I want to chime in on this topic and would be grateful for a solution.
I have 14 RBcAP2n and a Groove A-52HPn connected to a CCR1009 and managed by Capsman. Firmware on all devices is atm 6.38.8.
WiFi is configured as WPA2-EAP with EAP passthrough to a Windows NPS/Radius Server.
When I try to connect a Win 10 Tablet using 802.1x PEAP, MsChapV2 User Authentication the login prompt pops up, asking the user for his credentials. If the user is slow the popup resets while the user is typing. User gets confused - phones IT. Looking at the mikrotik side of things the client disconnects with
AA:BB:CC:DD:EE:FF@CAP2 disconnected, max key exchange retries
and immediately reconnects prompting the user again with the login prompt for about 40 seconds until disconnecting again. (Or the user is quicker this time, hits enter, connects and everybody is happy)
Once it's connected it stays connected. Didn't observe the problem the OT describes where it drops with this error after a while after being connected.
This problem does not occur when using Windows 7 and user authentication.
No problems with android devices or some ~50 computers authenticating over 802.1x with their machine accounts.
No packet is sent to the radius server while the user types his credentials.
I can only assume that the CCR or the RBcAP2n on initial connect presents itself as a 802.1x authenticator to the client (Win10) and waits a preset amount of time for an EAP packet to come in. When the user is not quick enough to type, hit enter and send the packet, the RBcAP resets some session and Win10 starts the login process all over again.
Anyone else got this problem? Is there a hidden timeout to be increased either on mikrotik side or in Win 10?
As said, no problem with Android, Apple, Win7 or 802.1x at all except for this specific use case.
Edit: Verified the problem on Win 7. Connection gets also reset with "max key exchange retries" while being in the login prompt. Windows 7 doesn't blank the prompt on reset so the user doesn't notice. Once he hit's enter the EAP packet is sent to the authenticator and discarded with an "EAP failure" (I assume because the RBcAP has opened a new EAP session with the client and the client sends an expired session id).
So please, where can I increase the "EAP handshake timeout" on mikrotik for those extra slow users?