SSID to Radius without WLC (Aironet 1240)

Hi.
I am working on setting up a new WLAN infrastructure. I have set up different SSIDs connected to different VLANs, in the AP.
I also want to use Windows NPS for authenticating users on the different SSIDs, with different authentication methods based on which SSID the user/device is connecting to. To do that, NPS needs to get the SSID, but the Aironet 1240 only sends its MAC address in the Called-Station-Id. I have read a bit about this, and found out that if I have a WLC, it will add the SSID to to the Called-Station-Id. But since we do not have a WLC, I am trying to get this to work anyway.
Is it possible to modify the Called-Station-Id to include the SSID on an Aironet 1240? If not, is it possible to send the SSID as a separate attribute that can be read by the NPS?

For your reference , please check the following two links about having custom VSAs on NPS:
http://technet.microsoft.com/en-us/library/cc754417%28v=ws.10%29.aspx
http://technet.microsoft.com/en-us/library/cc731611%28v=ws.10%29.aspx
Information about the custome attributes i mentioned above:
name : cisco-av-pair
ID      : 1
Type  : String
Direction: Both
Multiple allowed : True
IETF vendor code for Cisco is 6
Please Make sure to rate correct answers , and flag this thred as answered

Similar Messages

  • Dynamic VLAN Assignment with RADIUS Server and Aironet Access Points

    Hi Guys,
    I would like to go for "Dynamic VLAN Assignment with RADIUS Server and Aironet Access Points 1300". I want the AP to broadcast only 1 SSID. The client find the SSID ->put in his user credential->Raudius athentication->assign him to an specific vlan based on his groupship.
    The problem here is that I don't have a AP controller but only configurable Aironet Access Points 1300. I can connect to the radius server, but I am not sure how to confirgure the AP's port, radio port, vlan and SSID.
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml#switch
    I go through some references:
    3.5  RADIUS-Based VLAN Access Control
    As discussed earlier, each SSID is mapped to a default VLAN-ID on the wired side. The IT administrator may wish to impose back end (such as RADIUS)-based VLAN access control using 802.1X or MAC address authentication mechanisms. For example, if the WLAN is set up such that all VLANs use 802.1X and similar encryption mechanisms for WLAN user access, then a user can "hop" from one VLAN to another by simply changing the SSID and successfully authenticating to the access point (using 802.1X). This may not be preferred if the WLAN user is confined to a particular VLAN.
    There are two different ways to implement RADIUS-based VLAN access control features:
    1. RADIUS-based SSID access control: Upon successful 802.1X or MAC address authentication, the RADIUS server passes back the allowed SSID list for the WLAN user to the access point or bridge. If the user used an SSID on the allowed SSID list, then the user is allowed to associate to the WLAN. Otherwise, the user is disassociated from the access point or bridge.
    2. RADIUS-based VLAN assignment: Upon successful 802.1X or MAC address authentication, the RADIUS server assigns the user to a predetermined VLAN-ID on the wired side. The SSID used for WLAN access doesn't matter because the user is always assigned to this predetermined VLAN-ID.
    extract from: Wireless Virtual LAN Deployment Guide
    http://www.cisco.com/en/US/products/hw/wireless/ps430/prod_technical_reference09186a00801444a1.html
    ==============================================================
    Dynamic VLAN Assignment with RADIUS Server and Wireless LAN Controller Configuration Example
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml#switch
    ==============================================================
    Controller: Wireless Domain Services Configuration
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801c951f.shtml
    Any help on this issue is appreicated.
    Thanks.

    I'm not sure if the Autonomous APs have the option for AAA Override.  On the WLC, I can go into the BSSID, Security, Advanced, and there's a checkbox that I would check to allow a Radius server to send back the VLAN.
    I did a little research and it looks like the 1300 may give this option but instead is defined as "VLAN Override".  I've found the release notes for 12.3(7)JA5 (not sure what version you're running) that give mention and a link to configuring EAP on page 4: http://www.ciscosystems.ch/en/US/docs/wireless/access_point/1300/release/notes/o37ja5rn.pdf
    Hope this helps

  • I have a Problem with Romming Between SSIDs withing the same WLC but with deferent VLAN .

    HI All,
    I have a Problem with Romming Between SSIDs withing the same WLC but with deferent VLAN . the WLC are providing the HQ and one of the Branches the Wireless services .
    Am using all the available 9 SSIDs at the HQ , and am using only 4 of it at the Brnche.
    The problem that i have are happening only at the Branch office as i cant room between the SSIDs within Diferent VLANs but i can do it with the one that pointing to the same VLAN. Once the client ( Laptop/Phone ) connected to one of the SSIDs. it imposiible to have him connected to the other ones with Different VLAN. meanwhile, It says its connected to the other SSID but its not getting IP from that pool.
    here is the Show Run-Config from my WLC .. and the Problem happening between the SSID AMOBILE and ASTAFF. i have the Debug while am switching between the SSIDs if needed .
    =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2013.11.04 10:20:47 =~=~=~=~=~=~=~=~=~=~=~=
    show run-config
    Press Enter to continue...
    System Inventory
    NAME: "Chassis"   , DESCR: "Cisco 5500 Series Wireless LAN Controller"
    PID: AIR-CT5508-K9, VID: V01, SN: FCW1535L01G
    Burned-in MAC Address............................ 30:E4:DB:1B:99:80
    Power Supply 1................................... Present, OK
    Power Supply 2................................... Absent
    Maximum number of APs supported.................. 12
    Press Enter to continue or <ctrl-z> to abort
    System Information
    Manufacturer's Name.............................. Cisco Systems Inc.
    Product Name..................................... Cisco Controller
    Product Version.................................. 7.0.235.0
    Bootloader Version............................... 1.0.1
    Field Recovery Image Version..................... 6.0.182.0
    Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
    Build Type....................................... DATA + WPS
    System Name...................................... WLAN Controller 5508
    System Location..................................
    System Contact...................................
    System ObjectID.................................. 1.3.6.1.4.1.9.1.1069
    IP Address....................................... 10.125.18.15
    Last Reset....................................... Software reset
    System Up Time................................... 41 days 5 hrs 14 mins 42 secs
    System Timezone Location......................... (GMT -5:00) Eastern Time (US and Canada)
    Current Boot License Level....................... base
    Current Boot License Type........................ Permanent
    Next Boot License Level.......................... base
    Next Boot License Type........................... Permanent
    Configured Country............................... US - United States
    --More or (q)uit current module or <ctrl-z> to abort
    Operating Environment............................ Commercial (0 to 40 C)
    Internal Temp Alarm Limits....................... 0 to 65 C
    Internal Temperature............................. +36 C
    External Temperature............................. +20 C
    Fan Status....................................... OK
    State of 802.11b Network......................... Enabled
    State of 802.11a Network......................... Enabled
    Number of WLANs.................................. 10
    Number of Active Clients......................... 61
    Burned-in MAC Address............................ 30:E4:DB:1B:99:80
    Power Supply 1................................... Present, OK
    Power Supply 2................................... Absent
    Maximum number of APs supported.................. 12
    Press Enter to continue or <ctrl-z> to abort
    AP Bundle Information
    Primary AP Image  Size
    ap3g1             5804
    ap801             5192
    ap802             5232
    c1100             3096
    c1130             4972
    c1140             4992
    c1200             3364
    c1240             4812
    c1250             5512
    c1310             3136
    c1520             6412
    c3201             4324
    c602i             3716
    Secondary AP Image      Size
    ap801             4964
    c1100             3036
    --More or (q)uit current module or <ctrl-z> to abort
    c1130             4884
    c1140             4492
    c1200             3316
    c1240             4712
    c1250             5064
    c1310             3084
    c1520             5244
    c3201             4264
    Press Enter to continue or <ctrl-z> to abort
    Switch Configuration
    802.3x Flow Control Mode......................... Disable
    FIPS prerequisite features....................... Disabled
    secret obfuscation............................... Enabled
    Strong Password Check Features:
           case-check ...........Enabled
           consecutive-check ....Enabled
           default-check .......Enabled
           username-check ......Enabled
    Press Enter to continue or <ctrl-z> to abort
    Network Information
    RF-Network Name............................. OGR
    Web Mode.................................... Disable
    Secure Web Mode............................. Enable
    Secure Web Mode Cipher-Option High.......... Disable
    Secure Web Mode Cipher-Option SSLv2......... Enable
    OCSP........................................ Disabled
    OCSP responder URL..........................
    Secure Shell (ssh).......................... Enable
    Telnet...................................... Disable
    Ethernet Multicast Forwarding............... Disable
    Ethernet Broadcast Forwarding............... Disable
    AP Multicast/Broadcast Mode................. Unicast
    IGMP snooping............................... Disabled
    IGMP timeout................................ 60 seconds
    IGMP Query Interval......................... 20 seconds
    User Idle Timeout........................... 300 seconds
    ARP Idle Timeout............................ 300 seconds
    Cisco AP Default Master..................... Enabled
    AP Join Priority............................ Disable
    Mgmt Via Wireless Interface................. Disable
    Mgmt Via Dynamic Interface.................. Disable
    --More or (q)uit current module or <ctrl-z> to abort
    Bridge MAC filter Config.................... Enable
    Bridge Security Mode........................ EAP
    Mesh Full Sector DFS........................ Enable
    AP Fallback ................................ Enable
    Web Auth Redirect Ports .................... 80
    Web Auth Proxy Redirect ................... Disable
    Fast SSID Change ........................... Enabled
    AP Discovery - NAT IP Only ................. Enabled
    IP/MAC Addr Binding Check .................. Enabled
    Press Enter to continue or <ctrl-z> to abort
    Port Summary
               STP   Admin   Physical   Physical   Link   Link
    Pr Type   Stat   Mode     Mode     Status   Status Trap    POE   SFPType  
    1 Normal Forw Enable Auto       1000 Full Up     Enable N/A     1000BaseTX
    2 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    3 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    4 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    5 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    6 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    7 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    8 Normal Disa Enable Auto       Auto       Down   Enable N/A     Not Present
    Press Enter to continue or <ctrl-z> to abort
    AP Summary
    Number of APs.................................... 8
    Global AP User Name.............................. Not Configured
    Global AP Dot1x User Name........................ Not Configured
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    KNOWLOGY_DC01       2     AIR-LAP1131AG-A-K9   00:1d:45:86:ed:4e KNOWLOGY_DC_Serv 1       US       1
    KNOWLOGY_DC02       2     AIR-LAP1131AG-A-K9   00:21:d8:36:c5:c4 KNOWLOGY_DC_Serv 1       US       1
    KN1252_AP01         2     AIR-LAP1252AG-A-K9   00:21:d8:ef:06:50 Knowlogy Confere 1       US       1
    KN1252_AP02         2     AIR-LAP1252AG-A-K9   00:22:55:8e:2e:d4 Server Room Side 1       US       1
    Anham_AP03           2     AIR-LAP1142N-A-K9     70:81:05:88:15:b5 default location 1       US       1
    ANHAM_AP01          2     AIR-LAP1142N-A-K9     70:81:05:b0:e4:62 Small Conference 1       US       1
    ANHAM_AP04           2     AIR-LAP1131AG-A-K9   00:1d:45:86:e1:b8   Conference room 1       US       1
    ANHAM_AP02           2     AIR-LAP1142N-A-K9     70:81:05:96:7a:49         Copy Room 1       US       1
    AP Tcp-Mss-Adjust Info
    AP Name             TCP State MSS Size
    KNOWLOGY_DC01       disabled   -
    KNOWLOGY_DC02       disabled   -
    --More or (q)uit current module or <ctrl-z> to abort
    KN1252_AP01         disabled   -
    KN1252_AP02         disabled   -
    Anham_AP03           disabled   -
    ANHAM_AP01           disabled   -
    ANHAM_AP04           disabled   -
    ANHAM_AP02           disabled   -
    Press Enter to continue or <ctrl-z> to abort
    AP Location
    Total Number of AP Groups........................ 3  
    Site Name........................................ ANHAM8075
    Site Description................................. ANHAM 8075 Location
    WLAN ID         Interface         Network Admission Control         Radio Policy
    1               knowlogy_ogr         Disabled                         None
    6               knowlogy_ogr         Disabled                         None
    9               knowlogy_ogr         Disabled                         None
    7               knowlogy_ogr         Disabled                         None
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    Anham_AP03           2     AIR-LAP1142N-A-K9   70:81:05:88:15:b5 default location 1     US       1
    ANHAM_AP01           2     AIR-LAP1142N-A-K9   70:81:05:b0:e4:62 Small Conference 1     US       1
    ANHAM_AP04           2     AIR-LAP1131AG-A-K9   00:1d:45:86:e1:b8   Conference room 1     US       1
    ANHAM_AP02           2     AIR-LAP1142N-A-K9   70:81:05:96:7a:49         Copy Room 1     US       1
    Site Name........................................ Knowlogy_DC
    --More or (q)uit current module or <ctrl-z> to abort
    Site Description................................. DC Center Access points
    WLAN ID         Interface         Network Admission Control         Radio Policy
    2               knowlogy_ogr         Disabled                         None
    4               knowlogy_ogr         Disabled                         None
    3               knowlogy_ogr         Disabled                         None
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    KNOWLOGY_DC01       2     AIR-LAP1131AG-A-K9   00:1d:45:86:ed:4e KNOWLOGY_DC_Serv 1     US       1
    KNOWLOGY_DC02       2     AIR-LAP1131AG-A-K9   00:21:d8:36:c5:c4 KNOWLOGY_DC_Serv 1     US       1
    Site Name........................................ OGR
    Site Description................................. 1934 OGR Office
    WLAN ID         Interface         Network Admission Control         Radio Policy
    1               knowlogy_ogr         Disabled                         None
    2               knowlogy_ogr         Disabled                        None
    4               knowlogy_ogr         Disabled                         None
    6               knowlogy_ogr         Disabled                         None
    --More or (q)uit current module or <ctrl-z> to abort
    7               knowlogy_ogr        Disabled                         None
    9               knowlogy_ogr         Disabled                         None
    8               knowlogy_ogr         Disabled                         None
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    KN1252_AP01         2     AIR-LAP1252AG-A-K9   00:21:d8:ef:06:50 Knowlogy Confere 1    US       1
    KN1252_AP02         2     AIR-LAP1252AG-A-K9   00:22:55:8e:2e:d4 Server Room Side 1     US       1
    Site Name........................................ default-group
    Site Description................................. <none>
    WLAN ID        Interface         Network Admission Control         Radio Policy
    1               knowlogy_ogr         Disabled                         None
    2               knowlogy_ogr         Disabled                         None
    3               knowlogy_ogr         Disabled                         None
    4               knowlogy_ogr         Disabled                         None
    5               knowlogy_ogr         Disabled                         None
    6               knowlogy_ogr         Disabled                         None
    7               knowlogy_ogr         Disabled                         None
    8               knowlogy_ogr         Disabled                          None
    --More or (q)uit current module or <ctrl-z> to abort
    9               knowlogy_ogr         Disabled                         None
    10             management           Disabled                         None
    AP Name             Slots AP Model             Ethernet MAC       Location         Port Country Priority
    Press Enter to continue or <ctrl-z> to abort
    AP Config
    Cisco AP Identifier.............................. 6
    Cisco AP Name.................................... KNOWLOGY_DC01
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:1d:45:86:ed:4e
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.22.1.100
    Gateway IP Addr.................................. 10.22.1.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Disabled
    Ssh State........................................ Disabled
    Cisco AP Location................................ KNOWLOGY_DC_ServerRoom
    Cisco AP Group Name.............................. Knowlogy_DC
    Primary Cisco Switch Name........................ wireless.knowlogy.com
    Primary Cisco Switch IP Address.................. 10.125.18.15
    Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    --More or (q)uit current module or <ctrl-z> to abortIP Address.................. 10.125.18.15
    Tertiary Cisco Switch Name.......................
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W Version .................................... 7.0.235.0
    Boot Version ................................... 12.3.8.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Disabled
    PoE Power Injector MAC Addr...................... Disabled
    Power Type/Mode.................................. Power injector / Normal mode
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1131AG-A-K9
    AP Image......................................... C1130-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    --More or (q)uit current module or <ctrl-z> to abort
    Reset Button..................................... Enabled
    AP Serial Number................................. FTX1134T0QG
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 22
          WLAN 2 :........................................ 21
          WLAN 4 :........................................ 25
          WLAN 3 :........................................ 25
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    AP Up Time....................................... 48 days, 20 h 19 m 18 s
    AP LWAPP Up Time................................. 40 days, 13 h 58 m 18 s
    Join Date and Time............................... Tue Sep 24 21:24:33 2013
    Join Taken Time.................................. 0 days, 00 h 10 m 47 s
    --More or (q)uit current module or <ctrl-z> to abort
    Attributes for Slot 0
        Radio Type................................... RADIO_TYPE_80211b
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
       Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 3
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
         CFP MaxDuration ........................... 60
         BSSID ..................................... 00:1d:71:09:8f:90
         Operation Rate Set
           1000 Kilo Bits........................... MANDATORY
           2000 Kilo Bits........................... MANDATORY
           5500 Kilo Bits........................... MANDATORY
           11000 Kilo Bits.......................... MANDATORY
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
    --More or (q)uit current module or <ctrl-z> to abort
         Multi Domain Capability Enabled ........... TRUE
         Country String ............................ US
        Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 1
         Number Of Channels ........................ 11
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
       Tx Power
         Num Of Supported Power Levels ............. 8
         Tx Power Level 1 .......................... 20 dBm
         Tx Power Level 2 .......................... 17 dBm
         Tx Power Level 3 .......................... 14 dBm
         Tx Power Level 4 .......................... 11 dBm
         Tx Power Level 5 .......................... 8 dBm
         Tx Power Level 6 .......................... 5 dBm
         Tx Power Level 7 .......................... 2 dBm
         Tx Power Level 8 .......................... -1 dBm
    --More or (q)uit current module or <ctrl-z> to abort
         Tx Power Configuration .................... AUTOMATIC
         Current Tx Power Level .................... 1
       Phy DSSS parameters
         Configuration ............................. AUTOMATIC
         Current Channel ........................... 11
         Extension Channel ......................... NONE
         Channel Width.............................. 20 Mhz
         Allowed Channel List....................... 1,2,3,4,5,6,7,8,9,10,11
         Current CCA Mode .......................... 0
         ED Threshold .............................. -50
         Antenna Type............................... INTERNAL_ANTENNA
         Internal Antenna Gain (in .5 dBi units).... 8
         Diversity.................................. DIVERSITY_ENABLED
       Performance Profile Parameters
         Configuration ............................. AUTOMATIC
         Interference threshold..................... 10 %
         Noise threshold............................ -70 dBm
         RF utilization threshold................... 80 %
         Data-rate threshold........................ 1000000 bps
         Client threshold........................... 12 clients
         Coverage SNR threshold..................... 12 dB
    --More or (q)uit current module or <ctrl-z> to abort
         Coverage exception level................... 25 %
         Client minimum exception level............. 3 clients
       Rogue Containment Information
       Containment Count............................ 0
       CleanAir Management Information
           CleanAir Capable......................... No
    Cisco AP Identifier.............................. 6
    Cisco AP Name.................................... KNOWLOGY_DC01
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:1d:45:86:ed:4e
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.22.1.100
    Gateway IP Addr.................................. 10.22.1.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Disabled
    Ssh State........................................ Disabled
    --More or (q)uit current module or <ctrl-z> to abort
    Cisco AP Location................................ KNOWLOGY_DC_ServerRoom
    Cisco AP Group Name.............................. Knowlogy_DC
    Primary Cisco Switch Name........................ wireless.knowlogy.com
    Primary Cisco Switch Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    Tertiary Cisco Switch Name.......................
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W Version .................................... 7.0.235.0
    Boot Version ................................... 12.3.8.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Disabled
    PoE Power Injector MAC Addr...................... Disabled
    --More or (q)uit current module or <ctrl-z> to abort
    Power Type/Mode.................................. Power injector / Normal mode
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1131AG-A-K9
    AP Image......................................... C1130-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    Reset Button..................................... Enabled
    AP Serial Number................................. FTX1134T0QG
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 22
          WLAN 2 :........................................ 21
          WLAN 4 :........................................ 25
          WLAN 3 :........................................ 25
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    --More or (q)uit current module or <ctrl-z> to abort
    AP Up Time....................................... 48 days, 20 h 19 m 18 s
    AP LWAPP Up Time................................. 40 days, 13 h 58 m 18 s
    Join Date and Time............................... Tue Sep 24 21:24:33 2013
    Join Taken Time.................................. 0 days, 00 h 10 m 47 s
    Attributes for Slot 1
       Radio Type................................... RADIO_TYPE_80211a
       Radio Subband................................ RADIO_SUBBAND_ALL
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
       Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 3
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
          CFP MaxDuration ........................... 60
         BSSID ..................................... 00:1d:71:09:8f:90
         Operation Rate Set
           6000 Kilo Bits........................... MANDATORY
    --More or (q)uit current module or <ctrl-z> to abort
           9000 Kilo Bits........................... SUPPORTED
           12000 Kilo Bits.......................... MANDATORY
           18000 Kilo Bits.......................... SUPPORTED
           24000 Kilo Bits.......................... MANDATORY
          36000 Kilo Bits.......................... SUPPORTED
           48000 Kilo Bits.......................... SUPPORTED
           54000 Kilo Bits.......................... SUPPORTED
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
         Multi Domain Capability Enabled ........... TRUE
         Country String ............................ US
       Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 36
         Number Of Channels ........................ 20
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
    --More or (q)uit current module or <ctrl-z> to abort
       Tx Power
         Num Of Supported Power Levels ............. 7
         Tx Power Level 1 .......................... 15 dBm
         Tx Power Level 2 .......................... 14 dBm
         Tx Power Level 3 .......................... 11 dBm
         Tx Power Level 4 .......................... 8 dBm
         Tx Power Level 5 .......................... 5 dBm
         Tx Power Level 6 .......................... 2 dBm
         Tx Power Level 7 .......................... -1 dBm
         Tx Power Configuration .................... AUTOMATIC
         Current Tx Power Level .................... 1
       Phy OFDM parameters
         Configuration ............................. AUTOMATIC
         Current Channel ........................... 44
         Extension Channel ......................... NONE
         Channel Width.............................. 20 Mhz
         Allowed Channel List....................... 36,40,44,48,52,56,60,64,100,
           ......................................... 104,108,112,116,132,136,140,
           ......................................... 149,153,157,161
         TI Threshold .............................. -50
         Antenna Type............................... INTERNAL_ANTENNA
         Internal Antenna Gain (in .5 dBi units).... 8
    --More or (q)uit current module or <ctrl-z> to abort
         Diversity.................................. DIVERSITY_ENABLED
       Performance Profile Parameters
         Configuration ............................. AUTOMATIC
         Interference threshold..................... 10 %
         Noise threshold............................ -70 dBm
         RF utilization threshold................... 80 %
          Data-rate threshold........................ 1000000 bps
         Client threshold........................... 12 clients
         Coverage SNR threshold..................... 16 dB
         Coverage exception level................... 25 %
         Client minimum exception level............. 3 clients
       Rogue Containment Information
       Containment Count............................ 0
       CleanAir Management Information
           CleanAir Capable......................... No
    Press Enter to continue or <ctrl-z> to abort
    Cisco AP Identifier.............................. 3
    Cisco AP Name.................................... KNOWLOGY_DC02
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:21:d8:36:c5:c4
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.22.1.101
    Gateway IP Addr.................................. 10.22.1.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Disabled
    Ssh State........................................ Disabled
    Cisco AP Location................................ KNOWLOGY_DC_ServerRoom
    Cisco AP Group Name.............................. Knowlogy_DC
    Primary Cisco Switch Name........................
    Primary Cisco Switch IP Address.................. Not Configured
    Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    Tertiary Cisco Switch Name.......................
    --More or (q)uit current module or <ctrl-z> to abort
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W  Version .................................... 7.0.235.0
    Boot Version ................................... 12.3.8.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Enabled
    PoE Power Injector MAC Addr...................... Disabled
    Power Type/Mode.................................. Power injector / Normal mode
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1131AG-A-K9
    AP Image......................................... C1130-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    Reset Button..................................... Enabled
    --More or (q)uit current module or <ctrl-z> to abort
    AP Serial Number................................. FTX1230T24F
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 22
          WLAN 2 :........................................ 21
          WLAN 4 :........................................ 25
          WLAN 3 :........................................ 25
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    AP Up Time....................................... 48 days, 20 h 24 m 41 s
    AP LWAPP Up Time................................. 40 days, 13 h 58 m 18 s
    Join Date and Time............................... Tue Sep 24 21:24:35 2013
    Join Taken Time.................................. 0 days, 00 h 10 m 48 s
    --More or (q)uit current module or <ctrl-z> to abort
    Attributes for Slot 0
       Radio Type................................... RADIO_TYPE_80211b
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
        Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 3
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
         CFP MaxDuration ........................... 60
         BSSID ..................................... 00:22:55:a5:0c:30
         Operation Rate Set
           1000 Kilo Bits........................... MANDATORY
           2000 Kilo Bits........................... MANDATORY
           5500 Kilo Bits........................... MANDATORY
           11000 Kilo Bits.......................... MANDATORY
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
         Multi Domain Capability Enabled ........... TRUE
    --More or (q)uit current module or <ctrl-z> to abort
         Country String ............................ US
       Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 1
         Number Of Channels ........................ 11
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
       Tx Power
         Num Of Supported Power Levels ............. 8
         Tx Power Level 1 .......................... 20 dBm
         Tx Power Level 2 .......................... 17 dBm
         Tx Power Level 3 .......................... 14 dBm
         Tx Power Level 4 .......................... 11 dBm
         Tx Power Level 5 .......................... 8 dBm
         Tx Power Level 6 .......................... 5 dBm
         Tx Power Level 7 .......................... 2 dBm
         Tx Power Level 8 .......................... -1 dBm
         Tx Power Configuration .................... AUTOMATIC
    --More or (q)uit current module or <ctrl-z> to abort
         Current Tx Power Level .................... 1
       Phy DSSS parameters
         Configuration ............................. AUTOMATIC
         Current Channel ........................... 1
         Extension Channel ......................... NONE
         Channel Width.............................. 20 Mhz
         Allowed Channel List....................... 1,2,3,4,5,6,7,8,9,10,11
         Current CCA Mode .......................... 0
         ED Threshold .............................. -50
         Antenna Type............................... INTERNAL_ANTENNA
         Internal Antenna Gain (in .5 dBi units).... 8
         Diversity.................................. DIVERSITY_ENABLED
       Performance Profile Parameters
         Configuration ............................. AUTOMATIC
         Interference threshold..................... 10 %
         Noise threshold............................ -70 dBm
         RF utilization threshold................... 80 %
         Data-rate threshold........................ 1000000 bps
         Client threshold........................... 12 clients
         Coverage SNR threshold..................... 12 dB
         Coverage exception level................... 25 %
    --More or (q)uit current module or <ctrl-z> to abort
         Client minimum exception level............. 3 clients
       Rogue Containment Information
       Containment Count............................ 0
       CleanAir Management Information
           CleanAir Capable......................... No
    Cisco AP Identifier.............................. 3
    Cisco AP Name.................................... KNOWLOGY_DC02
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:21:d8:36:c5:c4
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.22.1.101
    Gateway IP Addr.................................. 10.22.1.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Disabled
    Ssh State........................................ Disabled
    Cisco AP Location................................ KNOWLOGY_DC_ServerRoom
    --More or (q)uit current module or <ctrl-z> to abort
    Cisco AP Group Name.............................. Knowlogy_DC
    Primary Cisco Switch Name........................
    Primary Cisco Switch IP Address.................. Not Configured
    Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    Tertiary Cisco Switch Name.......................
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W Version .................................... 7.0.235.0
    Boot Version ................................... 12.3.8.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Enabled
    PoE Power Injector MAC Addr...................... Disabled
    --More or (q)uit current module or <ctrl-z> to abort
    Power Type/Mode.................................. Power injector / Normal mode
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1131AG-A-K9
    AP Image......................................... C1130-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    Reset Button..................................... Enabled
    AP Serial Number................................. FTX1230T24F
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 22
          WLAN 2 :........................................ 21
          WLAN 4 :........................................ 25
          WLAN 3 :........................................ 25
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    --More or (q)uit current module or <ctrl-z> to abort
    AP Up Time....................................... 48 days, 20 h 24 m 41 s
    AP LWAPP Up Time................................. 40 days, 13 h 58 m 18 s
    Join Date and Time............................... Tue Sep 24 21:24:35 2013
    Join Taken Time.................................. 0 days, 00 h 10 m 48 s
    Attributes for Slot 1
       Radio Type................................... RADIO_TYPE_80211a
       Radio Subband................................ RADIO_SUBBAND_ALL
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
       Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 3
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
         CFP MaxDuration ........................... 60
         BSSID ..................................... 00:22:55:a5:0c:30
         Operation Rate Set
           6000 Kilo Bits........................... MANDATORY
    --More or (q)uit current module or <ctrl-z> to abort
           9000 Kilo Bits........................... SUPPORTED
           12000 Kilo Bits.......................... MANDATORY
           18000 Kilo Bits.......................... SUPPORTED
           24000 Kilo Bits.......................... MANDATORY
           36000 Kilo Bits.......................... SUPPORTED
           48000 Kilo Bits.......................... SUPPORTED
           54000 Kilo Bits.......................... SUPPORTED
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
         Multi Domain Capability Enabled ........... TRUE
         Country String ............................ US
       Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 36
         Number Of Channels ........................ 20
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
    --More or (q)uit current module or <ctrl-z> to abort
       Tx Power
         Num Of Supported Power Levels ............. 7
         Tx Power Level 1 .......................... 15 dBm
        Tx Power Level 2 .......................... 14 dBm
         Tx Power Level 3 .......................... 11 dBm
         Tx Power Level 4 .......................... 8 dBm
         Tx Power Level 5 .......................... 5 dBm
         Tx Power Level 6 .......................... 2 dBm
         Tx Power Level 7 .......................... -1 dBm
         Tx Power Configuration .................... AUTOMATIC
         Current Tx Power Level .................... 1
       Phy OFDM parameters
         Configuration ............................. AUTOMATIC
         Current Channel ........................... 36
         Extension Channel ......................... NONE
         Channel Width.............................. 20 Mhz
         Allowed Channel List....................... 36,40,44,48,52,56,60,64,100,
           ......................................... 104,108,112,116,132,136,140,
           ......................................... 149,153,157,161
         TI Threshold .............................. -50
         Antenna Type............................... INTERNAL_ANTENNA
         Internal Antenna Gain (in .5 dBi units).... 8
    --More or (q)uit current module or <ctrl-z> to abort
         Diversity.................................. DIVERSITY_ENABLED
       Performance Profile Parameters
          Configuration ............................. AUTOMATIC
         Interference threshold..................... 10 %
         Noise threshold............................ -70 dBm
         RF utilization threshold................... 80 %
         Data-rate threshold........................ 1000000 bps
         Client threshold........................... 12 clients
         Coverage SNR threshold..................... 16 dB
         Coverage exception level................... 25 %
         Client minimum exception level............. 3 clients
       Rogue Containment Information
       Containment Count............................ 0
       CleanAir Management Information
           CleanAir Capable......................... No
    Press Enter to continue or <ctrl-z> to abort
    Cisco AP Identifier.............................. 5
    Cisco AP Name.................................... KN1252_AP01
    Country code..................................... US - United States
    Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
    AP Country code.................................. US - United States
    AP Regulatory Domain............................. -A
    Switch Port Number .............................. 1
    MAC Address...................................... 00:21:d8:ef:06:50
    IP Address Configuration......................... DHCP
    IP Address....................................... 10.125.18.101
    IP NetMask....................................... 255.255.255.0
    Gateway IP Addr.................................. 10.125.18.1
    NAT External IP Address.......................... None
    CAPWAP Path MTU.................................. 1485
    Telnet State..................................... Enabled
    Ssh State........................................ Disabled
    Cisco AP Location................................ Knowlogy Conference Rooms Side
    Cisco AP Group Name.............................. OGR
    Primary Cisco Switch Name........................
    Primary Cisco Switch IP Address.................. Not Configured
    Secondary Cisco Switch Name......................
    Secondary Cisco Switch IP Address................ Not Configured
    --More or (q)uit current module or <ctrl-z> to abort
    Tertiary Cisco Switch Name.......................
    Tertiary Cisco Switch IP Address................. Not Configured
    Administrative State ............................ ADMIN_ENABLED
    Operation State ................................. REGISTERED
    Mirroring Mode .................................. Disabled
    AP Mode ......................................... H-Reap
    Public Safety ................................... Disabled
    AP SubMode ...................................... Not Configured
    Remote AP Debug ................................. Disabled
    Logging trap severity level ..................... informational
    Logging syslog facility ......................... kern
    S/W Version .................................... 7.0.235.0
    Boot Version ................................... 12.4.10.0
    Mini IOS Version ................................ 3.0.51.0
    Stats Reporting Period .......................... 180
    LED State........................................ Enabled
    PoE Pre-Standard Switch.......................... Disabled
    PoE Power Injector MAC Addr...................... Disabled
    Power Type/Mode.................................. PoE/Medium Power (15.4 W)
    Number Of Slots.................................. 2
    AP Model......................................... AIR-LAP1252AG-A-K9
    AP Image......................................... C1250-K9W8-M
    IOS Version...................................... 12.4(23c)JA5
    --More or (q)uit current module or <ctrl-z> to abort
    Reset Button..................................... Enabled
    AP Serial Number................................. FTX122990L5
    AP Certificate Type.............................. Manufacture Installed
    H-REAP Vlan mode :............................... Enabled
          Native ID :..................................... 118
          WLAN 1 :........................................ 111
          WLAN 2 :........................................ 111
          WLAN 4 :........................................ 112
          WLAN 6 :........................................ 112
          WLAN 7 :........................................ 111
          WLAN 9 :........................................ 112
          WLAN 8 :........................................ 112
    H-REAP Backup Auth Radius Servers :
    Static Primary Radius Server.................... Disabled
    Static Secondary Radius Server.................. Disabled
    Group Primary Radius Server..................... Disabled
    Group Secondary Radius Server................... Disabled
    AP User Mode..................................... AUTOMATIC
    AP User Name..................................... Not Configured
    AP Dot1x User Mode............................... Not Configured
    AP Dot1x User Name............................... Not Configured
    Cisco AP system logging host..................... 255.255.255.255
    AP Up Time....................................... 26 days, 00 h 24 m 39 s
    --More or (q)uit current module or <ctrl-z> to abort
    AP LWAPP Up Time................................. 26 days, 00 h 23 m 48 s
    Join Date and Time............................... Wed Oct 9 10:59:07 2013
    Join Taken Time.................................. 0 days, 00 h 00 m 50 s
    Attributes for Slot 0
       Radio Type................................... RADIO_TYPE_80211n-2.4
       Administrative State ........................ ADMIN_ENABLED
       Operation State ............................. UP
       Radio Role .................................. ACCESS
       CellId ...................................... 0
       Station Configuration
         Configuration ............................. AUTOMATIC
         Number Of WLANs ........................... 7
         Medium Occupancy Limit .................... 100
         CFP Period ................................ 4
         CFP MaxDuration ........................... 60
         BSSID ..................................... 00:22:55:df:a5:90
         Operation Rate Set
           1000 Kilo Bits........................... MANDATORY
           2000 Kilo Bits........................... MANDATORY
           5500 Kilo Bits........................... MANDATORY
    --More or (q)uit current module or <ctrl-z> to abort
           11000 Kilo Bits.......................... MANDATORY
         MCS Set
           MCS 0.................................... SUPPORTED
           MCS 1.................................... SUPPORTED
           MCS 2.................................... SUPPORTED
           MCS 3.................................... SUPPORTED
           MCS 4.................................... SUPPORTED
           MCS 5.................................... SUPPORTED
           MCS 6.................................... SUPPORTED
           MCS 7.................................... SUPPORTED
           MCS 8.................................... SUPPORTED
            MCS 9.................................... SUPPORTED
           MCS 10................................... SUPPORTED
           MCS 11................................... SUPPORTED
           MCS 12................................... SUPPORTED
           MCS 13................................... SUPPORTED
           MCS 14................................... SUPPORTED
           MCS 15................................... SUPPORTED
         Beacon Period ............................. 100
         Fragmentation Threshold ................... 2346
         Multi Domain Capability Implemented ....... TRUE
         Multi Domain Capability Enabled ........... TRUE
         Country String ............................ US
    --More or (q)uit current module or <ctrl-z> to abort
       Multi Domain Capability
         Configuration ............................. AUTOMATIC
         First Chan Num ............................ 1
         Number Of Channels ........................ 11
       MAC Operation Parameters
         Configuration ............................. AUTOMATIC
         Fragmentation Threshold ................... 2346
         Packet Retry Limit ........................ 64
       Tx Power
         Num Of Supported Power Levels ............. 8
         Tx Power Level 1 .......................... 20 dBm
         Tx Power Level 2 .......................... 17 dBm
         Tx Power Level 3 .......................... 14 dBm
         Tx Power Level 4 ..........

    Well you need to understand the behavior of h-reap or what it's called now, FlexConnect. In this mode, the clients are still remembers on the WLC until the session timer/idle timer expires. So switching between SSID's in h-reap will not be the same when switching when the AP's are in local mode.
    Take a look at the client when connected in FlexConnect in the WLC GUI monitor tab. Thus will show you what ssid and vlan the client is on. Now switch to a different ssid and compare this. It's probably the same because the client has not timed out. Now go back to the other ssid and look again. Now on the WLC, remove or delete the client and then switch to the other ssid at the same time. Or switch SSID's and then remove the client. The client will join the new ssid and in the monitor tab, you should see the info.
    There is no need to have clients have multiple SSID's unless your testing. Devices should only have one ssid profile configured to eliminate any connectivity issues from the device wanting to switch SSID's.
    Sent from Cisco Technical Support iPhone App

  • Wireless Bridge Aironet 1240

    Hi all,
    is it possible to create a wireless bridge between 2 AP of different brands?
    I need to create a bridge between an Aironet 1240 and a Telecom Italia router (Alice Gate VoIP 2 Plus Wi-Fi), where
    the Alice Gate is the AP and the aironet works in the workgroup mode.
    At home I tried with the Aironet and a Thomson st585: when aironet tries to connect to the ssid, the thomson ap reloads.
    In Aironet logs I find : "Parent lost : too many requests"
    What does it mean?

    dancampb is right. There isn't a standard for wireless bridging so interoperability between vendors is very low.
    I have tried the following 3 tests.
    1. Set Cisco Aironet 1242 as the root AP and Cisco Aironet 1231 as the wireless work bridge. No problem with all encryption methods like WEP, WPA WPA2.
    2. Set Linksys WRT310N as the root AP and Cisco Aironet 1242 as the wireless work bridge. Tried WPA2, can't associate.
    3. Set Belkin54g as the root AP and Cisco Aironet 1231 as the wireless work bridge/repeater. Open method, can't associate.
    As far as I know, if you can flash both the AP and the Bridge with the same firmware like DD-WRT, then you have a big chance to successfully associate them.
    Hope the above tests help.

  • No of SSID support on Cisco WLC

    Hi All,
    Can you please help me on providing below details on Cisco wireless controller?
    1. No of SSID support on Cisco WLC
    2. Is it possible to restrict SSID on AP's (e.g. I have 10 SSID's configured on controller, I want first 10 Access points use set of SSID (SSID 1-5), and rest of the AP use SSID 6-10.
    Thanks
    Jamal

    Hi Jamal,
    Just to add a touch to the great info from Robert (+5 points Robert)
    The feature you are looking for is called WLAN Override in WLC 4.x versions.
    Enabling WLAN Override
    By default, access points transmit all defined WLANs on the controller. However, you can use the WLAN Override option to select which WLANs are transmitted and which ones are not on a per access point basis. For example, you can use WLAN override to control where in the network the guest WLAN is transmitted or you can use it to disable a specific WLAN in a certain area of the network.
    From this doc;
    http://www.cisco.com/en/US/docs/wireless/controller/4.0/configuration/guide/c40wlan.html#wp1114777
    Once you create a new WLAN, the WLAN > Edit page for the new WLAN appears. In this page you can define various parameters specific to this WLAN including General Policies, RADIUS Servers, Security Policies, and 802.1x Parameters.
    **Check Admin Status under General Policies to enable the WLAN. If you want the AP to broadcast the SSID in its beacon frames, check Broadcast SSID.
    Note: You can configure up to sixteen WLANs on the controller. The Cisco WLAN Solution can control up to sixteen WLANs for Lightweight APs. Each WLAN has a separate WLAN ID (1 through 16), a separate WLAN SSID (WLAN name), and can be assigned unique security policies. Lightweight APs broadcast all active Cisco WLAN Solution WLAN SSIDs and enforce the policies that you define for each WLAN.
    From this good doc;
    http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080665d18.shtml#c3
    In 5.x versions you will use AP Groups, because in WLC 5.x versions, WLAN Override has been replaced with the "AP Groups" feature;
    Creating Access Point Groups
    After all access points have joined the controller, you can create up to 150 access point groups and assign up to 16 WLANs to each group. Each access point advertises only the enabled WLANs that belong to its access point group. The access point does not advertise disabled WLANs in its access point group or WLANs that belong to another group.
    http://www.cisco.com/en/US/docs/wireless/controller/5.2/configuration/guide/c52wlan.html#wp1128591
    To learn more about AP Groups check out George's excellent video
    http://www.my80211.com/cisco-labs/2009/3/22/cisco-ap-group-nugget.html
    Hope this helps!
    Rob

  • Inquiry - Cisco Captive Portal without WLC

    Hi
    based on article http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008067489f.shtml
    Is it possible or how should I design captive portal without WLC.
    In our organization, I have about 20 AP (various models) running on standalone with VLAN and ACS server for MAC authentication.
    I have plan to create new VLAN just only for guest users to browse with username/password URL redirectiotion (without MAC authentication).
    Seek your help.
    Thank You

    Without a wlc you would need another solution to handle the portal piece.
    Sent from Cisco Technical Support iPad App

  • 1552 without WLC

    Hi
    is it possible to setup and use 1552 AP as a standalone AP, without WLC to act as a bridge between two locations and possible to serve the clients?
    With 1142 (indoor) i can setup autonomouse mode, access 1142 AP over the http ad configure it without using WLC.
    Can the same be done with 1552 without having to use WLC? Was able to setup static IP on 1552 but dont see the option to configure it further.
    Thanks

    OK. I tried to connect this AP to the vWLC. I can see this ouput on AP console:
    *Mar 21 14:30:16.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.48.7.120 peer_port: 5246
    *Mar 21 14:30:45.999: DTLS_CLIENT_ERROR: ../dtls/dtls_connection_db.c:2017 Max retransmission count reached!
    *Mar 21 14:30:45.999: %DTLS-3-HANDSHAKE_RETRANSMIT: Max retransmit count for 10.48.7.120 is reached.
    % CDP is not supported on this interface, or for this encapsulation
    *Mar 21 14:30:49.983: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.48.7.120:5246
    *Mar 21 14:30:49.983: %MESH-6-CAPWAP_RESTART: Mesh Capwap re-started
    *Mar 21 14:30:50.019: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
    *Mar 21 14:30:50.019: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
    *Mar 21 14:30:50.091:  status of voice_diag_test from WLC is false
    *Mar 21 14:33:10.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.48.7.120 peer_port: 5246
    *Mar 21 14:33:10.000: %CAPWAP-5-CHANGED: CAPWAP changed state to
    *Mar 21 14:33:10.007: %LWAPP-3-CLIENTERRORLOG: Peer certificate verification failed
    *Mar 21 14:33:10.007: %CAPWAP-3-ERRORLOG: Certificate verification failed!
    *Mar 21 14:33:10.007: DTLS_CLIENT_ERROR: ../capwap/capwap_wtp_dtls.c:348 Certificate verified failed!
    *Mar 21 14:33:10.007: %DTLS-4-BAD_CERT: Certificate verification failed. Peer IP: 10.48.7.120
    *Mar 21 14:33:10.007: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 10.48.7.120:5246
    *Mar 21 14:33:10.007: %DTLS-3-BAD_RECORD: Erroneous record received from 10.48.7.120: Malformed Certificate
    *Mar 21 14:33:10.011: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.48.7.120:5246
    *Mar 21 14:33:10.011: %CAPWAP-3-ERRORLOG: Invalid event 38 & state 3 combination.
    vWLC has bad certificate?

  • WLC AND AIRONET 1240 LWAPP CONFIG

    Hi all, Can anyone tell me what I need to do to configure my 1240ag access points to work with my wlc using lwapp.
    Also how reliable are the wlc's should you use a backup wlc on each site ?

    Your 1240ag must be an LWAP. Look at the back of the AP and check the model. If you see AP1242 then no, but if you see LAP1242 then all you need to do is stage the LWAP to the WLC.
    Backups depend on your policies and how important the wireless will be to your byusiness.
    Read this doc to help you understand better. Hope this helps:
    http://www.cisco.com/en/US/products/hw/wireless/ps430/products_configuration_example09186a0080665cdf.shtml

  • Cannot authenticate Radius via WLC

    Trying to configure RADIUS client on Server 2012 using a 5508 series WLC.  Getting the following debug on the WLC:
    (Cisco Controller) >*dot1xMsgTask: Dec 13 12:43:19.695: 74:e5:43:5d:48:78 Not sending EAP-Failure for STA 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:43:25.523: 74:e5:43:5d:48:78 Association received from mobile on BSSID 0c:68:03:b8:60:47
    *apfMsConnTask_7: Dec 13 12:43:25.523: 74:e5:43:5d:48:78 Global 200 Clients are allowed to AP radio
    *apfMsConnTask_7: Dec 13 12:43:25.523: 74:e5:43:5d:48:78 Max Client Trap Threshold: 0  cur: 9
    *apfMsConnTask_7: Dec 13 12:43:25.523: 74:e5:43:5d:48:78 Rf profile 600 Clients are allowed to AP wlan
    *apfMsConnTask_7: Dec 13 12:43:25.523: 74:e5:43:5d:48:78 Deleting client immediately since WLAN has changed
    *apfMsConnTask_7: Dec 13 12:43:25.523: 74:e5:43:5d:48:78 Scheduling deletion of Mobile Station:  (callerId: 50) in 1 seconds
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:25.550: 74:e5:43:5d:48:78 Ignoring any event(1), since client is marked for deletion
    *osapiBsnTimer: Dec 13 12:43:26.494: 74:e5:43:5d:48:78 apfMsExpireCallback (apf_ms.c:615) Expiring Mobile!
    *apfReceiveTask: Dec 13 12:43:26.494: 74:e5:43:5d:48:78 apfMsExpireMobileStation (apf_ms.c:5827) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:b8:60:40 from Associated to Disassociated
    *apfReceiveTask: Dec 13 12:43:26.494: 74:e5:43:5d:48:78 apfMsAssoStateDec
    *apfReceiveTask: Dec 13 12:43:26.494: 74:e5:43:5d:48:78 apfMsExpireMobileStation (apf_ms.c:5959) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:b8:60:40 from Disassociated to Idle
    *apfReceiveTask: Dec 13 12:43:26.494: 74:e5:43:5d:48:78 pemApfDeleteMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0.
    *apfReceiveTask: Dec 13 12:43:26.494: 74:e5:43:5d:48:78 0.0.0.0 8021X_REQD (3) Deleted mobile LWAPP rule on AP [0c:68:03:b8:60:40]
    *apfReceiveTask: Dec 13 12:43:26.494: 74:e5:43:5d:48:78 Deleting mobile on AP 0c:68:03:b8:60:40(0)
    *apfMsConnTask_7: Dec 13 12:43:31.820: 74:e5:43:5d:48:78 Adding mobile on LWAPP AP 0c:68:03:d7:c7:90(0)
    *apfMsConnTask_7: Dec 13 12:43:31.820: 74:e5:43:5d:48:78 Reassociation received from mobile on BSSID 0c:68:03:d7:c7:97
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Global 200 Clients are allowed to AP radio
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Max Client Trap Threshold: 0  cur: 3
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Rf profile 600 Clients are allowed to AP wlan
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Applying Interface policy on Mobile, role Unassociated. Ms NAC State 0 Quarantine Vlan 0 Access Vlan 0
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Re-applying interface policy for client
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 0.0.0.0 START (0) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2018)
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 0.0.0.0 START (0) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2246)
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 In processSsidIE:4210 setting Central switched to TRUE
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 In processSsidIE:4213 apVapId = 8 and Split Acl Id = 65535
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Applying site-specific Local Bridging override for station 74:e5:43:5d:48:78 - vapId 8, site 'default-group', interface 'management'
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Applying Local Bridging Interface Policy for station 74:e5:43:5d:48:78 - vlan 219, interface id 0, interface 'management'
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 processSsidIE  statusCode is 0 and status is 0
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 processSsidIE  ssid_done_flag is 0 finish_flag is 0
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 STA - rates (4): 130 132 139 150 0 0 0 0 0 0 0 0 0 0 0 0
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 suppRates  statusCode is 0 and gotSuppRatesElement is 1
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 STA - rates (12): 130 132 139 150 12 18 24 36 48 72 96 108 0 0 0 0
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 extSuppRates  statusCode is 0 and gotExtSuppRatesElement is 1
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Processing RSN IE type 48, length 20 for mobile 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Received RSN IE with 0 PMKIDs from mobile 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 Setting active key cache index 8 ---> 8
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 unsetting PmkIdValidatedByAp
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 0.0.0.0 START (0) Initializing policy
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state START (0)
    *apfMsConnTask_7: Dec 13 12:43:31.821: 74:e5:43:5d:48:78 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state AUTHCHECK (2)
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 Not Using WMM Compliance code qosCap 00
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 0.0.0.0 8021X_REQD (3) Plumbed mobile LWAPP rule on AP 0c:68:03:d7:c7:90 vapId 8 apVapId 8 flex-acl-name:
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 apfMsAssoStateInc
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 apfPemAddUser2 (apf_policy.c:276) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:d7:c7:90 from Idle to Associated
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 apfPemAddUser2:session timeout forstation 74:e5:43:5d:48:78 - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is  0
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 Stopping deletion of Mobile Station: (callerId: 48)
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 Func: apfPemAddUser2, Ms Timeout = 0, Session Timeout = 0
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 Sending Assoc Response to station on BSSID 0c:68:03:d7:c7:97 (status 0) ApVapId 8 Slot 0
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 apfProcessAssocReq (apf_80211.c:7399) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:d7:c7:90 from Associated to Associated
    *apfMsConnTask_7: Dec 13 12:43:31.822: 74:e5:43:5d:48:78 Updating AID for REAP AP Client 0c:68:03:d7:c7:90 - AID ===> 3
    *dot1xMsgTask: Dec 13 12:43:31.825: 74:e5:43:5d:48:78 Station 74:e5:43:5d:48:78 setting dot1x reauth timeout = 1800
    *dot1xMsgTask: Dec 13 12:43:31.825: 74:e5:43:5d:48:78 dot1x - moving mobile 74:e5:43:5d:48:78 into Connecting state
    *dot1xMsgTask: Dec 13 12:43:31.825: 74:e5:43:5d:48:78 Sending EAP-Request/Identity to mobile 74:e5:43:5d:48:78 (EAP Id 1)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:31.831: 74:e5:43:5d:48:78 Received EAPOL START from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:31.831: 74:e5:43:5d:48:78 dot1x - moving mobile 74:e5:43:5d:48:78 into Connecting state
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:31.831: 74:e5:43:5d:48:78 Sending EAP-Request/Identity to mobile 74:e5:43:5d:48:78 (EAP Id 2)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.346: 74:e5:43:5d:48:78 Received EAPOL EAPPKT from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.346: 74:e5:43:5d:48:78 Received Identity Response (count=2) from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.346: 74:e5:43:5d:48:78 EAP State update from Connecting to Authenticating for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.346: 74:e5:43:5d:48:78 dot1x - moving mobile 74:e5:43:5d:48:78 into Authenticating state
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.346: 74:e5:43:5d:48:78 Entering Backend Auth Response state for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.350: 74:e5:43:5d:48:78 Processing Access-Challenge for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.350: 74:e5:43:5d:48:78 Entering Backend Auth Req state (id=3) for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.350: 74:e5:43:5d:48:78 Sending EAP Request from AAA to mobile 74:e5:43:5d:48:78 (EAP Id 3)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.358: 74:e5:43:5d:48:78 Received EAPOL EAPPKT from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.358: 74:e5:43:5d:48:78 Received EAP Response from mobile 74:e5:43:5d:48:78 (EAP Id 3, EAP Type 25)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.358: 74:e5:43:5d:48:78 Entering Backend Auth Response state for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.360: 74:e5:43:5d:48:78 Processing Access-Challenge for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.360: 74:e5:43:5d:48:78 Entering Backend Auth Req state (id=4) for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.360: 74:e5:43:5d:48:78 Sending EAP Request from AAA to mobile 74:e5:43:5d:48:78 (EAP Id 4)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.514: 74:e5:43:5d:48:78 Received EAPOL EAPPKT from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.514: 74:e5:43:5d:48:78 Received EAP Response from mobile 74:e5:43:5d:48:78 (EAP Id 4, EAP Type 25)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.514: 74:e5:43:5d:48:78 Entering Backend Auth Response state for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.516: 74:e5:43:5d:48:78 Processing Access-Challenge for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.516: 74:e5:43:5d:48:78 Entering Backend Auth Req state (id=5) for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:37.516: 74:e5:43:5d:48:78 Sending EAP Request from AAA to mobile 74:e5:43:5d:48:78 (EAP Id 5)
    *apfMsConnTask_7: Dec 13 12:43:42.724: 74:e5:43:5d:48:78 Client stats update: Time now in sec 1386956622, Last Acct Msg Sent at 0 sec
    *apfMsConnTask_7: Dec 13 12:43:42.724: 74:e5:43:5d:48:78 Requested to send acct interim update request msg to APF task for client 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:43:42.725: 74:e5:43:5d:48:78 Client stats update: Time now in sec 1386956622, Last Acct Msg Sent at 0 sec
    *apfMsConnTask_7: Dec 13 12:43:42.725: 74:e5:43:5d:48:78 Requested to send acct interim update request msg to APF task for client 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:43:42.726: 74:e5:43:5d:48:78 Client stats update: Time now in sec 1386956622, Last Acct Msg Sent at 0 sec
    *apfMsConnTask_7: Dec 13 12:43:42.726: 74:e5:43:5d:48:78 Requested to send acct interim update request msg to APF task for client 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:43:42.727: 74:e5:43:5d:48:78 Association received from mobile on BSSID 0c:68:03:d7:c7:90
    *apfMsConnTask_7: Dec 13 12:43:42.727: 74:e5:43:5d:48:78 Global 200 Clients are allowed to AP radio
    *apfMsConnTask_7: Dec 13 12:43:42.728: 74:e5:43:5d:48:78 Max Client Trap Threshold: 0  cur: 4
    *apfMsConnTask_7: Dec 13 12:43:42.728: 74:e5:43:5d:48:78 Rf profile 600 Clients are allowed to AP wlan
    *apfMsConnTask_7: Dec 13 12:43:42.728: 74:e5:43:5d:48:78 Deleting client immediately since WLAN has changed
    *apfMsConnTask_7: Dec 13 12:43:42.728: 74:e5:43:5d:48:78 Scheduling deletion of Mobile Station:  (callerId: 50) in 1 seconds
    *apfMsConnTask_7: Dec 13 12:43:42.731: 74:e5:43:5d:48:78 Client stats update: Time now in sec 1386956622, Last Acct Msg Sent at 0 sec
    *apfMsConnTask_7: Dec 13 12:43:42.731: 74:e5:43:5d:48:78 Requested to send acct interim update request msg to APF task for client 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:42.744: 74:e5:43:5d:48:78 Ignoring any event(1), since client is marked for deletion
    *osapiBsnTimer: Dec 13 12:43:43.694: 74:e5:43:5d:48:78 apfMsExpireCallback (apf_ms.c:615) Expiring Mobile!
    *apfReceiveTask: Dec 13 12:43:43.694: 74:e5:43:5d:48:78 apfMsExpireMobileStation (apf_ms.c:5827) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:d7:c7:90 from Associated to Disassociated
    *apfReceiveTask: Dec 13 12:43:43.694: 74:e5:43:5d:48:78 apfMsAssoStateDec
    *apfReceiveTask: Dec 13 12:43:43.694: 74:e5:43:5d:48:78 apfMsExpireMobileStation (apf_ms.c:5959) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:d7:c7:90 from Disassociated to Idle
    *apfReceiveTask: Dec 13 12:43:43.694: 74:e5:43:5d:48:78 pemApfDeleteMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0.
    *apfReceiveTask: Dec 13 12:43:43.695: 74:e5:43:5d:48:78 0.0.0.0 8021X_REQD (3) Deleted mobile LWAPP rule on AP [0c:68:03:d7:c7:90]
    *apfReceiveTask: Dec 13 12:43:43.695: 74:e5:43:5d:48:78 Deleting mobile on AP 0c:68:03:d7:c7:90(0)
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 Adding mobile on LWAPP AP 0c:68:03:b8:60:40(0)
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 Reassociation received from mobile on BSSID 0c:68:03:b8:60:40
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 Global 200 Clients are allowed to AP radio
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 Max Client Trap Threshold: 0  cur: 9
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 Rf profile 600 Clients are allowed to AP wlan
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 Applying Interface policy on Mobile, role Unassociated. Ms NAC State 0 Quarantine Vlan 0 Access Vlan 0
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 Re-applying interface policy for client
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 0.0.0.0 START (0) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2018)
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 0.0.0.0 START (0) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2246)
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 In processSsidIE:4210 setting Central switched to TRUE
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 In processSsidIE:4213 apVapId = 1 and Split Acl Id = 65535
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 Applying site-specific Local Bridging override for station 74:e5:43:5d:48:78 - vapId 1, site 'default-group', interface 'management'
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 Applying Local Bridging Interface Policy for station 74:e5:43:5d:48:78 - vlan 219, interface id 0, interface 'management'
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 processSsidIE  statusCode is 0 and status is 0
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 processSsidIE  ssid_done_flag is 0 finish_flag is 0
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 STA - rates (4): 130 132 139 150 0 0 0 0 0 0 0 0 0 0 0 0
    *apfMsConnTask_7: Dec 13 12:43:49.065: 74:e5:43:5d:48:78 suppRates  statusCode is 0 and gotSuppRatesElement is 1
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 STA - rates (12): 130 132 139 150 12 18 24 36 48 72 96 108 0 0 0 0
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 extSuppRates  statusCode is 0 and gotExtSuppRatesElement is 1
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 Processing RSN IE type 48, length 20 for mobile 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 Received RSN IE with 0 PMKIDs from mobile 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 Setting active key cache index 8 ---> 8
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 unsetting PmkIdValidatedByAp
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 0.0.0.0 START (0) Initializing policy
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state START (0)
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state AUTHCHECK (2)
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 Not Using WMM Compliance code qosCap 00
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 0.0.0.0 8021X_REQD (3) Plumbed mobile LWAPP rule on AP 0c:68:03:b8:60:40 vapId 1 apVapId 1 flex-acl-name:
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 apfMsAssoStateInc
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 apfPemAddUser2 (apf_policy.c:276) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:b8:60:40 from Idle to Associated
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 apfPemAddUser2:session timeout forstation 74:e5:43:5d:48:78 - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is  0
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 Stopping deletion of Mobile Station: (callerId: 48)
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 Func: apfPemAddUser2, Ms Timeout = 0, Session Timeout = 0
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 Sending Assoc Response to station on BSSID 0c:68:03:b8:60:40 (status 0) ApVapId 1 Slot 0
    *apfMsConnTask_7: Dec 13 12:43:49.066: 74:e5:43:5d:48:78 apfProcessAssocReq (apf_80211.c:7399) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:b8:60:40 from Associated to Associated
    *apfMsConnTask_7: Dec 13 12:43:49.067: 74:e5:43:5d:48:78 Updating AID for REAP AP Client 0c:68:03:b8:60:40 - AID ===> 1
    *dot1xMsgTask: Dec 13 12:43:49.068: 74:e5:43:5d:48:78 Station 74:e5:43:5d:48:78 setting dot1x reauth timeout = 1800
    *dot1xMsgTask: Dec 13 12:43:49.068: 74:e5:43:5d:48:78 dot1x - moving mobile 74:e5:43:5d:48:78 into Connecting state
    *dot1xMsgTask: Dec 13 12:43:49.068: 74:e5:43:5d:48:78 Sending EAP-Request/Identity to mobile 74:e5:43:5d:48:78 (EAP Id 1)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:49.075: 74:e5:43:5d:48:78 Received EAPOL START from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:49.076: 74:e5:43:5d:48:78 dot1x - moving mobile 74:e5:43:5d:48:78 into Connecting state
    debug client 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:49.076: 74:e5:43:5d:48:78 Sending EAP-Request/Identity to mobile 74:e5:43:5d:48:78 (EAP Id 2)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:58.993: 74:e5:43:5d:48:78 Received EAPOL EAPPKT from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:58.993: 74:e5:43:5d:48:78 Received Identity Response (count=2) from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:58.993: 74:e5:43:5d:48:78 EAP State update from Connecting to Authenticating for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:58.993: 74:e5:43:5d:48:78 dot1x - moving mobile 74:e5:43:5d:48:78 into Authenticating state
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:58.993: 74:e5:43:5d:48:78 Entering Backend Auth Response state for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.000: 74:e5:43:5d:48:78 Processing Access-Challenge for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.000: 74:e5:43:5d:48:78 Entering Backend Auth Req state (id=3) for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.000: 74:e5:43:5d:48:78 Sending EAP Request from AAA to mobile 74:e5:43:5d:48:78 (EAP Id 3)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.007: 74:e5:43:5d:48:78 Received EAPOL EAPPKT from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.007: 74:e5:43:5d:48:78 Received EAP Response from mobile 74:e5:43:5d:48:78 (EAP Id 3, EAP Type 25)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.007: 74:e5:43:5d:48:78 Entering Backend Auth Response state for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.010: 74:e5:43:5d:48:78 Processing Access-Challenge for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.010: 74:e5:43:5d:48:78 Entering Backend Auth Req state (id=4) for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.010: 74:e5:43:5d:48:78 Sending EAP Request from AAA to mobile 74:e5:43:5d:48:78 (EAP Id 4)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.038: 74:e5:43:5d:48:78 Received EAPOL EAPPKT from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.038: 74:e5:43:5d:48:78 Received EAP Response from mobile 74:e5:43:5d:48:78 (EAP Id 4, EAP Type 25)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.038: 74:e5:43:5d:48:78 Entering Backend Auth Response state for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.040: 74:e5:43:5d:48:78 Processing Access-Challenge for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.040: 74:e5:43:5d:48:78 Entering Backend Auth Req state (id=5) for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.040: 74:e5:43:5d:48:78 Sending EAP Request from AAA to mobile 74:e5:43:5d:48:78 (EAP Id 5)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.069: 74:e5:43:5d:48:78 Received EAPOL EAPPKT from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.070: 74:e5:43:5d:48:78 Received EAP Response from mobile 74:e5:43:5d:48:78 (EAP Id 5, EAP Type 25)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.070: 74:e5:43:5d:48:78 Entering Backend Auth Response state for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.071: 74:e5:43:5d:48:78 Processing Access-Challenge for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.071: 74:e5:43:5d:48:78 Entering Backend Auth Req state (id=6) for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.071: 74:e5:43:5d:48:78 Sending EAP Request from AAA to mobile 74:e5:43:5d:48:78 (EAP Id 6)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.125: 74:e5:43:5d:48:78 Received EAPOL EAPPKT from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.125: 74:e5:43:5d:48:78 Received EAP Response from mobile 74:e5:43:5d:48:78 (EAP Id 6, EAP Type 25)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.125: 74:e5:43:5d:48:78 Entering Backend Auth Response state for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.128: 74:e5:43:5d:48:78 Processing Access-Reject for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.128: 74:e5:43:5d:48:78 Removing PMK cache due to EAP-Failure for mobile 74:e5:43:5d:48:78 (EAP Id 6)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.128: 74:e5:43:5d:48:78 Sending EAP-Failure to mobile 74:e5:43:5d:48:78 (EAP Id 6)
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.128: 74:e5:43:5d:48:78 Entering Backend Auth Failure state (id=6) for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.128: 74:e5:43:5d:48:78 Setting quiet timer for 5 seconds for mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:43:59.128: 74:e5:43:5d:48:78 dot1x - moving mobile 74:e5:43:5d:48:78 into Unknown state
    *apfMsConnTask_7: Dec 13 12:44:00.651: 74:e5:43:5d:48:78 Client stats update: Time now in sec 1386956640, Last Acct Msg Sent at 0 sec
    *apfMsConnTask_7: Dec 13 12:44:00.651: 74:e5:43:5d:48:78 Requested to send acct interim update request msg to APF task for client 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:44:00.659: 74:e5:43:5d:48:78 Client stats update: Time now in sec 1386956640, Last Acct Msg Sent at 0 sec
    *apfMsConnTask_7: Dec 13 12:44:00.660: 74:e5:43:5d:48:78 Requested to send acct interim update request msg to APF task for client 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:44:00.660: 74:e5:43:5d:48:78 Association received from mobile on BSSID 0c:68:03:b8:60:40
    *apfMsConnTask_7: Dec 13 12:44:00.660: 74:e5:43:5d:48:78 Global 200 Clients are allowed to AP radio
    *apfMsConnTask_7: Dec 13 12:44:00.660: 74:e5:43:5d:48:78 Max Client Trap Threshold: 0  cur: 10
    *apfMsConnTask_7: Dec 13 12:44:00.660: 74:e5:43:5d:48:78 Rf profile 600 Clients are allowed to AP wlan
    *apfMsConnTask_7: Dec 13 12:44:00.660: 74:e5:43:5d:48:78 Applying Interface policy on Mobile, role Unassociated. Ms NAC State 2 Quarantine Vlan 0 Access Vlan 219
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 Re-applying interface policy for client
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 0.0.0.0 8021X_REQD (3) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2018)
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 0.0.0.0 8021X_REQD (3) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2246)
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 In processSsidIE:4210 setting Central switched to TRUE
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 In processSsidIE:4213 apVapId = 1 and Split Acl Id = 65535
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 Applying site-specific Local Bridging override for station 74:e5:43:5d:48:78 - vapId 1, site 'default-group', interface 'management'
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 Applying Local Bridging Interface Policy for station 74:e5:43:5d:48:78 - vlan 219, interface id 0, interface 'management'
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 processSsidIE  statusCode is 0 and status is 0
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 processSsidIE  ssid_done_flag is 0 finish_flag is 0
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 STA - rates (4): 130 132 139 150 12 18 24 36 48 72 96 108 0 0 0 0
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 suppRates  statusCode is 0 and gotSuppRatesElement is 1
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 STA - rates (12): 130 132 139 150 12 18 24 36 48 72 96 108 0 0 0 0
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 extSuppRates  statusCode is 0 and gotExtSuppRatesElement is 1
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 Processing RSN IE type 48, length 20 for mobile 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 Received RSN IE with 0 PMKIDs from mobile 74:e5:43:5d:48:78
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 Setting active key cache index 8 ---> 8
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 unsetting PmkIdValidatedByAp
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 0.0.0.0 8021X_REQD (3) Initializing policy
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 0.0.0.0 8021X_REQD (3) Change state to AUTHCHECK (2) last state 8021X_REQD (3)
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state AUTHCHECK (2)
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 Not Using WMM Compliance code qosCap 00
    *apfMsConnTask_7: Dec 13 12:44:00.661: 74:e5:43:5d:48:78 0.0.0.0 8021X_REQD (3) Plumbed mobile LWAPP rule on AP 0c:68:03:b8:60:40 vapId 1 apVapId 1 flex-acl-name:
    *apfMsConnTask_7: Dec 13 12:44:00.662: 74:e5:43:5d:48:78 apfPemAddUser2 (apf_policy.c:276) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:b8:60:40 from Associated to Associated
    *apfMsConnTask_7: Dec 13 12:44:00.662: 74:e5:43:5d:48:78 apfPemAddUser2:session timeout forstation 74:e5:43:5d:48:78 - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is  0
    *apfMsConnTask_7: Dec 13 12:44:00.662: 74:e5:43:5d:48:78 Stopping deletion of Mobile Station: (callerId: 48)
    *apfMsConnTask_7: Dec 13 12:44:00.662: 74:e5:43:5d:48:78 Func: apfPemAddUser2, Ms Timeout = 0, Session Timeout = 0
    *apfMsConnTask_7: Dec 13 12:44:00.662: 74:e5:43:5d:48:78 Sending Assoc Response to station on BSSID 0c:68:03:b8:60:40 (status 0) ApVapId 1 Slot 0
    *apfMsConnTask_7: Dec 13 12:44:00.662: 74:e5:43:5d:48:78 apfProcessAssocReq (apf_80211.c:7399) Changing state for mobile 74:e5:43:5d:48:78 on AP 0c:68:03:b8:60:40 from Associated to Associated
    *dot1xMsgTask: Dec 13 12:44:00.664: 74:e5:43:5d:48:78 dot1x - moving mobile 74:e5:43:5d:48:78 into Connecting state
    *dot1xMsgTask: Dec 13 12:44:00.664: 74:e5:43:5d:48:78 Sending EAP-Request/Identity to mobile 74:e5:43:5d:48:78 (EAP Id 1)
    *Dot1x_NW_MsgTask_0: Dec 13 12:44:00.677: 74:e5:43:5d:48:78 Received EAPOL START from mobile 74:e5:43:5d:48:78
    *Dot1x_NW_MsgTask_0: Dec 13 12:44:00.677: 74:e5:43:5d:48:78 dot1x - moving mobile 74:e5:43:5d:48:78 into Connecting state
    *Dot1x_NW_MsgTask_0: Dec 13 12:44:00.677: 74:e5:43:5d:48:78 Sending EAP-Request/Identity to mobile 74:e5:43:5d:48:78 (EAP Id 2)
    I setup wireshark to capture on all interfaces and am getting absolutely 0 packet data when I attempt to authenticate as well.
    Thanks in advance,
    -B

    Thanks for the reply Scott...so sorry for the spammy post!
    The radius server where the client is deployed is not displaying any sort of logs in any of the NPS log files.
    Show WLAN 1 is as follows:
    WLAN Identifier.................................. 1
    Profile Name..................................... GHI
    Network Name (SSID).............................. GHI
    Status........................................... Enabled
    MAC Filtering.................................... Disabled
    Broadcast SSID................................... Disabled
    AAA Policy Override.............................. Disabled
    Network Admission Control
      Client Profiling Status ....................... Enabled
       DHCP ......................................... Enabled
       HTTP ......................................... Disabled
      Radius-NAC State............................... Disabled
      SNMP-NAC State................................. Disabled
      Quarantine VLAN................................ 0
    Maximum number of Associated Clients............. 0
    Maximum number of Clients per AP Radio........... 200
    Number of Active Clients......................... 0
    Exclusionlist Timeout............................ 60 seconds
    Session Timeout.................................. 1800 seconds
    User Idle Timeout................................ 300 seconds
    User Idle Threshold.............................. 0 Bytes
    NAS-identifier................................... GHI_WLC
    CHD per WLAN..................................... Enabled
    Webauth DHCP exclusion........................... Disabled
    Interface........................................ management
    Multicast Interface.............................. Not Configured
    WLAN IPv4 ACL.................................... unconfigured
    WLAN IPv6 ACL.................................... unconfigured
    mDNS Status...................................... Enabled
    mDNS Profile Name................................ default-mdns-profile
    DHCP Server...................................... Default
    DHCP Address Assignment Required................. Enabled
    Static IP client tunneling....................... Disabled
    PMIPv6 Mobility Type............................. none
    Quality of Service............................... Silver
    Per-SSID Rate Limits............................. Upstream      Downstream
    Average Data Rate................................   0             0
    Average Realtime Data Rate.......................   0             0
    Burst Data Rate..................................   0             0
    Burst Realtime Data Rate.........................   0             0
    Per-Client Rate Limits........................... Upstream      Downstream
    Average Data Rate................................   0             0
    Average Realtime Data Rate.......................   0             0
    --More-- or (q)uit
    Burst Data Rate..................................   0             0
    Burst Realtime Data Rate.........................   0             0
    Scan Defer Priority.............................. 4,5,6
    Scan Defer Time.................................. 100 milliseconds
    WMM.............................................. Allowed
    WMM UAPSD Compliant Client Support............... Disabled
    Media Stream Multicast-direct.................... Disabled
    CCX - AironetIe Support.......................... Enabled
    CCX - Gratuitous ProbeResponse (GPR)............. Disabled
    CCX - Diagnostics Channel Capability............. Disabled
    Dot11-Phone Mode (7920).......................... Disabled
    Wired Protocol................................... None
    Passive Client Feature........................... Disabled
    Peer-to-Peer Blocking Action..................... Drop
    Radio Policy..................................... All
    DTIM period for 802.11a radio.................... 1
    DTIM period for 802.11b radio.................... 1
    Radius Servers
       Authentication................................ 172.18.0.44 1812
       Accounting.................................... Global Servers
          Interim Update............................. 600 Seconds
       Dynamic Interface............................. Enabled
       Dynamic Interface Priority.................... wlan
    --More-- or (q)uit
    Local EAP Authentication......................... Disabled
    Security
       802.11 Authentication:........................ Open System
       FT Support.................................... Disabled
       Static WEP Keys............................... Disabled
       802.1X........................................ Disabled
       Wi-Fi Protected Access (WPA/WPA2)............. Enabled
          WPA (SSN IE)............................... Disabled
          WPA2 (RSN IE).............................. Enabled
             TKIP Cipher............................. Disabled
             AES Cipher.............................. Enabled
                                                                   Auth Key Management
             802.1x.................................. Enabled
             PSK..................................... Disabled
             CCKM.................................... Disabled
             FT-1X(802.11r).......................... Disabled
             FT-PSK(802.11r)......................... Disabled
             PMF-1X(802.11w)......................... Disabled
             PMF-PSK(802.11w)........................ Disabled
          FT Reassociation Timeout................... 20
          FT Over-The-DS mode........................ Enabled
          GTK Randomization.......................... Disabled
          SKC Cache Support.......................... Disabled
          CCKM TSF Tolerance......................... 1000
       WAPI.......................................... Disabled
       Wi-Fi Direct policy configured................ Disabled
       EAP-Passthrough............................... Disabled
       CKIP ......................................... Disabled
       Web Based Authentication...................... Disabled
       Web-Passthrough............................... Disabled
       Conditional Web Redirect...................... Disabled
       Splash-Page Web Redirect...................... Disabled
       Auto Anchor................................... Disabled
       FlexConnect Local Switching................... Disabled
       flexconnect Central Dhcp Flag................. Disabled
       flexconnect nat-pat Flag...................... Disabled
       flexconnect Dns Override Flag................. Disabled
       FlexConnect Vlan based Central Switching ..... Disabled
       FlexConnect Local Authentication.............. Disabled
       FlexConnect Learn IP Address.................. Enabled
       Client MFP.................................... Optional
       PMF........................................... Disabled
       PMF Association Comeback Time................. 1
       PMF SA Query RetryTimeout..................... 200
       Tkip MIC Countermeasure Hold-down Timer....... 60
    AVC Visibilty.................................... Disabled
    AVC Profile Name................................. None
    Flow Monitor Name................................ None
    Call Snooping.................................... Disabled
    Roamed Call Re-Anchor Policy..................... Disabled
    SIP CAC Fail Send-486-Busy Policy................ Enabled
    SIP CAC Fail Send Dis-Association Policy......... Disabled
    KTS based CAC Policy............................. Disabled
    Assisted Roaming Prediction Optimization......... Disabled
    802.11k Neighbor List............................ Disabled
    802.11k Neighbor List Dual Band.................. Disabled
    Band Select...................................... Disabled
    Load Balancing................................... Disabled
    Multicast Buffer................................. Disabled
    Mobility Anchor List
    WLAN ID     IP Address            Status
    802.11u........................................ Disabled
    MSAP Services.................................. Disabled
    Hope this helps and thanks again!
    /r
    B

  • ISE deployment in wireless infra without WLC (only Access Point 1240AG)

    Hello All,
    I am having access point 1240AG and planning to deploy ISE as a exteral radius server. I would like to know how deifferent authorization policy need to configure in AP/ISE. Whether I can use named ACL or VLANs (CoA) as a enforcement types without use of WLC. If yes then how?
    Thanks in advance.

    Hi,
    You can perform COA on standalone APs you will need to have an inline posture node in order to reap the benefits of COA, you may have heard this from any vpn related deployments. If you are in the design phase of this project, you may want to purse controllers because the latest rumor is that the inline posture node may be dropped since Cisco is planning on supporting coa on all their devices once the 9.x code drops for the ASAs. However please contact your Cisco rep for an official response.
    Here is the footnote in the following link: "Autonomous AP deployments (no WLC) also require deployment of an Inline Posture Node for posture support."
    http://www.cisco.com/en/US/docs/security/ise/1.1/compatibility/ise_sdt.html#wp55038
    Thanks,
    Tarik admani

  • Config RADIUS on WLC 5508 - Problems comunication with NPS Server

    Hi,
    I'm facing some problems when configuring RADIUS auth with a NPS Windows Server.
    My WLAN interface is in a different vlan than the management interface, is that a problem?
    I want this wlan to be on a different vlan from the management. When i use wlan interface in the same vlan the RADIUS works without problems. But in different vlans is not working.
    The NPS server as 2 NICs, 1 for the wireless vlan, and another for the management vlan.
    the logs from the WLC shows this, but i have difficulties interpreting all this data:
    *apfMsConnTask_0: Dec 29 12:49:14.636: Association request from the P2P Client Process P2P Ie and Upadte CB
    *apfMsConnTask_5: Dec 29 12:49:36.607: 3c:c2:43:94:3e:bc Adding mobile on LWAPP AP d4:d7:48:45:fb:20(0)
    *apfMsConnTask_5: Dec 29 12:49:36.607: 3c:c2:43:94:3e:bc Association received from mobile on AP d4:d7:48:45:fb:20
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc 0.0.0.0 START (0) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1709)
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc 0.0.0.0 START (0) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1876)
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc Applying site-specific Local Bridging override for station 3c:c2:43:94:3e:bc - vapId 9, site 'XXX', interface 'wlan'
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc Applying Local Bridging Interface Policy for station 3c:c2:43:94:3e:bc - vlan 900, interface id 16, interface 'wlan'
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc Applying site-specific override for station 3c:c2:43:94:3e:bc - vapId 9, site 'XXX', interface 'wlan'
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc 0.0.0.0 START (0) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1709)
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc 0.0.0.0 START (0) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1876)
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc processSsidIE  statusCode is 0 and status is 0
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc processSsidIE  ssid_done_flag is 0 finish_flag is 0
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc STA - rates (8): 130 132 139 12 18 150 24 36 0 0 0 0 0 0 0 0
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc suppRates  statusCode is 0 and gotSuppRatesElement is 1
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc STA - rates (12): 130 132 139 12 18 150 24 36 48 72 96 108 0 0 0 0
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc extSuppRates  statusCode is 0 and gotExtSuppRatesElement is 1
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc Processing RSN IE type 48, length 20 for mobile 3c:c2:43:94:3e:bc
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc Received RSN IE with 0 PMKIDs from mobile 3c:c2:43:94:3e:bc
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc Setting active key cache index 8 ---> 8
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc unsetting PmkIdValidatedByAp
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc 0.0.0.0 START (0) Initializing policy
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state AUTHCHECK (2)
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state 8021X_REQD (3)
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) DHCP required on AP d4:d7:48:45:fb:20 vapId 9 apVapId 8for this client
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc Not Using WMM Compliance code qosCap 00
    *apfMsConnTask_5: Dec 29 12:49:36.608: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) Plumbed mobile LWAPP rule on AP d4:d7:48:45:fb:20 vapId 9 apVapId 8 flex-acl-name:
    *apfMsConnTask_5: Dec 29 12:49:36.609: 3c:c2:43:94:3e:bc apfMsAssoStateInc
    *apfMsConnTask_5: Dec 29 12:49:36.609: 3c:c2:43:94:3e:bc apfPemAddUser2 (apf_policy.c:270) Changing state for mobile 3c:c2:43:94:3e:bc on AP d4:d7:48:45:fb:20 from Idle to Associated
    *apfMsConnTask_5: Dec 29 12:49:36.609: 3c:c2:43:94:3e:bc Stopping deletion of Mobile Station: (callerId: 48)
    *apfMsConnTask_5: Dec 29 12:49:36.609: 3c:c2:43:94:3e:bc Sending Assoc Response to station on BSSID d4:d7:48:45:fb:20 (status 0) ApVapId 8 Slot 0
    *apfMsConnTask_5: Dec 29 12:49:36.609: 3c:c2:43:94:3e:bc apfProcessAssocReq (apf_80211.c:6309) Changing state for mobile 3c:c2:43:94:3e:bc on AP d4:d7:48:45:fb:20 from Associated to Associated
    *dot1xMsgTask: Dec 29 12:49:36.611: 3c:c2:43:94:3e:bc Station 3c:c2:43:94:3e:bc setting dot1x reauth timeout = 0
    *dot1xMsgTask: Dec 29 12:49:36.611: 3c:c2:43:94:3e:bc Stopping reauth timeout for 3c:c2:43:94:3e:bc
    *dot1xMsgTask: Dec 29 12:49:36.611: 3c:c2:43:94:3e:bc dot1x - moving mobile 3c:c2:43:94:3e:bc into Connecting state
    *dot1xMsgTask: Dec 29 12:49:36.611: 3c:c2:43:94:3e:bc Sending EAP-Request/Identity to mobile 3c:c2:43:94:3e:bc (EAP Id 1)
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:36.684: 3c:c2:43:94:3e:bc Received EAPOL START from mobile 3c:c2:43:94:3e:bc
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:36.684: 3c:c2:43:94:3e:bc dot1x - moving mobile 3c:c2:43:94:3e:bc into Connecting state
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:36.684: 3c:c2:43:94:3e:bc Sending EAP-Request/Identity to mobile 3c:c2:43:94:3e:bc (EAP Id 2)
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:36.761: 3c:c2:43:94:3e:bc Received EAPOL EAPPKT from mobile 3c:c2:43:94:3e:bc
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:36.761: 3c:c2:43:94:3e:bc Received Identity Response (count=2) from mobile 3c:c2:43:94:3e:bc
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:36.761: 3c:c2:43:94:3e:bc EAP State update from Connecting to Authenticating for mobile 3c:c2:43:94:3e:bc
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:36.761: 3c:c2:43:94:3e:bc dot1x - moving mobile 3c:c2:43:94:3e:bc into Authenticating state
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:36.761: 3c:c2:43:94:3e:bc Entering Backend Auth Response state for mobile 3c:c2:43:94:3e:bc
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:54.794: 3c:c2:43:94:3e:bc Received EAPOL START from mobile 3c:c2:43:94:3e:bc
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:54.794: 3c:c2:43:94:3e:bc dot1x - moving mobile 3c:c2:43:94:3e:bc into Aborting state
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:54.795: 3c:c2:43:94:3e:bc dot1x - moving mobile 3c:c2:43:94:3e:bc into Connecting state
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:54.795: 3c:c2:43:94:3e:bc Sending EAP-Request/Identity to mobile 3c:c2:43:94:3e:bc (EAP Id 4)
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:54.795: 3c:c2:43:94:3e:bc Reached Max EAP-Identity Request retries (3) for STA 3c:c2:43:94:3e:bc
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:54.795: 3c:c2:43:94:3e:bc Sent Deauthenticate to mobile on BSSID d4:d7:48:45:fb:20 slot 0(caller 1x_auth_pae.c:3165)
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:54.795: 3c:c2:43:94:3e:bc Scheduling deletion of Mobile Station:  (callerId: 6) in 10 seconds
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:54.795: 3c:c2:43:94:3e:bc dot1x - moving mobile 3c:c2:43:94:3e:bc into Disconnected state
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:54.795: 3c:c2:43:94:3e:bc Not sending EAP-Failure for STA 3c:c2:43:94:3e:bc
    *apfMsConnTask_5: Dec 29 12:49:55.518: 3c:c2:43:94:3e:bc Association received from mobile on AP d4:d7:48:45:fb:20
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1709)
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1876)
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc Applying site-specific Local Bridging override for station 3c:c2:43:94:3e:bc - vapId 9, site 'XXX', interface 'wlan'
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc Applying Local Bridging Interface Policy for station 3c:c2:43:94:3e:bc - vlan 900, interface id 16, interface 'wlan'
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc Applying site-specific override for station 3c:c2:43:94:3e:bc - vapId 9, site 'XXX', interface 'wlan'
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1709)
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1876)
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc processSsidIE  statusCode is 0 and status is 0
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc processSsidIE  ssid_done_flag is 0 finish_flag is 0
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc STA - rates (8): 130 132 139 12 18 150 24 36 48 72 96 108 0 0 0 0
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc suppRates  statusCode is 0 and gotSuppRatesElement is 1
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc STA - rates (12): 130 132 139 12 18 150 24 36 48 72 96 108 0 0 0 0
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc extSuppRates  statusCode is 0 and gotExtSuppRatesElement is 1
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc Processing RSN IE type 48, length 20 for mobile 3c:c2:43:94:3e:bc
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc Received RSN IE with 0 PMKIDs from mobile 3c:c2:43:94:3e:bc
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc Setting active key cache index 8 ---> 8
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc unsetting PmkIdValidatedByAp
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) Initializing policy
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) Change state to AUTHCHECK (2) last state 8021X_REQD (3)
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state 8021X_REQD (3)
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) DHCP required on AP d4:d7:48:45:fb:20 vapId 9 apVapId 8for this client
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc Not Using WMM Compliance code qosCap 00
    *apfMsConnTask_5: Dec 29 12:49:55.519: 3c:c2:43:94:3e:bc 0.0.0.0 8021X_REQD (3) Plumbed mobile LWAPP rule on AP d4:d7:48:45:fb:20 vapId 9 apVapId 8 flex-acl-name:
    *apfMsConnTask_5: Dec 29 12:49:55.520: 3c:c2:43:94:3e:bc apfPemAddUser2 (apf_policy.c:270) Changing state for mobile 3c:c2:43:94:3e:bc on AP d4:d7:48:45:fb:20 from Associated to Associated
    *apfMsConnTask_5: Dec 29 12:49:55.520: 3c:c2:43:94:3e:bc Stopping deletion of Mobile Station: (callerId: 48)
    *apfMsConnTask_5: Dec 29 12:49:55.520: 3c:c2:43:94:3e:bc Sending Assoc Response to station on BSSID d4:d7:48:45:fb:20 (status 0) ApVapId 8 Slot 0
    *apfMsConnTask_5: Dec 29 12:49:55.520: 3c:c2:43:94:3e:bc apfProcessAssocReq (apf_80211.c:6309) Changing state for mobile 3c:c2:43:94:3e:bc on AP d4:d7:48:45:fb:20 from Associated to Associated
    *dot1xMsgTask: Dec 29 12:49:55.521: 3c:c2:43:94:3e:bc Station 3c:c2:43:94:3e:bc setting dot1x reauth timeout = 0
    *dot1xMsgTask: Dec 29 12:49:55.521: 3c:c2:43:94:3e:bc Stopping reauth timeout for 3c:c2:43:94:3e:bc
    *dot1xMsgTask: Dec 29 12:49:55.521: 3c:c2:43:94:3e:bc dot1x - moving mobile 3c:c2:43:94:3e:bc into Connecting state
    *dot1xMsgTask: Dec 29 12:49:55.521: 3c:c2:43:94:3e:bc Sending EAP-Request/Identity to mobile 3c:c2:43:94:3e:bc (EAP Id 1)
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:55.592: 3c:c2:43:94:3e:bc Received EAPOL START from mobile 3c:c2:43:94:3e:bc
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:55.592: 3c:c2:43:94:3e:bc dot1x - moving mobile 3c:c2:43:94:3e:bc into Connecting state
    *Dot1x_NW_MsgTask_4: Dec 29 12:49:55.592: 3c:c2:43:94:3e:bc Sending EAP-Request/Identity to mobile 3c:c2:43:94:3e:bc (EAP Id 2)

    yes, I thought of that. But if i use a simple password authentication on the wireless, i can reach the server with the same subnet interface. But i don't want to allow this subnet to acess the management subnet of the wireless controller.
    One question i have is: The WLC uses whitch subnet on radius? Uses the subnet of the wireless interface or uses always the management interface?
    Could you help me understand how the radius auth works with this wireless controller? Did you see anything strange in the logs that I posted above? It seems to run ok until:
    dot1x - moving mobile 3c:c2:43:94:3e:bc into Authenticating state
    Entering Backend Auth Response state for mobile 3c:c2:43:94:3e:bc
    Received EAPOL START from mobile 3c:c2:43:94:3e:bc
    dot1x - moving mobile 3c:c2:43:94:3e:bc into Aborting state
    I also note this: "Applying Local Bridging Interface Policy for station "
    What does this means?

  • Multiple AP1252AG without WLC

    Hi,
    Last year I remember reading that it is possible to configure multiple AP1252AG (running in autonomous mode) to work together so that devices seemlessly pass between each AP without disconnection. No seperate WLC required. Unfortunately I cannot find the information about how to do this. I have two of these Access points. Can someone point me to the information I need please?

    Hi,
    Its called Fast secure roaming!! here is the link to the same!!
    http://www.cisco.com/en/US/docs/wireless/access_point/12.4_21a_JA1/configuration/guide/scg12421aJA1-chap12-wdsroam-rm.html
    lemme know if this answered ur question and please dont forget to rate the usefull posts!!
    Regards
    Surendra

  • Bonjour, without WLC, pointers?

    If I can ask for some pointers or ideas on this:
    Currently have a mix of 3502e and 3602e APs.  They are configured in auton. mode, so no WLC.  The same config across them has a native vlan of 1, vlans 10, 20, and 60.  These all are running off a stack of 3750's, the master is doing ip-routing
    Vlans 10 and 20 use WP2 AES-CCMP for encryption, vlan 60 is open.  
    The issue I'm trying to troubleshoot is getting IOS devices to communicate wirelessly on the same vlan.  I have a presentation station using an Apple TV. This has been joined to the vlan 10 network via wireless, then wired, but other IOS devices even when connected to vlan 10 don't want to see each other.  I've gone around and around trying to look into this without success.  I vaguely remember when having a 3502i AP configured to a single vlan (non trunked on the switch) there wasn't a problem, but this was probably the occasional, oh cool, this works and never really relied on for daily functions.  
    My next troubleshooting technique is going to be putting that 3502i unit back online under the single vlan, join the appletv and an IOS device to it and slowly migrate it towards the current AP config and see where it breaks.
    I have searched extensively on configuring bonjour from a WLC standpoint, and mostly relating to getting it to talk across vlans.  But with everything connecting to the same vlan, I would think it would work as it did with APs just running on a single vlan assigned port.
    Aside from my theory for troubleshooting, if anybody could offer any pointers on what should or shouldn't be configured, whether on the port config or the AP, to get these devices to talk... that would be great!
    Thanks!

    Hello,
    WLC is mandatory for a mesh deployment. Please refer to the following link which clearly illustrates this:
    http://www.cisco.com/en/US/products/ps8368/products_configuration_example09186a0080bd2100.shtml

  • Anchoring multiple Guest SSIDs to the same WLC

    Hi All,
    I've currently got a typical 'anchored' Guest WLAN solution where several WLCs tunnel guest traffic back to an isolated WLC for WebAuth - this all works fine using a mix of 5508 / 4400, all on v7.0.98.0 code.
    The question is, can I add a second Guest SSID to the estate and anchor it back to the same Guest Anchor WLC that I'm already using?
    I can't find anything to say it won't work and have found this that says it should, but none of this is very concrete...  Does anybody know of any better references and/or have you done this in the wild?
    https://supportforums.cisco.com/message/1276785
    Cheers,
    Richard

    Hi,
    yes it's totally ok.
    On the foreign, just create a second WLAN and anchor it to the other WLC. On the anchor, create the same second WLAN that you anchor to itself ...
    Nothing speciali in order to configure it.
    Nicolas
    ===
    Don't forget to rate answers that you find useful

  • Using RADIUS without enabling AAA

    is there anyway I can use a RADIUS server without enabling/using AAA.
    is there any command "ip auth radius ... " ?
    cudnt find anything on cisco as such.

    Swapnendu
    Am I correct in assuming that you are talking about on IOS based routers or catOS switches? If so I believe that the only way to use Radius is to use AAA.
    HTH
    Rick

Maybe you are looking for