Wireless Client associated to 2 APs

I searched for my mac address in WCS and I recieved three results. See the attached screenshot. I am just curious why the second entry show I am associated to AP 00:00:00:00:00:00?
I do not have an AP named that.
Running 4.2.130 on all my WLC. Have a mis of WiSM and 4400 Controllers totaling about 10 WLCs.

As Jeff mentioned, this is due to your client roaming and most likely due to wlc roaming. The information you see is not real time accurate, especially the wlc information of clients. You can see that 10.92.0.111 shows the client as still being authenticated which is not the case. So most likely what happens is the wlc is cached until flushed or cleared, but ap's keep the real time information, so the all zero's just mean that the wlc knows of the client but not yet flushed the old info and when it tries to detect which ap that user is on, there isn't one.... so it produces the all zero's.

Similar Messages

  • Understanding of wireless client connection to multiple APs

    Hello,
    I would like to know how do wireless clients connect to APs
    For e.g. if in a single floor square office space - wireless network with multiple APs exists on the same SSID, how do clients decide which AP to connect to. For e.g. the client may get similar strength signals from two APs close to each other (such as Excellent). Which AP does client connect to.
    Secondly, how does the load distribution take place. For e.g. if on one AP, 10 clients connect and on the other AP, 20 clients connect, how can equal load distribution be acheived, that is 15 on each AP without the tiring MAC filtering configurations.
    Thirdly, is there something like number of user/connection restrictions on APs. I have gone through some AP manuals and did not find any such specifications like max. # of users = 20 etc. Currently we are using D-Link AP and have noticed that once the # of connections go upto 20, performance reduces heavily such as the latency on gateway pings go upto 1000-2000ms.
    Fourthly, how can I identify from the client to which AP it is connected.
    Thanks.

    I would like to know how do wireless clients connect to APs
    For  e.g. if in a single floor square office space - wireless network with  multiple APs exists on the same SSID, how do clients decide which AP to  connect to. For e.g. the client may get similar strength signals from  two APs close to each other (such as Excellent). Which AP does client  connect to.
    ANS - Its first come first serve... however.. sometimes if we have multiple SSIDs one with open auth and no encryption and other fuly protected.. then the client wil connect to the open rather the secured on.
    Secondly, how does  the load distribution take place. For e.g. if on one AP, 10 clients  connect and on the other AP, 20 clients connect, how can equal load  distribution be acheived, that is 15 on each AP without the tiring MAC  filtering configurations.
    ANS - MAC is a good option but apart from that.. i have seen somewhere but not able to remember the command which will limit the number of clients per radio..
    Thirdly, is there  something like number of user/connection restrictions on APs. I have  gone through some AP manuals and did not find any such specifications  like max. # of users = 20 etc. Currently we are using D-Link AP and have  noticed that once the # of connections go upto 20, performance reduces  heavily such as the latency on gateway pings go upto 1000-2000ms.
    ANS - AP can take upto 2048 MAC addresses.. its recommended not to have more than 24 clients per AP..
    Fourthly, hw can I identify from the client to which AP it is connected.
    ANS -If the clients are CCX compatible and aironet extentions enabled on the AP. then the command "show dot11 ass" will tell the clients connecting to which AP.. the AP name will get displsayed in the output..
    Regards
    Surendra

  • Wireless client association hostname

    Hi all, 
    I'm having issue with the above unit. Currently I have 3 units of AIR-SAP2602E-S-K9 with 15.2(2)JB under 1 SSID. Currently all my clients connected to the AP does not have their computer hostname appearing under the client association. What it is showing instead is the hostname of the AP. For eg;
    Device Type
    Name
    IP Address
    MAC Address
    State
    Parent
    VLAN
    ccx-client
    AP-HOSTNAME
    XXX.XXX.XXX.XXX
    Xxx.xXx.Xxx
    EAP-Associated
    self
    1
    Any Idea how I can get the hostname of the clients instead?

    If both the SSID and your client were configured for open, and you still couldn't associate, something doesn't jive. There are a couple of things that can cause an issue like this.
    1) Is the MFP Client Protection "Required" under the advanced tab?
    2) Is the WMM Policy "Required" under the QoS tab?
    3) Is the "Aironet IE" enabled under the advanced tab of the SSID? That can cause problems for some clients.
    Any of those (especially the first two) would cause a similar issue with not being able to associate, as having mismatched encryption types.

  • Continuous Wireless Client Associations and De-authentications

    I have a remote site whose wlan consist of a 2112-WLC and twelve 1142N's.  The issue I am seeing is that several clients will associate continuously   throughout the day.  This does not occur for any specific client or ap.  These multiple associations appear to take place every 5-10 minutes most of the time.  I have 4 other sites using the same wireless network equipment and I do not see this problem.  I have verified the ap signal strengths and verified that the noise and interference levels are ok.  Any assistance provided will be very appreciated.

    Is enable session time out enabled
    WLANS-->ADVANCED-->Look at enable session time out ... what does it say ?

  • Dot11 associations table, client associated with 0.0.0.0

    I'm having an issue where wireless client association seam to fail to get IP address, but acctually don't...
    MAC Address    IP address      Device        Name            Parent         State    
    0016.eaae.c896 0.0.0.0         unknown       -               self           EAP-Assoc
    001f.e178.c6d8 192.168.27.192  unknown       -               self           EAP-Assoc
    This happens only "sometimes", especially when the clients (laptops) wake up from sleep mode.
    Although the association shows IP 0.0.0.0, the state is "EAP-Assoc" and I can confirm that the client passed RADIUS authentication, received IP from DHCP and can ping the gateway.
    The wireless network is made up by autonomous/standalone access-points (Cisco aironet 1100, 1130, 1200, 1040).
    Network access is PEAP, WPA/AES, dot1x, multiple Vlans...
    All access-points have an access-list at the radio IN that is dropping all IP broadcasts.
    When I remove the ACL, everything appear to be fine (at least all the times that I checked), but when the ACL is active the issue doesn't always come up.
    I must understand what is going on because this ACL (although it's not very common) has proven it's value by saving 30-40% CPU usage on access-points...
    Does anyone know how the "dot11 associations" table is built??
    Maybe some tips on how to troubleshoot the issue.
    thanks in advance

    As an answer to your early quetsions (that I don't know why we did not answer it yet):
    Assoc table is mainly built from information in association frames.
    Assoc frames have no idea about IP addresses so how the APs know the IP? Not from assoc frames of course.
    Each vendor may have different way to know the IP (they can look into the header of the IP traffic of that special client or they an look into dhcp communication).
    summarizing the issue so far:
    - The issue happens ONLY with the ACL in place.
    - It does not happen with all clients.
    - It happens ONLY when the clients in power save mode.
    - It happens with same clients if they use static ip address even if they are not in power save mode (please confirm or amend this sentence to be more accurate).
    Why power save mode do not show the IP? - > answering this quetion almost solves the problem.
    what is common among the problematic clients? - > need to know this in order to isolate further.
    Is it AP hardware/software related? -> helps to isolate further.
    I said that it could possibly be related to information elements but not necessarily.
    There are information element that transfer Power Save capability between clietns and the AP. I have no idea though how those can be related.
    More information about information elements can be found in the IEEE standard downloadable from here:
    http://standards.ieee.org/getieee802/download/802.11-2007.pdf
    go to section :
    7.3.2 Information elements
    in page 99.
    I tried to read about power save and tried to link that with our issue with no hope.
    It could possibly a bug or so that when PS is used the AP behaves differently.
    HTH
    Amjad

  • Wireless client disconnecting

    Hi All,
    We have a WLAN setup with 1 AP 1230 assigned as a WDS, and the 16 APs configured as Infrastructure AP. Off late, I am experiencing a problem where all my clients are getting disconnected frequently. I have checked the logs and the logs indicate the follwoing:
    %DOT11-4-TKIP_MIC_FAILURE: TKIP Michael MIC failure was detected on a packet (TSC=0x19B42) received from 0013.ced4.bd48.
    Oct 24 12:45:42 172.20.166.22 5673: Oct 24 07:15:42.428: %DOT11-3-TKIP_MIC_FAILURE_REPEATED: Two TKIP Michael MIC failures were detected within 48 seconds on Dot11Radio0 interface. The interface will be put on MIC failure hold state for next 60 seconds.
    Oct 24 12:45:42 172.20.166.22 5674: Oct 24 07:15:42.429: %DOT11-4-TKIP_MIC_FAILURE: TKIP Michael MIC failure was detected on a packet (TSC=0x19B43) received from 0013.ced4.bd48.
    Oct 24 12:45:42 172.20.166.22 5675: Oct 24 07:15:42.430: %DOT11-4-TKIP_MIC_FAILURE: TKIP Michael MIC failure was detected on a packet (TSC=0x19B44) received from 0013.ced4.bd48.
    Oct 24 12:45:42 172.20.166.22 5676: Oct 24 07:15:42.430: Too many MIC failures.
    I need a solution to overcome this problems. Please let me know if you need any further information, to help me provide a solution.
    regds,
    Mahesh

    Good afternoon Mahesh...
    Similar to a CRC, TKIP uses Message Integrity Check(MIC) to ensure protection of the payload and headers. Presently the Michael algorithm is used to accomplish this function. Essentially these messages are early warning signs of RF interference, hardware failure and or an active attack.
    The initial error message of TKIP_MIC_FAILURE is rather harmless, as there is no effect to surrounding clients. It simply states that the AP has received a packet which failed its integrity check. MIC replaced WEP's CRC-32 checksum for improved security. You will NOT see this issue in LEAP as it does not utilize MIC.
    TKIP_MIC_FAILURE_REPEATED, however is another story. If you see this log entry on an access point, you will want to respond quickly. This is stating that a workstation has sent X number of MIC failures in a certain number of seconds. As stated by the 802.11i standard, the access point goes into a blackout period. ( Cisco's default is 60 second blackout period), what this does is disassociates all wireless clients associated with the access point and puts the radio in a type of hold where it does not allow any associations until the blackout is lifted.
    The offending client and those associated with the access point do not receive any sort of error. All the user will notice, is that their laptop's wireless has been disconnected. If the user's laptop is able to access another AP it will attempt to connect to it, if behaving and configure correctly. What we have seen in at our facility is the offending client will continue to cause TKIP errors and bring down the AP it just connected to.
    Is there a Band-Aid to this problem?
    Interface dot11radio x
    countermeasure tkip hold-time 0
    This is NOT a solution, its simply a fix to keep your APs from going into blackout. Again I would only use this if you had a larger volume of laptops with malfunctioning nics than your local techsupport could handle.
    There are two typical causes for these errors, hardware problems and RF issues. RF changes even at 5ft, if you are able to go to multiple areas of your facility (saying you have a large facility) and take still shoot out errors, you likly have a hardware issue. Replace the card and your good to go.
    While upgrading to the latest IOS is always the best messure even when not facing problems you will likly not see a decrease/increase.
    hope this helps.... Simply put , research if its a single laptop... If it is, attempt to replace the nic.. We had one laptop which even after reloading the IOS, swapping the cards, etc it kept commiting the units. We kept the harddrive and sent the laptop off and was RMA'd. New laptop came in, put the old hdd back in, no problems.
    We have not noticed a link between driver version nor firmware...

  • Client Association,Authentication

    Hey All,
    In regards to the Assoiciation and Authentication I would just like to check that I am getting the process correct:
    1. Authentication( open or shared) this is the client talking to the AP and saying that it is an 802.11 device ( kind of like an ethernet cable being pluged into a wall jack), if it has a PSK then it must have the right details to Auth with the AP. This is Auth'd to the AP but not the network, so no network traffic can pass just yet.
    2. Association the client associates with the BSS/AP and data can now pass over to the AP.
    3. 802.1x Authentication ( EAP) - if required
      In the above Image the Associated status means it passed step 2 and the Auth means in passed 802.1x? 
    If this is the case in the above Image the Authed clients ( blue line) are the clients that have passed 802.1x? and the red line is clients that have passed stage 2?
    Thanks

    Hello,
    In the client association process,  access points send out beacons announcing one or more SSIDs, data rates,  and other information. The client sends  out a probe and scans all the channels and listens for beacons and  responses to the probes from the access points. The client associates to the access point that has  the strongest signal. If the signal becomes low, the client repeats the scan to associate with  another access point (this process is called roaming). During  association, the SSID, MAC address, and security settings are sent from  the client to the access point and  checked by the access point. Figure  3-6 illustrates the client  association process.
    Figure 3-6 Client  Association
    A wireless clients association to a selected access point  is actually the second step in a two-step process. First, authentication  and then association must occur before an 802.11 client can pass traffic through the access  point to another host on the network. Client  authentication in this initial process is not the same as network  authentication (entering username and password to get access to the  network). Client authentication is simply  the first step (followed by association) between the wireless client and access point, and it establishes  communication. The 802.11 standard specifies only two different methods  of authentication: open authentication and shared key authentication.  Open authentication is simply the exchange of four "hello" type packets  with no client or access point  verification, to allow ease of connectivity. Shared key authentication  uses a statically defined WEP key, known between the client and access point, for verification. This  same key might or might not be used to encrypt the actual data passing  between a wireless client and an access  point based on user configuration.
    http://www.ciscopress.com/articles/article.asp?p=1156068&seqNum=3

  • 2504 controller + 2602 APs = wireless clients connectivity problems

    Hello, everybody!
    I have a connectivity problems of wireless clients. The symptoms are:
    1) Some clients receive 169.254.x.x., instead a correct DHCP addresses, less in a minute connection drops, and in controller's "Monitor" > "Clients" tab these clients are marked as "Excluded".
    2) Most of the clients receive the correct addresses from DHCP (192.168.2.x), but also loose connection soon.
    3) Wireless clients with correct addresses can't ping each other, gateway and an address of the controller's dynamic interface (all of them are in same subnet).
    4) And the most suspicious problem is that some machines are unable to connect to APs after several attemps to do that. I mean, I configure controller and change some options, trying to understand, whether they were applied or not and constantly connect and disconnet certain PC to the SSID. After five or ten attempts I can't connect to the SSID. During these attempts, the others PCs stay connected, without interruptions, and they could be reconnected again. It's like some kind of port security works, but I'm not sure...
    Do you have any ideas which options should I configure?
    My configuration:
    I have three interfaces on the controller: virtual, management (default) and dynamic (it is set to the WLAN)
    I have one SSID, WPA/WPA2, AES/TKIP, authentication PSK.
    My clients are a/b/g/n, all are permitted on the controller. No custom security policies were applied.
    All the devices are in a single room: controller, one AP and different clients: desktop, notebooks, iPad, Nokia Lumia, etc.
    I have an internal DHCP Server on the controller and it works perfectly well.
    I can provide all the screenshots required from web-interface of the controller...
    Many thanks in advance for all ideas that you have about these problems...

    Hi, there!
    The problem was solved.
    1) APIPA address receives only single machine with Win8 - I think there are some firewall issues
    2) Other devices have been loosing connection because they were mobile devices, like iPad and Lumia. If you keep working with it, it doesn't drop the connection
    3) The dynamic interface address and gateway address were inaccessible because i had not used an appropriate port on the controller. =)))) Firstly, it was just a guess, but it proved.
    Now, everything works with WPA2, AES, PSK...
    It is a very good day!)
    The only question remains: why I can't connect machines, which have a static IP? During the controller initialization, I said "yes" for permitting static IPs...
    Guys, many thanks for your help!

  • Wireless clients load balancing on the APs on WLC 4404

    Hi Experts,
    I'm just wondering if the WLC 4404 with firmware 4.2.207.0 can load balance the wireless clients on different WAPs. Let's say that an AP is already handling 15 Wireless devices. When the 16th is trying to join, the controller somehow puts it on another nearby AP, even the signal from this AP is weaker. I heard the similar feature on other Wireless solution vendors. I'm just wondering if Cisco has the similar feature or not.
    Thanks!

    Yes it is known as aggressive load balancing sending a code 17 making the wireless client to loook at another nearby AP.
    here it is the documentation:
    http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a00809c2fc3.shtml

  • Flexconnect AP(Local Switching) Wireless clients are not able communicate eachother

    Hi,
      Scenario :  We are deployed the WLC in Corparate Office and Access Points are placed in Branch Office with FlexConnect Local Switching mode.
    In this case, I am not able to Ping the Wireless clients eachother . Peer to Peer Block Option also Disabled.
    Some time Wireless clients Ping eachother & some times not. Both Wireless clients  are associated with Same AP & Same WLAN SSID.
    Please help me urgent ..
    Devices :
    1)WLC 2500 series , Software 7.2
    2)Cisco 1400 series APs
    3)CISCO ACS server for AAA authentication
    Regards,
    Shanmugam Nachimuthu

    Hi Shanmugam,
    Please apply following steps to configure P2P setting for WLAN:
    Step 1 Choose WLANs to open the WLANs page.
    Step 2 Click the ID number of the WLAN for which you want to configure peer-to-peer blocking.
    Step 3 Choose the Advanced tab to open the WLANs > Edit (Advanced) page.
    Step 4 Choose one of the following options from the P2P Blocking drop-down list:
    • Disabled — Disables peer-to-peer blocking and bridges traffic locally within the controller whenever possible. This is the default value.
    NOTE: Traffic is never bridged across VLANs in the controller.
    • Drop—Causes the controller to discard the packets.
    • Forward - Upstream — causes the packets to be forwarded on the upstream VLAN. The device above the controller decides what action to take regarding the packets.
    NOTE: To enable peer-to-peer blocking on a WLAN configured for FlexConnect local switching, select Drop from the P2P Blocking drop-down list and select the FlexConnect Local Switching check box.
    Step 5 Click Apply to commit your changes.
    Step 6 Click Save Configuration to save your changes.
    Thanks,
    Prashant Gondaliya

  • 6 AP1260's but 1 has 10x client associations.

    Hi Experts,We have 6 autonomous AP1260's in access point mode in our office.  Its a pretty flat office layout and the ap's are equidistant from each other but for some reason 1 gets ~ 60 clients , the remaining gets around 5 -10 each.  All are configured identically.   Would reducing the power on the one with the most associations help - what power setting should I change it to ?
    Any suggestions on making the client associations more evenly spread out.

    I would have you look at Rob's suggestion in this thread.
    https://supportforums.cisco.com/thread/329179
    Unfortunately, load-balancing is not something the IOS AP's can accomplish.  Without that capability it is completely a "client" decisions where they decide to go.  Eduardo's suggestion of a survey is applicable as you may have the APs placed in such a fashion that your highest density of user's are close to "one" particular AP.  You could tweak power levels using any of the supported power levels listed here on the 1260 data sheet; but that still may not be the best option. http://www.cisco.com/en/US/prod/collateral/wireless/ps5678/ps10980/data_sheet_c78-593663.html
    Using Rob's suggestion of setting a max-assocation count for your SSID would definitely be an easier route, but you will need to be certain on your counts and coverage so you don't end up with your APs maxed, and no additional clients getting logged on.

  • -1 (Minus One) Wireless Client Rate for networked PCs with Ariport Express

    Trying to figure out connection problems...
    Under Airport Utility > Advanced > Logs and Statistics > Wireless Clients...
    My MBP gets a Rate 54Mbps when I am beside it in my room, but sometimes drops down to 11 or so and then goes back up. I think this is why I am losing my AirTunes connection.
    Both PCs on the network are farther away but are showing a Rate of -1Mbps, even when they are brought into the same room as the APX.
    Any thoughts.

    1. How does the client device know which Airport to connect to?
    The Mac computer will automatically connect to the wireless access point with the strongest signal...which is probably the closest AirPort. An iPhone or iPad may not do this and will tend to stay connected to one AirPort.
    2. How can I tell which of the Airports the attached client device is using?
    On a Mac, open Macintosh HD > Applications > Utilities > AirPort Utility. Click on one of AirPorts. In the area to the right, locate the AirPort ID and jot that down. Then do the same for your other AirPort.
    Move your Mac near one of the AirPorts and log on to the wireless. Hold down the option key on the Mac while you click the fan shaped AirPort icon at the top of the screen. Look for the BSSID. That is the AirPort ID of the device to which you are connected.
    If you are close to the "remote" AirPort, and you see the AIrPort ID of the "main" router when you are testing, then you know that the network is not configured correctly.
    Can I use this second Airport Express to extend the wireless network via "Extended Wireless Network" while the other two are in "Roaming Netowrk" configuration? Without bogging down??
    There will be a modest 10-15% bandwidth loss with the "extend" setup, assuming that the Express is located where it can receive a strong wireless signal from the AirPort to which it is associated. You can avoid the bandwidth loss if the Express is also connected via Ethernet as part of the roaming configuration.

  • Wireless Clients getting DHCP IP from other WLAN

    Hi,
    My client has a wireless setup consisting of a WLC 2112 and about 7 1131AG LWAPPs. There are two SSIDs, say CORP(mapped to VLAN 900) and GUEST(mapped to VLAN 901). Wireless clients get IP through DHCP. DHCP IP is configured in the Dynamic interface.
    The problem is sometimes (not always), clients connecting to SSID CORP get a DHCP IP assigned for GUEST VLAN(VLAN 901).
    Since it is happening randomly, clueless as to what is causing the problem.
    Any inputs?
    Regards
    Gnan.
    P.S Just to add though this could be irrelevant, only after making VLAN ID of the admin interface and AP Manager interface as '0', the APs could talk to the WLC and i was able to http to the WLC from the LAN.(WLC Mgmt, AP Mgmt IPs and AP Manager interface are in same VLAN).

    It sounds like the client may be connecting to the guest WLAN first, then connecting to the Corp WLAN.
    As to the VLAN setting.  0 in the WLC means untagged.  If your switchport has the switchport trunk native valn < x > command you would need to be untagged.  Otherwise the switch would get a packet tagged with the native vlan, and then drop the traffic.
    ***if your management is in VLAN 1, the above is true with out the native setting, as VLAN 1 is native by default
    HTH,
    Steve
    Please remember to rate helpful posts or to mark the question as answered so that it can be found later.

  • Wireless client keep loosing IP address.

    Hi,
    I am in hot water, i am not good with wireless i have wireless LAN in my network which is connected to wired network. the problem is my clients get connected to the network but suddently they loose connectivity and start dhcp request and get limited connecitivity with automatic ip address.
    My network design is like this.
    1. I have a three floor building every floor has its own core and access layer and floors are connected layer 3 (not usual layer 2).
    2. Wireless Controllers 4402 are in layer 3 mode and are on ground floor and AP are everywhere in building.
    3. Wireless controllers are connected to ground floor core using a VLAN say VLAN 205 and AP's on ground floor and other floors are in different VLANs (physical connectivity of AP's).
    4. controllers are configured for two different VLAN's say VLAN 212 for data and VLAN 213 for voice.
    5. VLAN interface of the controller is configured with right helper address for DHCP.
    My problem is i am a bit confused with the desigh of the network. As i mentioned all floors are connected layer 3 it means seperate VTP domain and seperate VLAN's, all APs on all floors are in differnt IP subnet respectively. but the wireless VLAN is common for all the users on all floors, this is the bit which confuses me alot. the wireless data VLAN has its own IP subnet which is advertised from gound floor only (make sense) but the users are not connecting to ground floor APs only they are connecting everywhere in the building. Users are getting IP address from the wireless VLAN range on every floor, can anybody explain me how they are getting communication because wireless subnet is only local to ground floor core not to first floor or second floor but some people are connecting to 1st floor and 2nd floor AP and are working fine.
    The next pain is that my laptops started loosing IP address and they get automatic private IP address hence loose connectivity, the communication issue i referred above is secondary i am actually looking to rectify the ip address issue because users are having problem with it. Signal strength on every floor is perfect and coverage is ok, i have tried to debug dhcp detail packet but i don't receive any because controllers are in differnt VLAN for physical connectivity. Can somebody help me with this thing?
    Regards,

    Your wireless clients will associate to the best AP interms of signal strenght and signal to noise etc.
    There is an LWAPP tunnel between the access point and the controller.
    At the controller there will be logical interfaces for the wireless LANS that are asssociated to specific VLANs on the wired network.
    It doesn't matter where you are in the building as a client as its the controller that puts the client data onto the wired network.
    All client data is tunneled between the access point and the controller.
    With regard to the losing IP address situation. I assume that the clients do initially get an IP address and then lose it after a period of time.
    Check the session timeout paramter on the controller (look on the WLAN-Advanced).
    There is a bug with some versions of software relating to session timeouts. Try setting the timeout to 65535 seconds. The default setting is probably 30 minutes.

  • WLC 5760 - MAC Filtering wireless clients

    Hi,
    Does anyone ever deployed mac-filtering authentication to wireless clients in the WLC 5760?
    I've configured a WLAN for Mac-filtering authentication only (named it as "macauth"):
    wlan RNVDOS 4 RNVDOS
    aaa-override
    no broadcast-ssid
    client vlan RNVDOS
    mac-filtering macauth
    no security wpa
    no security wpa akm dot1x
    no security wpa wpa2
    no security wpa wpa2 ciphers aes
    session-timeout 1800
    no shutdown
    Then, below Configuration->Security->MAC Filtering I've added several MAC addresses i.e. :
    MAC Address: 88532e9ef70a  Attribute List: macauth
    Which turned out to be display in the CLI as:
    username 88532e9ef70a mac aaa attribute list macauth
    The problem is that whenever I try to associate the wireless client 88532e9ef70a, the client passes to the exclusion list.:
    Sep 16 10:54:55.603: 8853.2E9E.F70A Adding mobile on LWAPP AP  0C68.03EA.4070 (1)  1 wcm: E9E.F70A (.t^GwtSessionID: 0afe01fbtQ^GwH^Cnz^Gw00dd) was added to ^G$h\225v^K
    Sep 16 10:54:55.603: 8853.2E9E.F70A  Creating WL station entry for client -  rc 0 1 wcm:
    Sep 16 10:54:55.603: 8853.2E9E.F70A Association received from mobile on AP  0C68.03EA.4070  1 wcm: (.t^GwtSessionID: 0afe01fbtQ^GwH^Cnz^Gw00dd) was added to ^G$h\225v^K
    Sep 16 10:54:55.603: 8853.2E9E.F70A qos upstream policy is unknown and downstream policy is unknown 1 wcm: ssionID: 0afe01fbtQ^GwH^Cnz^Gw00dd) was added to ^G$h\225v^K
    Sep 16 10:54:55.603: 8853.2E9E.F70A apChanged 0 wlanChanged 0 mscb ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0 1 wcm: H^Cnz^Gw00dd) was added to ^G$h\225v^K
    Sep 16 10:54:55.603: 8853.2E9E.F70A Applying WLAN policy on MSCB. 1 wcm:  ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:55.603: 8853.2E9E.F70A Applying WLAN ACL policies to client 1 wcm:  0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:55.603: 8853.2E9E.F70A No Interface ACL used for Wireless client in WCM(NGWC) 1 wcm: usOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:55.603: 8853.2E9E.F70A Applying site-specific IPv6 override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm:  ^G$h\225v^K
    Sep 16 10:54:55.603: 8853.2E9E.F70A Applying local bridging Interface Policy for station  8853.2E9E.F70A  - vlan 4, interface 'RNVDOS' 1 wcm: ce 'RNVDOS'
    Sep 16 10:54:55.603: 8853.2E9E.F70A Applying site-specific override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: DOS'
    Sep 16 10:54:55.603: 8853.2E9E.F70A STA - rates (8): 1 wcm:  140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0
    Sep 16 10:54:55.603: 8853.2E9E.F70A new capwap_wtp_iif_id a45d40000000a5, sm capwap_wtp_iif_id 0 1 wcm: - vapId 4, site 'renova', interface 'RNVDOS'
    Sep 16 10:54:55.603: 8853.2E9E.F70A apfProcessAssocReq (apf_80211.c: 1 wcm: 5137) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from Idle to AAA Pending
    Sep 16 10:54:55.603: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:55.604: 8853.2E9E.F70A
    client incoming attribute size are 0 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:55.604: 8853.2E9E.F70A Sending Assoc Response to station on BSSID  0C68.03EA.4070  (status 256) ApVapId 2 Slot 1 1 wcm: 68.03EA.4070  from Idle to AAA Pending
    Sep 16 10:54:55.604: 8853.2E9E.F70A apfProcessRadiusAssocResp (apf_80211.c: 1 wcm: 2149) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from AAA Pending to Authenticated
    Sep 16 10:54:55.604: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 18) in 10 seconds
    Sep 16 10:54:55.813: 8853.2E9E.F70A Association received from mobile on AP  0C68.03EA.4070  1 wcm: n.t^Gwseconds
    Sep 16 10:54:55.813: 8853.2E9E.F70A qos upstream policy is unknown and downstream policy is unknown 1 wcm: onds
    Sep 16 10:54:55.813: 8853.2E9E.F70A apChanged 0 wlanChanged 0 mscb ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0 1 wcm: H^Cnz^Gw  0C68.03EA.4070  f^G$h\225v^K
    Sep 16 10:54:55.813: 8853.2E9E.F70A Applying WLAN policy on MSCB. 1 wcm:  ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:55.813: 8853.2E9E.F70A Applying WLAN ACL policies to client 1 wcm:  0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:55.813: 8853.2E9E.F70A No Interface ACL used for Wireless client in WCM(NGWC) 1 wcm: usOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:55.813: 8853.2E9E.F70A Applying site-specific IPv6 override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: f^G$h\225v^K
    Sep 16 10:54:55.813: 8853.2E9E.F70A Applying local bridging Interface Policy for station  8853.2E9E.F70A  - vlan 4, interface 'RNVDOS' 1 wcm: ce 'RNVDOS'
    Sep 16 10:54:55.813: 8853.2E9E.F70A Applying site-specific override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: DOS'
    Sep 16 10:54:55.813: 8853.2E9E.F70A STA - rates (8): 1 wcm:  140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0
    Sep 16 10:54:55.813: 8853.2E9E.F70A new capwap_wtp_iif_id a45d40000000a5, sm capwap_wtp_iif_id 0 1 wcm: - vapId 4, site 'renova', interface 'RNVDOS'
    Sep 16 10:54:55.813: 8853.2E9E.F70A apfProcessAssocReq (apf_80211.c: 1 wcm: 5137) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:55.813: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:55.814: 8853.2E9E.F70A
    client incoming attribute size are 0 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:55.814: 8853.2E9E.F70A Sending Assoc Response to station on BSSID  0C68.03EA.4070  (status 256) ApVapId 2 Slot 1 1 wcm: 68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:55.814: 8853.2E9E.F70A apfProcessRadiusAssocResp (apf_80211.c: 1 wcm: 2149) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from AAA Pending to Authenticated
    Sep 16 10:54:55.814: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 18) in 10 seconds
    Sep 16 10:54:56.520: 8853.2E9E.F70A Association received from mobile on AP  0C68.03EA.4070  1 wcm: n.t^Gwseconds
    Sep 16 10:54:56.520: 8853.2E9E.F70A qos upstream policy is unknown and downstream policy is unknown 1 wcm: onds
    Sep 16 10:54:56.520: 8853.2E9E.F70A apChanged 0 wlanChanged 0 mscb ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0 1 wcm: H^Cnz^Gw  0C68.03EA.4070  f^G$h\225v^K
    Sep 16 10:54:56.520: 8853.2E9E.F70A Applying WLAN policy on MSCB. 1 wcm:  ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:56.520: 8853.2E9E.F70A Applying WLAN ACL policies to client 1 wcm:  0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:56.520: 8853.2E9E.F70A No Interface ACL used for Wireless client in WCM(NGWC) 1 wcm: usOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:56.520: 8853.2E9E.F70A Applying site-specific IPv6 override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: f^G$h\225v^K
    Sep 16 10:54:56.520: 8853.2E9E.F70A Applying local bridging Interface Policy for station  8853.2E9E.F70A  - vlan 4, interface 'RNVDOS' 1 wcm: ce 'RNVDOS'
    Sep 16 10:54:56.520: 8853.2E9E.F70A Applying site-specific override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: DOS'
    Sep 16 10:54:56.520: 8853.2E9E.F70A STA - rates (8): 1 wcm:  140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0
    Sep 16 10:54:56.520: 8853.2E9E.F70A new capwap_wtp_iif_id a45d40000000a5, sm capwap_wtp_iif_id 0 1 wcm: - vapId 4, site 'renova', interface 'RNVDOS'
    Sep 16 10:54:56.520: 8853.2E9E.F70A apfProcessAssocReq (apf_80211.c: 1 wcm: 5137) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:56.520: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:56.521: 8853.2E9E.F70A
    client incoming attribute size are 0 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:56.521: 8853.2E9E.F70A Sending Assoc Response to station on BSSID  0C68.03EA.4070  (status 256) ApVapId 2 Slot 1 1 wcm: 68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:56.521: 8853.2E9E.F70A apfProcessRadiusAssocResp (apf_80211.c: 1 wcm: 2149) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from AAA Pending to Authenticated
    Sep 16 10:54:56.521: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 18) in 10 seconds
    Sep 16 10:54:56.729: 8853.2E9E.F70A Association received from mobile on AP  0C68.03EA.4070  1 wcm: n 10 seconds
    Sep 16 10:54:56.729: 8853.2E9E.F70A qos upstream policy is unknown and downstream policy is unknown 1 wcm: onds
    Sep 16 10:54:56.729: 8853.2E9E.F70A apChanged 0 wlanChanged 0 mscb ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0 1 wcm: A  on AP  0C68.03EA.4070  from AAA Pending to Authenticated
    Sep 16 10:54:56.729: 8853.2E9E.F70A Applying WLAN policy on MSCB. 1 wcm:  ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:56.729: 8853.2E9E.F70A Applying WLAN ACL policies to client 1 wcm:  0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:56.729: 8853.2E9E.F70A No Interface ACL used for Wireless client in WCM(NGWC) 1 wcm: usOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:56.729: 8853.2E9E.F70A Applying site-specific IPv6 override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: from AAA Pending to Authenticated
    Sep 16 10:54:56.729: 8853.2E9E.F70A Applying local bridging Interface Policy for station  8853.2E9E.F70A  - vlan 4, interface 'RNVDOS' 1 wcm: ce 'RNVDOS'
    Sep 16 10:54:56.729: 8853.2E9E.F70A Applying site-specific override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: DOS'
    Sep 16 10:54:56.729: 8853.2E9E.F70A STA - rates (8): 1 wcm:  140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0
    Sep 16 10:54:56.729: 8853.2E9E.F70A new capwap_wtp_iif_id a45d40000000a5, sm capwap_wtp_iif_id 0 1 wcm: - vapId 4, site 'renova', interface 'RNVDOS'
    Sep 16 10:54:56.729: 8853.2E9E.F70A apfProcessAssocReq (apf_80211.c: 1 wcm: 5137) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:56.729: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:56.730: 8853.2E9E.F70A
    client incoming attribute size are 0 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:56.730: 8853.2E9E.F70A Sending Assoc Response to station on BSSID  0C68.03EA.4070  (status 256) ApVapId 2 Slot 1 1 wcm: 68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:56.730: 8853.2E9E.F70A apfProcessRadiusAssocResp (apf_80211.c: 1 wcm: 2149) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from AAA Pending to Authenticated
    Sep 16 10:54:56.730: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 18) in 10 seconds
    Sep 16 10:54:56.937: 8853.2E9E.F70A Association received from mobile on AP  0C68.03EA.4070  1 wcm: n.t^Gwseconds
    Sep 16 10:54:56.937: 8853.2E9E.F70A qos upstream policy is unknown and downstream policy is unknown 1 wcm: onds
    Sep 16 10:54:56.937: 8853.2E9E.F70A apChanged 0 wlanChanged 0 mscb ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0 1 wcm: H^Cnz^Gw  0C68.03EA.4070  f^G$h\225v^K
    Sep 16 10:54:56.937: 8853.2E9E.F70A Applying WLAN policy on MSCB. 1 wcm:  ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:56.937: 8853.2E9E.F70A Applying WLAN ACL policies to client 1 wcm:  0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:56.937: 8853.2E9E.F70A No Interface ACL used for Wireless client in WCM(NGWC) 1 wcm: usOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:56.937: 8853.2E9E.F70A Applying site-specific IPv6 override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: f^G$h\225v^K
    Sep 16 10:54:56.937: 8853.2E9E.F70A Applying local bridging Interface Policy for station  8853.2E9E.F70A  - vlan 4, interface 'RNVDOS' 1 wcm: ce 'RNVDOS'
    Sep 16 10:54:56.937: 8853.2E9E.F70A Applying site-specific override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: DOS'
    Sep 16 10:54:56.937: 8853.2E9E.F70A STA - rates (8): 1 wcm:  140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0
    Sep 16 10:54:56.937: 8853.2E9E.F70A new capwap_wtp_iif_id a45d40000000a5, sm capwap_wtp_iif_id 0 1 wcm: - vapId 4, site 'renova', interface 'RNVDOS'
    Sep 16 10:54:56.937: 8853.2E9E.F70A apfProcessAssocReq (apf_80211.c: 1 wcm: 5137) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:56.937: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:56.937: 8853.2E9E.F70A
    client incoming attribute size are 0 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:56.937: 8853.2E9E.F70A Sending Assoc Response to station on BSSID  0C68.03EA.4070  (status 256) ApVapId 2 Slot 1 1 wcm: 68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:56.937: 8853.2E9E.F70A apfProcessRadiusAssocResp (apf_80211.c: 1 wcm: 2149) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from AAA Pending to Authenticated
    Sep 16 10:54:56.937: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 18) in 10 seconds
    Sep 16 10:54:57.143: 8853.2E9E.F70A Association received from mobile on AP  0C68.03EA.4070  1 wcm: n.t^Gwseconds
    Sep 16 10:54:57.143: 8853.2E9E.F70A qos upstream policy is unknown and downstream policy is unknown 1 wcm: onds
    Sep 16 10:54:57.143: 8853.2E9E.F70A apChanged 1 wlanChanged 0 mscb ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0 1 wcm: H^Cnz^Gw  0C68.03EA.4070  f^G$h\225v^K
    Sep 16 10:54:57.143: 8853.2E9E.F70A Applying WLAN policy on MSCB. 1 wcm:  ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:57.143: 8853.2E9E.F70A Applying WLAN ACL policies to client 1 wcm:  0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:57.143: 8853.2E9E.F70A No Interface ACL used for Wireless client in WCM(NGWC) 1 wcm: usOverride 0x0, numIPv6Addr=0
    Sep 16 10:54:57.143: 8853.2E9E.F70A Applying site-specific IPv6 override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: f^G$h\225v^K
    Sep 16 10:54:57.143: 8853.2E9E.F70A Applying local bridging Interface Policy for station  8853.2E9E.F70A  - vlan 4, interface 'RNVDOS' 1 wcm: ce 'RNVDOS'
    Sep 16 10:54:57.143: 8853.2E9E.F70A Applying site-specific override for station  8853.2E9E.F70A  - vapId 4, site 'renova', interface 'RNVDOS' 1 wcm: DOS'
    Sep 16 10:54:57.143: 8853.2E9E.F70A STA - rates (8): 1 wcm:  130 132 139 150 12 18 24 36 0 0 0 0 0 0 0 0
    Sep 16 10:54:57.143: 8853.2E9E.F70A STA - rates (12): 1 wcm:  130 132 139 150 12 18 24 36 48 72 96 108 0 0 0 0
    Sep 16 10:54:57.144:  8853.2E9E.F70A  0.0.0.0 START (0) Deleted mobile LWAPP rule on AP [ 0C68.03EA.4070 ] 1 wcm:  site 'renova', interface 'RNVDOS'
    Sep 16 10:54:57.144: 8853.2E9E.F70A Updated location for station old AP  0C68.03EA.4070 -1, new AP  0C68.03EA.4070 -0 1 wcm: va', interface 'RNVDOS'
    Sep 16 10:54:57.144: 8853.2E9E.F70A new capwap_wtp_iif_id a45d40000000a5, sm capwap_wtp_iif_id 0 1 wcm: P  0C68.03EA.4070 -0
    Sep 16 10:54:57.144: 8853.2E9E.F70A apfProcessAssocReq (apf_80211.c: 1 wcm: 5137) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:57.144: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:57.144: 8853.2E9E.F70A
    client incoming attribute size are 0 1 wcm:   (callerId: 20) in 10 seconds
    Sep 16 10:54:57.145: 8853.2E9E.F70A Sending Assoc Response to station on BSSID  0C68.03EA.4070  (status 256) ApVapId 2 Slot 0 1 wcm: 68.03EA.4070  from Authenticated to AAA Pending
    Sep 16 10:54:57.145: 8853.2E9E.F70A apfBlacklistMobileStationEntry2 (apf_ms.c: 1 wcm: 6129) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from AAA Pending to Exclusion-list (1)
    Sep 16 10:54:57.145: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 44) in 10 seconds
    Sep 16 10:54:57.145: 8853.2E9E.F70A client is added to the exclusion list, reason 1 1 wcm: d: 44) in 10 seconds
    Sep 16 10:54:57.145: *apfReceiveTask: 1 wcm:  %APF-4-ADD_TO_BLACKLIST_REASON: Client 8853.2E9E.F70A (AuditSessionID: 0afe01fb5236e37f000000de) was added to exclusion list. Reason: 802.11 association failure 
    Sep 16 10:54:57.836: 8853.2E9E.F70A Ignoring assoc request due to mobile in exclusion list or marked for deletion  1 wcm: fbtQ^GwH^Cnz^Gw00de) was added to ^G$h\225v^K
    Sep 16 10:54:58.533: 8853.2E9E.F70A Ignoring assoc request due to mobile in exclusion list or marked for deletion  1 wcm: fbtQ^GwH^Cnz^Gw00de) was added to ^G$h\225v^K
    Sep 16 10:54:59.231: 8853.2E9E.F70A Ignoring assoc request due to mobile in exclusion list or marked for deletion  1 wcm: fbtQ^GwH^Cnz^Gw00de) was added to ^G$h\225v^K
    Sep 16 10:54:59.922: 8853.2E9E.F70A Ignoring assoc request due to mobile in exclusion list or marked for deletion  1 wcm: fbtQ^GwH^Cnz^Gw00de) was added to ^G$h\225v^K
    Sep 16 10:55:06.972: 8853.2E9E.F70A apfMsExpireCallback (apf_ms.c: 1 wcm: 664) Expiring Mobile!
    Sep 16 10:55:06.972: 8853.2E9E.F70A Scheduling deletion of Mobile Station: 1 wcm:   (callerId: 46) in 60 seconds
    Sep 16 10:55:06.972: 8853.2E9E.F70A apfMsExpireMobileStation (apf_ms.c: 1 wcm: 7067) Changing state for mobile  8853.2E9E.F70A  on AP  0C68.03EA.4070  from Exclusion-list (1) to Exclusion-list (2)
    Sep 16 10:55:06.972:  8853.2E9E.F70A  0.0.0.0 START (0) Deleted mobile LWAPP rule on AP [ 0C68.03EA.4070 ] 1 wcm: 3.2E9E.F70A  on AP  0C68.03EA.4070  from Exclusion-list (1) to Exclusion-list (2)
    Sep 16 10:55:06.972:  8853.2E9E.F70A  0.0.0.0 START (0) FastSSID for the client [ 0C68.03EA.4070 ] NOTENABLED 1 wcm: E9E.F70A  on AP  0C68.03EA.4070  from Exclusion-list (1) to Exclusion-list (2)
    Sep 16 10:55:06.972: 8853.2E9E.F70A Incrementing the Reassociation Count 1 for client (of interface RNVDOS) 1 wcm: D
    Sep 16 10:55:06.972: 8853.2E9E.F70A Clearing Dhcp state for station  ---  1 wcm:  for client (of interface RNVDOS)
    WLC1#
    WLC1#
    Kind Regards,
    Vasco

    Hi Patrick,
    Thank you for sharing your solution. It didn't solved entirely the problem but you pointed to the right direction!
    They are caused, because the system searches for an aaa authorization list, which is not configured.
    To resolve this configure the following
    aaa authorization network mac-filter local
    where mac-filter is the name you defined in the SSID.
    I've used your sugestion to create an aaa local authorization list but instead of naming it with the SSID, I've used the name of the attribute list ( macauth ) and it solved the problem:
    aaa authorization network macauth local
    username 88532e9ef70a mac aaa attribute list macauth
    wlan RNVDOS 4 RNVDOS
    client vlan RNVDOS
    mac-filtering macauth
    WLC1#sh wireless client summ
    Number of Local Clients : 1
    MAC Address    AP Name                          WLAN State              Protocol
    8853.2e9e.f70a APf872.ead7.31da                 4    UP                 11n(5)  
    Cheers,
    Vasco

Maybe you are looking for