Ignoring assoc request due to mobile in exclusion list

erikreig1 — Mon, 05 Jul 2021 16:50:36 GMT

Hello,

We have a WLC 5508 running under 8.3.143.0 version.

We found a problem trying to connect a device to a SSID.

After debugging mac address this is what we get:

(Cisco Controller) >config sessions timeout 0

(Cisco Controller) >debug client e4:42:a6:4c:1e:cc

(Cisco Controller) >debug dhcp message enable

(Cisco Controller) >*apfMsConnTask_3: Feb 13 11:11:38.977: e4:42:a6:4c:1e:cc Dro pping action frame from the client (Unsupported ActionCategory:7)

*apfOpenDtlSocket: Feb 13 13:43:00.879: e4:42:a6:4c:1e:cc Recevied management fr ame ASSOCIATION REQUEST on BSSID 00:23:eb:e3:c0:bc destination addr 00:23:eb:e3 :c0:bc

*apfOpenDtlSocket: Feb 13 13:43:00.881: e4:42:a6:4c:1e:cc Recevied management fr ame ACTION on BSSID 00:23:eb:e3:c0:bc destination addr 00:23:eb:e3: c0:bc

*apfMsConnTask_3: Feb 13 13:43:00.881: e4:42:a6:4c:1e:cc Got action frame from t he client (ActionCategory:7)

*apfMsConnTask_3: Feb 13 13:43:00.881: e4:42:a6:4c:1e:cc Dropping action frame from the client (Unsupported ActionCategory:7)

*apfOpenDtlSocket: Feb 13 13:43:05.992: e4:42:a6:4c:1e:cc Recevied management frame REASSOCIATION REQUEST on BSSID 00:23:eb:e3:c0:bc destination addr 00:23:eb:e3:c0:bc

*apfMsConnTask_3: Feb 13 13:43:05.993: e4:42:a6:4c:1e:cc Processing assoc-req station:e4:42:a6:4c:1e:cc AP:00:23:eb:e3:c0:b0-01 ssid : W170909_Alm thread:1a93b028

*apfMsConnTask_3: Feb 13 13:43:05.993: e4:42:a6:4c:1e:cc Ignoring assoc request due to mobile in exclusion list

*apfOpenDtlSocket: Feb 13 13:43:05.995: e4:42:a6:4c:1e:cc Recevied management frame ACTION on BSSID 00:23:eb:e3:c0:bc destination addr 00:23:eb:e3:c0:bc

*apfMsConnTask_3: Feb 13 13:43:05.995: e4:42:a6:4c:1e:cc Got action frame from the client (ActionCategory:7)

*apfMsConnTask_3: Feb 13 13:43:05.995: e4:42:a6:4c:1e:cc Dropping action frame from the client (Unsupported ActionCategory:7)

*apfOpenDtlSocket: Feb 13 13:43:11.093: e4:42:a6:4c:1e:cc Recevied management frame REASSOCIATION REQUEST on BSSID 00:23:eb:e3:c0:bc destination addr 00:23:eb:e3:c0:bc

*apfMsConnTask_3: Feb 13 13:43:11.093: e4:42:a6:4c:1e:cc Processing assoc-req station:e4:42:a6:4c:1e:cc AP:00:23:eb:e3:c0:b0-01 ssid : W170909_Alm thread:1a93b028

*apfMsConnTask_3: Feb 13 13:43:11.093: e4:42:a6:4c:1e:cc Ignoring assoc request due to mobile in exclusion list

*apfOpenDtlSocket: Feb 13 13:43:11.096: e4:42:a6:4c:1e:cc Recevied management frame ACTION on BSSID 00:23:eb:e3:c0:bc destination addr 00:23:eb:e3:c0:bc

*apfMsConnTask_3: Feb 13 13:43:11.096: e4:42:a6:4c:1e:cc Got action frame from the client (ActionCategory:7)

*apfMsConnTask_3: Feb 13 13:43:11.096: e4:42:a6:4c:1e:cc Dropping action frame from the client (Unsupported ActionCategory:7)

*apfOpenDtlSocket: Feb 13 13:43:16.170: e4:42:a6:4c:1e:cc Recevied management frame REASSOCIATION REQUEST on BSSID 00:23:eb:e3:c0:bc destination addr 00:23:eb:e3:c0:bc

*apfMsConnTask_3: Feb 13 13:43:16.170: e4:42:a6:4c:1e:cc Processing assoc-req station:e4:42:a6:4c:1e:cc AP:00:23:eb:e3:c0:b0-01 ssid : W170909_Alm thread:1a93b028

*apfMsConnTask_3: Feb 13 13:43:16.170: e4:42:a6:4c:1e:cc Ignoring assoc request due to mobile in exclusion list

*apfOpenDtlSocket: Feb 13 13:43:16.172: e4:42:a6:4c:1e:cc Recevied management frame ACTION on BSSID 00:23:eb:e3:c0:bc destination addr 00:23:eb:e3:c0:bc

*apfMsConnTask_3: Feb 13 13:43:16.172: e4:42:a6:4c:1e:cc Got action frame from the client (ActionCategory:7)

We don't apply mac filtering neither excluded any client.

Can anybody help us please?

If you need more information let me know.

Thanks,

Re: Ignoring assoc request due to mobile in exclusion list

Haydn Andrews — Wed, 13 Feb 2019 20:11:03 GMT

Looks like the client has been excluded.

What WLC version are you running?

There are a number of reasons for a client to be excluded:

Excessive 802.11 Association Failures—Clients are excluded on the sixth 802.11 association attempt, after five consecutive failures.
Excessive 802.11 Authentication Failures—Clients are excluded on the sixth 802.11 authentication attempt, after five consecutive failures.
Excessive 802.1X Authentication Failures—Clients are excluded on the fourth 802.1X authentication attempt, after three consecutive failures.
IP Theft or IP Reuse—Clients are excluded if the IP address is already assigned to another device.
Excessive Web Authentication Failures—Clients are excluded on the fourth web authentication attempt, after three consecutive failures.

You would need to identify the reason it is being excluded.

The reason I ask about the WLC version is there is a bug where the client exclusion does not clear on an AP once the client exclusion timeout expires:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve36706

topic Re: Ignoring assoc request due to mobile in exclusion list in Wireless

Ignoring assoc request due to mobile in exclusion list

Re: Ignoring assoc request due to mobile in exclusion list