WLC Duplicate IP address detected for AP-Manager Interface

I am getting an error log in the WLC saying, its IP address is duplicate by another machine with MAC address A.B.C.D
But this MAC address A.B.C.D is the MAC address of the AP-Manager Interface in the same controller.
Model No.                   AIR-WLC2106-K9
Software Version                 7.0.116.0
%LWAPP-3-DUP_IP: spam_lrad.c:27626 Adding client 58:b0:35:83:72:86 to exclusion list due to IP Address conflict with AP 'AP_DUXO_3'
%LWAPP-3-DUP_AP_IP: spam_lrad.c:27612 Duplicate IP address detected for AP AP_DUXO_3, IP address of AP 10.184.1.224, this is a duplicate of IP on another machine (MAC address 58:b0:35:83:72:86)
Cisco AP Identifier.............................. 1
Cisco AP Name.................................... AP_DUXO_3
Country code..................................... US - United States
Regulatory Domain allowed by Country............. 802.11bg:-A     802.11a:-A
AP Country code.................................. US - United States
AP Regulatory Domain............................. 802.11bg:-A    802.11a:-N
Switch Port Number .............................. 1
MAC Address...................................... cc:ef:48:1a:e4:af
IP Address Configuration......................... Static IP assigned
IP Address....................................... 10.184.1.224
IP NetMask....................................... 255.255.0.0
Gateway IP Addr.................................. 10.184.20.2
Domain...........................................
Name Server......................................
NAT External IP Address.......................... None
CAPWAP Path MTU.................................. 1485
Telnet State..................................... Enabled
Ssh State........................................ Disabled
Cisco AP Location................................ DUXO_BOX
Cisco AP Group Name.............................. default-group
Does anyone have an issue like this ?

Are you sure this MAC address 58:b0:35:83:72:86 isn't some type of Apple device? Its OUI is registered to apple. How do clients get ip addresses DHCP? It appears that the IP 10.184.1.224 is statically assigned to your ap-manager and that this client 58:b0:35:83:72:86 is either getting that same IP from DHCP or the client is statically assigning it themselves.

Similar Messages

Duplicate IP address detected in WCS

Hi to Cisco Support Community,
I would like to verify some questions regarding our network setup for wireless devices.
We have here in our client a 5508 WLC version 6.0.196.0 and WCS version 7.0.164.0 using windows platform.
My concern is that there is always a duplicate IP address detected by the WCS and when we trace the machine given its MAC address, we found out that the machine is a printer with a static IP of different IP address not the same to the management IP address of the WLC.
I have already disabled the port where the machine detected is terminated and still experiencing the same issue.
Is this a software bug or some sort of network issue? Please advice.
Thank you in advance!
Regards,
Joghson

Hi,
I have raised the issue with TAC and they told me that this is a software issue, we are currently making packet sniffs which is needed by the software developer. I will give you updates on this.
Thanks!

Standard Asynchronous ES for Quality Management interface

Hi,
Synchronous standard ES is available for Quality Management interfaces under ES bundle.
Could you please suggest if there is any standard Asynchronous ES available for above QM interfaces like Inspection plan, Inspection results and Usage Decision.
Br,
Madan

Dear Hummel
This link required SAP ID and use less for those who do not have S User ID's.
further more.... could you please differentiate Stand SAP QM process compare to QM process in RDS?

WLC 5508 with 6.0.188 -- ap-manager interface..

6.0.188 code on new 5508 WLC does not show ap-manager interface.
6.0.188 code on 4404 wlc does have ap-manager interface.
Both are working fine.
Why is that?

The 5500 controllers use the management interface to function as both the management interface and ap-manager. There will not be an ap-manager in the 5500.

WLC as a Mobility Anchor for guest access - Management on DMZ or not DMZ

When using Guest Access Cisco recommend a Mobility Anchor Controller be placed on a DMZ and the guest access wireless Lan is tunneled to this controller. This means that 2 DMZ subnetworks are required - one for the management interface and one for the wireless lan's dynamic interface itself.
I am trying to see if there are any disadvantages/security risks using 2 physical ports on the controller (no LAG) and placing one on a corporate network inside the firewall for management and to terminate the mobility anchor tunnel, and one outside the firewall on a DMZ for the wireless lan's dynamic interface.
Advantages that I see are that no tunnels need to go though a firewall, management of the WLC is kept completely inside the corporate network, protected by the firewall and not left on the DMZ.
Thanks.

OK, so to recap;
- place the 2nd WLC in the DMZ with only 1 port (set for dynamic AP management)?
- Then Anchor the guest SSID (on it's DMZ IP instead of management IP as is now)
And to make that kind of anchoring work, I have to open ports below on the firewall.. right?
UDP port 16666 for inter-WLC communication, and IP protocol ID 97 Ethernet in IP for client traffic.
and:
•TCP 161 and 162 for SNMP
•UDP 69 for TFTP
•TCP 80 or 443 for HTTP, or HTTPS for GUI access
•TCP 23 or 22 for Telnet, or SSH for CLI access
Thanks to confirm that

WLC IP Conflict with AP-Manager Interface

I am getting an error log in the WLC saying, its IP address is being used by another machine with MAC address A.B.C.D
But this MAC address A.B.C.D is the MAC address of the AP-Manager Interface in the same controller.
have anyone faced an issue like this ?
The same issue is having in another controller also. But I have two more controllers with the same IOS , which are working fine.

Hey Scott...
Thanks for ua quick response.
We have controller 4402.
We have all the two ports connected to core. But we have enabled LAG as well.
It was working perfect since almost an year and half. Recently we had an image upgradation to 6.0.182.0.
Upgradation was done for all the 5 controllers. But two are having this error log since then.
Its not continously coming.. Only sometimes..

WLC to use Management Interface & Few more getting started Questions

Hello,
I'm yet to implement the Wireless LAN in one of our client's corporate office. There 40 x 1130AG LWAPP AP's and 4404 WLC with ACS 4.x for the Authentication of the Wireless Clients who is trying to access the LAN.
For the WLC to connect to the Dual Core Switch, i need to use only one Management Interface with Distribution System port 1 being the Primary and mapping the DS Port 2 as the Backup port for the Management Interface. Is this Right? or do i have configure Dynamic Interfaces as well. Is management interface for accessing / management and configuration only? Management Interface will communicate with ACS for AAA and AP's who would like to associate with the WLC, is this Right?
Note: WLC, AP's, Wireless Clients & AP's are in the same IP Subnet.
Few other question of WLAN's so it helps me during implementation -
â¢ Can I use the 802.1x Authentication application found in the Windows XP for the Wireless Interface; instead of Cisco Client Application. For this; I have to configure the WLC / Wireless Client to use EAP algorithm; is this Right?
â¢ With the help of RRM, the channel interference between multiple AP's (3 - 4 AP's) in the same area is controlled by the WLC by changing the Channels used by the AP which is not same on all the AP's. Is this right?
â¢ How many Client Users will connect per Channels. 802.11 a / g will provide 11 Channels, is this Right?.
â¢ I'm trying to set in the WLC to limit the Client connections per AP to 25, can this be achieved?
Please, can anyone help me in calrifying the above points.
Regards,
Keshava Raju

Many Thanks Mr. Dennis for your help & Clarification.
With ref to your reply point no# 1. I have actually planned to connect one Gig port of the controller to each of the Dual Cisco Core Switch setup. Can i use all 4 Controller Interfaces configured as LAG and Port 1 & 2 connecting to Core Switch 01 and Port 3 & 4 connecting to Core Switch 02?
I have Final two more questions, Request you to help me calrifying this?
â¢ I'm willing to configure Multicast communication between the WLC & AP's. For this configuration is it necessary to Connect the WLC in a different VLAN than the VLAN of the AP's. Is it necessary that I have to set the controller to LWAPP Layer 3 mode to support the Multicast communication?
â¢ Though I do not have implementation experience of the WLAN. My understanding of the Interface settings on the WLC - is I will have to configure one Management Interface for in-band management. Do I have to configure AP-Manager Interface (to support Multicast communication) and to make the WLC to communicate with ACS for Client Authentication. All of the Wireless Devices including the ACS are in one VLAN / IP Subnet, is only one Management Interface is enough for communicating with AP's (with Multicast) and communicating with ACS for forwarding the Authentication messages between the ACS & Wireless Clients?

IPS 4240 management interface MAC address

Hi All,
I am using DHCP in my network. And i need to reserve one IP for the Management Interface of the IPS.
I tried to get the MAC but couldn't. It is not even on the Show tech-support.
Can any please tell me how to get the MAC of Management interface of IPS?

If the show interface output is not giving you this information, you can logon via service account and run the 'ifconfig -a' command. Just make sure you do a 'su -' otherwise this command won't be available.
Please rate if helpful :)
Regards
Farrukh

Altering VLAN-Konfiguration Controller Management-Interface

Hello
I tried to alter the vlan configuration for the management interface on 4402 controller. The management interface are tagged with the vlan 55.
Now, I d'like to change this vlan 55 definition to a untagged configuration. On the corresponding switchport, I configured the command "sw trunk native vlan 55".
I think with this config the management interface works in the vlan 55 again, but the interface is not reachable after this changes.
Is it possible to do such changes on a working config?
Does anyone know what is wrong with my config?
Regards
Pascal

I know there is a bug on the 5.0 code, which might still be on the 5.1, but I don't have that info. There also was a bug on the 4.1, in which you would have to load the webauth page to the wlc, set the wlc to use the default page and hit apply. Then you would choose to use custom webauth and hit apply and that would fix the issue. You can try that to see if that works, or else if you configurations are correct, then maybe open a TAC case. Like I said earlier, that code is too new.

Nexus 5548 - %ARP-3-DUP_SRCIP_PROBE: Duplicate address Detected

Hello.
Looking for some assistance on the following please, I'll try to include a lot of detail:
I noticed we're receiving repeating messages on a pair of Nexus 5548UP switches, regarding duplicate IP's, and the IP's in question are the mgmt0 of each respective Nexus switch; which are connected to each other and uplinked to two 3750X switches which are also linked to each other (not as a stack, with optics).
Here is a sample of the syslog message: %ARP-3-DUP_SRCIP_PROBE: arp [####] Duplicate address Detected. Probe packet received from zzzz.zzzz.zzzz on mgmt0 with destination set to our local ip, xxx.xxx.xxx.xxx
And in ascii art, here is a diagram: SW1&2 are 3750X (running 15.x code) and NX1&2 are Nexus 5548UP (running 6.x code)
SW1---SW2
| |
NX1---NX2
Pretty basic box/"ring", just in case the diagram doesn't format well, with rapid spanning-tree in effect. The Nexus are Layer2 only, and the 3750X's are Layer 2 & 3 /w HSRP on a few SVI's in them. All vlans can pass over the connecting trunks. And on the Nexus, the management interface (mgmt0) is connected to 3750X (NX1 to SW1 and NX2 to SW2); e.g. management is done over this vrf interface, versus it flowing through a trunk interface to a SVI on the Nexus.
I know these messages to be erroneous as far an being actual duplicate IP's on the network, and have seen a few posts that indicate a command ("no ip arp gratuitous hsrp duplicate") typically referencing a Nexus 7000 setup has helped, but obviously as described that's not involved here. Note: Placing that command on the mgmt0 interface of the two nexus had no positive effect. The messages didn't start showing until after HSRP was enabled on the applicable 3750X SVI's - so seems a likely correlation.
Essentially looking to clear this up (ideally) or suppress the messages since they're false. Any ideas?
Thanks!

For those encountering this same issue, here is some information that may lead you to a resolve.
I decided to open a TAC case to get some direct assistance, and I was directed to the 3750X's and a new feature in the 15.x code, "ip device tracking". I was directed to remove that without specific details / steps on how to best do it (e.g. "no ip device tracking" does not remove it from the global config, as of 15.2(1)E anyway and is the most current at the time of this posting), and that didn't take, giving the message: % IP device tracking is disabled at the interface level by removing the relevant configs. However, after doing some research on the command, I can across some similar posts on 15.x code and duplicate IP messages.... Here's two posts I referenced:
https://supportforums.cisco.com/thread/2244042
https://supportforums.cisco.com/thread/2239656
I opted for the "no macro auto monitor" command in the 3750X's in global config, as mentioned in the above post(s) - This did stop the messages from occurring in the Nexus switches. IMPORTANT NOTE: I noticed that it did appear to bounce all the switch ports however, which could impact production - Be advised!
I cannot speak to if the interface level command 'nmsp attach suppress' is a better route to go, which is also referenced in the posts (first one primarily) - I went the other route to not have all the extra config line entries. I have asked Cisco what the true impact of the "no macro auto monitor" command is, and am waiting a response - Ideally there's little to none, probably depending on if you want to make use of device tracking or not... in my case, I suspect I don't have a need for this and thus there's no impact - I shall see.
It would be ideal if code is released to disable this service / feature in the future more gracefully and/or code changes are done to remedy this issue so you can have the feature enabled (or not). I akin this much like the "vstack" service that was introduced around 12.2(55/58)SE IOS that couldn't be disabled & left an open TCP port (not good for security scans), then with 12.2(58)SE2 they allowed it to be disabled (e.g. "no vstack" in global config).
Hopefully these details prove of value.
Regards.
NOTE: Since it doesn't seem you can"answer" your own posts, which seems silly; please note I consider this item resolved / answered.

How to manage IP address assignment for laptops?

Dear All,
I'm looking for an efficient way to manage IP address assignment for laptops.
I have a DHCP server with reservation for all my devices.
Laptops usually have 2 NICs: LAN and WiFi card.
So, how can I manage the IP assignment for these devices?
If I make a DHCP reservetion with two different IP addresses, I can have problems with DNS round-robin.
Should I enable the DNS secure dynamic update for domain members and then reserve two different IP addresses on DHCP?
I don't want that user needs to manually change their NIC configuration.
What you suggest?
Thanks

The best way to manage it would be to "not" manage it. DHCP by definition is supposed to be "dynamic". DHCP Reservations are great for a few devices that live under "special circumstances" but you never want to set Reservations for everything,...if
you do that then just don't have DHCP to start with and statically assign everything.
The combination of DHCP with dynamically updated DNS in AD means you never have to know or ever care what the IP# is. Everything is referred to by it's hostname.
Some things to keep in mind:
Every interfaces has a different MAC,...meaning the Laptops have two MACs. Therefore it is impossible to reserve the same IP# for both. So they end up with a different IP# depending on which Nic they use. Running two laptop nics on the same LAN at
the same time is always bad. Either always use the wireless,...or always turn off the wireless nic when laptops are local within your facility and can use the physical nic. In other words pick one,...or the other,...never allow both to work
at the same time. This is a responsibility and education issue of the user,...you can't do this for them.
User can not change their own network IP Specs unless they are Local Administrators on their machines,...and they should never be allowed to be Local Administrators.

Unchained certificate for WLC management interface

Hi all ,
I want to know , how to generate unchained certificate for the managemetn interface of WLC ? . Whether Root CA will be giving this unchained certificate ?
Because WLC management wont support chained certificate..
Thanks,
Vijay.

Hello Vijay,
Just go through this short cisco doc regarding generating CSR for Third-Party Certificates and Download Unchained Certificates to the WLC:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00806e367a.shtml

AIR-LAP1242AG-K9 could not join a 2106 WLC: i ma getting ready for a deployment, how can i resolve this?

Hi,
I setup a mini wireless LAN network lab with a not for resale 2106 wireless lan controller and a sales air-lap1242ag access point. I do not have a DHCP and DNS in my lab environment. I have configured the WLC with the basic configuration using the CLI wizard, i also configured the WLC as a DHCP server for clients that will be connecting to the APs associated to the controller.
I powered up the AP and connect the ethernet port directly to the controller, the controller issued an IP address to the AP, the AP downloaded a new operating system from the controller but failed to join the controller.
I check both debug message on the controller console and the trap messages on the controller's GUI and it say the AP could not download a configuration from the controller and it is beacuse of invalid license. Below is the trap message:
Configuration Phase Statistics
Requests Received
Responses Sent
Unsuccessful Request Processed
Reason For Last Unsuccessful Attempt
Last Successful Attempt Time
Last Unsuccessful Attempt Time
Last Error Summary
Last AP Message Decryption Failure
Last AP Connection Failure
Last Error Occurred
Last Error Occurred Reason
Last Join Error Timestamp
Also, I tried to log into the GUI of the AP using the both the username and password ''Cisco'' but I cannot get into the device. I can only get in through the CLI. In the CLI, almost all the commands I enter gives an error the it is disabled. I don't know what to do any more, I want to know if the access point is faulty or i am not doing the right thing.
PLEASE HELP!!!!!!!!!!!!!!!!!!!

Thank you for the quick response.
The controller is running firmware version:
Software Version 6.0.199.4
Emergency Image Version 6.0.199.4
The AP can ping the Management IP address of the controller successfully via console. I have also entered in the AP the WLC's Management IP address information and it is still the same. Below is the message I'm getting on the console of the AP it self:
*Jul 9 13:06:09.803: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Jul 9 13:06:10.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip:
192.168.50.246 peer_port: 5246
*Jul 9 13:06:10.001: %CAPWAP-5-CHANGED: CAPWAP changed state to
*Jul 9 13:06:11.636: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully
peer_ip: 192.168.50.246 peer_port: 5246
*Jul 9 13:06:11.638: %CAPWAP-5-SENDJOIN: sending Join Request to 192.168.50.246
*Jul 9 13:06:11.638: %CAPWAP-5-CHANGED: CAPWAP changed state to JOIN
*Jul 9 13:06:11.724: %CAPWAP-5-CHANGED: CAPWAP changed state to CFG
*Jul 9 13:06:11.726: %DTLS-5-ALERT: Received WARNING : Close notify alert from
192.168.50.246
*Jul 9 13:06:11.727: %DTLS-5-PEER_DISCONNECT: Peer 192.168.50.246 has closed conne
ction.
*Jul 9 13:06:11.727: %DTLS-5-SEND_ALERT: Send WARNING : Close notify Alert to 1
92.168.50.246:5246
*Jul 9 13:06:11.772: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
*Jul 9 13:06:11.772: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
I will also like to know if AIR-LAP1242AG is compatible with WLC 2106 controller.
Any help will be greatly appreciated, i really need to resolve this issue in my LAB now so that I don't go to my customer site to fumble.
thanks in advance.

Windows 7 / 2008 duplicate static address when using 802.1x / MAB - ISE

Hi all!
ISE 1.1.3
Cisco 3750 switches
Windows XP / 7 / 2008 clients
I'm having some weird issues were if a client connects to a switchport and happens to be using a static IP address then the client warns of a duplicate address problem. Also the client will then only show the default gateway within ipconfig even though the IP address / mask is still in the GUI network properties of the adaptor. This is happening with Windows 7 and Windows 2008 devices.
Windows XP clients don't get the issue.
Some clients will use 802.1x native supplicant and some will be authenticated based on MAB. Not noticed the problem with 802.1x clients but it always occurs on MAB.
I came across a similar issue here:
http://networkingblog.vvlabs.com/2012/07/cisco-ise-duplicate-ip-address-windows-7.html
Going of that blog I tried using the "ip device tracking delay probe delay" command but the switches don't recognise the "delay" keyword.
The switches are 3750 switches running version 12.2(58)SE2.
All I have is "count, interval, use-svi" as extra options.
Catalyst 4500 switch guide has "delay" option but no "count, interval or use-svi".
The only way I have managed to avoid the problem is using the second solution which is a registry hack on each client. This is fine for the odd server but not realistic when there will be hundreds of other clients.
Any ideas?

Hi
We are doing 802.1x for clients using the Windows supplicant. For clients not using supplicants we are using MAB. So the print servers and printers use MAB.
Extract of config...
aaa new-model
aaa authentication login default local
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa authorization auth-proxy default group radius
aaa accounting update periodic 5
aaa accounting dot1x default start-stop group radius
aaa accounting system default start-stop group radius
aaa server radius dynamic-author
client x server-key 7 x
client x server-key 7 x
aaa session-id common
clock summer-time BST recurring last Sun Mar 23:00 last Sun Oct 23:00
system mtu routing 1500
vtp mode transparent
authentication mac-move permit
ip routing
no ip domain-lookup
ip device tracking
dot1x system-auth-control
dot1x critical eapol
spanning-tree mode pvst
spanning-tree extend system-id
vlan internal allocation policy ascending
interface FastEthernet1/0/1
description ### Dot1x with MAB fallback ###
switchport mode access
switchport voice vlan 2
ip access-group ACL-DEFAULT in
srr-queue bandwidth share 10 10 60 20
priority-queue out
authentication event fail action next-method
authentication event server dead action authorize vlan 1
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication open
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer restart 0
authentication timer reauthenticate server
authentication violation restrict
mab
mls qos trust device cisco-phone
mls qos trust cos
auto qos voip cisco-phone
dot1x pae authenticator
dot1x timeout tx-period 5
spanning-tree portfast
service-policy input AutoQoS-Police-CiscoPhone
ip http server
ip http secure-server
ip access-list extended ACL-DEFAULT
remark Deny access to new network
deny ip any 172.x.x.x 0.0.0.255 log
remark Allow everything else to other networks
permit ip any any
ip radius source-interface Vlan2
logging esm config
logging host x transport udp port 20514
logging host x transport udp port 20514
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 30 tries 3
radius-server vsa send accounting
radius-server vsa send authentication
radius server ISE-1
address ipv4 x auth-port 1645 acct-port 1646
key 7 x
radius server ISE-2
address ipv4 x auth-port 1645 acct-port 1646
key 7 x

Setting management interface WLC 7.4.121.0

Hello.
I have a problem setting Management interface IP in new controller 5508. I get the error "Error in setting management interface IP".I can not place a management controller IP.
Starting IPv6 Services: ok
Starting Config Sync Manager : ok
Starting Hotspot Services: ok
Starting PMIP Services: ok
Starting Portal Server Services: ok
Starting mDNS Services: ok
Starting Management Services:
Web Server: CLI: ok
Secure Web: Web Authentication Certificate not found (error). If you cannot access management interface via HTTPS please reconfigure Virtual Interface.
License Agent: ok
(Cisco Controller)
Welcome to the Cisco Wizard Configuration Tool
Use the '-' character to backup
Would you like to terminate autoinstall? [yes]: -
Invalid response
Would you like to terminate autoinstall? [yes]: no
System Name [Cisco_bf:dd:c4] (31 characters max):
AUTO-INSTALL: process terminated -- no configuration loaded
Enter Administrative User Name (24 characters max): admin
Enter Administrative Password (3 to 24 characters): ********
Re-enter Administrative Password : ********
Service Interface IP Address Configuration [static][DHCP]: none
Service Interface IP Address: 1.1.1.1
Service Interface Netmask: 255.255.255.0
Enable Link Aggregation (LAG) [yes][NO]: no
Management Interface IP Address: 192.168.10.1
Management Interface Netmask: 255.255.255.0
Management Interface Default Router: 192.168.10.10
Error in setting management interface IP
Management Interface IP Address: 10.10.10.1
Management Interface Netmask: 255.255.255.0
Management Interface Default Router: 10.10.10.100
Error in setting management interface IP
Management Interface IP Address:
Does anyone faced this issue?
Thanks.

Hi,
Try these:
1. With the WLC, Please set flow control(in SecureCRT or hperterminal) to none. Once the changes are made, CLI will start working as usual.
2. Another common reason can be related to the virtual interface configuration of the controller. In order to resolve this problem, remove the virtual interface and then re-generate it with this command:
WLC>config interface address virtual 1.1.1.1
Then, reboot the controller. After the controller is rebooted, re-generate the webauth certificate locally on the controller with this command:
WLC>config certificate generate webauth
In the output of this command, you should see this message: Web Authentication certificate has been generated.
Now, you should be able to access the secure web mode of the controller upon reboot.
3. Try to use some diff IP address for service interface don't use 1.1.1.1.
Regards
Dont forget to rate helpful posts

WLC Duplicate IP address detected for AP-Manager Interface

Similar Messages

Maybe you are looking for