Understanding statistics from a Cisco WLC?

Hello,
From the "Monitor" page on our Cisco WLC.  If you go to "Access Points" from the left side then choose one of the Radios like 802.11b/g/n.  That will list all the APs connected with your controller.
1) First question, some of the APs listed show the "Interference Profile" as "Failed".  What does this mean?  It has connected clients and no one is reporting an issue.  So what does that really mean?
2) Second question, if you go to the "Details" for one of the APs I can see the "802.11 MAC Counters" showing things like Tx Fragments, Tx Failed Count, FCS Error Count, etc.  Below is what I see.
Can someone explain what these statistics are saying?  Again there are no issues reported by our users, but some of these values seem high and I don't understand what they are saying or if there is anything I should be considered with.
Any help on this would be great!
Thank you!
-rya

For your convenience:
The details of the " 802.11 MAC Counters " :
Counters
Tx Fragment Count
This counter is incremented for an acknowledged MPDU with an individual address in the address 1 field.
Tx Failed Count
This counter increments when an MSDU is successfully transmitted after one or more retransmissions.
Multiple Retry Count (Graphics view only)
This counter shall increment when an MSDU is successfully transmitted after more than one retransmission.
RTS Success Count
This counter increments when a CTS is received in response to an RTS.
ACK Failure Count
This counter increments when an ACK is not received when expected.
Multicast Rx Frame Count
This counter increments when a MSDU is received with the multicast bit set in the destination MAC address.
Tx Frame Count
This counter increments for each successfully transmitted MSDU.
Multicast Tx Frame Count
This  counter increments only when the multicast bit is set in the  destination MAC address of a successfully transmitted MSDU. When  operating as a STA in an ESS, where these frames are directed to the  access point, this implies having received an acknowledgment to all  associated MPDUs.
Retry Count
This counter increments when an MSDU is successfully transmitted after one or more retransmissions.
Frame Duplicate Count
This counter increments when a frame is received that the Sequence Control field indicates is a duplicate.
RTS Failure Count
This counter increments when a CTS is not received in response to an RTS.
Rx Fragment Count
This counter shall be incremented for each successfully received MPDU of type Data or Management.
FCS Error Count
This counter increments when an FCS error is detected in a received MPDU.
WEP Undecryptable Count
This  counter increments when a frame is received with the WEP subfield of  the Frame Control field set to one and the WEPOn value for the key  mapped to the TA's MAC address indicates that the frame should not have  been encrypted or that frame is discarded due to the receiving STA not  implementing the privacy option.
Band Select statistics
When  the feature is activated, the WLC doesn't immediately reply to probe  requests on 11b/g. If immediately a probe is also seen on 11a, then the  client is detected as dual band. Then WLC only replies on 11a. After  some time, this "categorization" expires and WLC will again try to see  if the client is present on both bands.

Similar Messages

  • Cisco APs get disconnected from cisco WLC after 30 min when connected on Juniper SRX

    Hi,
    I am connecting all my Cisco 1131AG APs via Juniper SRX 240 box and Cisco WLC is placed in the LAN.
    We are running LWAPP in layer 3 mode. The APs get dissassociated form the WLC after 30 min.
    The Setup is like :-
    AP->AccessSwitch-->JuniperSRX(reth2.0)-->JuniperSRX(reth1.0)-->CoreSwitch-->CiscoWLC
    could anyone please help me to resolve this issue.

    Firmware for WLC is AIR-WLC4400-K9-4-2-99-0
    Firmware for AP is 12.4(10b)JA1
    The logs form WLC during disconnection :-
    Mon Sep 6 20:05:52 2010 AP Disassociated. Base Radio MAC:00:1f:ca:2d:4e:a0
    1 Mon Sep 6 20:05:52 2010 AP's Interface:0(802.11b) Operation State Down: Base Radio MAC:00:1f:ca:2d:4e:a0 Cause=Heartbeat Timeout
    2 Mon Sep 6 20:05:51 2010 AP Disassociated. Base Radio MAC:00:1f:9e:c1:0d:30
    3 Mon Sep 6 20:05:51 2010 AP's Interface:0(802.11b) Operation State Down: Base Radio MAC:00:1f:9e:c1:0d:30 Cause=Heartbeat Timeout

  • Automatic MAC account creatation from Cisco WLC

    We are creating a BYOD network, have any of you tried this?
    1) First time user attempts to connect to byod_ssid they are presented with captive portal page that requests AD credentials.  In the back ground users MAC address needs to be captured.
    2) All subsequent connections to byod_ssid are MAC authenticated.
    I am not finding any documentation on this process from the Cisco side.  What do you think?  Is it possible?
    Thanks!

    you may do this via DRW on ISE
    configure ssid with mac filtering, then on ise confignauthz rule with redirect to drw... register your device... CoA sent by ise... connect again and should work
    sth similar to below , instead you are using mab
    http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_guest_pol.html#wp1220041
    Sent from Cisco Technical Support iPad App

  • Cisco WLC 2500 - 802.1x with Vasco Radius SMS OTP

    Hello folks,
    I have what seems to be a complex implementation with many things that need to be done on a customers network and I wanted to be pointed in the right direction.
    The current scenario is such, the customer has a Cisco WLC 2500 device that has 3 access points(these are in the same AP group) connected to it. There is one SSID that I will call PRODUCTION here that some domain users use to connect to the local network. The customer has requested to have a GUEST SSID added to the WLC where guest users will connect to and recieve a SMS OTP for authentication.
    Correct me if I am wrong, but I will obviously need to segment the SSIDs to have them running on different subnets to ensure that guest users do not have access to the production network once they authenticate. In order to do this I will need to configure Dynamic VLAN assignment for the Cisco WLC and connect it to a 802.1x port on the switch.
    Now what is not clear is I am not interested in authenticating the users that connect via "Production SSID" and want to bypass authentication for those users and have them assigned to the default vlan (or maybe perhaps have them authenticate via LDAP on the AD), however I want to force the "GUEST" SSID users to authenticate so that they may recieve an SMS OTP (reason for this is to force guests to register their phone numbers to use the internet so that Illegal activity may be tracked).
    1)So would it be possible to bypass authentication(or authenticate them via LDAP) for the PRODUCTION SSID as only domain users would know the SSID password to log on and have them by default assigned to the production subnet (default vlan) but force the GUEST SSID users to another VLAN via 802.1x sms otp?
    2)*Important* Another issue that is not clear is will I be able to directly configure AAA Radius settings on the Cisco WLC to directly authenticate with the VASCO Radius OTP and recieve a challenge-response(required for OTP) during authentication? As I have seen from Ciscos Dynamic VLAN assignment docuementation (http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml) additional IETF Radius Perimeters are used such as Tunnel-Private-Group-ID etc are used which I can't seem to configure on the Vasco.
    I do beileve this is a great project in helping me understand the INs and OUTs of CISCO WLC as well as Wireless NAC, If anyone could enlighten me and point me in the right direction I would be forever in debt. Much appreciated.
    Best Regards
    Sinan Barghouthi - JNCIA-FWV , JNCIA-IDP , CCA-NS , TCSM-8.0

    On your WLAN you can enable AES and TKIP. Just know that some clients mau have issue when they see both TKIP and AES. Ive had pretty good success with this in the past. Dont forget, you also need to enable WMM allowed to get N rates.
    But you will need to configure AES on the client as well to support N rates.
    "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
    ‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

  • Mobility between Cisco WLC and Meraki(other vendor)

    Is it possible that users can roam between Cisco WLC and other vendor wireless gear? Meraki keeps saying it is possible.
    They keep saying it is a IEEE feature and everone should support but I do not understand how?

    While theoretically possible with the adoption of capwap, it would require all the manufacturers to follow the specs exactly the same. Kind of like hearding cats, not impossible, but highly unlikely.. That's just my opinion
    Sent from Cisco Technical Support iPad App

  • Cisco WLC : AP automatic configuration for flexconnect parameters and ap group

    Hello !
    Is there a way to configure cisco WLC to automatically set flexconnect parameters such as Vlan support and Native Vlan ID when an access point join the controller ? 
    Same question to assign the access point to a specific AP Group ?
    PS: The access points are set with usine parameters and the WLC is in version 7.4
    Thank you for your answers !
    Stephane

    To my knowledge these features are not available in 7.4, but from what I understand 8.0 will have similar features. I can say that 7.6 has global commands, not sure if its part of 7.4.
    If it is you can navigate there Wireless>Access Points>Global Configuration you can do things like configure your primary and backup controllers, set login credentials, pre-download images to AP's.
    Please rate if you find the information helpful.
    HTH

  • Certificate based authentication with Cisco WLC and Juniper IC

    Hi
    I have a cisco WLC 4400 and Juniper IC which works as the external Radius server.
    I want the wireless clients to be authenticated using certificates. I know the Juniper IC can understand certificates.
    My question is can cisco WLC understand that the information being presented to it by the client is not username/pwd but a user certificate.
    i have also looked at this article :
    http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/100590-ldap-eapfast-config.html
    What i don't understand here is the need of WLC authenticating the user with his credentials by LDAP when it has authenticated the user cert.
    All your help is appreciated.

    Hi,
    Since you use an external radius server you don't have to worry for this.
    The only config that you need to do on WLC is to define the radius server under Security-AAA-Radius-Authentication and on your WLAN-Security-AAA.
    The doc you refer is only for Local Radius on WLC.
    Hope this helps
    Regards,
    Christos

  • Generate one time authentication for Guest on Cisco WLC

    Hi All
    Sorry for my question, because I just started to work with Cisco WLC.
    I have created some WLAN for local users with authentication by 802.1x + Radius by certificate.
    For Guest I used PSK with MAC-filtering.
    But I see that is not comfortable for Guests, each time they come and want to access our wireless, we have to come and get their MAC.
    I checked on Internet and find that the wireless solution for Hotel, Resorts are very easy.
    I also googled and see that Cisco WLC support Lobby Ambassador to generate Guest username/password. But as I checked, this username/password might only use with Web-Auth, this method is not comfortable for Guest who don't know they have to go to Web-Auth to do authentication (e.g: when they only get pop3 email, or vpn, ... not use browsers)
    Could I use this method (or another method) for creating one time Guest wireless username/password or Guest PSK that can be used for authentication when Guests click to Wireless-SSID name only (no need to open web browser to do Web-Auth).
    Regards
    Hai

    Hi Choudhary
    Thank you much for your information
    Could I reconfirm about my concern.
    With Cisco WLC, I can use WebAuth with Guest user only
    If I want to use Guest user for authentication when guests connect to SSID (not by WebAuth, I means use Layer 2 security only, not Layer 3), I will have to use additional Radius Server.
    And if I understand right, could you please recommend me software based Radius Server with support generate one time username/password for Guest, because I checked IAS/NPS on windows server may not have this function (ISE is not appropriate for us at this time, due to high expense)
    Regards
    Hai

  • Called-Station-ID attribute and Cisco WLC code 7.4

    Hello
    I have 2 WLCs configured with 2 SSIDs (one is [WPA2][Auth(802.1X)] and the other is Web-Auth). One of the WLCs is remote and its WLANs are configured with mobility anchors pointing to the other WLC. Both WLCs are configured with Called-Station-ID set to AP Mac Address:SSID. I use this attribute on ACS to authenticate/authorize users based on what SSID they connect to.
    This worked fine on WLC code 7.0 but on upgrading to 7.4 I started having some issues:
    clients on the remote WLC can still authenticate on the [WPA2][Auth(802.1X)] SSID as the Called-Station-ID attribute is still AP Mac Address:SSID
    clients on the remote WLC cannot authenticate on the Web-Auth SSID as the Called-Station-ID attribute now appears to be the Mac Address of the WLC anchor controller
    WLC models are 5508 and current code is 7.4.110.0 (APs are AIR-LAP1142N-E-K9). Can anyone tell me why I'm seeing this behaviour on the Web-Auth SSID on the remote WLC?
    Thanks
    Andy

    Since you have two AAA devices that's sending info, you can have your policy for the guest specifying the guest WLC. The SSID policy for the foreign WLC is only really needed if you have multiple 802.1x authentication from the foreign WLC and that's when you can use the regex to defiance the SSID per AD Group.
    Look at a successful authentication from one of the guest users. Look at the detailed log and then in that log, you will see all the attributes being sent that the radius can send back to the WLC. You can use any of those attributes in your policies.
    Called-Station-ID might not be sent like what your use to, because the foreign WLC has the access point the guest user associates to and tunnels it back to the anchor WLC. So this attribute might not be available. Things do change with code versions so you might just have to adjust your policies. I haven't played around with 7.0.x code with guest anchor and radius in a while, but I have in the past upgraded radius or the WLC and had to tweak my radius policies.
    Sent from Cisco Technical Support iPhone App

  • Cisco WLC 5508 - NPS Radius

    Cisco WLC 5508
    Software Version: 7.4.100.0
    Windows Server 2008R2
    I've got everything setup on the Windows Server 2008 side of things (certificates, radius clients, etc)
    I added the radius server on the WLC, and configured a new WLAN to use it.
    Both are on the same subnet.
    When trying to conect to the WLAN it kept failing.  I installed wireshark on the server to monitor the radius traffic, and to my surprise there was no radius traffic showing up on the server.  The radius statistics on the WLC are at 0 as well, so it's like the WLC isn't even attempting Radius.
    I reverified that the server was enabled on both the security tab and the WLAN itself on the WLC.  Rebooted the controller and the server, all to no avail.  I used a radius test client, and can successfully send radius commands to the server using that utility.
    Frustrated, I just kept trying to reconnect on my wireless device, and after about the 15th try, finally I saw radius activity on wireshark.  It rejected my access, but at least I saw activity.  It also registerd radius statistcs on the WLC as well.
    So now if I keep trying to connect repeatedly, about every dozen or so times the WLC actually will send a radius request to the server.
    What in the world is going on here?

    I do have local management users on the controller.
    Some hours later I added the option of authenticating management users, for the NPS server. Then logged inn to the management GUI using NPS radius, worked just fine.
    However, these commands have been useful to me several times, to make sure unsuccessful requests appear in the Windows Event log:
    auditpol /get /subcategory:"Network Policy Server"
    If it shows ‘No auditing’ or just "Success", you can run this command to enable it:
    auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
    So now I know that the NPS radius server works, for management access. I will go to the customer's site some other day to test it for 802.1x authentication. If not, I'll do some debugging to decide wihich to blame - the WLC or NPS.

  • Cisco WLC 5508 not sending SNMP Traps

    Hello Everyone.
    I'm having a weird error on our WLC environment. We have an HA with two cisco WLC 5508 and i cannot get SNMP Traps working on a Windows PC running Kiwi Syslog server (free ed.).
    I can receive correctly Syslog messages, but not traps.
    I Tried also to send SNMP Traps from WLC to a different PC using Linux with snmptrapd and it works fine.
    I tried then to send from my Linux box a snmp trap to my Windows PC, and it works fine, but i still cannot receive anything from WLC.
    Using Wireshark to detect traffic, i cannot see any packet on udp port 162.
    I cannot figure out any problem with my scenario, but i can see the following errors on syslog:
    *rmgrTrasport: Mar 30 16:08:22.602: #RMGR-3-INVALID_PING_RESPONSE: rmgr_utils.c:270 Ping response from <my_windows_PC> is invalid. Ip address do not match.
    My WLC Version is 7.6.130.0
    Thank you for your support.

    I have gone through your query and found the following fruitful links ,please let me know if it helps and mark it correct answer if it is.
    https://www.manageengine.com/network-monitoring/help/userguide/processing_traps.html
    https://rscciew.wordpress.com/2014/10/12/snmp-configuration-on-wlc/
    Thanks :)

  • Cisco WLC 5508 with 3702APs - mobile hotspot for 2000 Guest users

    Cisco WLC 5508 with 3702APs - mobile hotspot for 2000 Guest users
    I've been given a fantastic "opportunity" by my boss to use our existing wireless infrastructure to provide internet access to potentially upto 2000 VIP guests arriving with BYOD devices, in a very densely populated area for a 3 day event. We are talking an area of approx 200m x 15m. Think of it as an awards ceremony/concert. The solution will also be mobile so we will be using internet breakout from different telcos as it will move to approx 20 countries. The area is also incredibly densely populated with other wifi APs. I did a brief site survey and AirMagnet could detect over 2500 other 'rogue' APs from where I was stood! I hope CleanAir works!
    We need a simple authentication method for them to connect with zero admin from our side. We don't want to just offer up a rolling daily PSK as that's a bit amateur and we don't really want the VIP guests sharing the PSK with others during their stay. Ideally they could self-provision by providing an email address.
    I know the WLC can handle webauth for local users but I don't think it scales very well. ie I don't think I can offer the account to several hundred people.
    Cisco ISE looks a very expansive (and expensive) product but I don't think we need all it's capabilities (do I?). It would be nice to just ask a potential user for their email address and grant them access and email them next year. I've seen Cisco NAC but that looks over the top too for just guest users who will only be accessing a shared internet connection.
    I've seen 3rd party supposed software solutions from Kiosk Antamedia etc do they work with Cisco Enterprise WLC solutions?
    We'd like to limit users to a certain (low) bandwidth and block (say) torrent traffic to keep the general user experience worthwhile.
    Does anybody have any case study documents or experience of such a project? As well as the authentication it's how well the APs will handle the dense potential number of clients trying to connect in such a confined space. 
    Any suggestions would be gratefully appreciated from the knowledgeable community.
    Cheers,
    Mike

    Hi Rasika,
    We are having WLC 5508 model with software version running 7.4.121.0. AP Models are AIR-CAP2602I.
    Normally our WAN links are good even while the issue pertains. We are connected to remote offices over ipsec site to site vpn for WAN. The link latency in WLC between the AP and the controller shows  <1ms.
    currently the Guest network is using WPA2-PSK auth given in the controller. we are trying to find a option to make the Guest wireless auth local to the office, and see if this solves the problem. 
    any suggestions,
    Thank you,
    Arjun

  • Backing up config on Cisco WLC 2504

    I need to upgrade the software on my controller but first need to take a backup of the config.
    I log into the GUI of the controller and then go to Commands / Upload File, I then select my options:
    File Type: Configuration
    Transfer Mode: TFTP
    IP: 10.x.x.x
    File Path: C:\Cisco\WLC
    File Name: ciscowlc.cfg
    Click Upload
    After about a minute it receive the following error:
    % Error: Config file transfer failed - Error from server: The specified operation is not supported.
    I can't seem to find any information on this error.
    Any help would be greatly appreciated.
    Thanks,
    James

    What TFTP server are you using... I use 3CDeamon and I also select the folder from the TFTP server so my path would just be ./
    Make sure that the firewall on the tftp server is disabled and also make sure your doing the tftp to a wired machine and not a wireless machine.  TFTP and FTP is not allowed when your associated to an AP that is joined to that WLC.
    Thanks,
    Scott
    Help out other by using the rating system and marking answered questions as "Answered"

  • Bonjour Discovery browser and cisco WLC mDNS

    Hello
    I'm using a Bonjour Discovery browser on an iPad to see if I can check what Bonjour services are available on a cisco 2504 running code 7.5.102.0. WLC is configured as per cisco documentation for mdns:
    Multicast disabled on WLC
    wired vlan (with bonjour services) is trunked to WLC
    mdns profile configured and bonjour services are visible on WLC
    mdns profile applied to WLAN
    when i connect an ipad to the wlan and start the browser, no services appear (2 are visible on the WLC). Debug on the WLC shows the following (where XX:XX:XX:XX:XX:XX is the iPad mac)
    *Bonjour_Msg_Task: Nov 04 10:51:06.674: XX:XX:XX:XX:XX:XX Failed to updated data to Service Provider DB
    *Bonjour_Msg_Task: Nov 04 10:51:12.798: processBonjourPacket : 935 Queried service-string : _dns-sd._udp.local. is not configured in MSAL-DB
    Is it possible to get Bonjour Discovery browser working with cisco WLC?
    thanks
    andy

    I have used Avahi when I have had deployments that were FlexConnect and the site had multiple subnets for Apple TV's and or the devices that would be using the Apple TV, printers, etc.  Avahi is free and my customers would spin this up on an available PC or laptop and connect it to the network.
    mDNS AP
    1. This feature enhancement allow controllers to have the visibility of wired service providers which are on VLANs that are not visible to the controller.
    2. User configuration is required to configure APs as mDNS AP. This configuration allows AP to forward mDNS packets to WLC.
    3. VLAN's visibility at WLC is achieved by APs forwarding the mDNS advertisements to controllers. The mDNS packet between AP and controller are forwarded in CAPWAP data tunnel similar to mDNS packets from wireless client.
    4. APs can either be in access or trunk mode to learn the mDNS packets from wired side and forward it to the controller.
    5. This  configuration also allows the user to specify the VLANs from which the  AP should snoop the mDNS advertisements from wired side. The maximum  number of VLANs that AP can snoop is 10.
    6. If the AP is in access mode, the user should NOT configure any VLANs for AP to snoop.
    AP will send untagged packets when a query  is to be sent. When an mDNS advertisement is received by mDNS AP, VLAN  information is not passed to the controller. Hence the service provider's VLAN, learnt via mDNS AP's access VLAN will be maintained as 0 in the controller.
    7. If  the AP is in trunk mode, then the user has to configure the VLAN on the  controller on which AP would snoop & forward the mDNS packets. The  native VLAN snooping is enabled by default when mDNS AP is enabled. AP will send VLAN information as 0 for packets snooped on native VLAN.
    8. This feature is supported on local and monitor mode AP, and not on Flexconnect mode APs.
    9. If a mDNS AP joins/resets (or) joins the same/another controller, the behavior is as follows:
    a. If global snooping is disabled on the controller, then a payload will be sent to AP to disable mDNS snooping.
    b. If global snooping is enabled on the controller, then configuration of the AP previous to reset/join procedure will be retained.
    Thanks,
    Scott
    *****Help out other by using the rating system and marking answered questions as "Answered"*****

  • Need Information of cisco WLC 5508 LAG Interface

    HI
    We have cisco WLC 5508 in our network and right now ,this WLC is connected to two ports of each core switches.Both CORP and GUEST SSID are configured on this WLC.
    Now we want to segregate the trafffic og GUEST to on core switches from WLC. SO my question is ,how can we achieve this without using guest anchor controller ?
    Can i use one interfcae cisco WLC 5508 and connect it to the firewall or any device ?
    Thanks
    Puneet

    Hi
    Thanks ...I am using WLC as a DHCP server for Guest.
    So  i want to know ,is there any requirement that GUEST subnet should be pingable from WLC management IP address.
    my topology is here...
    Corp network and management network are reachable however management metwork is not pinagble from guest netowrk.

Maybe you are looking for