;)
Tuesday
Dec292009
Configure TKIP Countermeasure Holdoff Timer on Autonomous
Tuesday, December 29, 2009 at 6:37PM 
After having worked on countless Cisco WLAN VoIP deployments a general rule of thumb from Cisco TAC is to disable TKIP countermeasure on ALL voice WLANs and lessen the timer for DATA WLANs. Again this is all subject to your comfort level and performance requirements. Personally, I can't say I have ever seen this to be an issue or had an issue that was directly related to the countermeasure. But something to chew on!
TKIP countermeasure mode can occur if the Access Point receives 2 message integrity check (MIC) errors 
within a 60 second period. When this occurs, the Access Point will de-authenticate ALL TKIP clients associated to that 802.11 radio and holdoff any clients for the countermeasure holdoff time (default = 60 seconds).
within a 60 second period. When this occurs, the Access Point will de-authenticate ALL TKIP clients associated to that 802.11 radio and holdoff any clients for the countermeasure holdoff time (default = 60 seconds).
ap#config t
ap(config)#interface dot11Radio 0
Note: This is radio specific on autonomous access points
ap(config-if)#countermeasure tkip 0
Note: Configures TKIP MIC countermeasures hold-down timer (0-65535 seconds), unlike the WLC which is (0-60 seconds)
Reader Comments (1)
I have always thought of this TKIP MIC countermeasure be be a short-sighted (stupid :)) thing. Cause it can be used for DOS attack on your WLC not allowing all your clients to associate for a long time before the attack is discovered. I am not sure but I remember reading that it has become disabled in some of the most recent of future codes for WLC at least. But isn´t this "feature" disabled for Autonomous APs ? At least I never have come accross this problem in those.
regards. Kristjan Edvardsson