Wlc 5508 multicast/bonjour

hello,
i have a wlc 5508 with code 7.0.220, with multicast enabled in it and on the lan too.I am having a bit of confusion getting bonjour to work on the wireless side. Looking at some of the cisco docs, i still have some questions on how to get it working in my specific enviroment.
I have the wlc conected to the lan via a port-channel.  2 wlan (ssid1 and ssid2) each wlan maps to a specific vlan (dynamic int), the management int (also used for dynamic ap-manager) on a third vlan (vlan x).
The requirement:
I need to get Bonjour working between ssid1 and vlan-x, so my wireless clients (in ssid1 can use bonjour with their laptops) can synch between wireless and wired. I know that you can do this within the same wlan (ssid) but in this case, when a user has a laptop wired into the network he cant comunicate to the wireless device. I read about Vlan Select and Multicast Optimization however, from what i understand i need to setup an interface group and just assign my wlan1 and management int to it, correct?
Is there anyone that has this type of setup working? Can you provide some configs/print screens.
Another scenario that may come into play would also be when or if i need a different segment (vlan y) in my lan to also "bonjour" with ssid1? For this i assume i would need to create a dynamic interface on the wlc using the same IP segment and do the a new interface group?
thanks in advance

Cisco answers user questions about upcoming Apple Bonjour Gateway
How specific can you be about the beta release of the Gateway?
Beta for the v7.4 release will be in Oct/Nov of this year [2012].
[RECORDING]Better Application Device Visibility With Cisco’s Bonjour Gateway-20120724 1704-1

Similar Messages

  • WLC 5508 -7.4.100 mDNS Bonjour snooping

    Hello
    Have 7.4 installed and configured for Bonjour Snooping. All is working, but working too well. We have a large campus that house 2 schools and each school is complaining that they can see the other schools AppleTV devices.
    I have played around with a few different scenarios to see if I can localize the bonjour traffic.
    I guess I am looking to create a logical split for bonjour devices amoung the schools.
    Apple came to the school and informed us that the IPAD has a limit of 64 devices that can be seen via the bonjour. At some point we will have over 100 AppleTV added.
    so we have 3 wlc 5508's with 7.4.100
    we have 2 SSIDs that span the whole campus
    using AP groups to segment the floors in buildings
    So the schools are logically split with AP groups
    Here is what I have tried
    I created few mDNS profiles and assigned the services for Apple TV - let's call them school1 and school2
    I assign the mDNS profiles to the interfaces dedicated each school
    enable snooping on the WLAN with profile of none
    The end result is that devices from both schools can be seen.
    I tried to create new ssid for apple TVs and a new ssid for 1 schools teachers
    I followed the vlan select example
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_tech_note09186a0080bb1d7c.shtml
    end result is that devices from both schools can be seen
    I have tried the mDNS without multicast enabled just like the video shows to no avail - I assume maybe my AP groups might be more complicated then the example of just 2 vlans
    https://supportforums.cisco.com/community/netpro/wireless-mobility/begin-wireless/blog/2013/01/01/wireless-lan-controller-wlc-release-74--bonjour-gateway-configuration-example
    I have tried combinations of things, but I must be missing something
    In the webinar, Cisco said it will use filtering to restrict which  clients can see which services (Apple TV's, etc). What will Cisco use to  filter Bonjour requests?
    according to this article
    http://www.pcadvisor.co.uk/news/network-wifi/3376119/cisco-answers-user-questions-about-upcoming-apple-bonjour-gateway/#ixzz2SIDqFH49
    The filtering options are: · Per WLAN/SSID · Per VLAN or AP  Group · Per Interface Group (which is a group of VLANs pooled together).
    A Bonjour service policy can be created and applied on any one of  the above criteria. In the future, we will support per-user Bonjour  service policies which will come as a RADIUS attribute from the AAA server.
    Read more: http://www.pcadvisor.co.uk/news/network-wifi/3376119/cisco-answers-user-questions-about-upcoming-apple-bonjour-gateway/#ixzz2SZqMYpdh
    Cheers
    Any insight would be appreciated

    Here are the ACLs for the controller
    acl create BlockBonjour
    acl apply BlockBonjour
    acl counter start
    acl rule add BlockBonjour 1
    acl rule add BlockBonjour 2
    acl rule action BlockBonjour 1 deny
    acl rule action BlockBonjour 2 permit
    acl rule destination address BlockBonjour 1 224.0.0.251 255.255.255.255
    acl rule destination address BlockBonjour 2 0.0.0.0 0.0.0.0
    acl rule destination port range BlockBonjour 1 0 65535
    acl rule destination port range BlockBonjour 2 0 65535
    acl rule source address BlockBonjour 1 0.0.0.0 0.0.0.0
    acl rule source address BlockBonjour 2 0.0.0.0 0.0.0.0
    acl rule source port range BlockBonjour 1 0 65535
    acl rule source port range BlockBonjour 2 0 65535
    acl rule direction BlockBonjour 1  In 
    acl rule direction BlockBonjour 2 Any 
    acl rule dscp BlockBonjour 1  Any 
    acl rule dscp BlockBonjour 2  Any 
    acl rule protocol BlockBonjour 1  Any 
    acl rule protocol BlockBonjour 2  Any 
    acl apply BlockBonjour ipv6 acl create BlockAllIPv6
    ipv6 acl apply BlockAllIPv6
    ipv6 acl rule add BlockAllIPv6 1
    ipv6 acl rule action BlockAllIPv6 1 deny
    ipv6 acl rule destination address BlockAllIPv6 1 :: 0
    ipv6 acl rule destination port range BlockAllIPv6 1 0 65535
    ipv6 acl rule source address BlockAllIPv6 1 :: 0
    ipv6 acl rule source port range BlockAllIPv6 1 0 65535
    ipv6 acl rule direction BlockAllIPv6 1 Any 
    ipv6 acl rule dscp BlockAllIPv6 1  Any 
    ipv6 acl rule protocol BlockAllIPv6 1 Any
    ipv6 acl apply BlockAllIPv6
    Apply to wlan:  The wlan index is used in this case, the first wlan created on controller
    wlan acl 1 BlockBonjour
    wlan ipv6 acl 1 BlockAllIPv6

  • WLC - AP Groups - Multicast - Bonjour - Apple TVv3

    Good Morning
    first off - Should start off by saying I have followed the Apple Bonjour deployment guide [except for interface group] portion
    I have searched high and low, here and there to no avail.
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_tech_note09186a0080bb1d7c.shtml
    I am aware that the bonjour gateway IOS may or may not come out in Oct/Nov 2012, which maybe my only option at this point.
    Is this not working because of my AP groups setup or have I misssed something
    I can only get bonjour to work if multicast - unicast mode is selected, but our network slowly grinds to a halt, so it is not an option
    when I first connect to the wireless I see 1 bonjour device for about 3 minutes and then disappears.
    I can not see the appletv at all with an ipad, airplay does not appear at all.
    We have the following setup.
    2 campuses - Campus 2 is simular setup, but WLCs higher model and ios 7.2 and clients and subnets are double
    Campus 1
    2 WLC 4404 ios 7.0.230.0
    30 AP groups mapped to 30 Interfaces using subnets with /23 bit subnetmasks
    multicast - multicast is set with multicast addresses of
    controller 1 239.239.5.1 and
    controller 2 239.239.5.2
    multicast is enabled
    IGMPsnooping as well
    On Switch multicast routing is enabled
    all AP group subnets and Mgmt vlans are PIM enabled dense mode
    set up a trunk to ubuntu server to act as a bonjour gateway, installed avahi and vlan
    mapped all AP and mgmt vlans to Ubuntu server.
    avahi see the following + more
    + eth0.136 IPv6 Apple TV                                      _airplay._tcp        local
    + eth0.136 IPv4 Apple TV                                      _airplay._tcp        local
    + eth0.134 IPv6 Apple TV                                      _airplay._tcp        local
    + eth0.134 IPv4 Apple TV                                      _airplay._tcp        local
    + eth0.132 IPv6 Apple TV                                      _airplay._tcp        local
    + eth0.132 IPv4 Apple TV                                      _airplay._tcp        local
    + eth0.130 IPv6 Apple TV                                      _airplay._tcp        local
    more goes on forever
    + eth0.136 IPv4 xyz Library                             Apple Home Sharing   local
    show ip multicast
      Multicast Routing: enabled
      Multicast Multipath: disabled
      Multicast Route limit: No limit
      Multicast Triggered RPF check: enabled
      Multicast Fallback group mode: Dense
    show ip multicast interface vlan 128
    Vlan128 is up, line protocol is up
      Internet address is x.x.128.1/23
      Multicast routing: enabled
      Multicast switching: fast
      Multicast packets in/out: 14671352/276693
      Multicast boundary: not set
      Multicast TTL threshold: 0
      Multicast Tagswitching: disabled
    Where do I go from here?

    Thanks Yahya and Stephen
    I have tried to simplify my config as much as possible.
    wlc 4404
    Ethernet Multicast Forwarding............... Enable
    Ethernet Broadcast Forwarding............... Enable
    AP Multicast/Broadcast Mode................. Multicast   Address : 239.239.5.1
    IGMP snooping............................... Enabled
    IGMP timeout................................ 60 seconds
    IGMP Query Interval......................... 20 seconds
    I have an interface created 10.x.x.x/23
    I have created a new SSID APPLETV - assigned Interface
    I have added the SSID to just 1 AP Group
    show network multicast mgid summary
    Layer2 MGID Mapping:
    InterfaceName                    vlanId   MGID
    2upadhoc                         136      27
    Layer3 MGID Mapping:
    Number of Layer3 MGIDs........................... 11
    My vlan does not show up here.
    I only have 2 devices in this vlan the AppleTV and IPAD
    checking the switch for all required vlans
    show ip multicast
      Multicast Routing: enabled
      Multicast Multipath: disabled
      Multicast Route limit: No limit
      Multicast Triggered RPF check: enabled
      Multicast Fallback group mode: Dense
    admin interface
    Management, AP-Manger
    Vlan12 is up, line protocol is up
      Internet address is x.x.x.1/24
      Multicast routing: enabled
      Multicast switching: fast
      Multicast packets in/out: 238489978/724352
      Multicast boundary: not set
      Multicast TTL threshold: 0
      Multicast Tagswitching: disabled
    AP vlan
    Vlan222 is up, line protocol is up
      Internet address is x.y.z.1/24
      Multicast routing: enabled
      Multicast switching: fast
      Multicast packets in/out: 11423/238338583
      Multicast boundary: not set
      Multicast TTL threshold: 0
      Multicast Tagswitching: disabled
    The test Apple TV Vlan
    Vlan136 is up, line protocol is up
      Internet address is x.xx.1/23
      Multicast routing: enabled
      Multicast switching: fast
      Multicast packets in/out: 156740/0
      Multicast boundary: not set
      Multicast TTL threshold: 0
      Multicast Tagswitching: disabled
    interface Vlan12
    ip pim dense-mode
    interface Vlan222
    ip pim dense-mode
    interface Vlan136
    ip pim dense-mode
    Show ip igmp groups
    Group Address    Interface                Uptime    Expires   Last Reporter
    224.0.1.39       Vlan136                  2d00h     00:02:35  x.x.x.1
    So just to recap
    Same subnet in a AP Group
    New SSID
    multicast enabled on WLC - using multicast multicast mode
    Broadcast forward enable
    Switch -Multicast routing enabled
    all vlans enabled for PIM
    2 devices - added Imac to see if I could home share through Itunes.
    end result
    no bonjour clients, no apple tv, no airplay
    Bonjour Gateway device - although same subnet it shouldn't be needed
    eth0.12   Link encap:Ethernet  HWaddr bc:30:5b:x:x:x 
              inet addr:x.x.x.244  Bcast:x.x.x.255  Mask:255.255.255.0
              inet6 addr: fe80::be30:5bff:fed6:a178/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:55005 errors:0 dropped:115 overruns:0 frame:0
              TX packets:23003 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:2776156 (2.7 MB)  TX bytes:11285256 (11.2 MB)
    eth0.136  Link encap:Ethernet  HWaddr bc:30:5b:x:x:x 
              inet addr:x.x.x.9  Bcast:x.x.x.255  Mask:255.255.254.0
              inet6 addr: fe80::be30:5bff:fed6:a178/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:42167 errors:0 dropped:115 overruns:0 frame:0
              TX packets:22340 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:3251242 (3.2 MB)  TX bytes:10373581 (10.3 MB)
    eth0.222  Link encap:Ethernet  HWaddr bc:30:5b:xx:xx:xx 
              inet addr:x.x.x.9  Bcast:x.x.x.255  Mask:255.255.255.0
              inet6 addr: fe80::be30:5bff:fed6:a178/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:152397 errors:0 dropped:115 overruns:0 frame:0
              TX packets:23768 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:12795709 (12.7 MB)  TX bytes:11318103 (11.3 MB)
    + eth0.222 IPv6 67665ACD317A45B0                              _appletv-v2._tcp     local
    + eth0.222 IPv4 67665ACD317A45B0                              _appletv-v2._tcp     local
    + eth0.136 IPv6 67665ACD317A45B0                              _appletv-v2._tcp     local
    + eth0.136 IPv4 67665ACD317A45B0                              _appletv-v2._tcp     local
    + eth0.12 IPv6 67665ACD317A45B0                              _appletv-v2._tcp     local
    + eth0.12 IPv4 67665ACD317A45B0                              _appletv-v2._tcp     local
    Should Bonjour work same subnet with these settings?
    I am going to have read more about the Interface groups and the Multicast vlan.

  • Cisco ISE 1.2 & Cisco WLC 5508 v7.6

    Hi all,
    we are planning to upgrade our WLC to 7.6 to fix a bug with FlexConnect Client ACLs but I have just seen on the Cisco ISE Compatibility table that the it only recommends up to v7.5 of the WLC 5508...
    Cisco have told me to steer clear of 7.5 as it is in a defferred status, so does anyone know, or have running in a lab or production, ISE1.2 with a 5508 WLC v7.6 NAD ?
    I would much rather know of any issues people are experiencing before hand than to have to go through a software upgrade and then rollback.
    Thanks all
    Mario De Rosa

    Hi Neno,
    right I have this almost working now.
    I have simplified the setup. I am not going to do any client provisioning at the moment.
    So I can connect to the corporate SSID using EAP-TLS and I can successfully push the branch data VLAN upon successful authorisation.
    Now I am trying to introduce the posture element & per user ACLs.
    I have defined the redirect ACL & Flex ACL on the vWLC however the NAC agent will not pop-up. The client is in the right VLAN and the redirect ACL seems to be getting applied as the client does get an IP through DHCP. However, the client cannot ping the ISE or access the guest portal when I open the browser.
    DNS resolution seems to be working fine.
    VLAN220 is my datacentre VLAN which the Management Interface on the controller is plugged in to.
    VLAN10 is the branch DATA VLAN.
    below is some output to give you some more details...
    (Cisco Controller) >show client detail 00:24:d6:97:b3:be
    Client MAC Address............................... 00:24:d6:97:b3:be
    Client Username ................................. [email protected]
    AP MAC Address................................... 18:33:9d:f0:21:80
    AP Name.......................................... test-flex-ap
    AP radio slot Id................................. 0
    Client State..................................... Associated
    Client NAC OOB State............................. Access
    Wireless LAN Id.................................. 2
    Hotspot (802.11u)................................ Not Supported
    BSSID............................................ 18:33:9d:f0:21:81
    Connected For ................................... 128 secs
    Channel.......................................... 6
    IP Address....................................... 10.130.130.120
    Gateway Address.................................. 10.130.130.1
    Netmask.......................................... 255.255.255.0
    IPv6 Address..................................... fe80::f524:1910:69f0:9482
    Association Id................................... 1
    Authentication Algorithm......................... Open System
    Reason Code...................................... 1
    Status Code...................................... 0
    Client CCX version............................... 4
    Client E2E version............................... 1
    --More-- or (q)uit
    Re-Authentication Timeout........................ 1651
    QoS Level........................................ Silver
    Avg data Rate.................................... 0
    Burst data Rate.................................. 0
    Avg Real time data Rate.......................... 0
    Burst Real Time data Rate........................ 0
    802.1P Priority Tag.............................. disabled
    CTS Security Group Tag........................... Not Applicable
    KTS CAC Capability............................... No
    WMM Support...................................... Enabled
      APSD ACs.......................................  BK  BE  VI  VO
    Power Save....................................... OFF
    Current Rate..................................... m13
    Supported Rates.................................. 1.0,2.0,5.5,11.0,6.0,9.0,
        ............................................. 12.0,18.0,24.0,36.0,48.0,
        ............................................. 54.0
    Mobility State................................... Local
    Mobility Move Count.............................. 0
    Security Policy Completed........................ No
    Policy Manager State............................. POSTURE_REQD
    Policy Manager Rule Created...................... Yes
    AAA Override ACL Name............................ POSTURE_REDIRECT_ACL
    AAA Override ACL Applied Status.................. Yes
    --More-- or (q)uit
    AAA Override Flex ACL Name....................... POSTURE_REDIRECT_ACL
    AAA Override Flex ACL Applied Status............. Yes
    AAA URL redirect................................. https://pdc-ise-man01.kier.group:8443/guestportal/gateway?sessionId=c8dc800a00000005b3e7e953&action=cpp
    Audit Session ID................................. c8dc800a00000005b3e7e953
    AAA Role Type.................................... none
    Local Policy Applied............................. none
    IPv4 ACL Name.................................... none
    FlexConnect ACL Applied Status................... Yes
    IPv4 ACL Applied Status.......................... Unavailable
    IPv6 ACL Name.................................... none
    IPv6 ACL Applied Status.......................... Unavailable
    Layer2 ACL Name.................................. none
    Layer2 ACL Applied Status........................ Unavailable
    mDNS Status...................................... Disabled
    mDNS Profile Name................................ none
    No. of mDNS Services Advertised.................. 0
    Policy Type...................................... WPA2
    Authentication Key Management.................... 802.1x
    Encryption Cipher................................ CCMP (AES)
    Protected Management Frame ...................... No
    Management Frame Protection...................... No
    EAP Type......................................... EAP-TLS
    FlexConnect Data Switching....................... Local
    --More-- or (q)uit
    FlexConnect Dhcp Status.......................... Local
    FlexConnect Vlan Based Central Switching......... No
    FlexConnect Authentication....................... Central
    Quarantine VLAN.................................. 0
    Access VLAN...................................... 220
    Client Capabilities:
          CF Pollable................................ Not implemented
          CF Poll Request............................ Not implemented
          Short Preamble............................. Implemented
          PBCC....................................... Not implemented
          Channel Agility............................ Not implemented
          Listen Interval............................ 10
          Fast BSS Transition........................ Not implemented
    Client Wifi Direct Capabilities:
          WFD capable................................ No
          Manged WFD capable......................... No
          Cross Connection Capable................... No
          Support Concurrent Operation............... No
    Fast BSS Transition Details:
    Client Statistics:
          Number of Bytes Received................... 33698
          Number of Bytes Sent....................... 19397
          Total Number of Bytes Sent................. 19397
    --More-- or (q)uit
          Total Number of Bytes Recv................. 33698
          Number of Bytes Sent (last 90s)............ 19397
          Number of Bytes Recv (last 90s)............ 33698
          Number of Packets Received................. 283
          Number of Packets Sent..................... 147
          Number of Interim-Update Sent.............. 0
          Number of EAP Id Request Msg Timeouts...... 0
          Number of EAP Id Request Msg Failures...... 0
          Number of EAP Request Msg Timeouts......... 0
          Number of EAP Request Msg Failures......... 0
          Number of EAP Key Msg Timeouts............. 0
          Number of EAP Key Msg Failures............. 0
          Number of Data Retries..................... 53
          Number of RTS Retries...................... 0
          Number of Duplicate Received Packets....... 2
          Number of Decrypt Failed Packets........... 0
          Number of Mic Failured Packets............. 0
          Number of Mic Missing Packets.............. 0
          Number of RA Packets Dropped............... 0
          Number of Policy Errors.................... 0
          Radio Signal Strength Indicator............ -42 dBm
          Signal to Noise Ratio...................... 41 dB
    Client Rate Limiting Statistics:
    --More-- or (q)uit
          Number of Data Packets Recieved............ 0
          Number of Data Rx Packets Dropped.......... 0
          Number of Data Bytes Recieved.............. 0
          Number of Data Rx Bytes Dropped............ 0
          Number of Realtime Packets Recieved........ 0
          Number of Realtime Rx Packets Dropped...... 0
          Number of Realtime Bytes Recieved.......... 0
          Number of Realtime Rx Bytes Dropped........ 0
          Number of Data Packets Sent................ 0
          Number of Data Tx Packets Dropped.......... 0
          Number of Data Bytes Sent.................. 0
          Number of Data Tx Bytes Dropped............ 0
          Number of Realtime Packets Sent............ 0
          Number of Realtime Tx Packets Dropped...... 0
          Number of Realtime Bytes Sent.............. 0
          Number of Realtime Tx Bytes Dropped........ 0
    Nearby AP Statistics:
          test-flex-ap(slot 0)
            antenna0: 14 secs ago.................... -51 dBm
            antenna1: 14 secs ago.................... -37 dBm
          test-flex-ap(slot 1)
            antenna0: 14 secs ago.................... -51 dBm
            antenna1: 14 secs ago.................... -54 dBm
    --More-- or (q)uit
    DNS Server details:
          DNS server IP ............................. 10.0.17.31
          DNS server IP ............................. 10.0.17.43
    Assisted Roaming Prediction List details:
     Client Dhcp Required:     False
    Allowed (URL)IP Addresses
    (Cisco Controller) >
    (Cisco Controller) >show wlan 2
    WLAN Identifier.................................. 2
    Profile Name..................................... Demo1x
    Network Name (SSID).............................. Demo1x
    Status........................................... Enabled
    MAC Filtering.................................... Disabled
    Broadcast SSID................................... Enabled
    AAA Policy Override.............................. Enabled
    Network Admission Control
    Client Profiling Status
        Radius Profiling ............................ Disabled
         DHCP ....................................... Disabled
         HTTP ....................................... Disabled
        Local Profiling ............................. Disabled
         DHCP ....................................... Disabled
         HTTP ....................................... Disabled
      Radius-NAC State............................... Enabled
      SNMP-NAC State................................. Disabled
      Quarantine VLAN................................ 0
    Maximum number of Associated Clients............. 0
    Maximum number of Clients per AP Radio........... 200
    --More-- or (q)uit
    Number of Active Clients......................... 1
    Exclusionlist Timeout............................ 60 seconds
    Session Timeout.................................. 1800 seconds
    User Idle Timeout................................ Disabled
    Sleep Client..................................... disable
    Sleep Client Timeout............................. 12 hours
    User Idle Threshold.............................. 0 Bytes
    NAS-identifier................................... mario-test-flex-vwlc
    CHD per WLAN..................................... Enabled
    Webauth DHCP exclusion........................... Disabled
    Interface........................................ management
    Multicast Interface.............................. Not Configured
    WLAN IPv4 ACL.................................... unconfigured
    WLAN IPv6 ACL.................................... unconfigured
    WLAN Layer2 ACL.................................. unconfigured
    mDNS Status...................................... Disabled
    mDNS Profile Name................................ unconfigured
    DHCP Server...................................... Default
    DHCP Address Assignment Required................. Disabled
    Static IP client tunneling....................... Disabled
    Quality of Service............................... Silver
    Per-SSID Rate Limits............................. Upstream      Downstream
    Average Data Rate................................   0             0
    --More-- or (q)uit
    Average Realtime Data Rate.......................   0             0
    Burst Data Rate..................................   0             0
    Burst Realtime Data Rate.........................   0             0
    Per-Client Rate Limits........................... Upstream      Downstream
    Average Data Rate................................   0             0
    Average Realtime Data Rate.......................   0             0
    Burst Data Rate..................................   0             0
    Burst Realtime Data Rate.........................   0             0
    Scan Defer Priority.............................. 4,5,6
    Scan Defer Time.................................. 100 milliseconds
    WMM.............................................. Allowed
    WMM UAPSD Compliant Client Support............... Disabled
    Media Stream Multicast-direct.................... Disabled
    CCX - AironetIe Support.......................... Enabled
    CCX - Gratuitous ProbeResponse (GPR)............. Disabled
    CCX - Diagnostics Channel Capability............. Disabled
    Dot11-Phone Mode (7920).......................... Disabled
    Wired Protocol................................... None
    Passive Client Feature........................... Disabled
    Peer-to-Peer Blocking Action..................... Disabled
    Radio Policy..................................... All
    DTIM period for 802.11a radio.................... 1
    DTIM period for 802.11b radio.................... 1
    --More-- or (q)uit
    Radius Servers
       Authentication................................ 10.0.16.111 1812
       Accounting.................................... 10.131.16.111 1813
          Interim Update............................. Disabled
          Framed IPv6 Acct AVP ...................... Prefix
       Dynamic Interface............................. Disabled
       Dynamic Interface Priority.................... wlan
    Local EAP Authentication......................... Disabled
    Security
       802.11 Authentication:........................ Open System
       FT Support.................................... Disabled
       Static WEP Keys............................... Disabled
       802.1X........................................ Disabled
       Wi-Fi Protected Access (WPA/WPA2)............. Enabled
          WPA (SSN IE)............................... Disabled
          WPA2 (RSN IE).............................. Enabled
             TKIP Cipher............................. Disabled
             AES Cipher.............................. Enabled
                                                                   Auth Key Management
             802.1x.................................. Enabled
             PSK..................................... Disabled
             CCKM.................................... Disabled
    --More-- or (q)uit
             FT-1X(802.11r).......................... Disabled
             FT-PSK(802.11r)......................... Disabled
             PMF-1X(802.11w)......................... Disabled
             PMF-PSK(802.11w)........................ Disabled
          FT Reassociation Timeout................... 20
          FT Over-The-DS mode........................ Enabled
          GTK Randomization.......................... Disabled
          SKC Cache Support.......................... Disabled
          CCKM TSF Tolerance......................... 1000
       WAPI.......................................... Disabled
       Wi-Fi Direct policy configured................ Disabled
       EAP-Passthrough............................... Disabled
       CKIP ......................................... Disabled
       Web Based Authentication...................... Disabled
       Web-Passthrough............................... Disabled
       Conditional Web Redirect...................... Disabled
       Splash-Page Web Redirect...................... Disabled
       Auto Anchor................................... Disabled
       FlexConnect Local Switching................... Enabled
       flexconnect Central Dhcp Flag................. Disabled
       flexconnect nat-pat Flag...................... Disabled
       flexconnect Dns Override Flag................. Disabled
       flexconnect PPPoE pass-through................ Disabled
    --More-- or (q)uit
       flexconnect local-switching IP-source-guar.... Disabled
       FlexConnect Vlan based Central Switching ..... Disabled
       FlexConnect Local Authentication.............. Disabled
       FlexConnect Learn IP Address.................. Enabled
       Client MFP.................................... Optional
       PMF........................................... Disabled
       PMF Association Comeback Time................. 1
       PMF SA Query RetryTimeout..................... 200
       Tkip MIC Countermeasure Hold-down Timer....... 60
       Eap-params.................................... Disabled
    AVC Visibilty.................................... Disabled
    AVC Profile Name................................. None
    Flow Monitor Name................................ None
    Split Tunnel (Printers).......................... Disabled
    Call Snooping.................................... Disabled
    Roamed Call Re-Anchor Policy..................... Disabled
    SIP CAC Fail Send-486-Busy Policy................ Disabled
    SIP CAC Fail Send Dis-Association Policy......... Disabled
    KTS based CAC Policy............................. Disabled
    Assisted Roaming Prediction Optimization......... Disabled
    802.11k Neighbor List............................ Disabled
    802.11k Neighbor List Dual Band.................. Disabled
    Band Select...................................... Disabled
    --More-- or (q)uit
    Load Balancing................................... Disabled
    Multicast Buffer................................. Disabled
     Mobility Anchor List
     WLAN ID     IP Address            Status
    802.11u........................................ Disabled
    MSAP Services.................................. Disabled
    Local Policy
    Priority  Policy Name
    (Cisco Controller) >
    when debugging the client during redirect, this is the output and I cannot spot anything wrong here...
    (Cisco Controller) >*apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Adding mobile on LWAPP AP 18:33:9d:f0:21:80(1) 
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Association received from mobile on BSSID 18:33:9d:f0:21:8e
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Global 200 Clients are allowed to AP radio
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Max Client Trap Threshold: 0  cur: 0
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Rf profile 600 Clients are allowed to AP wlan
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be override for default ap group, marking intgrp NULL
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Applying Interface policy on Mobile, role Unassociated. Ms NAC State 0 Quarantine Vlan 0 Access Vlan 0
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Re-applying interface policy for client 
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be 0.0.0.0 START (0) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2219)
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be 0.0.0.0 START (0) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2240)
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be apfApplyWlanPolicy: Retaining the ACL recieved in AAA attributes 255 on mobile 
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be apfApplyWlanPolicy: Apply WLAN Policy over PMIPv6 Client Mobility Type
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be In processSsidIE:4850 setting Central switched to FALSE
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Applying site-specific Local Bridging override for station 00:24:d6:97:b3:be - vapId 2, site 'default-group', interface 'management'
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Applying Local Bridging Interface Policy for station 00:24:d6:97:b3:be - vlan 220, interface id 0, interface 'management'
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be processSsidIE  statusCode is 0 and status is 0 
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be processSsidIE  ssid_done_flag is 0 finish_flag is 0
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be STA - rates (8): 140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be suppRates  statusCode is 0 and gotSuppRatesElement is 1 
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Processing RSN IE type 48, length 22 for mobile 00:24:d6:97:b3:be
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Received RSN IE with 0 PMKIDs from mobile 00:24:d6:97:b3:be
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Setting active key cache index 8 ---> 8
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be unsetting PmkIdValidatedByAp
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Updating AID for REAP AP Client 18:33:9d:f0:21:80 - AID ===> 1
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be 0.0.0.0 START (0) Initializing policy
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state START (0)
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state AUTHCHECK (2)
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Central switch is FALSE
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be 0.0.0.0 8021X_REQD (3) DHCP required on AP 18:33:9d:f0:21:80 vapId 2 apVapId 2for this client
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Not Using WMM Compliance code qosCap 00
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be 0.0.0.0 8021X_REQD (3) Plumbed mobile LWAPP rule on AP 18:33:9d:f0:21:80 vapId 2 apVapId 2 flex-acl-name: 
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be apfMsAssoStateInc
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be apfPemAddUser2 (apf_policy.c:333) Changing state for mobile 00:24:d6:97:b3:be on AP 18:33:9d:f0:21:80 from Idle to Associated
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be apfPemAddUser2:session timeout forstation 00:24:d6:97:b3:be - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is  0 
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Stopping deletion of Mobile Station: (callerId: 48)
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Func: apfPemAddUser2, Ms Timeout = 0, Session Timeout = 0
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be Sending Assoc Response to station on BSSID 18:33:9d:f0:21:8e (status 0) ApVapId 2 Slot 1
    *apfMsConnTask_7: Aug 12 10:58:24.013: 00:24:d6:97:b3:be apfProcessAssocReq (apf_80211.c:8294) Changing state for mobile 00:24:d6:97:b3:be on AP 18:33:9d:f0:21:80 from Associated to Associated
    *spamApTask6: Aug 12 10:58:24.016: 00:24:d6:97:b3:be Sent 1x initiate message to multi thread task for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.016: 00:24:d6:97:b3:be EAP-PARAM Debug - eap-params for Wlan-Id :2 is disabled - applying Global eap timers and retries
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.016: 00:24:d6:97:b3:be Station 00:24:d6:97:b3:be setting dot1x reauth timeout = 1800
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.016: 00:24:d6:97:b3:be dot1x - moving mobile 00:24:d6:97:b3:be into Connecting state
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.016: 00:24:d6:97:b3:be Sending EAP-Request/Identity to mobile 00:24:d6:97:b3:be (EAP Id 1)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.016: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.016: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.016: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.016: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.083: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.083: 00:24:d6:97:b3:be Received Identity Response (count=1) from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.083: 00:24:d6:97:b3:be Resetting reauth count 1 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.083: 00:24:d6:97:b3:be EAP State update from Connecting to Authenticating for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.083: 00:24:d6:97:b3:be dot1x - moving mobile 00:24:d6:97:b3:be into Authenticating state
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.083: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.086: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.086: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=214) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.086: 00:24:d6:97:b3:be WARNING: updated EAP-Identifier 1 ===> 214 for STA 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.086: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 214)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.086: 00:24:d6:97:b3:be Allocating EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.086: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.086: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.086: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.086: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.090: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.090: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 214, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.090: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.090: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.091: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.091: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=215) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.091: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 215)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.091: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.091: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.091: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.091: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.091: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.095: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.095: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 215, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.095: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.095: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.096: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.096: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=216) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.096: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 216)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.096: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.096: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.096: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.096: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.096: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.100: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.100: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 216, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.100: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.100: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.101: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.101: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=217) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.101: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 217)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.101: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.101: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.101: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.101: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.101: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.105: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.105: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 217, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.105: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.105: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.106: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.106: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=218) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.106: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 218)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.106: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.106: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.106: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.106: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.106: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.110: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.110: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 218, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.110: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.110: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.111: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.111: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=219) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.111: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 219)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.111: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.111: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.111: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.111: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.111: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.115: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.115: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 219, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.115: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.115: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.116: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.116: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=220) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.116: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 220)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.116: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.116: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.116: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.116: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.116: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.352: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.352: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 220, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.352: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.352: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.354: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.354: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=221) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.354: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 221)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.354: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.354: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.354: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.354: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.354: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.359: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.359: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 221, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.359: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.359: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.360: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.360: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=222) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.360: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 222)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.360: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.360: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.360: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.360: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.360: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.365: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.365: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 222, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.365: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.365: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.366: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.366: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=223) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.366: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 223)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.366: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.366: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.366: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.366: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.366: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.371: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.371: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 223, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.371: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.371: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.372: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.372: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=224) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.372: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 224)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.372: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.372: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.372: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.372: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.372: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.375: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.375: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 224, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.375: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.375: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.389: 00:24:d6:97:b3:be Processing Access-Challenge for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.389: 00:24:d6:97:b3:be Entering Backend Auth Req state (id=225) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.389: 00:24:d6:97:b3:be Sending EAP Request from AAA to mobile 00:24:d6:97:b3:be (EAP Id 225)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.389: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.389: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.389: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.389: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.389: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.391: 00:24:d6:97:b3:be Received EAPOL EAPPKT from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.391: 00:24:d6:97:b3:be Received EAP Response from mobile 00:24:d6:97:b3:be (EAP Id 225, EAP Type 13)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.391: 00:24:d6:97:b3:be Resetting reauth count 0 to 0 for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.391: 00:24:d6:97:b3:be Entering Backend Auth Response state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Processing Access-Accept for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Resetting web IPv4 acl from 255 to 255
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Resetting web IPv4 Flex acl from 65535 to 65535
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Username entry ([email protected]) created for mobile, length = 253 
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Username entry ([email protected]) created in mscb for mobile, length = 253 
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be override for default ap group, marking intgrp NULL
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Applying Interface policy on Mobile, role Unassociated. Ms NAC State 2 Quarantine Vlan 0 Access Vlan 220
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Re-applying interface policy for client 
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be 0.0.0.0 8021X_REQD (3) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2219)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be 0.0.0.0 8021X_REQD (3) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2240)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be apfApplyWlanPolicy: Retaining the ACL recieved in AAA attributes 1 on mobile 
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be apfApplyWlanPolicy: Apply WLAN Policy over PMIPv6 Client Mobility Type
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Inserting AAA Override struct for mobile
        MAC: 00:24:d6:97:b3:be, source 4
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Setting re-auth timeout to 1800 seconds, got from WLAN config.
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Station 00:24:d6:97:b3:be setting dot1x reauth timeout = 1800
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Creating a PKC PMKID Cache entry for station 00:24:d6:97:b3:be (RSN 2)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Resetting MSCB PMK Cache Entry 0 for station 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Setting active key cache index 8 ---> 8
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Setting active key cache index 8 ---> 0
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Adding BSSID 18:33:9d:f0:21:8e to PMKID cache at index 0 for station 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: New PMKID: (16)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410:      [0000] 6f d1 ce 84 08 74 41 a5 06 6b 89 02 c9 e9 f8 c8
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Disabling re-auth since PMK lifetime can take care of same.
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be unsetting PmkIdValidatedByAp
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Client in Posture Reqd state. PMK cache not updated.
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Sending EAP-Success to mobile 00:24:d6:97:b3:be (EAP Id 225)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Freeing AAACB from Dot1xCB as AAA auth is done for  mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be EAPOL Header: 
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00000000: 02 03 5f 00                                       .._.
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Found an cache entry for BSSID 18:33:9d:f0:21:8e in PMKID cache at index 0 of station 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Found an cache entry for BSSID 18:33:9d:f0:21:8e in PMKID cache at index 0 of station 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: Including PMKID in M1  (16)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410:      [0000] 6f d1 ce 84 08 74 41 a5 06 6b 89 02 c9 e9 f8 c8
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Starting key exchange to mobile 00:24:d6:97:b3:be, data packets will be dropped
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Sending EAPOL-Key Message to mobile 00:24:d6:97:b3:be
       state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Sending EAPOL-Key Message to mobile 00:24:d6:97:b3:be
       state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Entering Backend Auth Success state (id=225) for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be Received Auth Success while in Authenticating state for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.410: 00:24:d6:97:b3:be dot1x - moving mobile 00:24:d6:97:b3:be into Authenticated state
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be Received EAPOL-Key from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be Received EAPOL-key in PTK_START state (message 2) from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be PMK: Sending cache add
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be Stopping retransmission timer for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be EAPOL Header: 
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00000000: 02 03 5f 00                                       .._.
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be Sending EAPOL-Key Message to mobile 00:24:d6:97:b3:be
       state PTKINITNEGOTIATING (message 3), replay counter 00.00.00.00.00.00.00.01
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be Sending EAPOL-Key Message to mobile 00:24:d6:97:b3:be
       state PTKINITNEGOTIATING (message 3), replay counter 00.00.00.00.00.00.00.01
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be Reusing allocated memory for  EAP Pkt for retransmission to mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be mscb->apfMsLwappLradNhMac = 00:00:0c:07:ac:dc mscb->apfMsLradSlotId = 1 mscb->apfMsLradJumbo = 0 mscb->apfMsintIfNum = 1
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be  mscb->apfMsBssid = 18:33:9d:f0:21:80 mscb->apfMsAddress = 00:24:d6:97:b3:be mscb->apfMsApVapId = 2
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be  dot1xcb->snapOrg = 00 00 00 dot1xcb->eapolWepBit = 0 mscb->apfMsLwappLradVlanId = 220 mscb->apfMsLwappMwarInet.ipv4.addr = 176217288
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.414: 00:24:d6:97:b3:be  mscb->apfMsLwappMwarPort = 5246 mscb->apfMsLwappLradInet.ipv4.addr = 176325157 mscb->apfMsLwappLradPort = 9385
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be Received EAPOL-Key from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be Received EAPOL-key in PTKINITNEGOTIATING state (message 4) from mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be Stopping retransmission timer for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be Freeing EAP Retransmit Bufer for mobile 00:24:d6:97:b3:be
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be apfMs1xStateInc
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 8021X_REQD (3) Change state to L2AUTHCOMPLETE (4) last state 8021X_REQD (3)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be Central switch is FALSE
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be Sending the Central Auth Info
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be Central Auth Info Allocated PMKLen = 32
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: EapolReplayCounter: 00 00 00 00 00 00 00 01
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: EapolReplayCounter: 00 00 00 00 00 00 00 01
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be PMK: pmkActiveIndex = 0
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be EapolReplayCounter: 00 00 00 00 00 00 00 01
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be msAssocTypeFlagsMsb = 0 msAssocTypeFlagsLsb = 2
    apfMsEntryType = 0 apfMsEapType = 13
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 L2AUTHCOMPLETE (4) DHCP required on AP 18:33:9d:f0:21:80 vapId 2 apVapId 2for this client
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be Not Using WMM Compliance code qosCap 00
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP 18:33:9d:f0:21:80 vapId 2 apVapId 2 flex-acl-name:POSTURE_REDIRECT_ACL 
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 L2AUTHCOMPLETE (4) Change state to DHCP_REQD (7) last state L2AUTHCOMPLETE (4)
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 6166, Adding TMP rule
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 DHCP_REQD (7) Adding Fast Path rule
      type = Airespace AP - Learn IP address
      on AP 18:33:9d:f0:21:80, slot 1, interface = 1, QOS = 0
      IPv4 ACL ID = 255, IPv
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 64206  Local Bridging Vlan = 220, Local Bridging intf id = 0
    *Dot1x_NW_MsgTask_6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255)
    *apfReceiveTask: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 DHCP_REQD (7) State Update from Mobility-Incomplete to Mobility-Complete, mobility role=Local, client state=APF_MS_STATE_ASSOCIATED
    *apfReceiveTask: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 5761, Adding TMP rule
    *apfReceiveTask: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 DHCP_REQD (7) Replacing Fast Path rule
      type = Airespace AP - Learn IP address
      on AP 18:33:9d:f0:21:80, slot 1, interface = 1, QOS = 0
      IPv4 ACL ID = 255, 
    *apfReceiveTask: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 64206  Local Bridging Vlan = 220, Local Bridging intf id = 0
    *apfReceiveTask: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255)
    *pemReceiveTask: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 Added NPU entry of type 9, dtlFlags 0x0
    *pemReceiveTask: Aug 12 10:58:24.418: 00:24:d6:97:b3:be 0.0.0.0 Added NPU entry of type 9, dtlFlags 0x0
    *spamApTask6: Aug 12 10:58:24.418: 00:24:d6:97:b3:be spamEncodeCentralAuthInoMsPayload: msAssocTypeFlagsMsb = 0 msAssocTypeFlagsLsb = 2
    apfMsEntryType = 0 pmkLen = 32
    *DHCP Socket Task: Aug 12 10:58:24.546: 00:24:d6:97:b3:be DHCP received op BOOTREPLY (2) (len 325,vlan 220, port 1, encap 0xec03)
    *DHCP Socket Task: Aug 12 10:58:24.546: 00:24:d6:97:b3:be DHCP setting server from ACK (server 10.0.17.85, yiaddr 10.130.130.120)
    *DHCP Socket Task: Aug 12 10:58:24.548: 00:24:d6:97:b3:be 10.130.130.120 DHCP_REQD (7) Change state to WEBAUTH_REQD (8) last state DHCP_REQD (7)
    *DHCP Socket Task: Aug 12 10:58:24.548: 00:24:d6:97:b3:be 10.130.130.120 WEBAUTH_REQD (8) pemAdvanceState2 6671, Adding TMP rule
    *DHCP Socket Task: Aug 12 10:58:24.548: 00:24:d6:97:b3:be 10.130.130.120 WEBAUTH_REQD (8) Replacing Fast Path rule
      type = Airespace AP Client - ACL passthru
      on AP 18:33:9d:f0:21:80, slot 1, interface = 1, QOS = 0
      IPv4 A
    *DHCP Socket Task: Aug 12 10:58:24.548: 00:24:d6:97:b3:be 10.130.130.120 WEBAUTH_REQD (8) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 64206  Local Bridging Vlan = 220, Local Bridging intf id = 0
    *DHCP Socket Task: Aug 12 10:58:24.548: 00:24:d6:97:b3:be 10.130.130.120 WEBAUTH_REQD (8) Successfully plumbed mobile rule (IPv4 ACL ID 1, IPv6 ACL ID 255, L2 ACL ID 255)
    *DHCP Socket Task: Aug 12 10:58:24.548: 00:24:d6:97:b3:be Plumbing web-auth redirect rule due to user logout
    *DHCP Socket Task: Aug 12 10:58:24.548: 00:24:d6:97:b3:be Assigning Address 10.130.130.120 to mobile 
    *DHCP Socket Task: Aug 12 10:58:24.548: 00:24:d6:97:b3:be DHCP success event for client. Clearing dhcp failure count for interface management.
    *DHCP Socket Task: Aug 12 10:58:24.548: 00:24:d6:97:b3:be DHCP success event for client. Clearing dhcp failure count for interface management.
    *pemReceiveTask: Aug 12 10:58:24.548: 00:24:d6:97:b3:be 10.130.130.120 Added NPU entry of type 2, dtlFlags 0x0
    *IPv6_Msg_Task: Aug 12 10:58:25.330: 00:24:d6:97:b3:be Pushing IPv6 Vlan Intf ID 0: fe80:0000:0000:0000:f524:1910:69f0:9482 , and MAC: 00:24:D6:97:B3:BE , Binding to Data Plane. SUCCESS !! dhcpv6bitmap 0
    *IPv6_Msg_Task: Aug 12 10:58:25.330: 00:24:d6:97:b3:be Link Local address fe80::f524:1910:69f0:9482 updated to mscb. Not Advancing pem state.Current state: mscb in apfMsMmInitial mobility state and client state APF_MS_STATE_A
    *DHCP Socket Task: Aug 12 10:58:28.581: 00:24:d6:97:b3:be DHCP received op BOOTREPLY (2) (len 308,vlan 220, port 1, encap 0xec03)
    *DHCP Socket Task: Aug 12 10:58:28.589: 00:24:d6:97:b3:be DHCP received op BOOTREPLY (2) (len 308,vlan 220, port 1, encap 0xec03)
    *DHCP Socket Task: Aug 12 11:00:07.959: 00:24:d6:97:b3:be DHCP received op BOOTREPLY (2) (len 308,vlan 220, port 1, encap 0xec03)
    *DHCP Socket Task: Aug 12 11:00:07.967: 00:24:d6:97:b3:be DHCP received op BOOTREPLY (2) (len 308,vlan 220, port 1, encap 0xec03)
    *DHCP Socket Task: Aug 12 11:01:59.153: 00:24:d6:97:b3:be DHCP received op BOOTREPLY (2) (len 308,vlan 220, port 1, encap 0xec03)
    Can you see any obvious reason why the NAC agent wont pop up?
    Thanks
    Mario

  • WLC 5508, SW 6.0.199.4, 1142 AP: Clients getting dropped intermittently

    We have deployed a WLC 5508 w/ SW version 6.0.199.4, 1142 AP's & open authentication w/ MAC filtering. Clients are randomly getting dropped with "Limited Access" shown in Win 7. In this state, the client machine is unable to ping the gateway and sometimes lose their DHCP assigned IP as well. A manual disconnect/re-connect to the SSID is required everytime.
    I ran a debug on one the clients stuck in the "Limited Access" state (debug client xx:xx:xx:xx):
    *Apr 15 16:59:23.205: e0:91:53:60:1f:e4 Adding mobile on LWAPP AP 3c:ce:73:c5:1e:b0(0)
    *Apr 15 16:59:23.205: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 23) in 5 seconds
    *Apr 15 16:59:23.205: e0:91:53:60:1f:e4 apfProcessProbeReq (apf_80211.c:4722) Changing state for mobile e0:91:53:60:1f:e4 on AP 3c:ce:73:c5:1e:b0 from Idle to Probe
    *Apr 15 16:59:23.205: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 24) in 5 seconds
    *Apr 15 16:59:23.225: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 24) in 5 seconds
    *Apr 15 16:59:23.225: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 24) in 5 seconds
    *Apr 15 16:59:23.646: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 24) in 5 seconds
    *Apr 15 16:59:23.646: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 24) in 5 seconds
    *Apr 15 16:59:23.666: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 24) in 5 seconds
    *Apr 15 16:59:23.666: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 24) in 5 seconds
    *Apr 15 16:59:28.553: e0:91:53:60:1f:e4 apfMsExpireCallback (apf_ms.c:418) Expiring Mobile!
    *Apr 15 16:59:28.554: e0:91:53:60:1f:e4 0.0.0.0 START (0) Deleted mobile LWAPP rule on AP [3c:ce:73:c5:1e:b0]
    *Apr 15 16:59:28.554: e0:91:53:60:1f:e4 Deleting mobile on AP 3c:ce:73:c5:1e:b0(0)
    On doing a manual re-connect, got the following logs:
    *Apr 15 17:01:38.143: e0:91:53:60:1f:e4 Association received from mobile on AP b8:62:1f:e9:9f:30
    *Apr 15 17:01:38.143: e0:91:53:60:1f:e4 Applying site-specific IPv6 override for station e0:91:53:60:1f:e4 - vapId 7, site 'Academy', interface 'students'
    *Apr 15 17:01:38.143: e0:91:53:60:1f:e4 Applying IPv6 Interface Policy for station e0:91:53:60:1f:e4 - vlan 15, interface id 14, interface 'students'
    *Apr 15 17:01:38.143: e0:91:53:60:1f:e4 Applying site-specific override for station e0:91:53:60:1f:e4 - vapId 7, site 'Academy', interface 'students'
    *Apr 15 17:01:38.143: e0:91:53:60:1f:e4 0.0.0.0 START (0) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1276)
    *Apr 15 17:01:38.143: e0:91:53:60:1f:e4 STA - rates (8): 130 132 139 150 12 18 24 36 0 0 0 0 0 0 0 0
    *Apr 15 17:01:38.143: e0:91:53:60:1f:e4 STA - rates (12): 130 132 139 150 12 18 24 36 48 72 96 108 0 0 0 0
    *Apr 15 17:01:38.143: e0:91:53:60:1f:e4 0.0.0.0 START (0) Deleted mobile LWAPP rule on AP [b8:62:1f:e5:6a:90]
    *Apr 15 17:01:38.144: e0:91:53:60:1f:e4 Updated location for station old AP b8:62:1f:e5:6a:90-0, new AP b8:62:1f:e9:9f:30-0
    *Apr 15 17:01:38.144: e0:91:53:60:1f:e4 apfProcessAssocReq (apf_80211.c:4268) Changing state for mobile e0:91:53:60:1f:e4 on AP b8:62:1f:e9:9f:30 from Probe to AAA Pending
    *Apr 15 17:01:38.144: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 20) in 10 seconds
    *Apr 15 17:01:38.144: e0:91:53:60:1f:e4 0.0.0.0 START (0) Initializing policy
    *Apr 15 17:01:38.144: e0:91:53:60:1f:e4 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state AUTHCHECK (2)
    *Apr 15 17:01:38.144: e0:91:53:60:1f:e4 0.0.0.0 AUTHCHECK (2) Change state to L2AUTHCOMPLETE (4) last state L2AUTHCOMPLETE (4)
    *Apr 15 17:01:38.144: e0:91:53:60:1f:e4 0.0.0.0 L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP b8:62:1f:e9:9f:30 vapId 7 apVapId 2
    *Apr 15 17:01:38.144: e0:91:53:60:1f:e4 0.0.0.0 L2AUTHCOMPLETE (4) Change state to DHCP_REQD (7) last state DHCP_REQD (7)
    *Apr 15 17:01:38.144: e0:91:53:60:1f:e4 apfPemAddUser2 (apf_policy.c:213) Changing state for mobile e0:91:53:60:1f:e4 on AP b8:62:1f:e9:9f:30 from AAA Pending to Associated
    *Apr 15 17:01:38.145: e0:91:53:60:1f:e4 Scheduling deletion of Mobile Station:  (callerId: 49) in 65535 seconds
    *Apr 15 17:01:38.145: e0:91:53:60:1f:e4 Including FT Mobility Domain IE (length 5) in Initial assoc Resp to mobile
    *Apr 15 17:01:38.145: e0:91:53:60:1f:e4 Sending Assoc Response to station on BSSID b8:62:1f:e9:9f:30 (status 0) Vap Id 2 Slot 0
    *Apr 15 17:01:38.145: e0:91:53:60:1f:e4 apfProcessRadiusAssocResp (apf_80211.c:1957) Changing state for mobile e0:91:53:60:1f:e4 on AP b8:62:1f:e9:9f:30 from Associated to Associated
    *Apr 15 17:01:38.189: e0:91:53:60:1f:e4 DHCP received op BOOTREQUEST (1) (len 308, port 13, encap 0xec03)
    *Apr 15 17:01:38.189: e0:91:53:60:1f:e4 DHCP dropping packet due to ongoing mobility handshake exchange, (siaddr 0.0.0.0,  mobility state = 'apfMsMmQueryRequested'
    *Apr 15 17:01:39.953: e0:91:53:60:1f:e4 0.0.0.0 DHCP_REQD (7) State Update from Mobility-Incomplete to Mobility-Complete, mobility role=Local, client state=APF_MS_STATE_ASSOCIATED
    *Apr 15 17:01:39.954: e0:91:53:60:1f:e4 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 4166, Adding TMP rule
    *Apr 15 17:01:39.954: e0:91:53:60:1f:e4 0.0.0.0 DHCP_REQD (7) Adding Fast Path rule
      type = Airespace AP - Learn IP address
      on AP b8:62:1f:e9:9f:30, slot 0, interface = 13, QOS = 0
      ACL Id = 255, Jumbo F
    *Apr 15 17:01:39.954: e0:91:53:60:1f:e4 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (ACL ID 255)
    *Apr 15 17:01:39.954: e0:91:53:60:1f:e4 0.0.0.0 Added NPU entry of type 9, dtlFlags 0x0
    *Apr 15 17:01:39.954: e0:91:53:60:1f:e4 Sent an XID frame
    *Apr 15 17:01:40.807: e0:91:53:60:1f:e4 Orphan Packet from STA - IP 169.254.201.128
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP received op BOOTREQUEST (1) (len 308, port 13, encap 0xec03)
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP processing DHCP DISCOVER (1)
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 0
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP   xid: 0x9b24c896 (2602879126), secs: 1280, flags: 0
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP   chaddr: e0:91:53:60:1f:e4
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP   ciaddr: 0.0.0.0,  yiaddr: 0.0.0.0
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP successfully bridged packet to DS
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP received op BOOTREPLY (2) (len 308, port 13, encap 0xec00)
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP processing DHCP OFFER (2)
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP   xid: 0x9b24c896 (2602879126), secs: 0, flags: 0
    *Apr 15 17:01:43.234: e0:91:53:60:1f:e4 DHCP   chaddr: e0:91:53:60:1f:e4
    *Apr 15 17:01:43.235: e0:91:53:60:1f:e4 DHCP   ciaddr: 0.0.0.0,  yiaddr: 10.6.2.160
    *Apr 15 17:01:43.235: e0:91:53:60:1f:e4 DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *Apr 15 17:01:43.235: e0:91:53:60:1f:e4 DHCP   server id: 10.6.15.254  rcvd server id: 10.6.15.254
    *Apr 15 17:01:43.235: e0:91:53:60:1f:e4 DHCP successfully bridged packet to STA
    *Apr 15 17:01:43.240: e0:91:53:60:1f:e4 DHCP received op BOOTREQUEST (1) (len 316, port 13, encap 0xec03)
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP processing DHCP REQUEST (3)
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 0
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   xid: 0x9b24c896 (2602879126), secs: 1280, flags: 0
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   chaddr: e0:91:53:60:1f:e4
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   ciaddr: 0.0.0.0,  yiaddr: 0.0.0.0
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   requested ip: 10.6.2.160
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   server id: 10.6.15.254  rcvd server id: 10.6.15.254
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP successfully bridged packet to DS
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP received op BOOTREPLY (2) (len 308, port 13, encap 0xec00)
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP processing DHCP ACK (5)
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   xid: 0x9b24c896 (2602879126), secs: 0, flags: 0
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   chaddr: e0:91:53:60:1f:e4
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   ciaddr: 0.0.0.0,  yiaddr: 10.6.2.160
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *Apr 15 17:01:43.241: e0:91:53:60:1f:e4 DHCP   server id: 10.6.15.254  rcvd server id: 10.6.15.254
    *Apr 15 17:01:43.242: e0:91:53:60:1f:e4 10.6.2.160 DHCP_REQD (7) Change state to RUN (20) last state RUN (20)
    *Apr 15 17:01:43.242: e0:91:53:60:1f:e4 10.6.2.160 RUN (20) Reached PLUMBFASTPATH: from line 4972
    *Apr 15 17:01:43.242: e0:91:53:60:1f:e4 10.6.2.160 RUN (20) Replacing Fast Path rule
      type = Airespace AP Client
      on AP b8:62:1f:e9:9f:30, slot 0, interface = 13, QOS = 0
      ACL Id = 255, Jumbo Frames = NO,
    *Apr 15 17:01:43.242: e0:91:53:60:1f:e4 10.6.2.160 RUN (20) Successfully plumbed mobile rule (ACL ID 255)
    *Apr 15 17:01:43.242: e0:91:53:60:1f:e4 Assigning Address 10.6.2.160 to mobile
    *Apr 15 17:01:43.242: e0:91:53:60:1f:e4 DHCP successfully bridged packet to STA
    *Apr 15 17:01:43.242: e0:91:53:60:1f:e4 10.6.2.160 Added NPU entry of type 1, dtlFlags 0x0
    *Apr 15 17:01:43.242: e0:91:53:60:1f:e4 Sending a gratuitous ARP for 10.6.2.160, VLAN Id 15
    *Apr 15 17:01:46.428: e0:91:53:60:1f:e4 DHCP received op BOOTREQUEST (1) (len 308, port 13, encap 0xec03)
    *Apr 15 17:01:46.428: e0:91:53:60:1f:e4 DHCP processing DHCP INFORM (8)
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 0
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   xid: 0xbb0d5d87 (3138215303), secs: 0, flags: 0
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   chaddr: e0:91:53:60:1f:e4
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   ciaddr: 10.6.2.160,  yiaddr: 0.0.0.0
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP successfully bridged packet to DS
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP received op BOOTREPLY (2) (len 308, port 13, encap 0xec00)
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP processing DHCP ACK (5)
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   xid: 0xbb0d5d87 (3138215303), secs: 0, flags: 0
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   chaddr: e0:91:53:60:1f:e4
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   ciaddr: 10.6.2.160,  yiaddr: 0.0.0.0
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *Apr 15 17:01:46.429: e0:91:53:60:1f:e4 DHCP   server id: 10.6.15.254  rcvd server id: 10.6.15.254
    show client e0:91:53:60:1f:e4 (after re-connect)
    (Cisco Controller) >show client detail e0:91:53:60:1f:e4
    Client MAC Address............................... e0:91:53:60:1f:e4
    Client Username ................................. N/A
    AP MAC Address................................... b8:62:1f:e9:9f:30
    Client State..................................... Associated    
    Client NAC OOB State............................. Access
    Wireless LAN Id.................................. 7 
    BSSID............................................ b8:62:1f:e9:9f:31 
    Connected For ................................... 105 secs
    Channel.......................................... 11
    IP Address....................................... 10.6.2.160
    Association Id................................... 8 
    Authentication Algorithm......................... Open System
    Reason Code...................................... 1 
    Status Code...................................... 0 
    Session Timeout.................................. 65535
    Client CCX version............................... No CCX support
    QoS Level........................................ Silver
    Diff Serv Code Point (DSCP)...................... disabled
    802.1P Priority Tag.............................. disabled
    WMM Support...................................... Enabled
    U-APSD Support................................... Disabled
    Power Save....................................... OFF
    Current Rate..................................... m7
    Supported Rates.................................. 1.0,2.0,5.5,11.0,6.0,9.0,
        ............................................. 12.0,18.0,24.0,36.0,48.0,
        ............................................. 54.0
    Mobility State................................... Local
    Mobility Move Count.............................. 0
    Security Policy Completed........................ Yes
    Policy Manager State............................. RUN
    Policy Manager Rule Created...................... Yes
    ACL Name......................................... none
    ACL Applied Status............................... Unavailable
    Policy Type...................................... N/A
    Encryption Cipher................................ None
    Management Frame Protection...................... No
    EAP Type......................................... Unknown
    Interface........................................ students
    VLAN............................................. 15
    Quarantine VLAN.................................. 0
    Access VLAN...................................... 15
    Client Capabilities:
          CF Pollable................................ Not implemented
          CF Poll Request............................ Not implemented
          Short Preamble............................. Implemented
          PBCC....................................... Not implemented
          Channel Agility............................ Not implemented
          Listen Interval............................ 1
          Fast BSS Transition........................ Not implemented
    Fast BSS Transition Details:
    Client Statistics:
          Number of Bytes Received................... 36509
          Number of Bytes Sent....................... 32902
          Number of Packets Received................. 300
          Number of Packets Sent..................... 66
          Number of EAP Id Request Msg Timeouts...... 0
          Number of EAP Request Msg Timeouts......... 0
          Number of EAP Key Msg Timeouts............. 0
          Number of Data Retries..................... 95
          Number of RTS Retries...................... 0
          Number of Duplicate Received Packets....... 1
          Number of Decrypt Failed Packets........... 0
          Number of Mic Failured Packets............. 0
          Number of Mic Missing Packets.............. 0
          Number of Policy Errors.................... 0
          Radio Signal Strength Indicator............ -66 dBm
          Signal to Noise Ratio...................... 29 dB
    Nearby AP Statistics:
          APSOEBFF_COR3(slot 0) .....................
    antenna0: 50 seconds ago -91 dBm................. antenna1: 50 seconds ago -76 dBm
          APSOEAFF_FAC(slot 0) ......................
    antenna0: 108 seconds ago -89 dBm................ antenna1: 108 seconds ago -87 dBm
          APSOEBGF_FAC(slot 0) ......................
    antenna0: 50 seconds ago -82 dBm................. antenna1: 50 seconds ago -71 dBm
          APSOEBGF_STAFF(slot 0) ....................
    antenna0: 49 seconds ago -74 dBm................. antenna1: 49 seconds ago -58 dBm
    WLAN config
    WLAN Identifier.................................. 9
    Profile Name..................................... STAFF
    Network Name (SSID).............................. STAFF
    Status........................................... Enabled
    MAC Filtering.................................... Enabled
    Broadcast SSID................................... Enabled
    AAA Policy Override.............................. Disabled
    Network Admission Control
      NAC-State...................................... Disabled
      Quarantine VLAN................................ 0
    Number of Active Clients......................... 32
    Exclusionlist.................................... Disabled
    Session Timeout.................................. Infinity
    CHD per WLAN..................................... Disabled
    Webauth DHCP exclusion........................... Disabled
    Interface........................................ staff
    WLAN ACL......................................... unconfigured
    DHCP Server...................................... Default
    DHCP Address Assignment Required................. Disabled
    Quality of Service............................... Silver (best effort)
    Scan Defer Priority.............................. 5,6
    Scan Defer Time.................................. 100 milliseconds
    WMM.............................................. Allowed
    Media Stream Multicast-direct.................... Disabled
    CCX - AironetIe Support.......................... Enabled
    CCX - Gratuitous ProbeResponse (GPR)............. Disabled
    CCX - Diagnostics Channel Capability............. Disabled
    Dot11-Phone Mode (7920).......................... Disabled
    Wired Protocol................................... None
    IPv6 Support..................................... Disabled
    Peer-to-Peer Blocking Action..................... Disabled
    Radio Policy..................................... All
    DTIM period for 802.11a radio.................... 1
    DTIM period for 802.11b radio.................... 1
    Radius Servers
       Authentication................................ Disabled
       Accounting.................................... Disabled
       Dynamic Interface............................. Disabled
    Local EAP Authentication......................... Disabled
    Security
       802.11 Authentication:........................ Open System
       Static WEP Keys............................... Disabled
       802.1X........................................ Disabled
       Wi-Fi Protected Access (WPA/WPA2)............. Disabled
       CKIP ......................................... Disabled
       Web Based Authentication...................... Disabled
       Web-Passthrough............................... Disabled
       Conditional Web Redirect...................... Disabled
       Splash-Page Web Redirect...................... Disabled
       Auto Anchor................................... Disabled
       H-REAP Local Switching........................ Disabled
       H-REAP Learn IP Address....................... Enabled
       Infrastructure MFP protection................. Enabled (Global Infrastructure MFP Disabled)
       Client MFP.................................... Optional but inactive (WPA2 not configured)
       Tkip MIC Countermeasure Hold-down Timer....... 60
    Call Snooping.................................... Disabled
    Band Select...................................... Disabled
    Load Balancing................................... Disabled
    HELPPPP!

    We have 75 evenly distributed AP's servicing the 500 odd users. Found the below traps on WLC. I was making some changes in the WLAN settings at the time:
    Tue Apr 16 00:03:45 2013          Client Excluded: MACAddress:8c:a9:82:5d:d2:dc Base Radio MAC :3c:ce:73:c6:fe:00 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    106          Tue Apr 16 00:03:45 2013          Client Excluded: MACAddress:58:94:6b:f2:24:c8 Base Radio MAC :c8:f9:f9:4c:01:30 Slot: 1 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    107          Tue Apr 16 00:03:45 2013          Client Excluded: MACAddress:bc:77:37:72:dc:0b Base Radio MAC :3c:ce:73:c6:53:10 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    108          Tue Apr 16 00:03:45 2013          Client Excluded: MACAddress:00:26:c7:7d:12:76 Base Radio MAC :3c:ce:73:c4:79:80 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    109          Tue Apr 16 00:03:45 2013          Client Excluded: MACAddress:bc:77:37:75:1f:93 Base Radio MAC :c8:f9:f9:2b:85:30 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    110          Tue Apr 16 00:03:45 2013          Client Excluded: MACAddress:ac:72:89:58:8e:b9 Base Radio MAC :3c:ce:73:c6:53:10 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    111          Tue Apr 16 00:03:44 2013          Client Excluded: MACAddress:bc:77:37:26:cd:e3 Base Radio MAC :3c:ce:73:c5:1f:10 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    112          Tue Apr 16 00:03:44 2013          Client Excluded: MACAddress:ac:72:89:25:ea:e0 Base Radio MAC :3c:ce:73:c6:77:70 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    113          Tue Apr 16 00:03:44 2013          Client Excluded: MACAddress:00:24:2c:6a:85:3d Base Radio MAC :3c:ce:73:c6:6a:50 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    114          Tue Apr 16 00:03:44 2013          Client Excluded: MACAddress:68:5d:43:61:16:51 Base Radio MAC :3c:ce:73:f6:0c:20 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2
    115          Tue Apr 16 00:03:44 2013          Client Excluded: MACAddress:7c:d1:c3:8a:64:f6 Base Radio MAC :3c:ce:73:c4:74:20 Slot: 1 User Name: unknown Ip Address: unknown Reason:802.11 Association failed repeatedly. ReasonCode: 2

  • Deployment of WLC-5508 with 2702i-D have performance issue.

    Hi Team,
    We have centrally deployed WLC-5508 with 50 AP licence along with HA scenario. we have 3 locations.
    1- HQ. have 26 AP with POWINJ5.
    2- Branch location A- 8 AP with POWINJ5.
    3. Branch location B have 8 AP with POWINJ4.
    my exception is to achieve that  single SSID with dynamic VLAN from group police (NPS). MY HO have 26 AP and those are working in local mode.
    and branches are connected through flexconnect mode. and all are working with different-2 NPS. 
    Now i am facing a problem with this deployment are following.
    1- branch A have performance issue.
    2- HQ have performance issue.
    3- i don't want to go with dedicated NPS for every location. 
    In order to achieve this deployment i want only single SSID with primary and secondary NPS at my HQ with dynamic VLAN for respective departmental users vlans..
    above is my problem and concern. otherwise i am successfully achieving this solution with dedicated NPS with single group policy. but when i am going forward to achieve my expectation that time i am facing authentication issue at my HQ and sometimes am not able to get proper VLAN IPs. at my HQ. 
    kindly help me in that to understand where I am doing wrong things to achieve my expectation. 
    Thanks.
    Nalin    

    I am facing 2 different problems.
    1st issue- in existing setup we have throughput issue. (while downloading or uploading any data from the internet or Intranet,  that time wireless clients are facing slowness of the Speed. and same time when i am trying from LAN i am not facing any issue)
    2nd Issue- I want to achieve only single SSID with primary and secondary NPS (AD group is bind with vlan Attributes) with dynamic VLAN for respective departmental users.
    for Issue no 2 i have created SSID to achieve the single ssid parameter for every location. in order to achieve i have change all access points mode local to Flexconnect mode after that i have created AP groups location wise and then create flexconnect Groups where i have mapped all the vlan through AAA VLAN-ACL mapping. created interface group and mapped all the vlans in that group. 
    for more understanding please go through the below mentioned CLI view.
    Cisco Controller) >show wlan apgroups
    Total Number of AP Groups........................ 4
    Site Name........................................ GURGAON-AP-GROUP
    Site Description................................. GURGAON-AP-GROUP
    Venue Group Code................................. Unspecified
    Venue Type Code.................................. Unspecified
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Pol                                                                                        icy
     3               gurgaon-interface    Disabled                          None
    --More-- or (q)uit
     4               gurgaon-guest        Disabled                          None
    *AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
    AP Name             Slots  AP Model             Ethernet MAC       Location          Port  Country  Priority
    GUR-AP-01            2     AIR-CAP2702I-D-K9    f4:4e:05:78:ae:e4  default location  1     IN       1
    GUR-AP-05            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b5:18  default location  1     IN       1
    GUR-AP-03            2     AIR-CAP2702I-D-K9    bc:16:65:13:71:00  default location  1     IN       1
    GUR-AP-07            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b3:f8  default location  1     IN       1
    GUR-AP-06            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b3:e0  default location  1     IN       1
    GUR-AP-08            2     AIR-CAP2702I-D-K9    f4:4e:05:45:78:98  default location  1     IN       1
    GUR-AP-02            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b3:2c  default location  1     IN       1
    GUR-AP-04            2     AIR-CAP2702I-D-K9    f4:4e:05:78:ae:64  default location  1     IN       1
    GUR-AP-09            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b4:44  default location  1     IN       1
    Site Name........................................ MUMBAI-AP-GROUP
    Site Description................................. MUMBAI-AP-GROUP
    Venue Group Code................................. Unspecified
    Venue Type Code.................................. Unspecified
    --More-- or (q)uit
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Policy
     1               group for mumbai     Disabled                          None
     2               guest wifi           Disabled                          None
    *AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
    AP Name             Slots  AP Model             Ethernet MAC       Location          Port  Country  Priority
    FAL-7-AP08           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:24:d8         7th Floor  1     IN       3
    --More-- or (q)uit
    FAL-7-AP10           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:18         7th Floor  1     IN       1
    FAL-7-AP14           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:ad:e8         7th Floor  1     IN       1
    FAL-7-AP01           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:b0:4c         7th Floor  1     IN       1
    FAL-7-AP07           2     AIR-CAP2702I-D-K9    f0:7f:06:30:92:bc         7th Floor  1     IN       1
    FAL-7-AP13           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:80         7th Floor  1     IN       1
    FAL-7-AP02           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:94         7th Floor  1     IN       1
    FAL-7-AP05           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:e8         7th Floor  1     IN       1
    FAL-7-AP12           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:f0         7th Floor  1     IN       3
    FAL-7-AP03           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:e4         7th Floor  1     IN       1
    FAL-7-AP06           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:84         7th Floor  1     IN       3
    FAL-7-AP04           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:b0:14         7th Floor  1     IN       1
    FAL-7-AP09           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b4:c8         7th Floor  1     IN       3
    FAL-7-AP11           2     AIR-CAP2702I-D-K9    f0:7f:06:30:93:08         7th Floor  1     IN       1
    Site Name........................................ MUMBAI-THIRD-FLOOR-AP
    Site Description................................. MUMBAI-THIRD-FLOOR-AP
    Venue Group Code................................. Unspecified
    Venue Type Code.................................. Unspecified
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    --More-- or (q)uit
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Policy
     1               group for mumbai     Disabled                          None
     2               guest wifi           Disabled                          None
    *AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
    AP Name             Slots  AP Model             Ethernet MAC       Location          Port  Country  Priority
    FAL-3-AP07           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:a4         3rd Floor  1     IN       3
    FAL-3-AP09           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:94         3rd Floor  1     IN       3
    FAL-3-AP11           2     AIR-CAP2702I-D-K9    f4:0f:1b:73:00:74  3rd Floor- Eurek  1     IN       3
    FAL-3-AP06           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:ae:d0         3rd Floor  1     IN       3
    --More-- or (q)uit
    FAL-3-AP10           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b5:88         3rd Floor  1     IN       3
    FAL-3-AP08           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b4:9c         3rd Floor  1     IN       3
    FAL-3-AP03           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:af:a0         3rd Floor  1     IN       1
    FAL-3-AP12           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b3:fc  3rd Floor- Eurek  1     IN       3
    FAL-3-AP02           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:28         3rd Floor  1     IN       3
    FAL-3-AP01           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b4:f4         3rd Floor  1     IN       3
    FAL-3-AP04           2     AIR-CAP2702I-D-K9    f0:7f:06:30:92:8c         3rd Floor  1     IN       2
    FAL-3-AP05           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:f4         3rd Floor  1     IN       3
    Site Name........................................ RAHEJA-AP-GROUP
    Site Description................................. RAHEJA-AP-GROUP
    Venue Group Code................................. Unspecified
    Venue Type Code.................................. Unspecified
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    --More-- or (q)uit
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Policy
     5               raheja-interface     Disabled                          None
     2               raheja-guest         Disabled                          None
    *AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
    AP Name             Slots  AP Model             Ethernet MAC       Location          Port  Country  Priority
    FAL-RAHEJA-AP04      2     AIR-CAP2702I-D-K9    f0:7f:06:8d:24:1c  Near Meeting Roo  1     IN       3
    FAL-RAHEJA-AP02      2     AIR-CAP2702I-D-K9    f0:7f:06:8d:37:3c   Confrennce Room  1     IN       3
    FAL-RAHEJA-AP03      2     AIR-CAP2702I-D-K9    f0:7f:06:30:93:48  Near Confrence R  1     IN       3
    FAL-RAHEJA-AP05      2     AIR-CAP2702I-D-K9    f0:7f:06:bf:ae:c0  Near Meeting Roo  1     IN       3
    FAL-RAHEJA-AP06      2     AIR-CAP2702I-D-K9    f0:7f:06:92:b3:a0  Near Server Room  1     IN       3
    FAL-RAHEJA-AP01      2     AIR-CAP2702I-D-K9    f0:7f:06:92:b3:20    Reception Area  1     IN       3
    FAL-RAHEJA-AP08      2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:68  USER BAY ROAD si  1     IN       1
    FAL-RAHEJA-AP09      2     AIR-CAP2702I-D-K9    f0:7f:06:92:b4:d4     Training Room  1     IN       1
    --More-- or (q)uit
    Site Name........................................ default-group
    Site Description................................. <none>
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Policy
     1               group for mumbai     Disabled                          None
     2               guest wifi           Disabled                          None
     3               gurgaon-interface    Disabled                          None
     4               gurgaon-guest        Disabled                          None
     5               raheja-interface     Disabled                          None
     6               test                 Disabled                          None
    Cisco Controller) >show flexconnect group summary
    FlexConnect Group Summary: Count: 4
    Group Name                # Aps
    Gurgaon-AP                         9
    HQ-3RD-FLR-AP-GROUP                        12
    HQ-7THFLR-AP-GROUP                         14
    Raheja-AP-Group                            8
    (Cisco Controller) >show flexconnect group detail Gurgaon-AP
    Number of AP's in Group: 9
    bc:16:65:13:71:00    GUR-AP-03     Joined    Flexconnect
    f4:4e:05:45:78:98    GUR-AP-08     Joined    Flexconnect
    f4:4e:05:78:ae:64    GUR-AP-04     Joined    Flexconnect
    f4:4e:05:78:ae:e4    GUR-AP-01     Joined    Flexconnect
    f4:4e:05:80:b3:2c    GUR-AP-02     Joined    Flexconnect
    f4:4e:05:80:b3:e0    GUR-AP-06     Joined    Flexconnect
    f4:4e:05:80:b3:f8    GUR-AP-07     Joined    Flexconnect
    f4:4e:05:80:b4:44    GUR-AP-09     Joined    Flexconnect
    f4:4e:05:80:b5:18    GUR-AP-05     Joined    Flexconnect
    Efficient AP Image Upgrade ..... Disabled
    Master-AP-Mac     Master-AP-Name                    Model      Manual
    Group Radius Servers Settings:
    Type           Server Address    Port
                                             Primary       Unconfigured      Unconfigured
                                                                                          Secondary     Unconfigured      Unconfigured
    --More-- or (q)uit
    Group Radius AP Settings:
    AP RADIUS server............ Disabled
    EAP-FAST Auth............... Disabled
    LEAP Auth................... Disabled
    EAP-TLS Auth................ Disabled
    EAP-TLS CERT Download....... Disabled
    PEAP Auth................... Disabled
    Server Key Auto Generated... No
    Server Key..................     <hidden>
    Authority ID................ 436973636f0000000000000000000000
    Authority Info.............. Cisco A_ID
    PAC Timeout................. 0
    Multicast on Overridden interface config: Disabled
    DHCP Broadcast Overridden interface config: Disabled
    Number of User's in Group: 0
    Vlan :........................................... 203
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 205
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 204
    --More-- or (q)uit
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 206
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 207
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 208
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 209
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 210
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 211
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 212
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    --More-- or (q)uit
    Vlan :........................................... 216
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 217
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 218
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Group-Specific FlexConnect Wlan-Vlan Mapping:
    WLAN ID     Vlan ID
    WLAN ID   SSID                            Central-Dhcp  Dns-Override  Nat-Pat
    (Cisco Controller) >
    (Cisco Controller) >show wlan summary
    Number of WLANs.................................. 6
    WLAN ID  WLAN Profile Name / SSID               Status    Interface Name        PMIPv6 Mobility
    1        FRACTAL-EMP-MUMBAI / FRACTAL           Enabled   group for mumbai      none
    2        FRACTAL-GUEST / FRACTAL-GUEST          Enabled   guest wifi            none
    3        FRACTAL-EMP-GURGAON / FRACTAL-GURGAON  Enabled   gurgaon-interface     none
    4        GURGAON-GUEST / FRACTAL-GUEST-GURGAON  Enabled   gurgaon-guest         none
    5        RAHEJA-EMP-WIRELESS / FRACTAL-R        Enabled   raheja-interface      none
    6        TEST-SSID / TEST-SSID                  Enabled   test                  none
    hope this will give you proper understanding.  

  • IPhones not taking ipv4 addresses on Unified Wireless (WLC 5508 and AP 3602)

    This is a really odd one...
    Earlier this week we started having issues with our BYOD wireless network (802.1x, WPA2+AES) but only with Apple devices (iphone and ipad). Employees with Android or Windows phones are not having any problems at all.
    A brief summary of what's observable for the issue:
    Radius authentication succeeds (PASS observable in ACS logs)
    IPhone status viewed on both controllers (foreign anchor in DMZ as well as corporate WLC) shows phone associated.
    Debug client output shows an IPv4 address is actually being assigned to the phone however it appears to ignore it and restart the DHCP request process so debug output shows what looks to be a loop of DHCP request and offer stages.
    Infrastructure notes
    Cisco WLC 5508s are all running 7.4.121.0 (tried rolling back to 7.2.110.0 .....didn't help)
    APs are all 3602I-N-K9
    DHCP for the BYOD network is running on the anchor in the DMZ however this was temporarily moved to a switch (had no effect).
    Any ideas?
    DHCP Loop:
    *mmListen: Apr 30 11:44:50.476: a4:c3:61:7a:1a:4f 0.0.0.0 RUN (20) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 15206  Local Bridging Vlan = 93, Local Bridging intf id = 12
    *mmListen: Apr 30 11:44:50.476: a4:c3:61:7a:1a:4f 0.0.0.0 RUN (20) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255)
    *pemReceiveTask: Apr 30 11:44:50.476: a4:c3:61:7a:1a:4f Set bi-dir guest tunnel for a4:c3:61:7a:1a:4f as in Export Anchor role
    *pemReceiveTask: Apr 30 11:44:50.476: a4:c3:61:7a:1a:4f 0.0.0.0 Added NPU entry of type 1, dtlFlags 0x4
    *pemReceiveTask: Apr 30 11:44:50.476: a4:c3:61:7a:1a:4f Pushing IPv6: fe80:0000:0000:0000: 0c00:0c94:459e:a9db , and MAC: A4:C3:61:7A:1A:4F , Binding to Data Plane. SUCCESS !!
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP received op BOOTREQUEST (1) (len 308,vlan 92, port 13, encap 0xec05)
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP selecting relay 1 - control block settings:
                            dhcpServer: 172.24.13.251, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 172.24.16.251  VLAN: 93
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP selected relay 1 - 172.24.13.251 (local address 172.24.16.251, gateway 172.24.16.254, VLAN 93, port 13)
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP transmitting DHCP DISCOVER (1)
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 1
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP   xid: 0x7e549f4a (2119475018), secs: 0, flags: 0
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP   chaddr: a4:c3:61:7a:1a:4f
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP   ciaddr: 0.0.0.0,  yiaddr: 0.0.0.0
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP   siaddr: 0.0.0.0,  giaddr: 172.24.16.251
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP selecting relay 2 - control block settings:
                            dhcpServer: 172.24.13.251, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 172.24.16.251  VLAN: 93
    *DHCP Socket Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP selected relay 2 - NONE
    *DHCP Proxy Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP received op BOOTREPLY (2) (len 572,vlan 0, port 0, encap 0x0)
    *DHCP Proxy Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP sending packet in EoIP tunnel to foreign 10.65.31.8 (len 346)
    *DHCP Proxy Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP transmitting DHCP OFFER (2)
    *DHCP Proxy Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
    *DHCP Proxy Task: Apr 30 11:44:50.479: a4:c3:61:7a:1a:4f DHCP   xid: 0x7e549f4a (2119475018), secs: 0, flags: 0
    *DHCP Proxy Task: Apr 30 11:44:50.480: a4:c3:61:7a:1a:4f DHCP   chaddr: a4:c3:61:7a:1a:4f
    *DHCP Proxy Task: Apr 30 11:44:50.480: a4:c3:61:7a:1a:4f DHCP   ciaddr: 0.0.0.0,  yiaddr: 172.24.16.102
    *DHCP Proxy Task: Apr 30 11:44:50.480: a4:c3:61:7a:1a:4f DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *DHCP Proxy Task: Apr 30 11:44:50.480: a4:c3:61:7a:1a:4f DHCP   server id: 0.0.0.0  rcvd server id: 172.24.13.251
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP received op BOOTREQUEST (1) (len 308,vlan 92, port 13, encap 0xec05)
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP selecting relay 1 - control block settings:
                            dhcpServer: 172.24.13.251, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 172.24.16.251  VLAN: 93
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP selected relay 1 - 172.24.13.251 (local address 172.24.16.251, gateway 172.24.16.254, VLAN 93, port 13)
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP transmitting DHCP DISCOVER (1)
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 1
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP   xid: 0x7e549f4a (2119475018), secs: 1, flags: 0
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP   chaddr: a4:c3:61:7a:1a:4f
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP   ciaddr: 0.0.0.0,  yiaddr: 0.0.0.0
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP   siaddr: 0.0.0.0,  giaddr: 172.24.16.251
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP selecting relay 2 - control block settings:
                            dhcpServer: 172.24.13.251, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 172.24.16.251  VLAN: 93
    *DHCP Socket Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP selected relay 2 - NONE
    *DHCP Proxy Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP received op BOOTREPLY (2) (len 572,vlan 0, port 0, encap 0x0)
    *DHCP Proxy Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP sending packet in EoIP tunnel to foreign 10.65.31.8 (len 346)
    *DHCP Proxy Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP transmitting DHCP OFFER (2)
    *DHCP Proxy Task: Apr 30 11:44:51.649: a4:c3:61:7a:1a:4f DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
    *DHCP Proxy Task: Apr 30 11:44:51.650: a4:c3:61:7a:1a:4f DHCP   xid: 0x7e549f4a (2119475018), secs: 0, flags: 0
    *DHCP Proxy Task: Apr 30 11:44:51.650: a4:c3:61:7a:1a:4f DHCP   chaddr: a4:c3:61:7a:1a:4f
    *DHCP Proxy Task: Apr 30 11:44:51.650: a4:c3:61:7a:1a:4f DHCP   ciaddr: 0.0.0.0,  yiaddr: 172.24.16.102
    *DHCP Proxy Task: Apr 30 11:44:51.650: a4:c3:61:7a:1a:4f DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *DHCP Proxy Task: Apr 30 11:44:51.650: a4:c3:61:7a:1a:4f DHCP   server id: 0.0.0.0  rcvd server id: 172.24.13.251
    *DHCP Socket Task: Apr 30 11:44:53.754: a4:c3:61:7a:1a:4f DHCP received op BOOTREQUEST (1) (len 308,vlan 92, port 13, encap 0xec05)
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP selecting relay 1 - control block settings:
                            dhcpServer: 172.24.13.251, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 172.24.16.251  VLAN: 93
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP selected relay 1 - 172.24.13.251 (local address 172.24.16.251, gateway 172.24.16.254, VLAN 93, port 13)
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP transmitting DHCP DISCOVER (1)
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 1
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   xid: 0x7e549f4a (2119475018), secs: 3, flags: 0
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   chaddr: a4:c3:61:7a:1a:4f
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   ciaddr: 0.0.0.0,  yiaddr: 0.0.0.0
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   siaddr: 0.0.0.0,  giaddr: 172.24.16.251
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP selecting relay 2 - control block settings:
                            dhcpServer: 172.24.13.251, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 172.24.16.251  VLAN: 93
    *DHCP Socket Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP selected relay 2 - NONE
    *DHCP Proxy Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP received op BOOTREPLY (2) (len 572,vlan 0, port 0, encap 0x0)
    *DHCP Proxy Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP sending packet in EoIP tunnel to foreign 10.65.31.8 (len 346)
    *DHCP Proxy Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP transmitting DHCP OFFER (2)
    *DHCP Proxy Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
    *DHCP Proxy Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   xid: 0x7e549f4a (2119475018), secs: 0, flags: 0
    *DHCP Proxy Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   chaddr: a4:c3:61:7a:1a:4f
    *DHCP Proxy Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   ciaddr: 0.0.0.0,  yiaddr: 172.24.16.102
    *DHCP Proxy Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *DHCP Proxy Task: Apr 30 11:44:53.755: a4:c3:61:7a:1a:4f DHCP   server id: 0.0.0.0  rcvd server id: 172.24.13.251
    *DHCP Socket Task: Apr 30 11:44:58.594: a4:c3:61:7a:1a:4f DHCP received op BOOTREQUEST (1) (len 308,vlan 92, port 13, encap 0xec05)
    *DHCP Socket Task: Apr 30 11:44:58.594: a4:c3:61:7a:1a:4f DHCP selecting relay 1 - control block settings:
                            dhcpServer: 172.24.13.251, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 172.24.16.251  VLAN: 93
    *DHCP Socket Task: Apr 30 11:44:58.594: a4:c3:61:7a:1a:4f DHCP selected relay 1 - 172.24.13.251 (local address 172.24.16.251, gateway 172.24.16.254, VLAN 93, port 13)
    *DHCP Socket Task: Apr 30 11:44:58.594: a4:c3:61:7a:1a:4f DHCP transmitting DHCP DISCOVER (1)
    *DHCP Socket Task: Apr 30 11:44:58.594: a4:c3:61:7a:1a:4f DHCP   op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 1
    *DHCP Socket Task: Apr 30 11:44:58.594: a4:c3:61:7a:1a:4f DHCP   xid: 0x7e549f4a (2119475018), secs: 8, flags: 0
    *DHCP Socket Task: Apr 30 11:44:58.594: a4:c3:61:7a:1a:4f DHCP   chaddr: a4:c3:61:7a:1a:4f
    *DHCP Socket Task: Apr 30 11:44:58.594: a4:c3:61:7a:1a:4f DHCP   ciaddr: 0.0.0.0,  yiaddr: 0.0.0.0
    *DHCP Socket Task: Apr 30 11:44:58.594: a4:c3:61:7a:1a:4f DHCP   siaddr: 0.0.0.0,  giaddr: 172.24.16.251
    *DHCP Socket Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP selecting relay 2 - control block settings:
                            dhcpServer: 172.24.13.251, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 172.24.16.251  VLAN: 93
    *DHCP Socket Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP selected relay 2 - NONE
    *DHCP Proxy Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP received op BOOTREPLY (2) (len 572,vlan 0, port 0, encap 0x0)
    *DHCP Proxy Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP sending packet in EoIP tunnel to foreign 10.65.31.8 (len 346)
    *DHCP Proxy Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP transmitting DHCP OFFER (2)
    *DHCP Proxy Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
    *DHCP Proxy Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP   xid: 0x7e549f4a (2119475018), secs: 0, flags: 0
    *DHCP Proxy Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP   chaddr: a4:c3:61:7a:1a:4f
    *DHCP Proxy Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP   ciaddr: 0.0.0.0,  yiaddr: 172.24.16.102
    *DHCP Proxy Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP   siaddr: 0.0.0.0,  giaddr: 0.0.0.0
    *DHCP Proxy Task: Apr 30 11:44:58.595: a4:c3:61:7a:1a:4f DHCP   server id: 0.0.0.0  rcvd server id: 172.24.13.251
    *DHCP Socket Task: Apr 30 11:45:07.059: a4:c3:61:7a:1a:4f DHCP received op BOOTREQUEST (1) (len 308,vlan 92, port 13, encap 0xec05)
    *DHCP Socket Task: Apr 30 11:45:07.059: a4:c3:61:7a:1a:4f DHCP selecting relay 1 - control block settings:
                            dhcpServer: 172.24.13.251, dhcpNetmask: 0.0.0.0,

    Thanks Scott,  here you go...
    On Foreign:
    WLAN Identifier.................................. 2
    Profile Name..................................... BAI-Beta
    Network Name (SSID).............................. BAI-Beta
    Status........................................... Enabled
    MAC Filtering.................................... Disabled
    Broadcast SSID................................... Disabled
    AAA Policy Override.............................. Disabled
    Network Admission Control
      Client Profiling Status ....................... Disabled
       DHCP ......................................... Disabled
       HTTP ......................................... Disabled
      Radius-NAC State............................... Disabled
      SNMP-NAC State................................. Disabled
      Quarantine VLAN................................ 0
    Maximum number of Associated Clients............. 0
    Maximum number of Clients per AP Radio........... 200
    Number of Active Clients......................... 42
    Exclusionlist Timeout............................ 60 seconds
    Session Timeout.................................. 86400 seconds
    User Idle Timeout................................ 300 seconds
    --More-- or (q)uit
    User Idle Threshold.............................. 0 Bytes
    NAS-identifier................................... CHTWLC
    CHD per WLAN..................................... Enabled
    Webauth DHCP exclusion........................... Disabled
    Interface........................................ management
    Multicast Interface.............................. Not Configured
    WLAN IPv4 ACL.................................... unconfigured
    WLAN IPv6 ACL.................................... unconfigured
    mDNS Status...................................... Enabled
    mDNS Profile Name................................ default-mdns-profile
    DHCP Server...................................... Default
    DHCP Address Assignment Required................. Enabled
    Static IP client tunneling....................... Disabled
    PMIPv6 Mobility Type............................. none
    Quality of Service............................... Bronze
    Per-SSID Rate Limits............................. Upstream      Downstream
    Average Data Rate................................   0             0
    Average Realtime Data Rate.......................   0             0
    Burst Data Rate..................................   0             0
    Burst Realtime Data Rate.........................   0             0
    Per-Client Rate Limits........................... Upstream      Downstream
    Average Data Rate................................   0             0
    Average Realtime Data Rate.......................   0             0
    --More-- or (q)uit
    Burst Data Rate..................................   0             0
    Burst Realtime Data Rate.........................   0             0
    Scan Defer Priority.............................. 5,6
    Scan Defer Time.................................. 100 milliseconds
    WMM.............................................. Disabled
    WMM UAPSD Compliant Client Support............... Disabled
    Media Stream Multicast-direct.................... Disabled
    CCX - AironetIe Support.......................... Enabled
    CCX - Gratuitous ProbeResponse (GPR)............. Disabled
    CCX - Diagnostics Channel Capability............. Disabled
    Dot11-Phone Mode (7920).......................... Disabled
    Wired Protocol................................... None
    Passive Client Feature........................... Disabled
    Peer-to-Peer Blocking Action..................... Disabled
    Radio Policy..................................... All
    DTIM period for 802.11a radio.................... 1
    DTIM period for 802.11b radio.................... 1
    Radius Servers
       Authentication................................ 172.24.13.20 1812
       Accounting.................................... Disabled
       Dynamic Interface............................. Disabled
       Dynamic Interface Priority.................... wlan
    Local EAP Authentication......................... Disabled
    --More-- or (q)uit
    Security
       802.11 Authentication:........................ Open System
       FT Support.................................... Disabled
       Static WEP Keys............................... Disabled
       802.1X........................................ Disabled
       Wi-Fi Protected Access (WPA/WPA2)............. Enabled
          WPA (SSN IE)............................... Disabled
          WPA2 (RSN IE).............................. Enabled
             TKIP Cipher............................. Disabled
             AES Cipher.............................. Enabled
                                                                   Auth Key Management
             802.1x.................................. Enabled
             PSK..................................... Disabled
             CCKM.................................... Disabled
             FT-1X(802.11r).......................... Disabled
             FT-PSK(802.11r)......................... Disabled
             PMF-1X(802.11w)......................... Disabled
             PMF-PSK(802.11w)........................ Disabled
          FT Reassociation Timeout................... 20
          FT Over-The-DS mode........................ Enabled
          GTK Randomization.......................... Disabled
          SKC Cache Support.......................... Disabled
    --More-- or (q)uit
          CCKM TSF Tolerance......................... 1000
       WAPI.......................................... Disabled
       Wi-Fi Direct policy configured................ Disabled
       EAP-Passthrough............................... Disabled
       CKIP ......................................... Disabled
       Web Based Authentication...................... Disabled
       Web-Passthrough............................... Disabled
       Conditional Web Redirect...................... Disabled
       Splash-Page Web Redirect...................... Disabled
       Auto Anchor................................... Enabled
       FlexConnect Local Switching................... Disabled
       flexconnect Central Dhcp Flag................. Disabled
       flexconnect nat-pat Flag...................... Disabled
       flexconnect Dns Override Flag................. Disabled
       FlexConnect Vlan based Central Switching ..... Disabled
       FlexConnect Local Authentication.............. Disabled
       FlexConnect Learn IP Address.................. Enabled
       Client MFP.................................... Optional
       PMF........................................... Disabled
       PMF Association Comeback Time................. 1
       PMF SA Query RetryTimeout..................... 200
       Tkip MIC Countermeasure Hold-down Timer....... 60
    AVC Visibilty.................................... Disabled
    --More-- or (q)uit
    AVC Profile Name................................. None
    Flow Monitor Name................................ None
    Call Snooping.................................... Disabled
    Roamed Call Re-Anchor Policy..................... Disabled
    SIP CAC Fail Send-486-Busy Policy................ Enabled
    SIP CAC Fail Send Dis-Association Policy......... Disabled
    KTS based CAC Policy............................. Disabled
    Assisted Roaming Prediction Optimization......... Disabled
    802.11k Neighbor List............................ Disabled
    802.11k Neighbor List Dual Band.................. Disabled
    Band Select...................................... Disabled
    Load Balancing................................... Disabled
    Multicast Buffer................................. Disabled
     Mobility Anchor List
     WLAN ID     IP Address            Status
     2           172.24.13.251        Up
    802.11u........................................ Disabled
    MSAP Services.................................. Disabled
    On Anchor:
    WLAN Identifier.................................. 1
    Profile Name..................................... BAI-Beta
    Network Name (SSID).............................. BAI-Beta
    Status........................................... Enabled
    MAC Filtering.................................... Disabled
    Broadcast SSID................................... Disabled
    AAA Policy Override.............................. Disabled
    Network Admission Control
      Client Profiling Status ....................... Disabled
       DHCP ......................................... Disabled
       HTTP ......................................... Disabled
      Radius-NAC State............................... Disabled
      SNMP-NAC State................................. Disabled
      Quarantine VLAN................................ 0
    Maximum number of Associated Clients............. 0
    Maximum number of Clients per AP Radio........... 200
    Number of Active Clients......................... 48
    Exclusionlist Timeout............................ 60 seconds
    Session Timeout.................................. 86400 seconds
    User Idle Timeout................................ 300 seconds
    --More-- or (q)uit
    User Idle Threshold.............................. 0 Bytes
    NAS-identifier................................... CHADWLC01
    CHD per WLAN..................................... Enabled
    Webauth DHCP exclusion........................... Disabled
    Interface........................................ bai-beta
    Multicast Interface.............................. Not Configured
    WLAN IPv4 ACL.................................... unconfigured
    WLAN IPv6 ACL.................................... unconfigured
    mDNS Status...................................... Enabled
    mDNS Profile Name................................ default-mdns-profile
    DHCP Server...................................... Default
    DHCP Address Assignment Required................. Enabled
    Static IP client tunneling....................... Disabled
    PMIPv6 Mobility Type............................. none
    Quality of Service............................... Bronze
    Per-SSID Rate Limits............................. Upstream      Downstream
    Average Data Rate................................   0             0
    Average Realtime Data Rate.......................   0             0
    Burst Data Rate..................................   0             0
    Burst Realtime Data Rate.........................   0             0
    Per-Client Rate Limits........................... Upstream      Downstream
    Average Data Rate................................   0             0
    Average Realtime Data Rate.......................   0             0
    --More-- or (q)uit
    Burst Data Rate..................................   0             0
    Burst Realtime Data Rate.........................   0             0
    Scan Defer Priority.............................. 5,6
    Scan Defer Time.................................. 100 milliseconds
    WMM.............................................. Disabled
    WMM UAPSD Compliant Client Support............... Disabled
    Media Stream Multicast-direct.................... Disabled
    CCX - AironetIe Support.......................... Enabled
    CCX - Gratuitous ProbeResponse (GPR)............. Disabled
    CCX - Diagnostics Channel Capability............. Disabled
    Dot11-Phone Mode (7920).......................... Disabled
    Wired Protocol................................... None
    Passive Client Feature........................... Disabled
    Peer-to-Peer Blocking Action..................... Disabled
    Radio Policy..................................... All
    DTIM period for 802.11a radio.................... 1
    DTIM period for 802.11b radio.................... 1
    Radius Servers
       Authentication................................ 172.24.13.20 1812
       Accounting.................................... Disabled
       Dynamic Interface............................. Disabled
       Dynamic Interface Priority.................... wlan
    Local EAP Authentication......................... Disabled
    --More-- or (q)uit
    Security
       802.11 Authentication:........................ Open System
       FT Support.................................... Disabled
       Static WEP Keys............................... Disabled
       802.1X........................................ Disabled
       Wi-Fi Protected Access (WPA/WPA2)............. Enabled
          WPA (SSN IE)............................... Disabled
          WPA2 (RSN IE).............................. Enabled
             TKIP Cipher............................. Disabled
             AES Cipher.............................. Enabled
                                                                   Auth Key Management
             802.1x.................................. Enabled
             PSK..................................... Disabled
             CCKM.................................... Disabled
             FT-1X(802.11r).......................... Disabled
             FT-PSK(802.11r)......................... Disabled
             PMF-1X(802.11w)......................... Disabled
             PMF-PSK(802.11w)........................ Disabled
          FT Reassociation Timeout................... 20
          FT Over-The-DS mode........................ Enabled
          GTK Randomization.......................... Disabled
          SKC Cache Support.......................... Disabled
    --More-- or (q)uit
          CCKM TSF Tolerance......................... 1000
       WAPI.......................................... Disabled
       Wi-Fi Direct policy configured................ Disabled
       EAP-Passthrough............................... Disabled
       CKIP ......................................... Disabled
       Web Based Authentication...................... Disabled
       Web-Passthrough............................... Disabled
       Conditional Web Redirect...................... Disabled
       Splash-Page Web Redirect...................... Disabled
       Auto Anchor................................... Enabled
       FlexConnect Local Switching................... Disabled
       flexconnect Central Dhcp Flag................. Disabled
       flexconnect nat-pat Flag...................... Disabled
       flexconnect Dns Override Flag................. Disabled
       FlexConnect Vlan based Central Switching ..... Disabled
       FlexConnect Local Authentication.............. Disabled
       FlexConnect Learn IP Address.................. Enabled
       Client MFP.................................... Optional
       PMF........................................... Disabled
       PMF Association Comeback Time................. 1
       PMF SA Query RetryTimeout..................... 200
       Tkip MIC Countermeasure Hold-down Timer....... 60
    AVC Visibilty.................................... Disabled
    --More-- or (q)uit
    AVC Profile Name................................. None
    Flow Monitor Name................................ None
    Call Snooping.................................... Disabled
    Roamed Call Re-Anchor Policy..................... Disabled
    SIP CAC Fail Send-486-Busy Policy................ Enabled
    SIP CAC Fail Send Dis-Association Policy......... Disabled
    KTS based CAC Policy............................. Disabled
    Assisted Roaming Prediction Optimization......... Disabled
    802.11k Neighbor List............................ Disabled
    802.11k Neighbor List Dual Band.................. Disabled
    Band Select...................................... Disabled
    Load Balancing................................... Disabled
    Multicast Buffer................................. Disabled
     Mobility Anchor List
     WLAN ID     IP Address            Status
     1           172.24.13.251        Up
    802.11u........................................ Disabled
    MSAP Services.................................. Disabled

  • WLC 5508 Internal DHCP server issues

    Hi,
    I am hoping to get your feedback around the dhcp issues I am facing with Two Centrally Switched Wireless LANs. I have tried to explain the setup and the problems below and would appreciate it if anyone can suggest a solution for the problems I am facing:
    The setup is as follows:
    - I have a WLC 5508 which has been configured with 4 SSIDs, out of which 2 are using Central Authentication and Switching.
    - I have an LWAP connected to the WLC in HREAP mode.
    - WLC is configured as the DHCP server for clients connecting to the SSID 'Guest'. For the rest, I am using external dhcp server.
    - Only one scope for Guest Interface is setup on the WLC. 
    Problems:
    1. As far as I know, for WLC to act as internal dhcp server, it is mandatory to have the proxy enabled, but the Clients connecting to SSID 'Internet' are
    unable to get an ip address from the external dhcp server, if dhcp proxy is enabled on the WLC. If i disable the proxy, it all works fine.
    2. DHCP does not release the ip addresses assigned to clients even after they are logged out.
    3. If a machine which was earlier connected to 'Guest' SSID connects to the 'Internet' SSID, it requests the same ip it was assigned by the WLC which it was assigned under 'Guest', but gets tagged with the Vlan configured on the management interface.  
    ************Output from the Controller********************
    (Cisco Controller) >show sysinfo
    Manufacturer's Name.............................. Cisco Systems Inc.
    Product Name..................................... Cisco Controller
    Product Version.................................. 7.0.116.0
    Bootloader Version............................... 1.0.1
    Field Recovery Image Version..................... 6.0.182.0
    Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
    Build Type....................................... DATA + WPS + LDPE
    (Cisco Controller) >show interface summary
    Interface Name                   Port Vlan Id  IP Address         Type        Ap Mgr        Gu                                                                            
    est
    guest                                        1    301      10.255.255.30    Dynamic   No              No                                                                            
    management                          1    100      172.17.1.30        Static          Yes            No                                                          
    service-port                              N/A  N/A      192.168.0.1       Static         No               No                                                                            
    virtual                                        N/A   N/A      10.0.0.1              Static         No               No                                                                            
    (Cisco Controller) >show wlan summary
    Number of WLANs.................................. 4
    WLAN ID  WLAN Profile Name / SSID               Status    Interface Name
    1        LAN                                    Enabled   management
    2        Internet                               Enabled   management
    3        Managment Assets          Enabled   management
    4        Guest                                  Enabled   guest
    (Cisco Controller) >show dhcp detailed guest
    Scope: guest
    Enabled.......................................... Yes
    Lease Time....................................... 86400 (1 day )
    Pool Start....................................... 10.255.255.31
    Pool End......................................... 10.255.255.254
    Network.......................................... 10.255.255.0
    Netmask.......................................... 255.255.255.0
    Default Routers.................................. 10.255.255.1  0.0.0.0  0.0.0.0
    DNS Domain.......................................
    DNS.............................................. 8.8.8.8  8.8.4.4  0.0.0.0
    Netbios Name Servers............................. 0.0.0.0  0.0.0.0  0.0.0.0
    (Cisco Controller) >show interface detailed management
    Interface Name................................... management
    MAC Address...................................... e8:b7:48:9b:84:20
    IP Address....................................... 172.17.1.30
    IP Netmask....................................... 255.255.255.0
    IP Gateway....................................... 172.17.1.1
    External NAT IP State............................ Disabled
    External NAT IP Address.......................... 0.0.0.0
    VLAN............................................. 100
    Quarantine-vlan.................................. 0
    Active Physical Port............................. 1
    Primary Physical Port............................ 1
    Backup Physical Port............................. Unconfigured
    Primary DHCP Server.............................. 172.30.50.1
    Secondary DHCP Server............................ Unconfigured
    DHCP Option 82................................... Disabled
    ACL.............................................. Unconfigured
    AP Manager....................................... Yes
    Guest Interface.................................. No
    L2 Multicast..................................... Enabled
    (Cisco Controller) >show interface detailed guest
    Interface Name................................... guest
    MAC Address...................................... e8:b7:48:9b:84:24
    IP Address....................................... 10.255.255.30
    IP Netmask....................................... 255.255.255.0
    IP Gateway....................................... 10.255.255.1
    External NAT IP State............................ Disabled
    External NAT IP Address.......................... 0.0.0.0
    VLAN............................................. 301
    Quarantine-vlan.................................. 0
    Active Physical Port............................. 1
    Primary Physical Port............................ 1
    Backup Physical Port............................. Unconfigured
    Primary DHCP Server.............................. Unconfigured
    Secondary DHCP Server............................ Unconfigured
    DHCP Option 82................................... Disabled
    ACL.............................................. Unconfigured
    AP Manager....................................... No
    Guest Interface.................................. No
    L2 Multicast..................................... Enabled
    (Cisco Controller) >show dhcp leases
           MAC                IP         Lease Time Remaining
    00:21:6a:9c:03:04    10.255.255.46    23 hours 52 minutes 42 seconds        <<<<<<< lease remains even when the client is disconnected.
    *********Example of Client connected to the right Vlan with an ip address from the incorrect interface. *************
    (Cisco Controller) >show client detail 00:21:6a:9c:03:04
    Client MAC Address............................... 00:21:6a:9c:03:04
    Client Username ................................. N/A
    AP MAC Address................................... a0:cf:5b:00:49:c0
    AP Name.......................................... mel
    Client State..................................... Associated
    Client NAC OOB State............................. Access
    Wireless LAN Id.................................. 2                 <<<<<<<<   'Internet' SSID
    BSSID............................................ a0:cf:5b:00:49:ce
    Connected For ................................... 319 secs
    Channel.......................................... 36
    IP Address....................................... 10.255.255.46      <<<<<<< IP address assigned from the 'Guest' Interface or dhcp scope on the WLC
    Association Id................................... 1
    Authentication Algorithm......................... Open System
    Reason Code...................................... 1
    Status Code...................................... 0
    Session Timeout.................................. 1800
    Client CCX version............................... 4
    Client E2E version............................... 1
    QoS Level........................................ Silver
    802.1P Priority Tag.............................. disabled
    WMM Support...................................... Enabled
    Power Save....................................... OFF
    Mobility State................................... Local
    Mobility Move Count.............................. 0
    Security Policy Completed........................ Yes
    Policy Manager State............................. RUN
    Policy Manager Rule Created...................... Yes
    ACL Name......................................... none
    ACL Applied Status............................... Unavailable
    Policy Type...................................... N/A
    Encryption Cipher................................ None
    Management Frame Protection...................... No
    EAP Type......................................... Unknown
    H-REAP Data Switching............................ Central       <<<<<<<<<
    H-REAP Authentication............................ Central       <<<<<<<<<<
    Interface........................................ management
    VLAN............................................. 100           <<<<<<<<<<< right Vlan
    Quarantine VLAN.................................. 0
    Access VLAN...................................... 100

    Hi All,
    I have a similar issue where Wireless clients are not receiving automatic addressing from an internal DHCP server. I have multiple interfaces configured on the WLC which are connected to separate VLANS. The manually specified DHCP primary server entry is the same on all interfaces. Some clients are able to authenticate and receive automatic IP configuration but some clients are failing the address assignment process. I have checked connectivity between the WLC and DHCP server, this is confirmed as working. When I carry out a "debug dhcp packet enable", I get the following outputs which seems as if the DHCP discover request from the client is skipped. Your thoughts and inputs on this are appreciated.
    DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option len (including the magic cookie) 76
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: message type = DHCP DISCOVER
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 116 (len 1) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 61 (len 7) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: requested ip = 169.254.223.5
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 12 (len 13) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: vendor class id = MSFT 5.0 (len 8)
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 55 (len 11) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 43 (len 2) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP options end, len 76, actual 68
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP Forwarding DHCP packet (332 octets) packet DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option len (including the magic cookie) 76
    Thanks,
    Raj Sandhu

  • WLC 5508 tunneling issue

    Hi,
    I have a WLC 5508 connected in a hub and spoke topology. The WLC is located at the hub which is the main office. In one of the remote spoke locations I have five Access Points that are connected to the local LAN and the model for the APs is AIR-CAP3602I-E-K9. The APs are all connected to access ports on the switch in vlan 1. I have two WLAN configured on the controller. I have two interfaces configured on the controller. The management and the guest interface. WLAN 1 is associated with the management interface. In the WLAN 1 advanced setting the flex local switching option is enabled. WLAN 2 is associated with the guest interface and this interface is tunneling vlan 248 the guest vlan. The problem I am having is that the devices can not communicate with each other if they are connected to the wireless connection WLAN 2 which is the tunneled vlan.
    Example: The client would like to be able to connect his ipad to the apple tv for presentation. If I connect both devices to the WLAN 1 which is using flex local switching option they can communicate with no problem, but if the devices are connected to WLAN 2 the guest vlan they can't communicate with each other. Is it possible to get this to also work on WLAN 2 ?
    Note: Both WLAN types are WLAN and P2P Blocking Action is set to default (disabled).
    Does any one have any ideas what could be causing my issue?
    Thanks in advance for your help,

    Well since your talking about Apple TV, you need to look at this reference guide for Apple's bonjour. This will explain how to get it to work and the limitation when an AP is in local or FlexConnect mode. The bonjour just doesn't work as people think it should because they can get it to work with a linksys AP.
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_tech_note09186a0080bb1d7c.shtml
    Sent from Cisco Technical Support iPhone App

  • WLC 5508 APs showing Line Protocol Down

    I have a WLC 5508 (software version 7.5.102.0) and it has 175 APS (mixture of 1131, 1142, 1602, 2602).  Recently I've noticed that
    about 40 of those APs don't work on the 2.4G Dot11Radio0.  sh int dot11 0 shows me:
    Dot11Radio0 is up, line protocol is down
      Hardware is 802.11N 2.4GHz Radio, address is 1833.9d0c.2180 (bia 1833.9d0c.2180)
      MTU 1500 bytes, BW 54000 Kbit/sec, DLY 1000 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation ARPA, loopback not set
      Keepalive set (10 sec)
      ARP type: ARPA, ARP Timeout 04:00:00
      Last input never, output 00:00:00, output hang never
      Last clearing of "show interface" counters never
      Input queue: 0/9355/42086/0 (size/max/drops/flushes); Total output drops: 3769399
      Queueing strategy: fifo
      Output queue: 0/30 (size/max)
      5 minute input rate 11000 bits/sec, 13 packets/sec
      5 minute output rate 0 bits/sec, 0 packets/sec
         150800958 packets input, 597188558 bytes, 0 no buffer
         Received 0 broadcasts (0 IP multicasts)
         0 runts, 0 giants, 0 throttles
         0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
         0 input packets with dribble condition detected
         217132697 packets output, 1132963042 bytes, 0 underruns
         55238 output errors, 0 collisions, 8 interface resets
         0 unknown protocol drops
         0 babbles, 0 late collision, 0 deferred
         0 lost carrier, 0 no carrier
         0 output buffer failures, 0 output buffers swapped out
    I've tried restarting the interface,to no avail, but rebooting the whole AP does bring it back up, but I expect that's a solution to the symptom, not the problem.

    Hi Sean,
    There are certain related bugs of this version. You may need to check whether you are hitting one these. I would suggest staying in 7.4.121.0 code would be a good idea unless you require new features available in 7.5 or 7.6.
    CSCui66891:Marvell-based radio goes down due to stuck multicast packets in driverSymptom:AP's radio interface goes down and does not recover on its own without an AP reboot.Conditions:With releases 7.2.103.0 - 7.2.115.2, 7.3.101.0 - 7.3.112.0, and 7.4.100.0 - 7.4.110.0, this bug applies to all Marvell-based 802.11n Cisco Aironet access points *except* the 1140, 1040, and certain mesh APs.With releases 7.5.90.0 - 7.5.102.0, this bug applies to *all* Marvell-based 802.11n Cisco Aironet access points.Workaround:None. Reboot the AP.
    Known Affected Releases(6)7.6(1.52)7.6(1.50)7.5(102.0)7.6(1.226)7.6(1.95)15.2(4)JA
    Known Fixed Releases(10)10.1(0.74)7.6(1.55)7.5(102.8)10.1(100.0)15.2(4)JN7.6(1.103)10.1(11.5)7.4(111.7)15.2(4)JB7.4(121.0)
    CSCum14069: AP1600/2600 radio down with 7.5.102.0 release  Symptom:[AIR-CAP1602I-Q-K9 (AC power supply) ]---------[Catalyst switch]------------[AIR-CT5508-K9 (7.5.102.0)][AIR-CAP1602I-Q-K9 (PoE) ]----[AIR-PWRINJ5=]-----[ Catalyst switch]------------[AIR-CT5508-K9 (7.5.102.0)][AIR-CAP1602I-Q-K9 (AC power supply) ]---------[non-Cisco non-PoE switch]------------[AIR-CT5508-K9 (7.5.102.0)]AP1600/2600 radios never go UP on above topology if the Catalyst switch was running older IOS such as c3750-ipservices-mz.122-25.SEB4
    Conditions:WLC release 7.5.102.0 specific issue.AP1600/2600 specific issue.Older Catalyst IOS software (e.g. 12.2(25)SEB4)non-Cisco 3rd party switch
    Workaround:Enable "Pre-standard 802.3af switches" option on AP from WLC GUI;WIRELESS => Access Points => All APs => target AP name => Advanced tab => Power Over Ethernet SettingsThis option is required to workaround this problem even if you don't have Pre-standard 802.3af switch nor you're using AC adapter/Power Injector.
    Known Affected Releases:(1)7.5(102.0)Known Fixed Releases:(1)7.5(102.18)
    HTH
    Rasika
    **** Pls rate all useful responses *****

  • Autodiscovery over WLC 5508

    Hi guys,
    Any idea how to permit autodiscovery over my WLC 5508?
    My customer has a software for ordering that the only way to connect to the server is the auto discovery. It works fine with autonomus AP but it doesnt work when connecting to my Lightweight access points that are connect to the controller.
    Any ideas?
    Yannis

    Auto discovery usually use broadcast.
    Enabe both multicast and broadcast on your WLC and that should fix it.
    The reason why you need to enable multicast is that broadcast does not work if multicast is disabled.
    HTH
    Amjad
    Sent from Cisco Technical Support iPad App

  • AIR-CAP1602I-E-K9 Not Talking to WLC 5508

    hi all,
    can't seem to get my APs to talk to WLC 5508.
    can someone advise which WLC firmware to use and where can i get/download (link pls).
    currently WLC is running 6.0.199.4.
    Mar  1 00:00:47.839: %CDP_PD-4-POWER_OK: All radios disabled - NEGOTIATED inlin
    e power source
    *Mar  1 00:00:53.931: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does
    not have an Ip !!
    *Mar  1 00:00:55.963: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP addre
    ss 172.28.159.15, mask 255.255.255.192, hostname APfc99.47a3.4d22
    Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)
    *Mar  1 00:01:06.899: %CAPWAP-3-ERRORLOG: Did not get log server settings from D
    HCP.
    *Mar  1 00:01:15.899: %CAPWAP-3-ERRORLOG: Could Not resolve CISCO-CAPWAP-CONTROL
    LER
    *Mar  1 00:01:15.899: %CAPWAP-3-ERRORLOG: Discovery response from MWAR 'Cisco_f8
    :72:64'running version 6.0.199.4 is rejected.    <<<<
    APfc99.47a3.4d22>sh ve
    Cisco IOS Software, C1600 Software (AP1G2-RCVK9W8-M), Version 15.2(2)JB, RELEASE
    SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2012 by Cisco Systems, Inc.
    Compiled Tue 11-Dec-12 04:52 by prod_rel_team
    ROM: Bootstrap program is C1600 boot loader
    BOOTLDR: C1600 Boot Loader (AP1G2-BOOT-M) LoaderVersion 15.2(2)JAX, RELEASE SOFT
    WARE (fc1)
    APfc99.47a3.4d22 uptime is 11 minutes
    System returned to ROM by power-on
    System image file is "flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx"
    Last reload reason:
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    cisco AIR-CAP1602I-E-K9    (PowerPC) processor (revision B0) with 98294K/32768K
    bytes of memory.
    Processor board ID FGL1726W6DQ
    PowerPC CPU at 533Mhz, revision number 0x2151
    Last reset from power-on
    LWAPP image version 7.4.1.37
    1 Gigabit Ethernet interface
    32K bytes of flash-simulated non-volatile configuration memory.
    Base ethernet MAC Address: FC:99:47:A3:4D:22
    Part Number                          : 73-14671-04
    PCA Assembly Number                  : 000-00000-00
    PCA Revision Number                  :
    PCB Serial Number                    : FOC17182J4J
    Top Assembly Part Number             : 800-38552-01
    Top Assembly Serial Number           : FGL1726W6DQ
    Top Revision Number                  : A0
    Product/Model Number                 : AIR-CAP1602I-E-K9
    Configuration register is 0xF

    Hi,
    Date and time is ok on the WLC,
    I configured Accept Self Signed Certificate (SSC) under Security / AP policy, once done the WLC recognized the AP, but output from the console of the AP  power cycle the access point is:
    IOS Bootloader - Starting system.
    FLASH CHIP: Micronix MX25L256_35F
    Xmodem file system is available.
    flashfs[0]: 5 files, 2 directories
    flashfs[0]: 0 orphaned files, 0 orphaned directories
    flashfs[0]: Total bytes: 31936000
    flashfs[0]: Bytes used: 6551040
    flashfs[0]: Bytes available: 25384960
    flashfs[0]: flashfs fsck took 9 seconds.
    Reading cookie from SEEPROM
    Base Ethernet MAC address: 4c:00:82:9a:47:a3
    ************* loopback_mode = 0
    Loading "flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx"...####################
    File "flash:/ap1g2-rcvk9w8-mx/ap1g2-rcvk9w8-mx" uncompressed and installed, entr
    y point: 0x100000
    executing...
                  Restricted Rights Legend
    Use, duplication, or disclosure by the Government is
    subject to restrictions as set forth in subparagraph
    (c) of the Commercial Computer Software - Restricted
    Rights clause at FAR sec. 52.227-19 and subparagraph
    (c) (1) (ii) of the Rights in Technical Data and Computer
    Software clause at DFARS sec. 252.227-7013.
               cisco Systems, Inc.
               170 West Tasman Drive
               San Jose, California 95134-1706
    Cisco IOS Software, C1600 Software (AP1G2-RCVK9W8-M), Version 15.2(2)JB, RELEASE
    SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2012 by Cisco Systems, Inc.
    Compiled Tue 11-Dec-12 04:52 by prod_rel_team
    Initializing flashfs...
    FLASH CHIP: Micronix MX25L256_35F
    flashfs[2]: 5 files, 2 directories
    flashfs[2]: 0 orphaned files, 0 orphaned directories
    flashfs[2]: Total bytes: 31808000
    flashfs[2]: Bytes used: 6551040
    flashfs[2]: Bytes available: 25256960
    flashfs[2]: flashfs fsck took 9 seconds.
    flashfs[2]: Initialization complete.
    flashfs[3]: 0 files, 1 directories
    flashfs[3]: 0 orphaned files, 0 orphaned directories
    flashfs[3]: Total bytes: 11999232
    flashfs[3]: Bytes used: 1024
    flashfs[3]: Bytes available: 11998208
    flashfs[3]: flashfs fsck took 1 seconds.
    flashfs[3]: Initialization complete....done Initializing flashfs.
    This product contains cryptographic features and is subject to United
    States and local country laws governing import, export, transfer and
    memory validate-checksum 30
    ^
    % Invalid input detected at '^' marker.
    no ip http server
           ^
    % Invalid input detected at '^' marker.
    use. Delivery of Cisco cryptographic products does not imply
    third-party authority to import, export, distribute or use encryption.
    Importers, exporters, distributors and users are responsible for
    login authentication default
      ^
    % Invalid input detected at '^' marker.
    compliance with U.S. and local country laws. By using this product you
    agree to comply with applicable laws and regulations. If you are unable
    to comply with U.S. and local laws, return this product immediately.
    A summary of U.S. laws governing Cisco cryptographic products may be found at:
    http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
    If you require further assistance please contact us by sending email to
    [email protected].
    Warning:  the compile-time code checksum does not appear to be present.
    cisco AIR-CAP1602I-N-K9    (PowerPC) processor (revision B0) with 98294K/32768K
    bytes of memory.
    Processor board ID FGL1730S57A
    PowerPC CPU at 533Mhz, revision number 0x2151
    Last reset from power-on
    LWAPP image version 7.4.1.37
    1 Gigabit Ethernet interface
    32K bytes of flash-simulated non-volatile configuration memory.
    Base ethernet MAC Address: 4C:00:82:9A:47:A3
    Part Number                          : 73-14671-04
    PCA Assembly Number                  : 000-00000-00
    PCA Revision Number                  :
    PCB Serial Number                    : FOC17284HL9
    Top Assembly Part Number             : 800-38552-01
    Top Assembly Serial Number           : FGL1730S57A
    Top Revision Number                  : A0
    Product/Model Number                 : AIR-CAP1602I-N-K9
    % Please define a domain-name first.
    logging facility kern
            ^
    % Invalid input detected at '^' marker.
    logging trap emergencies
            ^
    % Invalid input detected at '^' marker.
    Press RETURN to get started!
    *Mar  1 00:00:12.451: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. In
    itialising Cfg
    *Mar  1 00:00:13.683: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state
    to up
    *Mar  1 00:00:14.687: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEth
    ernet0, changed state to up
    *Mar  1 00:00:15.123: %SYS-5-RESTART: System restarted --
    Cisco IOS Software, C1600 Software (AP1G2-RCVK9W8-M), Version 15.2(2)JB, RELEASE
    SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2012 by Cisco Systems, Inc.
    Compiled Tue 11-Dec-12 04:52 by prod_rel_team
    *Mar  1 00:00:15.151: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. In
    itialising Cfg
    *Mar  1 00:00:15.151: %CAPWAP-3-ERRORLOG: Failed to load configuration from flas
    h. Resetting to default config
    *Mar  1 00:00:16.195: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, chan
    ged state to uplwapp_crypto_init: MIC Present and Parsed Successfully
    no bridge-group 1 source-learning
                       ^
    % Invalid input detected at '^' marker.
    %Default route without gateway, if not a point-to-point interface, may impact pe
    rformance
    *Mar  1 00:00:48.695: %CDP_PD-4-POWER_OK: All radios disabled - INJECTOR_CONFIGU
    RED_ON_SOURCE inline power source
    *Mar  1 00:00:48.923: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP addre
    ss 10.2.3.100, mask 255.255.255.0, hostname AP4c00.829a.47a3
    Translating "CISCO-CAPWAP-CONTROLLER.campeche.ecosur.mx"...domain server (10.2.3
    .10) [OK]
    *Mar  1 00:00:59.915: %CAPWAP-3-ERRORLOG: Did not get log server settings from D
    HCP.
    *Mar  1 00:00:59.919: %CAPWAP-3-ERRORLOG: Dropping dtls packet since session is
    not established. A0203E6, 147E, A020364, A47B, 0
    *Mar  1 00:01:09.915: %CAPWAP-3-ERRORLOG: Go join a capwap controller
    *Jan 29 09:33:18.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_i
    p: 10.2.3.230 peer_port: 5246
    *Jan 29 09:33:18.535: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully
    peer_ip: 10.2.3.230 peer_port: 5246
    *Jan 29 09:33:18.535: %CAPWAP-5-SENDJOIN: sending Join Request to 10.2.3.230
    *Jan 29 09:33:23.535: %CAPWAP-5-SENDJOIN: sending Join Request to 10.2.3.230
    logging facility kern
            ^
    % Invalid input detected at '^' marker.
    logging trap emergencies
            ^
    % Invalid input detected at '^' marker.
    *Jan 29 09:34:17.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.
    2.3.230:5246
    *Jan 29 09:34:17.999: %LWAPP-3-CLIENTERRORLOG: LWAPP LED Init: incorrect led sta
    te 255
    *Jan 29 09:34:17.999: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. In
    itialising Cfg
    *Jan 29 09:34:17.999: %CAPWAP-3-ERRORLOG: Failed to load configuration from flas
    h. Resetting to default config
    *Jan 29 09:34:28.015: %CAPWAP-3-ERRORLOG: Go join a capwap controller
    *Jan 29 09:34:28.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_i
    p: 10.2.3.230 peer_port: 5246
    *Jan 29 09:34:28.535: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully
    peer_ip: 10.2.3.230 peer_port: 5246
    *Jan 29 09:34:28.535: %CAPWAP-5-SENDJOIN: sending Join Request to 10.2.3.230
    *Jan 29 09:34:33.535: %CAPWAP-5-SENDJOIN: sending Join Request to 10.2.3.230
    and debug command output enable CAPWAP events
    (Cisco Controller) >debug capwap events enable
    (Cisco Controller) >*spamApTask7: Jan 29 03:39:08.092: acDtlsPlumbControlPlaneKeys: lrad:10.2.3.100(42107) mwar:10.2.3.230(5246)
    *spamApTask7: Jan 29 03:39:08.093: 4c:00:82:9a:47:a0 DTLS keys for Control Plane deleted successfully for AP 10.2.3.100
    *spamApTask7: Jan 29 03:39:08.100: 4c:00:82:9a:47:a0 DTLS connection closed event receivedserver (10.2.3.230/5246) client (10.2.3.100/42107)
    *spamApTask7: Jan 29 03:39:08.100: 4c:00:82:9a:47:a0 Entry exists for AP (10.2.3.100/42107)
    *spamApTask7: Jan 29 03:39:08.100: 4c:00:82:9a:47:a0 No AP entry exist in temporary database for 10.2.3.100:42107
    *spamApTask7: Jan 29 03:39:08.104: 4c:00:82:9a:47:a0 Discovery Request from 10.2.3.100:42107
    *spamApTask7: Jan 29 03:39:08.104: 4c:00:82:9a:47:a0 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 500, joined Aps =0
    *spamApTask7: Jan 29 03:39:08.104: apModel:
    *spamApTask7: Jan 29 03:39:08.104: apType = 38 apModel:
    *spamApTask0: Jan 29 03:39:08.105: 4c:00:82:9a:47:a3 Received LWAPP DISCOVERY REQUEST to 6c:41:6a:5f:95:2f on port '13'
    *spamApTask0: Jan 29 03:39:08.105: 4c:00:82:9a:47:a3 Discarding discovery request in LWAPP from AP supporting CAPWAP
    *spamApTask7: Jan 29 03:39:08.105: 4c:00:82:9a:47:a0 Discovery Response sent to 10.2.3.100 port 42107
    *spamApTask7: Jan 29 03:39:08.105: 4c:00:82:9a:47:a0 Discovery Response sent to 10.2.3.100:42107
    *spamApTask7: Jan 29 03:39:08.105: 4c:00:82:9a:47:a0 Discovery Request from 10.2.3.100:42107
    *spamApTask7: Jan 29 03:39:08.105: 4c:00:82:9a:47:a0 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 500, joined Aps =0
    *spamApTask7: Jan 29 03:39:08.105: apModel:
    *spamApTask7: Jan 29 03:39:08.105: apType = 38 apModel:
    *spamApTask7: Jan 29 03:39:08.105: 4c:00:82:9a:47:a0 Discovery Response sent to 10.2.3.100 port 42107
    *spamApTask7: Jan 29 03:39:08.105: 4c:00:82:9a:47:a0 Discovery Response sent to 10.2.3.100:42107
    *spamApTask7: Jan 29 03:39:08.105: 4c:00:82:9a:47:a0 Discovery Request from 10.2.3.100:42107
    *spamApTask7: Jan 29 03:39:08.105: 4c:00:82:9a:47:a0 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 500, joined Aps =0
    *spamApTask7: Jan 29 03:39:08.105: apModel:
    *spamApTask7: Jan 29 03:39:08.105: apType = 38 apModel:
    *spamApTask7: Jan 29 03:39:08.106: 4c:00:82:9a:47:a0 Discovery Response sent to 10.2.3.100 port 42107
    (Cisco Controller) >*spamApTask7: Jan 29 03:39:08.106: 4c:00:82:9a:47:a0 Discovery Response sent to 10.2.3.100:42107
    *spamApTask7: Jan 29 03:39:18.104: 4c:00:82:9a:47:a3 DTLS connection not found, creating new connection for 10:2:3:100 (42107) 10:2:3:230 (5246)
    *spamApTask7: Jan 29 03:39:18.638: acDtlsPlumbControlPlaneKeys: lrad:10.2.3.100(42107) mwar:10.2.3.230(5246)
    *spamApTask7: Jan 29 03:39:18.638: 4c:00:82:9a:47:a3 Allocated index from main list, Index: 397
    *spamApTask7: Jan 29 03:39:18.638: 4c:00:82:9a:47:a3 Using CipherSuite AES128-SHA
    *spamApTask7: Jan 29 03:39:18.638: 4c:00:82:9a:47:a3 DTLS keys for Control Plane are plumbed successfully for AP 10.2.3.100. Index 398
    *spamApTask6: Jan 29 03:39:18.638: 4c:00:82:9a:47:a3 DTLS Session established server (10.2.3.230:5246), client (10.2.3.100:42107)
    *spamApTask6: Jan 29 03:39:18.638: 4c:00:82:9a:47:a3 Starting wait join timer for AP: 10.2.3.100:42107
    *spamApTask7: Jan 29 03:39:23.636: 4c:00:82:9a:47:a0 Join Request from 10.2.3.100:42107
    *spamApTask7: Jan 29 03:39:23.636: 4c:00:82:9a:47:a3 Deleting AP entry 10.2.3.100:42107 from temporary database.
    *spamApTask7: Jan 29 03:39:23.637: 4c:00:82:9a:47:a0 MIC AP is not allowed to join by config
    *spamApTask7: Jan 29 03:39:23.637: 4c:00:82:9a:47:a0 Join Request failed!

  • Converged Access Design Help (Catalyst 3850 and WLC 5508...Mobility Oracle)

    Hello,
    I am an engineer working with a Cisco Gold Partner in Saudi Arabia. We have a large university as our client where they are constructing a new
    building and require our services to build the network infrastructure. Therefore, we are to implement the routing and switching infrastructure as
    well as the Wireless solution.
    At present, I have no issues in implementing the R&S infrastructure as it is very straight forward but it has implications on the deployment of
    the wireless solution which I explain further below. The R&S infrastructure comprises of the typical Core, Distribution, and Access layers and we
    are focusing on the local distribution and access switches with regards to the new building. The client has a converged Layer 3 network spanning
    from distribution layer to core layer and they are running EIGRP for this convergence. This is not a problem and has already been implemented.
    Yet, the challenge arises in deploying the WLAN infrastructure. The client already has a Cisco WLAN infrastructure in place where they have a
    large number of LAPs that are registered with their controllers in the Data Center. They have two WLC 5508 where one is the Primary and the other
    the Secondary. The local distribution switch to which the WLC are connected also is the gateway for the SVIs for the SSIDs that are configured on
    the controllers. This means that once the packets from the AP come in to the WLC, they are tagged with the correct VLAN and sent to the directly
    connected distribution switch which then routes it into the rest of the Layer 3 network. Interestingly, the WLC 5508 are running AireOS 7.6 and
    support the "New Mobility" feature. The two controllers have formed a Mobility Group (MG) between each other.
    Now, the new building will have two Catalyst 3850 switches installed where each one has a total of 40 AP licenses pre-installed and activated
    i.e. a total of 80 APs can be supported by the two switches. A total of 67 LAPs will be deployed in the new building which can be accommodated
    between the two switches and their integrated controller.
    Yet, based on my understanding and research about Converged Access is that, ideally, the Catalyst 3850 will only run the Mobility Agent (MA)
    feature while a central controller would provide the Mobility Controller (MC) service. unfortunately, there are not enough licenses on the
    existing WLC 5508 nor can we migrate the new licenses that will facilitate such a split deployment.
    This means that I would need to configure the two Catalyst 3850 as independent MC and form a MG between them. I have done this and tested this
    already and the mobility is working fine. But my concern is not about getting the Catalyst 3850 to work as this is simple but rather it is
    focused on creating a common Mobility Domain (MD) so that clients can roam from this new building to the rest of the campus while maintaining the
    state of their connections to the WLAN infrastructure.
    To make things more complicated, since the new building will have its own Layer 3 distribution switch and the Catalyst 3850 switches will connect
    to this distribution switch, it means that new VLANs and SVIs need to be created for the SSIDs broadcast in the new building. This means that new
    subnets need to be assigned to the SSIDs.
    As such, I have the following questions:
    Q1) If we create new SVIs for the SSIDs (same SSIDs names will be used in the new building as in the rest of the university campus) this means
    that new subnets will be assigned to these SSIDs. Now, I believe I have two options...one is to make the new Catalyst 3850s to be in the same MG
    as the existing WLC 5508 which then cater for Layer 3 client roaming or I have to treat this as a totally seperate WLAN network and follow on to
    the solution as per the next question. Please advise which is a better option?
    Q2) I could create separate MG i.e. the new building Catalyst 3850s can be in one MG and the existing controllers can be in another MG. I can
    then have one of the existing WLC 5508 (the primary one) to run the Mobility Oracle (MO) feature so as to create a single Mobility Domain (MD).
    Would this facilitate in Layer 3 client roaming and RRM for all the controllers in the same MD?
    Q3) If I do create a MD, how is this accomplished in such an environment since the documentation is severely limited in this regard?
    Please advise at your earliest. To assist further, I have attached a topology diagram which may aid in explaining the situation with more
    clarity. If these things are clarified, I will be better able to wrap my head around the technology and in turn service my clients better.
    Regards,
    Amir

    Hi Amir,
    Q1) If we create new SVIs for the SSIDs (same SSIDs names will be used in the new building as in the rest of the university campus) this means that new subnets will be assigned to these SSIDs. Now, I believe I have two options...one is to make the new Catalyst 3850s to be in the same MG as the existing WLC 5508 which then cater for Layer 3 client roaming or I have to treat this as a totally seperate WLAN network and follow on to the solution as per the next question. Please advise which is a better option?
    I would configure them in the same mobility group. Also configure same SPG for those two 3850 stacks if users are frequently roaming within these two buildings.
    Q2) I could create separate MG i.e. the new building Catalyst 3850s can be in one MG and the existing controllers can be in another MG. I can then have one of the existing WLC 5508 (the primary one) to run the Mobility Oracle (MO) feature so as to create a single Mobility Domain (MD). Would this facilitate in Layer 3 client roaming and RRM for all the controllers in the same MD?
    MO is not required (it is only for very large scale deployments)
    Q3) If I do create a MD, how is this accomplished in such an environment since the documentation is severely limited in this regard?
    Yes, documents are hard to find :(
    These notes may be useful to you based on my experience. I am running IOS-XE 3.6.1 in my production.
    http://mrncciew.com/2014/05/06/configuring-new-mobility/
    http://mrncciew.com/2013/12/14/3850ma-with-5760mc/
    HTH
    Rasika
    *** Pls rate all useful responses ****

  • ISE 1.2 / WLC 5508 EAP-TLS expired certificate error, but wireless still working

    Hi I have a customer that we've deployed ISE 1.2 and WLC 5508s at.  Customer is using EAP-TLS with and everything appears to setup properly.  Users are able to login to the network and authenticate, however, frequently, I'm getting the following error in ISE authentication logs:
    12516 EAP-TLS failed SSL/TLS handshake because of an expired certificate in the client certificates chain
    OpenSSL messages are:
    SSL alert: code=Ox22D=557 : source=local ; type=fatal : message="X509
    certificate ex pi red"'
    4 727850450.3616:error.140890B2: SS L
    rOYbne s: SSL 3_  G ET _CL IE NT  _CE RT IF ICAT E:no ce rtific ate
    relurned: s3_ srvr.c: 272 0
    I'm not sure if this is cosmetic or if this is something that I should be tracking down.  System isn't in full production yet, but every client seems to be working and there is no expired cert in the chain.  Any ideas what to check?

    Hello Dino,
      thanks very much for your reply.
      The client uses a machine-certificate, the PKI is not a microsoft one, but a third party PKI.   The certificate is fresh and valid, the root-cert is installed and checked to be validated against it for the login.
    Clock is correct too. The same setup works flawlessly in Windows 7 and XP.
    EKU is set on the certificate (1.3.6.1.5.5.7.3.2)
    I suspect the cert-setup itself, but don't get a clue where this might stuck...
    Björn

  • WLC 5508 with LAP-1142n - Several Errors

    Hello all,
    I had installed a WLC 5508 with 7 LAP 1142n and 2 converted AP 1131abg.
    I am seeing some errors relating 2 issues.
    1st- One particular AP 1142 is disassociating and reseting the radios.
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:10.0pt;
    font-family:"Times New Roman","serif";}
    Thu Oct 28 11:50:49 2010
    AP's Interface:0(802.11b)   Operation State Up: Base Radio MAC:e8:04:62:23:ac:e0 Cause=Radio interface   reset. Status:NA
    Thu Oct 28 11:50:49 2010
    AP's Interface:0(802.11b)   Operation State Down: Base Radio MAC:e8:04:62:23:ac:e0 Cause=Radio interface   reset. Status:NA
    Thu Oct 28 11:50:49 2010
    AP's Interface:1(802.11a)   Operation State Up: Base Radio MAC:e8:04:62:23:ac:e0 Cause=Radio interface   reset. Status:NA
    Thu Oct 28 11:50:49 2010
    AP's Interface:1(802.11a)   Operation State Down: Base Radio MAC:e8:04:62:23:ac:e0 Cause=Radio interface   reset. Status:NA
    Thu Oct 28 11:50:46 2010
    AP's Interface:1(802.11a) Operation   State Up: Base Radio MAC:e8:04:62:23:ac:e0 Cause=Radio reset due to Init.   Status:NA
    Thu Oct 28 11:50:46 2010
    AP's Interface:0(802.11b)   Operation State Up: Base Radio MAC:e8:04:62:23:ac:e0 Cause=Radio reset due to   Init. Status:NA
    Thu Oct 28 11:50:46 2010
    AP 'AP3', MAC:   e8:04:62:23:ac:e0 disassociated previously due to AP Reset. Uptime: 1 days,   10 h 24 m 23 s . Last reset reason: operator changed 11g mode.
    Thu Oct 28 11:50:35 2010
    AP Disassociated. Base Radio   MAC:e8:04:62:23:ac:e0
    Thu Oct 28 11:50:35 2010
    AP's Interface:1(802.11a)   Operation State Down: Base Radio MAC:e8:04:62:23:ac:e0 Cause=New Discovery Status:NA
    Thu Oct 28 11:50:35 2010
    AP's Interface:0(802.11b) Operation   State Down: Base Radio MAC:e8:04:62:23:ac:e0 Cause=New Discovery Status:NA
    I had some search, and the new discovery cause, might be that the AP didnt know what WLC do associate, in a multi-controller environment. This is not the case. I only have one WLC in the same management vlan.
    2st-The Radius server is beeing related in the logs as been deactivated. I raise the server time-out on Radius configuration option, but it still continues to do it.
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:10.0pt;
    font-family:"Times New Roman","serif";}
    Thu Oct 28 10:24:41 2010
    RADIUS server 10.67.128.36:1812 deactivated in global list
    Thu Oct 28 10:24:41 2010
    RADIUS server 10.67.128.36:1812 failed to respond to request (ID 172)   for client e8:06:88:51:c0:2b / user 'unknown'
    Is this meaning the WLC stop sending request to the Radius Server ? We dont have BackUp Radius.
    As far as i know, its always the same mac-address client that is associated to that error, maybe a iphone.
    I had so many clients in that SSID and they are all working good.
    The Radius server is a NPS from windows Server 2008
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:10.0pt;
    font-family:"Times New Roman","serif";}
    , and the client says that the medium response time is 0,02 sec, so im wondering why the controller is not getting response from Radius for a particular client?! My client also says, that didnt found any log related to that mac-address client ... what is weird...
    WLC with last software available 7.0.164
    Hope some one help me here.
    Best Regards,
    Bruno Petrónio

    Thanks Scott,
    I understand what you are mentioning, and i really didnt do it yet.
    I realize that the primary controller was not configured on the
    /* Style Definitions */
    table.MsoNormalTable
    {mso-style-name:"Table Normal";
    mso-tstyle-rowband-size:0;
    mso-tstyle-colband-size:0;
    mso-style-noshow:yes;
    mso-style-priority:99;
    mso-style-qformat:yes;
    mso-style-parent:"";
    mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
    mso-para-margin:0cm;
    mso-para-margin-bottom:.0001pt;
    mso-pagination:widow-orphan;
    font-size:10.0pt;
    font-family:"Times New Roman","serif";}
    Wireless –> All APs –> High Availability tab, and did it only to the AP that is taking this beahviour.
    Is this mandatory for a 1 controller only ?
    No mather what the manual say, after that the AP is rebooting 2 mins in 2 mins... with the same kind of messages.
    The interface on the switch is getting a few input errors and the same numbers of crc... but are so few...
    Next step ... i will change it to another one's place/pathing cable.
    Regarding the Radius messages... any ideas ?
    I'm already on 30 sec's of server timeout.
    Best Regards,
    Bruno Petrónio

Maybe you are looking for

  • How can i get information off of my flash drive using the iMac?

    when i insert the thumb drive in the computer, it doesnt recognize the new hardware. i also do not know how to open the flash drive manually. Please help!

  • Purchase order, sales order documents

    hi all, can any one give me the format of purchase order n sales order . i want sap script for those two documents [pictorial presentation]. if possible send me screen shots to [email protected] thanks n regards, suresh babu aluri.

  • Dynamic determination of currency translation type

    Dear all, we have a requirement for some reports in Business Warehouse (NetWeaver 7.3) regarding the currency conversion type. In the Report a rolling forecast (always starting with the actual period) with one key figure (e.g. Price) shall be analyze

  • Check duplicates

    Hi, How would I check duplicate records in an internal table? Thanks Will

  • Process.destoy() problem

    Hi ! I've got a problem using jdk 1.2.2 on an alpha system java -versionjava version "1.2.2-6" Classic VM (build J2SDK.v.1.2.2:04/26/2000-09:58, native threads, jit_122) uname -aOSF1 <host> V4.0 878 alpha The problem is that when I start a process us