WLC 5508 Switchover Issue

Hi There,
   Our issue is about a WLC 5508 conected to a HP Switch L3 model HP7500 using link-aggregation. Sometimes the controller change to the secondary box and log the error message: Switchover Reason = Default gateway is not reachable, Switchover Time 
Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 7.6.120.0
Bootloader Version............................... 1.0.1
Field Recovery Image Version..................... 6.0.182.0
Firmware Version................................. FPGA 1.7, Env 1.8, USB console 2.2
Build Type....................................... DATA + WPS
management                       LAG  untagged x.y.z.a    Static  Yes    No
redundancy-management            LAG  untagged x,y.z.b     Static  No     No
redundancy-port                  -    untagged 169.254.0.12    Static  No     No
(Cisco Controller) >show redundancy summary
            Redundancy Mode = SSO ENABLED
                Local State = ACTIVE
                 Peer State = STANDBY HOT
                       Unit = Primary
                    Unit ID = 6C:41:6A:5F:75:00
           Redundancy State = SSO (Both AP and Client SSO)
               Mobility MAC = 6C:41:6A:5F:75:00
Average Redundancy Peer Reachability Latency = 488 usecs
Average Management Gateway Reachability Latency = 748 usecs
Redundancy Management IP Address................. x.y.z.a
Peer Redundancy Management IP Address............ x.y.z.b
Redundancy Port IP Address....................... 169.254.0.12
Peer Redundancy Port IP Address.................. 169.254.0.13
Peer Service Port IP Address..................... 0.0.0.0
Switchover History[1]:
Previous Active = 10.140.0.13, Current Active = x.y.z.a
Switchover Reason = Default gateway is not reachable, Switchover Time = Tue Aug 19 05:32:44 2014
Any idea what´s the problem could be?  We check alllan environment spanning-tree, vlan, routing, no physical issues.
My best regards
Adriano Porcaro

Show sysinfo results :
Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 7.0.116.0
Bootloader Version............................... 1.0.1
Field Recovery Image Version..................... 6.0.182.0
Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
Build Type....................................... DATA + WPS

Similar Messages

  • WLC 5508 authorization issue

    Hello,
    I have an issue with two wlc 5508 in the same mobility group. We use TACACS to authenticate admins, with maximum privileges.
    When I want to configure cleanair, or some security functions (such as ACL, or password policies), I have an error message saying that my privileges are not enough.
    When I use local account, it works well.
    At the begining, I thought it was a TACACS issue, but I have the same problem with WCS and SNMP. Cleanair doesn't appears in config menu, and I have an error message for security function.
    Do you have any idea ?
    Thanks for your help.
    FW : 7.0.116.0

    Show sysinfo results :
    Manufacturer's Name.............................. Cisco Systems Inc.
    Product Name..................................... Cisco Controller
    Product Version.................................. 7.0.116.0
    Bootloader Version............................... 1.0.1
    Field Recovery Image Version..................... 6.0.182.0
    Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
    Build Type....................................... DATA + WPS

  • WLC 5508 tunneling issue

    Hi,
    I have a WLC 5508 connected in a hub and spoke topology. The WLC is located at the hub which is the main office. In one of the remote spoke locations I have five Access Points that are connected to the local LAN and the model for the APs is AIR-CAP3602I-E-K9. The APs are all connected to access ports on the switch in vlan 1. I have two WLAN configured on the controller. I have two interfaces configured on the controller. The management and the guest interface. WLAN 1 is associated with the management interface. In the WLAN 1 advanced setting the flex local switching option is enabled. WLAN 2 is associated with the guest interface and this interface is tunneling vlan 248 the guest vlan. The problem I am having is that the devices can not communicate with each other if they are connected to the wireless connection WLAN 2 which is the tunneled vlan.
    Example: The client would like to be able to connect his ipad to the apple tv for presentation. If I connect both devices to the WLAN 1 which is using flex local switching option they can communicate with no problem, but if the devices are connected to WLAN 2 the guest vlan they can't communicate with each other. Is it possible to get this to also work on WLAN 2 ?
    Note: Both WLAN types are WLAN and P2P Blocking Action is set to default (disabled).
    Does any one have any ideas what could be causing my issue?
    Thanks in advance for your help,

    Well since your talking about Apple TV, you need to look at this reference guide for Apple's bonjour. This will explain how to get it to work and the limitation when an AP is in local or FlexConnect mode. The bonjour just doesn't work as people think it should because they can get it to work with a linksys AP.
    http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_tech_note09186a0080bb1d7c.shtml
    Sent from Cisco Technical Support iPhone App

  • WLC 5508 series issues with APs

    Hi  All,
    we recently upgrade our WLC to a new hardware 5508 running 7.6.120.0 and we seem to notice 
    now and then users ring up and complain that they can not connect to the APs most are AIR-CAP3502I-N-K9 or AIR-LAP1242AG-N-K9
    We can see the APs in the controller and can not see anything wrong.
    We reboot the APs and it fix the problems.
    Just wondering if anybody experience the same issues with this IOS & hardware ???
    Any feedback is much appreciated
    Thanks
    qle

    Cisco has issued a "deferred notice" for 7.6.120.X.  Cisco openly recommends everyone to use the newer code, 7.6.130.X.  
    If you "read between the lines", Cisco is saying everyone needs to AVOID 7.6.120.X.

  • In WLC 5508 HA Issue with Russia IOS Image

    Hi,
    I have two 5508 WLC IOS code 7.6.120.0 in the both wlc I am having the same code. But in the one wlc i am having Russia image as below mention...
    Cisco Unified Wireless Network Software Release 7.6 for Cisco 5500 Series Wireless LAN Controllers with Licensed Payload Encryption.Only Recommended for Russia Where Data DTLS Payload Encryption is Regulated by the Government. AIR-CT5500-LDPE-K9-7-6-120-0.aes & in the 2nd wlc Cisco Unified Wireless Network Software Release 7.6 for Cisco 5500 Series Wireless LAN Controllers. 
    AIR-CT5500-K9-7-6-120-0.aes. In this case can I configure HA one like as primary & 2nd wlc as standby mode use the same license in the both wlc. I bye it two separately box before 2 years.
    IOS code will be the same but image is change. It's possible for HA. When I buy it that time both wlc ios code is 7.0.X.X & 7.5.X.X.
    If possible then how can do for the same. or it's not possible. I am try to convert as normal ios code but it's not accepted. Only upgrade with Russia ios code. 
    Help me out please.....
    Thanks & Regards,
    Rahul Wankhade 

    HI Rahul,
    Yes you can configure WLC as HA.
    *** Diff of images:
    –Licensed DTLS— AS_5500_LDPE_x_x_x_x.aes
    –Non licensed DTLS— AS_5500_x_x_x_x.aes
    HA Config:
    1. Either you must have enough AP licencse on both.
    http://rscciew.wordpress.com/2014/01/22/ap-failover/
    2. Or you must have 2nd wlc with minimium 50AP licence to convert it to HA SKU.
    http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/7-5/High_Availability_DG.html
    Regards
    Dont forget to rate helpful posts

  • WLC 5508 HA Anchor DHCP issue

    Hi Cisco Support Community,
    I am currently notice some issues within my WiFi infrastructure.
    Our infrastructure is setup with a 8510 WLC high availability cluster (AP SSO) and a 5508 WLC high availability cluster (AP SSO) as mobility anchor within the DMZ zone.
    The issue I noticed is that if there is a switchover on the 5508 WLC high availability cluster the users wont be able to receive a DHCP IP address.
    I already read some of the other threads regarding this topic. (About Mobility Anchor: Policy Manager State = DHCP_REQD) (DHCP Anchor controller problem.)
    But unfortunately I was unable to find any solution for my issue.
    We currently have three SSID´s with anchoring active and I have noticed that only the SSID´s with layer 3 security enabled are affected by this issue.
    The one SSID with PSK and MAC Auth are not affected by this issue.
    I already checked the configuration for the SSID´s between the main controller and the anchor controller the SSID´s are configured the same except the breakout interface.
    Even the described SSID with PSK and MAC Auth configured uses the same breakout interface as one of our layer 3 security enabled SSID´s.
    The configuration works so far only in case of failover the clients connected to one of the SSID´s with layer 3 security enabled are unable to receive a IP address by the DHCP server.
    I also performed some troubleshooting for the client on the anchor side.
    I added part oft the troubleshooting outputs as workingssid.txt and notworkingssid.txt to this thread.
    Maybe one of you guys have some advice for me to address the issue.
    Thanks for your support in advance
    With kind regards
    Benedikt

    As far as your L3 roaming is concerned ,Make sure your using latest and most stable firmware for WLC,
    Make sure Mobility group are same and config on WLCs before switchover happens. Make sure if DHCP is out the network then option 43 is set and you are able to get ip from both WLC manually and able to ping. Make sure AP-manager interface virtual ip is set. Make sure SSO is enabled on both controller.
    Check the following link also.
    https://supportforums.cisco.com/discussion/11662541/layer-3-roaming-and-dhcp
    Please confirm and mark it correct answer if your issue resolved.

  • Deployment of WLC-5508 with 2702i-D have performance issue.

    Hi Team,
    We have centrally deployed WLC-5508 with 50 AP licence along with HA scenario. we have 3 locations.
    1- HQ. have 26 AP with POWINJ5.
    2- Branch location A- 8 AP with POWINJ5.
    3. Branch location B have 8 AP with POWINJ4.
    my exception is to achieve that  single SSID with dynamic VLAN from group police (NPS). MY HO have 26 AP and those are working in local mode.
    and branches are connected through flexconnect mode. and all are working with different-2 NPS. 
    Now i am facing a problem with this deployment are following.
    1- branch A have performance issue.
    2- HQ have performance issue.
    3- i don't want to go with dedicated NPS for every location. 
    In order to achieve this deployment i want only single SSID with primary and secondary NPS at my HQ with dynamic VLAN for respective departmental users vlans..
    above is my problem and concern. otherwise i am successfully achieving this solution with dedicated NPS with single group policy. but when i am going forward to achieve my expectation that time i am facing authentication issue at my HQ and sometimes am not able to get proper VLAN IPs. at my HQ. 
    kindly help me in that to understand where I am doing wrong things to achieve my expectation. 
    Thanks.
    Nalin    

    I am facing 2 different problems.
    1st issue- in existing setup we have throughput issue. (while downloading or uploading any data from the internet or Intranet,  that time wireless clients are facing slowness of the Speed. and same time when i am trying from LAN i am not facing any issue)
    2nd Issue- I want to achieve only single SSID with primary and secondary NPS (AD group is bind with vlan Attributes) with dynamic VLAN for respective departmental users.
    for Issue no 2 i have created SSID to achieve the single ssid parameter for every location. in order to achieve i have change all access points mode local to Flexconnect mode after that i have created AP groups location wise and then create flexconnect Groups where i have mapped all the vlan through AAA VLAN-ACL mapping. created interface group and mapped all the vlans in that group. 
    for more understanding please go through the below mentioned CLI view.
    Cisco Controller) >show wlan apgroups
    Total Number of AP Groups........................ 4
    Site Name........................................ GURGAON-AP-GROUP
    Site Description................................. GURGAON-AP-GROUP
    Venue Group Code................................. Unspecified
    Venue Type Code.................................. Unspecified
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Pol                                                                                        icy
     3               gurgaon-interface    Disabled                          None
    --More-- or (q)uit
     4               gurgaon-guest        Disabled                          None
    *AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
    AP Name             Slots  AP Model             Ethernet MAC       Location          Port  Country  Priority
    GUR-AP-01            2     AIR-CAP2702I-D-K9    f4:4e:05:78:ae:e4  default location  1     IN       1
    GUR-AP-05            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b5:18  default location  1     IN       1
    GUR-AP-03            2     AIR-CAP2702I-D-K9    bc:16:65:13:71:00  default location  1     IN       1
    GUR-AP-07            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b3:f8  default location  1     IN       1
    GUR-AP-06            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b3:e0  default location  1     IN       1
    GUR-AP-08            2     AIR-CAP2702I-D-K9    f4:4e:05:45:78:98  default location  1     IN       1
    GUR-AP-02            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b3:2c  default location  1     IN       1
    GUR-AP-04            2     AIR-CAP2702I-D-K9    f4:4e:05:78:ae:64  default location  1     IN       1
    GUR-AP-09            2     AIR-CAP2702I-D-K9    f4:4e:05:80:b4:44  default location  1     IN       1
    Site Name........................................ MUMBAI-AP-GROUP
    Site Description................................. MUMBAI-AP-GROUP
    Venue Group Code................................. Unspecified
    Venue Type Code.................................. Unspecified
    --More-- or (q)uit
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Policy
     1               group for mumbai     Disabled                          None
     2               guest wifi           Disabled                          None
    *AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
    AP Name             Slots  AP Model             Ethernet MAC       Location          Port  Country  Priority
    FAL-7-AP08           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:24:d8         7th Floor  1     IN       3
    --More-- or (q)uit
    FAL-7-AP10           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:18         7th Floor  1     IN       1
    FAL-7-AP14           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:ad:e8         7th Floor  1     IN       1
    FAL-7-AP01           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:b0:4c         7th Floor  1     IN       1
    FAL-7-AP07           2     AIR-CAP2702I-D-K9    f0:7f:06:30:92:bc         7th Floor  1     IN       1
    FAL-7-AP13           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:80         7th Floor  1     IN       1
    FAL-7-AP02           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:94         7th Floor  1     IN       1
    FAL-7-AP05           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:e8         7th Floor  1     IN       1
    FAL-7-AP12           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:f0         7th Floor  1     IN       3
    FAL-7-AP03           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:e4         7th Floor  1     IN       1
    FAL-7-AP06           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:84         7th Floor  1     IN       3
    FAL-7-AP04           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:b0:14         7th Floor  1     IN       1
    FAL-7-AP09           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b4:c8         7th Floor  1     IN       3
    FAL-7-AP11           2     AIR-CAP2702I-D-K9    f0:7f:06:30:93:08         7th Floor  1     IN       1
    Site Name........................................ MUMBAI-THIRD-FLOOR-AP
    Site Description................................. MUMBAI-THIRD-FLOOR-AP
    Venue Group Code................................. Unspecified
    Venue Type Code.................................. Unspecified
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    --More-- or (q)uit
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Policy
     1               group for mumbai     Disabled                          None
     2               guest wifi           Disabled                          None
    *AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
    AP Name             Slots  AP Model             Ethernet MAC       Location          Port  Country  Priority
    FAL-3-AP07           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:a4         3rd Floor  1     IN       3
    FAL-3-AP09           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:94         3rd Floor  1     IN       3
    FAL-3-AP11           2     AIR-CAP2702I-D-K9    f4:0f:1b:73:00:74  3rd Floor- Eurek  1     IN       3
    FAL-3-AP06           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:ae:d0         3rd Floor  1     IN       3
    --More-- or (q)uit
    FAL-3-AP10           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b5:88         3rd Floor  1     IN       3
    FAL-3-AP08           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b4:9c         3rd Floor  1     IN       3
    FAL-3-AP03           2     AIR-CAP2702I-D-K9    f0:7f:06:bf:af:a0         3rd Floor  1     IN       1
    FAL-3-AP12           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b3:fc  3rd Floor- Eurek  1     IN       3
    FAL-3-AP02           2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:28         3rd Floor  1     IN       3
    FAL-3-AP01           2     AIR-CAP2702I-D-K9    f0:7f:06:92:b4:f4         3rd Floor  1     IN       3
    FAL-3-AP04           2     AIR-CAP2702I-D-K9    f0:7f:06:30:92:8c         3rd Floor  1     IN       2
    FAL-3-AP05           2     AIR-CAP2702I-D-K9    f0:7f:06:30:91:f4         3rd Floor  1     IN       3
    Site Name........................................ RAHEJA-AP-GROUP
    Site Description................................. RAHEJA-AP-GROUP
    Venue Group Code................................. Unspecified
    Venue Type Code.................................. Unspecified
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    --More-- or (q)uit
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Policy
     5               raheja-interface     Disabled                          None
     2               raheja-guest         Disabled                          None
    *AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
    AP Name             Slots  AP Model             Ethernet MAC       Location          Port  Country  Priority
    FAL-RAHEJA-AP04      2     AIR-CAP2702I-D-K9    f0:7f:06:8d:24:1c  Near Meeting Roo  1     IN       3
    FAL-RAHEJA-AP02      2     AIR-CAP2702I-D-K9    f0:7f:06:8d:37:3c   Confrennce Room  1     IN       3
    FAL-RAHEJA-AP03      2     AIR-CAP2702I-D-K9    f0:7f:06:30:93:48  Near Confrence R  1     IN       3
    FAL-RAHEJA-AP05      2     AIR-CAP2702I-D-K9    f0:7f:06:bf:ae:c0  Near Meeting Roo  1     IN       3
    FAL-RAHEJA-AP06      2     AIR-CAP2702I-D-K9    f0:7f:06:92:b3:a0  Near Server Room  1     IN       3
    FAL-RAHEJA-AP01      2     AIR-CAP2702I-D-K9    f0:7f:06:92:b3:20    Reception Area  1     IN       3
    FAL-RAHEJA-AP08      2     AIR-CAP2702I-D-K9    f0:7f:06:8d:25:68  USER BAY ROAD si  1     IN       1
    FAL-RAHEJA-AP09      2     AIR-CAP2702I-D-K9    f0:7f:06:92:b4:d4     Training Room  1     IN       1
    --More-- or (q)uit
    Site Name........................................ default-group
    Site Description................................. <none>
    NAS-identifier................................... Fractal-WLC1
    Client Traffic QinQ Enable....................... FALSE
    DHCPv4 QinQ Enable............................... FALSE
    AP Operating Class............................... Not-configured
    Capwap Prefer Mode............................... Not-configured
    RF Profile
    2.4 GHz band..................................... <none>
    5 GHz band....................................... <none>
    WLAN ID          Interface          Network Admission Control          Radio Policy
     1               group for mumbai     Disabled                          None
     2               guest wifi           Disabled                          None
     3               gurgaon-interface    Disabled                          None
     4               gurgaon-guest        Disabled                          None
     5               raheja-interface     Disabled                          None
     6               test                 Disabled                          None
    Cisco Controller) >show flexconnect group summary
    FlexConnect Group Summary: Count: 4
    Group Name                # Aps
    Gurgaon-AP                         9
    HQ-3RD-FLR-AP-GROUP                        12
    HQ-7THFLR-AP-GROUP                         14
    Raheja-AP-Group                            8
    (Cisco Controller) >show flexconnect group detail Gurgaon-AP
    Number of AP's in Group: 9
    bc:16:65:13:71:00    GUR-AP-03     Joined    Flexconnect
    f4:4e:05:45:78:98    GUR-AP-08     Joined    Flexconnect
    f4:4e:05:78:ae:64    GUR-AP-04     Joined    Flexconnect
    f4:4e:05:78:ae:e4    GUR-AP-01     Joined    Flexconnect
    f4:4e:05:80:b3:2c    GUR-AP-02     Joined    Flexconnect
    f4:4e:05:80:b3:e0    GUR-AP-06     Joined    Flexconnect
    f4:4e:05:80:b3:f8    GUR-AP-07     Joined    Flexconnect
    f4:4e:05:80:b4:44    GUR-AP-09     Joined    Flexconnect
    f4:4e:05:80:b5:18    GUR-AP-05     Joined    Flexconnect
    Efficient AP Image Upgrade ..... Disabled
    Master-AP-Mac     Master-AP-Name                    Model      Manual
    Group Radius Servers Settings:
    Type           Server Address    Port
                                             Primary       Unconfigured      Unconfigured
                                                                                          Secondary     Unconfigured      Unconfigured
    --More-- or (q)uit
    Group Radius AP Settings:
    AP RADIUS server............ Disabled
    EAP-FAST Auth............... Disabled
    LEAP Auth................... Disabled
    EAP-TLS Auth................ Disabled
    EAP-TLS CERT Download....... Disabled
    PEAP Auth................... Disabled
    Server Key Auto Generated... No
    Server Key..................     <hidden>
    Authority ID................ 436973636f0000000000000000000000
    Authority Info.............. Cisco A_ID
    PAC Timeout................. 0
    Multicast on Overridden interface config: Disabled
    DHCP Broadcast Overridden interface config: Disabled
    Number of User's in Group: 0
    Vlan :........................................... 203
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 205
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 204
    --More-- or (q)uit
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 206
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 207
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 208
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 209
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 210
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 211
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 212
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    --More-- or (q)uit
    Vlan :........................................... 216
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 217
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Vlan :........................................... 218
            Ingress ACL :................................... None
            Egress ACL :.................................... None
    Group-Specific FlexConnect Wlan-Vlan Mapping:
    WLAN ID     Vlan ID
    WLAN ID   SSID                            Central-Dhcp  Dns-Override  Nat-Pat
    (Cisco Controller) >
    (Cisco Controller) >show wlan summary
    Number of WLANs.................................. 6
    WLAN ID  WLAN Profile Name / SSID               Status    Interface Name        PMIPv6 Mobility
    1        FRACTAL-EMP-MUMBAI / FRACTAL           Enabled   group for mumbai      none
    2        FRACTAL-GUEST / FRACTAL-GUEST          Enabled   guest wifi            none
    3        FRACTAL-EMP-GURGAON / FRACTAL-GURGAON  Enabled   gurgaon-interface     none
    4        GURGAON-GUEST / FRACTAL-GUEST-GURGAON  Enabled   gurgaon-guest         none
    5        RAHEJA-EMP-WIRELESS / FRACTAL-R        Enabled   raheja-interface      none
    6        TEST-SSID / TEST-SSID                  Enabled   test                  none
    hope this will give you proper understanding.  

  • WLC 5508 Internal DHCP server issues

    Hi,
    I am hoping to get your feedback around the dhcp issues I am facing with Two Centrally Switched Wireless LANs. I have tried to explain the setup and the problems below and would appreciate it if anyone can suggest a solution for the problems I am facing:
    The setup is as follows:
    - I have a WLC 5508 which has been configured with 4 SSIDs, out of which 2 are using Central Authentication and Switching.
    - I have an LWAP connected to the WLC in HREAP mode.
    - WLC is configured as the DHCP server for clients connecting to the SSID 'Guest'. For the rest, I am using external dhcp server.
    - Only one scope for Guest Interface is setup on the WLC. 
    Problems:
    1. As far as I know, for WLC to act as internal dhcp server, it is mandatory to have the proxy enabled, but the Clients connecting to SSID 'Internet' are
    unable to get an ip address from the external dhcp server, if dhcp proxy is enabled on the WLC. If i disable the proxy, it all works fine.
    2. DHCP does not release the ip addresses assigned to clients even after they are logged out.
    3. If a machine which was earlier connected to 'Guest' SSID connects to the 'Internet' SSID, it requests the same ip it was assigned by the WLC which it was assigned under 'Guest', but gets tagged with the Vlan configured on the management interface.  
    ************Output from the Controller********************
    (Cisco Controller) >show sysinfo
    Manufacturer's Name.............................. Cisco Systems Inc.
    Product Name..................................... Cisco Controller
    Product Version.................................. 7.0.116.0
    Bootloader Version............................... 1.0.1
    Field Recovery Image Version..................... 6.0.182.0
    Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
    Build Type....................................... DATA + WPS + LDPE
    (Cisco Controller) >show interface summary
    Interface Name                   Port Vlan Id  IP Address         Type        Ap Mgr        Gu                                                                            
    est
    guest                                        1    301      10.255.255.30    Dynamic   No              No                                                                            
    management                          1    100      172.17.1.30        Static          Yes            No                                                          
    service-port                              N/A  N/A      192.168.0.1       Static         No               No                                                                            
    virtual                                        N/A   N/A      10.0.0.1              Static         No               No                                                                            
    (Cisco Controller) >show wlan summary
    Number of WLANs.................................. 4
    WLAN ID  WLAN Profile Name / SSID               Status    Interface Name
    1        LAN                                    Enabled   management
    2        Internet                               Enabled   management
    3        Managment Assets          Enabled   management
    4        Guest                                  Enabled   guest
    (Cisco Controller) >show dhcp detailed guest
    Scope: guest
    Enabled.......................................... Yes
    Lease Time....................................... 86400 (1 day )
    Pool Start....................................... 10.255.255.31
    Pool End......................................... 10.255.255.254
    Network.......................................... 10.255.255.0
    Netmask.......................................... 255.255.255.0
    Default Routers.................................. 10.255.255.1  0.0.0.0  0.0.0.0
    DNS Domain.......................................
    DNS.............................................. 8.8.8.8  8.8.4.4  0.0.0.0
    Netbios Name Servers............................. 0.0.0.0  0.0.0.0  0.0.0.0
    (Cisco Controller) >show interface detailed management
    Interface Name................................... management
    MAC Address...................................... e8:b7:48:9b:84:20
    IP Address....................................... 172.17.1.30
    IP Netmask....................................... 255.255.255.0
    IP Gateway....................................... 172.17.1.1
    External NAT IP State............................ Disabled
    External NAT IP Address.......................... 0.0.0.0
    VLAN............................................. 100
    Quarantine-vlan.................................. 0
    Active Physical Port............................. 1
    Primary Physical Port............................ 1
    Backup Physical Port............................. Unconfigured
    Primary DHCP Server.............................. 172.30.50.1
    Secondary DHCP Server............................ Unconfigured
    DHCP Option 82................................... Disabled
    ACL.............................................. Unconfigured
    AP Manager....................................... Yes
    Guest Interface.................................. No
    L2 Multicast..................................... Enabled
    (Cisco Controller) >show interface detailed guest
    Interface Name................................... guest
    MAC Address...................................... e8:b7:48:9b:84:24
    IP Address....................................... 10.255.255.30
    IP Netmask....................................... 255.255.255.0
    IP Gateway....................................... 10.255.255.1
    External NAT IP State............................ Disabled
    External NAT IP Address.......................... 0.0.0.0
    VLAN............................................. 301
    Quarantine-vlan.................................. 0
    Active Physical Port............................. 1
    Primary Physical Port............................ 1
    Backup Physical Port............................. Unconfigured
    Primary DHCP Server.............................. Unconfigured
    Secondary DHCP Server............................ Unconfigured
    DHCP Option 82................................... Disabled
    ACL.............................................. Unconfigured
    AP Manager....................................... No
    Guest Interface.................................. No
    L2 Multicast..................................... Enabled
    (Cisco Controller) >show dhcp leases
           MAC                IP         Lease Time Remaining
    00:21:6a:9c:03:04    10.255.255.46    23 hours 52 minutes 42 seconds        <<<<<<< lease remains even when the client is disconnected.
    *********Example of Client connected to the right Vlan with an ip address from the incorrect interface. *************
    (Cisco Controller) >show client detail 00:21:6a:9c:03:04
    Client MAC Address............................... 00:21:6a:9c:03:04
    Client Username ................................. N/A
    AP MAC Address................................... a0:cf:5b:00:49:c0
    AP Name.......................................... mel
    Client State..................................... Associated
    Client NAC OOB State............................. Access
    Wireless LAN Id.................................. 2                 <<<<<<<<   'Internet' SSID
    BSSID............................................ a0:cf:5b:00:49:ce
    Connected For ................................... 319 secs
    Channel.......................................... 36
    IP Address....................................... 10.255.255.46      <<<<<<< IP address assigned from the 'Guest' Interface or dhcp scope on the WLC
    Association Id................................... 1
    Authentication Algorithm......................... Open System
    Reason Code...................................... 1
    Status Code...................................... 0
    Session Timeout.................................. 1800
    Client CCX version............................... 4
    Client E2E version............................... 1
    QoS Level........................................ Silver
    802.1P Priority Tag.............................. disabled
    WMM Support...................................... Enabled
    Power Save....................................... OFF
    Mobility State................................... Local
    Mobility Move Count.............................. 0
    Security Policy Completed........................ Yes
    Policy Manager State............................. RUN
    Policy Manager Rule Created...................... Yes
    ACL Name......................................... none
    ACL Applied Status............................... Unavailable
    Policy Type...................................... N/A
    Encryption Cipher................................ None
    Management Frame Protection...................... No
    EAP Type......................................... Unknown
    H-REAP Data Switching............................ Central       <<<<<<<<<
    H-REAP Authentication............................ Central       <<<<<<<<<<
    Interface........................................ management
    VLAN............................................. 100           <<<<<<<<<<< right Vlan
    Quarantine VLAN.................................. 0
    Access VLAN...................................... 100

    Hi All,
    I have a similar issue where Wireless clients are not receiving automatic addressing from an internal DHCP server. I have multiple interfaces configured on the WLC which are connected to separate VLANS. The manually specified DHCP primary server entry is the same on all interfaces. Some clients are able to authenticate and receive automatic IP configuration but some clients are failing the address assignment process. I have checked connectivity between the WLC and DHCP server, this is confirmed as working. When I carry out a "debug dhcp packet enable", I get the following outputs which seems as if the DHCP discover request from the client is skipped. Your thoughts and inputs on this are appreciated.
    DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option len (including the magic cookie) 76
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: message type = DHCP DISCOVER
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 116 (len 1) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 61 (len 7) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: requested ip = 169.254.223.5
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 12 (len 13) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: vendor class id = MSFT 5.0 (len 8)
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 55 (len 11) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option: 43 (len 2) - skipping
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP options end, len 76, actual 68
    *DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP Forwarding DHCP packet (332 octets) packet DHCP Socket Task: Nov 07 11:16:09.174: 00:22:fb:7b:37:32 DHCP option len (including the magic cookie) 76
    Thanks,
    Raj Sandhu

  • WLC 5508 8.0.100 AP dropout anf fallback issue

    After WLC upgrade to 8.0.100 [ not in HA mode], the AP seem to be dropping out and reconnect using the fallback to IP-  inspite of the statically configured IP on the AP
    Running Outdoor mesh AIR-CAP1552E-N-K9 on WLC 5508
    (Cisco Controller) >show boot
    Primary Boot Image............................... 8.0.100.0 (default) (active)
    Backup Boot Image................................ 7.6.101.2
    =========
    Last AP disconnect details
    - Reason for last AP connection failure.................... The AP has been reset by the controller
    - Last AP disconnect reason................................ Unknown failure reason
    Last join error summary
    - Type of error that occurred last......................... Lwapp join request rejected
    - Reason for error that occurred last...................... No Mwar payload found in join request
    - Time at which the last join error occurred............... Dec 03 00:05:26.114
    AP disconnect details
    - Reason for last AP connection failure.................... The AP has been reset by the controller

    We downgraded the WLC to  7.4.121.0 and finally got rid of the DHCP problem
    But encountered a new issue
    The WGB once connected to the mesh AP does not reconnect to the network  , auth failure-   AIR-SAP1602E-Z-K9 running  - ap1g2-k9w7-mx.152-2.JB2
    Local EAP auth configured for WGB client on the WLC
    Looks more like the WGB stuck in a state , unable to negotiate its credentials
    Controller log
    *dot1xMsgTask: Mar 24 10:33:52.737: #DOT1X-3-WPA_SEND_STATE_ERR: 1x_kxsm.c:1404 Unable to send EAPOL-key msg  - invalid WPA state (0) - client f4:0f:1b:23:03:37
    Attached is the debug and client status from WLC
    Any  idea what is going on
    Thanks

  • Wireless voice quality issues with wlc 5508 7.0.98

    Hi,
      I am having random occurances of voice drops (one-way audio) during phone calls. WLC 5508 (7.0.98) , LAP1242AG (only G antenna present), and 7925G phones. coverage is excellent throughout the floor and its a confined office space. Its not happening always. I am seeing these logs , not sure if it is related. :
    *apfReceiveTask: Feb 10 11:31:53.831: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg
    *apfReceiveTask: Feb 10 11:31:33.356: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg
    I have set DCA list to1,6 and 11. I tried disabling RRM and statically fixing the channels and power also. Still the issue is seen,
    7925G firmware is 1.4.1
    i tried to do linktest from the WLC to the phone, but link test is failed. linktest to a laptop works though. I have only mac filtering for the voice ssid.
    any suggestions pls ?
    regards
    Joe

    Hi Serge,
    Thanks for the suggestions. I have taken care of all the settings. Problem is , the user is seated in his office cabin and using the 7925 and there is around 50db signal strength in his room from an AP which is just outside the cabin. And this doesnt occur often, when we go to check and make calls, everything is fine whereas the user says it happens sometimes in the morning, evening etc... randomly... where the fone goes blank while in a call.... since the problem never happens when we go to troubleshoot the issue, we really dont know what is going on. This is happening when calling PSTN.
    AP's are not restarting and there is no logs indicating that. Wireless infrastructure looks very much OK cos there are other users who are not experiencing this problem and there is ample coverage all over the floor. I am baffled why only one user has this problem even when he is seated in his office cabin.
    Tried changing phones also, but still remains.
    Question  : i tried to do a linktest from WLC to his phone, but it failed, while linktest to laptops are working fine. Does wlc linktest not working for wireless phones ?
    regards
    Joe

  • 7925 Phones voice quality issues with wlc 5508 version 7.6

    Hi all,
    I have a mix environment with 1 WLC 5508  and more or less 6 sites with several Access Points ( all AIR-LAP1242AG and all in FlexConnect mode  Hreap ) and several wireless phones (all  CP7925G) . My Ap's have antennas 2.4GHz in all sites except 1 site ( the one i'm talking for now) with 2.4GHz and 5GHz , because of the problems we suggest to have all phone in A BAND (5Ghz) . In this site we force the phones just to A (802.11a only) , power safe NONE , Continuous scan mode , i fallow all in http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/7925g/7_0/english/deployment/guide/7925dply.pdf , one thing i didn’t do it was apply QoS because I can’t apply several ios commands in that 2960 with lan lite ios.
    So I have 3 SSID for data and 2 for VOICE  ( one is common to all environment and supports 2.4 and 5Ghz , and other just to test one site , with only 5Ghz  with “[WPA2][Auth(802.1X + CCKM)][Auth(FT 802.1X)]”, because I read that problem can be phone rooming , and in FlexConnect only have fast-roaming in a CCKM or a PKM  key-management solution , but even like this the problem still exist) .
    I have another sites with phones in 2.4GHz running well and others with problems.
    i read here in forums lots and lots of people with similar problems , i tried several solutions ( WLC  upgrades versions  and phones firmware's , ….  ) tried all my best of solving the problems mas now I’m running without any ideas , i did also some site surveys and detect some interferers that why I change phones to 5Ghz , and I run also WLC Config analyser to help me , but all without good success. Some changes solve temporarily problems , but after some time , people reclaim about problems.
    I can open a TAC case but first I want be sure if did all already.
    Can someone try to help me?
    ip phone 7925G firmware : CP7925G-1.4.5SR1.3      
    CUCM 8.6.2
    WLC    5508 : 7.6.120.0
    AP : AIR-LAP1242AG-E-K9    7.6.120.0       (flexconnect)
    Best Regards

    Hi Serge,
    Thanks for the suggestions. I have taken care of all the settings. Problem is , the user is seated in his office cabin and using the 7925 and there is around 50db signal strength in his room from an AP which is just outside the cabin. And this doesnt occur often, when we go to check and make calls, everything is fine whereas the user says it happens sometimes in the morning, evening etc... randomly... where the fone goes blank while in a call.... since the problem never happens when we go to troubleshoot the issue, we really dont know what is going on. This is happening when calling PSTN.
    AP's are not restarting and there is no logs indicating that. Wireless infrastructure looks very much OK cos there are other users who are not experiencing this problem and there is ample coverage all over the floor. I am baffled why only one user has this problem even when he is seated in his office cabin.
    Tried changing phones also, but still remains.
    Question  : i tried to do a linktest from WLC to his phone, but it failed, while linktest to laptops are working fine. Does wlc linktest not working for wireless phones ?
    regards
    Joe

  • Incompatibility issue - WLC 5508 and ACS 5.4

    Hi,
    This is my scenario:
    Cisco WLC 5508 firmware 7.4.110.20 and ACS 5.4, two WLAN eap/tls, many client  can't connect to WLAN and on ACS i receive the following error:
    Authentication failed : 11051 RADIUS packet contains invalid state attribute
    workaround:
    1 -Check the network device or AAA Client for hardware problems.
    2-known RADIUS compatibility issues.
    3-Check the network that connects the device to ACS for hardware problems
    there are some incompatibility issue between WLC and ACS ? the compatibility matrix document for wireless imposes the 7.5 firmware for WLC.
    What do you think is possibile ?

    Are there any other errors shown in the details of the failed authentication?
    We may need to look at service logs in debug mode, opening a TAC case would be the best way to go about this.
    Javier Henderson
    Cisco Systems

  • Wlc 5508 webauth subnet mask change issue

    Recenly l changed the network subnet for a particular wlc interface and scope and also an upstream router and for some reason it would only allow me to use a /24 Host mask as my plan was to go to a /22 mask to allow for over 1000 hosts within this scope.
    The Upstream Router which is a  ( RV042 ) had the following original config :
         192.168.1.1
         255.255.255.0
    I have noticed this device will not let me change the mask from a /24 to a /22 as you can only change from a pre-defined list of masks and you cannot manually add any either..
    New Config
         10.10.0.10
         255.255.255.0
    WLC 5508 Controller Interface
         Original Config
          192.168.1.25
         255.255.255.0
         192.168.1.1
         New Config
         10.10.0.25
         255.255.252.0
         Scope
         Range : 10.10.1.10 - 10.10.3.254
         Mask : 255.255.252.0
         Network : 10.0.0.0
         Router : 10.10.0.10
    When l reconfigure to this addressing the wireless clients connect and get the new dhcp scope details but following this the webauth screen doesn't appear not allowing them to connect meaning there is no routing of traffic / internet access.
    If l modify the above interface and scope masks back to a /24 - 255.255.255.0 the the wireless clients connect and webauth appears to prompt them to accept the terms and conditions and connect thus giving them internet access.
    It looks like an issue with the mask ? The main reason l am trying to change the subnet addressing is because the standard /24 mask is not providing enough dhcp addresses and we have had times were the scope has been exhausted due to the public connecting and disconnecting as the lease perod of 2 hours holds onto the address before expiring meaning there is not enough available addresses for people to connect.
    I would of thought that the upstream router ( RV042 ) even though it is only a /24 mask would still route the traffic coming from a WLC Controller interface with a /22 mask ?
    Hopefully someone can suggest a solution ?
    Thanks Simon

    Hey Scott just getting back to this issue..   If for instance l can modify the wlc interface and Scope to have a /22 mask ( 1022 Hosts ) and my upstream Router ( Cisco RV042 ) can only provide a /24 or higher mask then does that mean l am still limited to a range of 254 hosts ( /24 Mask ) ?  Would this mean l need to look into replacing my upstream Cisco RV042 VPN Router ?

  • WLC-5508 - Software Update issue

    Hi,
        I'm having a little problem with a WLC-5508, It has the 6.0.199.4 image version and when I try to update it with any of the new versions the controller prompt this error: "% Error: Code file transfer failed - Error while writing output file". I think the controller has no enough memory to copy the file.
        I ran the show memory statistics and the free system memory tells It has enogh space. So I don't know what to do, I read all the configuration manual but I can not find any slution. The probles is that I need to asosiate 8 new AP-2602 and with this old software version they are not compatible.
    If anyone knows a posible solution, it would help me a lot.
    Thanks!!

    You can not directly upgrade the ios, kindly consult the following cisco link 
    http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn74.html
    "It is not possible to directly upgrade to the 7.4.100.0 release from a release that is older than 7.0.98.0"
    you have to complete the work in two step i.e 6.x to 7.0.x and then to 7.4

  • WLC 5508 issue with 4 ports in portchannel

    Hi,
    We have one WLC 5508 and LAG is enabled on it but when we connect 4 cables to a distribution switch only 3 links are sending and receiving traffic and the 4th one is up with outgoing traffic from the distribution switch to WLC but nothing incoming.
    Some APs went down and refuse to be registered back to the WLC. when we shut down the 4th port everything is back to normal.
    the etherchannel config is identical and I can see all ports are active and not suspended :
    interface GigabitEthernet2/2/1
    description PortChannel-WLC1-Port1
     switchport
     switchport trunk encapsulation dot1q
     switchport trunk allowed vlan 60-67,2808,2922,2923,2932
     switchport mode trunk
     channel-group 99 mode on
    interface GigabitEthernet2/2/2
    description PortChannel-WLC1-Port2
     switchport
     switchport trunk encapsulation dot1q
     switchport trunk allowed vlan 60-67,2808,2922,2923,2932
     switchport mode trunk
     channel-group 99 mode on
    interface GigabitEthernet2/2/3
    description PortChannel-WLC1-Port3
     switchport
     switchport trunk encapsulation dot1q
     switchport trunk allowed vlan 60-67,2808,2922,2923,2932
     switchport mode trunk
     channel-group 99 mode on
    interface GigabitEthernet2/2/4
    description PortChannel-WLC1-Port4
     switchport
     switchport trunk encapsulation dot1q
     switchport trunk allowed vlan 60-67,2808,2922,2923,2932
     switchport mode trunk
     channel-group 99 mode on

    sh etherchannel 99 sum
    Flags:  D - down        P - bundled in port-channel
            I - stand-alone s - suspended
            H - Hot-standby (LACP only)
            R - Layer3      S - Layer2
            U - in use      N - not in use, no aggregation
            f - failed to allocate aggregator
            M - not in use, no aggregation due to minimum links not met
            m - not in use, port not aggregated due to minimum links not met
            u - unsuitable for bundling
            d - default port
            w - waiting to be aggregated
    Number of channel-groups in use: 38
    Number of aggregators:           38
    Group  Port-channel  Protocol    Ports
    ------+-------------+-----------+-----------------------------------------------
    99     Po99(SU)         -        Gi2/2/1(P)     Gi2/2/2(P)     Gi2/2/3(D)     
                                     Gi2/2/4(P)     
    Last applied Hash Distribution Algorithm: Fixed
    Gi2/2/3 is down becasue we had to shut down the interface because when it is up many APs refuse to register.

Maybe you are looking for