAP network at my office. The network is saved, but never connects. This occurs 100% of the time. My office also uses Cisco access points like comment #4 and #5 mentioned.

I can confirm the same issue on a Nexus 9 with build LRX21L; we have EAP-PEAP with MSCHAPv2 authentication and Cisco access points, ssid is "Data," WPA/WPA2 (TKIP/CCMP) encryption. Confirmed with multiple distinct APs located in separate buildings (in fact, some are miles apart).

Both a Nexus 7 (2013 LTE) and a Nexus 5 running 4.4.4 connect to this network without trouble, as does a 2012 MacBook Pro running Yosemite.

Seeing the same as above when connecting to a WPA2/AES enterprise wifi network:

I/wpa_supplicant( 9209): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2

I'm on the factory image (LRX21O) for Nexus 5, and this happens 100% of the time.

(If all AES encryption is really affected, this bug should be upgraded from 'small', but that's just my sysadmin non-developer perspective).

Same issue as described above. Happening on my company network using WPA2-PSK with AES, as well as PEAP-MSCHAPv2

Same as above for everyone else on this issue but mine is affected on the Nexus 7 2012 Wifi model.  
Went back to 4.4.4 and it works great, went back to 5.0 and no go.

I am also experiencing this at our company.  WPA/AES is not working correctly on our NEXUS 7 wifi models, switching to TKIP works on our CISCO AP's but the network is currently setup as AES.  This is a major problem how did this get through testing?

Also our devices are now running 5.0 when this problem started.  4.4.4 is fine.

Confirming same issue at my institution using factory image Nexus 5.  Logs look identical to what everyone else has already posted.

At the moment, I think it's useless for everyone to say "me too", it's obvious there is a bug crippling the wifi on android 5 since the 2nd preview and which, incredibly, made it into production.
It would be more useful if someone would be able to raise the priority of this bug because for now, it's at Priority-Small.

I think the interesting part of the logs is here:
11-13 09:04:14.653  9724  9724 I wpa_supplicant: wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2

For info:
Value 1 indicates HMAC-MD5 for data integrity and ARC4 for key wrapping. MIC is 16 octets
Value 2 indicates HMAC-SHA1 for data integrity and AES Key Wrap (RFC 3394) for key wrapping. MIC is 16 octets.
Value 3 indicates AES-CMAC for data integrity and AES Key Wrap (RFC 3394) for key wrapping. MIC is 16 octets.

I can confirm the same. Here are my observations while recreating the issue on LRX210.

It occurs with FACTORY IMAGES, NOT with OTA. (I flashed and it didn't work and my friend did OTA and he is able to connect).

It seems to be an issue with CISCO routers(using EAP).(I have belkin in my home(WPA2), and able to connect.)

will go back to 4.4.4 and do OTA....

and finally someone change the priority.

We are NOT using EAP here and is still an issue with WPA2/AES  I will also try going back to 4.4.4 and OTA unfortunately my devices weren't getting the OTA yet, thus why I had to force flash.

[Comment deleted]

I can confirm that if you roll back to 4.4.4 and then upgrade to 5.0 from OTA the wireless holds good with WPA2/AES.  I now have no problem connecting to networks.  Google has a link for the 5.0 from 4.4.4 update ZIPs available so I was able to sideload and test.

My CISCO equipment is as follows:

WLAN Controller: AIR-WLC4402-25-K9

AP's:  AIR-LAP1131AG-A-K9

Interesting update:

The network I'm having issues connecting with is actually configured for either AES or TKIP.

When I look at it in the Network Analyzer app, the security shows up as [WPA2-PSK-CCMP+TKIP].

So now I'm wondering is it's the supplicant not picking TKIP is AES doesn't work, or if it's something on Cisco's side that isn't allowing the TKIP connection.

[Comment deleted]

#29

Its most likely getting stuck on the choosing of AES or TKIP to authenticate with.  I also tested this by having a network with both enabled and was getting the same result.  It seems to get stuck if AES is offered in any fashion, which again goes to show the Factory image is screwed up with WPA2/AES.

Nexus Help Forumer Here...

My best friend noted these observations on his Nexus 5.

The factory image won't connect to the corporate network from initial setup -- the "connect to wifi" stage must be skipped.

If I use the 4.4.4 factory image, run through the setup there, it connects. Then if I use the OTA to update to 5.0, it will still connect.  However, if I flash 4.4.4 then update to 5.0 with the OTA without setting the device up/connecting to the corporate wifi (meaning 5.0's setup will run after the OTA), it will not connect.  So yes, kitkat > setup device (incl connect to wifi) > OTA works.  5.0 factory image > setup does not.  kitkat > OTA > setup device does not work.  Additionally, kitkat > skip setup > connect to wifi > OTA works, but then if I force the setup wizard to run with

adb shell am start -n com.google.android.setupwizard/.SetupWizardTestActivity

I can no longer connect.

So these observations seem to point to the setup corrupting something.

Interesting so if I forget the corporate or WPA2/AES networks it will corrupt again, good to know!  Thanks #32!

Could someone who can reproduce the issue that results in "wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2" showing up in the debug log send me a more complete extract of logcat with wpa_supplicant debug level increased (or alternatively, a wireless capture showing the frames exchanged between the AP and the Android device)? Feel free to email that directly to me (j@w1.fi) for some added privacy.

This looks like an interoperability issue with the AP selecting incorrect EAPOL-Key descriptor version for the specific AKM that was negotiated. I have not been able to reproduce this, but as soon as I'll confirm my suspicions, I can add a workaround to wpa_supplicant to avoid the issue.

I'm also having issues similar to those described. I've been able to connect to all wifi networks except the corporate network at work since flashing the newest 5.0 from two days ago on my Nexus 5. This issue was also happening after flashing the last two L previews. I was working with my IT manager yesterday to diagnose the issue. My home network is WPA2 as is the corporate network. APs at the office are Cisco. No certificates, just WPA2. We noticed that no matter what I did when trying to connect, including manually adding the network and specifying WPA2 encryption, the phone would repeatedly try to authenticate using 802.1x, until my device was added to an exclusion list after too many failed attempts.

Here's a dump.  I don't really know what I'm looking at, but it appears to be trying to connect at 5GHz and 2.4GHz.  Let me know if there are any more logs I can dump.

I/wpa_supplicant(  855): wlan0: CTRL-EVENT-SCAN-STARTED
E/WifiStateMachine(  716): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
E/WifiStateMachine(  716): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
E/WifiConfigStore(  716): saveWifiConfigBSSID Setting BSSID for "LibertyLake"WPA_PSK to any
E/WifiStateMachine(  716): CMD_AUTO_CONNECT will save config -> "LibertyLake" nid=0
E/WifiConfigStore(  716): will read network variables netId=0
E/WifiStateMachine(  716): CMD_AUTO_CONNECT did save config ->  nid=0
E/WifiConfigStore(  716): will read network variables netId=0
I/wpa_supplicant(  855): wlan0: Trying to associate with 00:26:cb:a0:80:5f (SSID='LibertyLake' freq=5200 MHz)
E/WifiConfigStore(  716): setLastSelectedConfiguration -1
I/wpa_supplicant(  855): wlan0: Associated with 00:26:cb:a0:80:5f
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: Authentication with 00:26:cb:a0:80:5f timed out.
I/wpa_supplicant(  855): wlan0: CTRL-EVENT-DISCONNECTED bssid=00:26:cb:a0:80:5f reason=3 locally_generated=1
I/wpa_supplicant(  855): wlan0: CTRL-EVENT-SCAN-STARTED
E/WifiStateMachine(  716): WifiStateMachine shouldSwitchNetwork  txSuccessRate=0.00 rxSuccessRate=0.00 delta 1000 -> 1000
E/WifiStateMachine(  716): CMD_AUTO_CONNECT sup state ScanState my state DisconnectedState nid=0 roam=3
E/WifiConfigStore(  716): saveWifiConfigBSSID Setting BSSID for "LibertyLake"WPA_PSK to any
E/WifiStateMachine(  716): CMD_AUTO_CONNECT will save config -> "LibertyLake" nid=0
E/WifiConfigStore(  716): will read network variables netId=0
E/WifiStateMachine(  716): CMD_AUTO_CONNECT did save config ->  nid=0
E/WifiConfigStore(  716): will read network variables netId=0
I/wpa_supplicant(  855): wlan0: Trying to associate with c4:0a:cb:df:62:f0 (SSID='LibertyLake' freq=2462 MHz)
E/WifiConfigStore(  716): setLastSelectedConfiguration -1
I/wpa_supplicant(  855): wlan0: Associated with c4:0a:cb:df:62:f0
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2
I/wpa_supplicant(  855): wlan0: CTRL-EVENT-DISCONNECTED bssid=c4:0a:cb:df:62:f0 reason=15

#35

what kind of authentication is your corporate network using?  WPA2 TKIP or AES or BOTH?  right now its only AES or MIXED that is not working.  TKIP alone on WPA2 seems to be fine.

#34 This is my logcat with the following filter: "wpa_supplicant:V *:S"

http://pastebin.com/qXDEGS1t

For the debug log, I would need to get more verbose logging enabled for Wi-Fi events than what shows up in logcat by default. I'm not completely sure what is needed for that in the official Android builds, but it may be possible to increase verbosity from the Settings app "Developer options" with the "Enable Wi-Fi Verbose Logging" option.

While I have not yet been able to reproduce the reported issue myself or confirm that this change addresses this with the APs mentioned here, I would expect this upstream wpa_supplicant change to resolve this interoperability issue for the case where "WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2" is shown in logcat:
http://w1.fi/cgit/hostap/commit/?id=9f6a7cddc42811883d6035032854089475f2fc65

[Comment deleted]

#39 just sent you logs at debug level at your email you provided

#41 Thanks. To record more details of the issue here, this was a Cisco AP configured with WPA+WPA2-PSK CCMP+TKIP mode without PMF being enabled. SHA1-based AKM was used and the AP ended up selecting incorrect descriptor version. Difficult to say why, but I guess that could have been triggered by the MFPC=1 (Management Frame Protection Capable) indication in the RSN element from the station.

I have a dual frequency router that broadcasts two separate, individually-named 2.4 and 5 GHz networks. In Lollipop, but also in KitKat, I've experienced quirks connecting to this setup which are possibly related to this overall issue. I had a single frequency 2.4GHz router prior to KitKat, so I can't comment on this issues existence before then.
The issue I've noticed is related to establishing a WiFi connection using different frequencies on my Nexus devices (N4 and N7-2013). It will not connect to either frequency unless I save both the 2.4 GHz and 5 GHz network profiles. In other words, if I started from scratch, with no WiFi networks saved, I can't connect to the 2.4 GHz network unless I *also* save the profile/password of the 5 GHz too.
Note: These SSID is hidden for these networks, so that's why I'm connecting manually.

[Comment deleted]

Nexus 5 with LRX21O

Also exhibits problem with Open Source router: DD-WRT v24-sp2 (05/27/13) running on Linksys E3000 router.

WPA2 PSK or Enterprise networks with AES cannot connect.

Reverted to 4.4.4 and connected fine.

Same issues as the others on LRX210. Hard to believe this is still marked "Priority-Small".

Just wanted to add that on the day I was trying to connect the problem network I had to force power down my phone after it locked up. Don't know if it's related, but it's the only time I can recall it locking up in the last year.

Just want to add thatbi flashed 4.4.4 and then OTA via adb sideload and now it works

Same issue.. I can't connect WPA2PSK cisco wifi network. I'm on the factory image, but somebody say OTA upgrade is working well. Does it mean the factory image and OTA version is different?

probably the OTA doesn't overwrite completely something...

Thank you #49..
I go back 4.4.4 and try to OTA upgrade using sideload..
yeah.. it's working..

I'm sure that factory image has some wifi connection bug?!!

[Comment deleted]

This "WPA: CCMP is used, but EAPOL-Key descriptor version (3) is not 2" issue is not really a bug in Android; it is a bug in the AP. This get triggered by enabling of PMF (management frame protection) which was done in Android 5.0. It sounds like OTA upgrade does not end up changing wpa_supplicant configuration file for this which explains why there is a difference between OTA upgrade and clean factory image flashing (or factory reset).

This AP bug can be worked around in couple of ways to avoid interoperability issues with deployed APs. The change I noted above would be the cleanest way. I just do not happen to have an AP that shows this issue (or well, I think I'm running with a newer version of Cisco software on the AP and that has the issue resolved) and I have not yet received a clear confirmation that the workaround avoids the issue completely with the APs that have been reported here. I'd assume that the wpa_supplicant change gets pulled into Android once such confirmation is available. Or alternatively, if that change is not enough to avoid the full issue, the other workarounds can be considered.

Um.. but my case, after OTA sideload update working well, I made factory reset using option menu in lollipop, I can't connect the same wifi again.

#53: That would match the expected behavior. OTA update did not modify wpa_supplicant configuration to enable PMF; factory reset replaced wpa_supplicant configuration with the L default (which does enable PMF).

This upstream wpa_supplicant change:

http://w1.fi/cgit/hostap/commit/?id=9f6a7cddc42811883d6035032854089475f2fc65

was confirmed to work around the issue with Cisco AP. As such, I'd recommend merging that into the following Android update.

I was experiencing similar issues since updating to 5.0 (LRX21O), but I was having wifi connectivity issues at home and not at work.

Home setup is a dual-band TP-Link Archer C7. Both networks are hidden, and security on both bands was WPA2-PSK with AES mandated. The wireless connection would establish on either network ("connected" in the network list), but the exclamation point would remain. At the same time, my full-strength LTE signal would disable (gaining its own exclamation point). I would have no data until wifi was disabled, at which point mobile data would immediately resume. Manually disabling mobile data, rebooting, toggling wifi on/off, forgetting and re-configuring wifi networks: none of it made a difference.

I reconfigured my router to automatic encryption (either TKIP or AES) on both bands, and my problems were resolved...full wifi connection on both networks that persists after reboot.

Got Lollipop OTA for my Nexus 5. Wifi doesnot connect at all. It says connecting and saved. But nothing happens. Please help. I tried factory reset still no use.

I have updated my Nexus from the factory image, and the connection is not working, so is not an OTA bug, but a release one.

I have experienced similar issues, which I could work around by assigning a
fixed IP address for the Wifi connection in question.

There is the off-chance that this might help some of you too...

2014-11-18 8:50 GMT+01:00 <android@googlecode.com>:

I have dirty-flashed (factory image) my Nexus 5 to LRX21O and the WiFi connection to our corporate wifi still works fine. On my Nexus 9 with LRX21Q (also dirty-flashed from LRX21L), the connection DOESN'T work (didn't work before) with that "CCMP is used, but EAPOL-Key descriptor version (3) is not 2" error.

Comparing both /data/misc/wifi/wpa_supplicant.conf files:

Nexus 5 (WORKS):
------------8<----------------8<-----------------8<-------------------8<------------
disable_scan_offload=1
update_config=1
device_name=hammerhead
manufacturer=LGE
model_name=Nexus 5
model_number=Nexus 5
serial_number=0123456789abcdef
device_type=10-0050F204-5
config_methods=physical_display virtual_push_button
p2p_disabled=1
external_sim=1
wowlan_triggers=any

network={
ssid="Mobile"
key_mgmt=WPA-EAP IEEE8021X
eap=PEAP
identity="myidentity"
password="mypassword"
priority=187
proactive_key_caching=1
}
------------8<----------------8<-----------------8<-------------------8<------------

Nexus 9 (DOESN'T WORK):
------------8<----------------8<-----------------8<-------------------8<------------
disable_scan_offload=1
driver_param=use_p2p_group_interface=1p2p_device=1
update_config=1
device_name=volantis
manufacturer=htc
model_name=Nexus 9
model_number=Nexus 9
serial_number=REDACTED
device_type=10-0050F204-5
config_methods=physical_display virtual_push_button
p2p_no_go_freq=5170-5740
pmf=1
external_sim=1
wowlan_triggers=any
p2p_search_delay=0

network={
ssid="Mobile"
scan_ssid=1
key_mgmt=WPA-EAP IEEE8021X
eap=PEAP
identity="myidentity"
password="mypassword"
priority=516
proactive_key_caching=1
}
------------8<----------------8<-----------------8<-------------------8<------------

I switched off wifi, removed the "pmf=1" line from the N9's config, rebooted immediately and voila: Connection works.

So if you are rooted, try this fix.

#60 - really works. tnx a lot! :) Nexus 5 + LRX21O (factory image with full wipe)

Now hopefully, someone could raise the prio on this bug or create a new one with higher prio to get someone from google noticing.

Thanks for the fix! Worked for me!

Another confirmation that removing the pmf=1 from the .conf file fixed the issue. You do have to reboot immediately though. Don't re-enable wifi until you reboot. I learned that the hard way.

Hi,

I'm sending this post to thanks #60. After applying the fix i've successfully connected to my wifi network (what a couldn't before the fix). Now i can use Lollipop.

Thanks,

Today I downgraded my Nexus 5 to the KTU84P build, then updated via OTA to the last build of Android 5. All is functioning.

Does the #60 fix work on anything other than a Nexus 5?  (I.E. Nexus 7 2012)

For anyone attempting the fix in #60, make sure the permissions for wpa_supplicant.conf are set to rw-rw----, the owner is system and the group is wifi otherwise your WiFi will not turn on.

I was able to fix this problem via a third party app:https://play.google.com/store/apps/details?id=com.brilliapps.wifiandmorefixer

I don't know if it's relevant but I ran into this (or a similar) bug when my Nexus 5 updated to KitKat.

I tried doing the edit to wpa_supplicant from #60, but the bit about checking the permissions mentioned in #68 hadn't been posted yet.

Ended up flashing 4.4.4 (KTU84P) and sideloading the 5.0 OTA. WiFi works, now, finally.  

App suggested in #69 did not work for me

Using the release Ota version for the nexus 5 and can confirm the wifi issue happens at free WiFi restaurants in Ontario Canada (restaurants like McDonald's free WiFi) saves but never connects. This issue is affecting public wifi as well as corporate and school wifi.

So this issue is anything but small

Same problem.  I received this phone from google play 1 week ago.  Got the Android 5.0 OTA today.  After 5.0 update, wifi was connected and working fine at work.  It will not connect now that I am at home (WPA Personal with AES) will not connect and my network just indicates as Saved.