topic Hi in Wireless

Ask the Expert: Deploying and Troubleshooting Wireless Networks

Monica Lluis — Mon, 05 Jul 2021 11:38:20 GMT

Welcome to this Cisco Support Community Ask the Expert conversation. This is an opportunity to learn and any ask questions about how to configure and troubleshoot a wireless network with Cisco expert Alexander De Menezes.

Ask questions from Monday February 22 to Friday March 4, 2016

Wireless networks have became pervasive in today's world. Cisco offers very strong wireless porfolio that helps business to connect to the Internet anywhere anytime.

This session will focus on answering question regarding how to deploy a wireless network and also, the common pitfalls and issues that might happen in an installed wireless network.

Alexander De Menezes is a Technical Support engineer in the Cisco Technical Assistance Center in Cisco Brussels. He is expert on any wireless products, including Wireless LAN controllers and Access Points. He also has in-depth knowledge of AAA and IBNS technologies. Alexander joined Cisco in 2007. He holds a Master in Sciences in Advanced Electronic Engineering from the University of Warwick, UK.

Alexander might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Getting Started with Wireless Community

Find other https://supportforums.cisco.com/expert-corner/events.

**Ratings Encourage Participation! **
Please be sure to rate the Answers to Questions

Hi Alexander,

Brett Verney — Mon, 22 Feb 2016 23:04:09 GMT

Hi Alexander,

I have trouble understanding when to use a Flex ACL vs a normal WLC ACL, especially when it comes to things like Central Web Auth using ISE.

I have two questions;

1.) What ACLs need to be present on the WLC for ISE to reference when using CWA for guests access.

2.) Where do the Flex ACLs for CWA need to be referenced in a FlexConnect group?

Thanks heaps!

-Brett

Hello Alex,

Jackson Braddock — Tue, 23 Feb 2016 20:10:50 GMT

Hello Alex,

What recommendations do you have to troubleshoot a WLAN where the authentication is failing? Thanks for your help on this.

- Jackson

Hi Jackson,

Alexander De Menezes — Tue, 23 Feb 2016 21:35:39 GMT

Hi Jackson,

I assume you refer to a setup using Cisco WLC and not standalone IOS APs.

You will also need to verify if the wireless client supplicant is correctly configured for the EAP authentication method as defined on the RADIUS/AAA server.

For debugging on Cisco WLC via cli:

show client detail <wireless mac of failing client>

debug client <wireless mac of failing client>

To disable all debugs:

debug disable-all

From the debug, we can search for the keyword: Access-Accept

For a successful client authentication attempt ,we will have following line in the debug:
"Processing Access-Accept for mobile"

If an "access-accept" is not seen in the WLC debug or if we have an "access-reject" from RADIUS/AAA server, then the troubleshooting will need to be focussed on the RADIUS/AAA server.
For example, if using a Cisco ISE as RADIUS server,we can run a tcpdump/sniffer trace or view the user live authentication detail report or run "runtime-aaa" in debug level for details into authentication flow.

As example, from the tcpdump/sniffer trace on RADIUS/AAA server, we can filter sniffer capture on "radius" and verify if we have the "access-accept" frame for the client/user access request frame.

Now if we have the "access-accept" for the client/user , but the client is still not working and not in "RUN" policy manager state on the WLC.
Then based on your WLAN/SSID config, if you have some WLAN/SSID config like below ,the issue may then be in latter 4 way handshake process after 802.1X EAP authentication is completed.

Wi-Fi Protected Access (WPA/WPA2)............. Enabled
WPA (SSN IE)............................... Disabled
WPA2 (RSN IE).............................. Enabled
TKIP Cipher............................. Disabled
AES Cipher.............................. Enabled

Auth Key Management
802.1x.................................. Enabled

For some info on client policy state on the WLC:

http://www.cisco.com/c/en/us/support/docs/wireless/aironet-1200-series/100260-wlc-debug-client.html#pem

Do let me know if you see something unclear in the debug, and I will gladly help.

-Alex

Hi Brett,

Alexander De Menezes — Tue, 23 Feb 2016 22:23:18 GMT

Hi Brett,

I share some links to clarify it in more detail.

Page 8 onwards for info on question 1:

http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/howto_40_webauthentication_dg.pdf

Page 10 onwards for config details on question 2:

http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo-14-Universal_WLC_FlexConnect_Config.pdf

Also another link for info on CWA with Flexconnect APs:

http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/116087-configure-cwa-wlc-ise-00.html

There are some bugs to note here which is probably causing confusion.Depending on what is your WLC version and if you upgrade from 7.5/7.6 to 8.x, your earlier working CWA setup with flex connect ACLs may break, these are the bugs to watch out for:

CSCue68065 CWA with Flex APs require a local ACL with same name as Flex ACL
CSCuv04255 8510 wlc not getting portal page while doing cwa
CSCuy01846 ACL blocking some traffic after upgrade
CSCuy18455 Documentation should reflect Airspace ACL behavior change

As mentioned in above document link:

An issue with FlexConnect APs is that you must create a FlexConnect ACL separate from your
normal ACL. This issue is documented in Cisco Bug CSCue68065 and is fixed in Release 7.5.
In WLC 7.5 and later, only a FlexACL is required, and no standard ACL is needed. The WLC
expects that the redirect ACL returned by ISE is a normal ACL. However, to ensure it
works, you need the same ACL applied as the FlexConnect ACL.

There is a note in 8.x release:

http://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/wlcrn80.html#pgfId-1266575

and for 8500 WLC platform:

CSCuv04255 8510 wlc not getting portal page while doing cwa

Conditions:
When flexconnect ACL and regular ACL has the same name and the same exact acl

Workaround:
Remove the regular ACL or have the same regular ACL name as the flexconnect group ACL with deny statement

Hope that helps to clarify?

-Alex

Hi Alex,

wyfy-2015 — Wed, 24 Feb 2016 03:29:38 GMT

Hi Alex,

If the client suddenly get disconnect ,cisco prime will show disassocited from the ap.

How do we get details of the disassociation reason .

Thanks

Hi,

wyfy-2015 — Wed, 24 Feb 2016 03:37:19 GMT

Hi,

For some reason i had to change Multicast unicast mode .But broadcasting videos became sluggish

Now i would like to change to back Multicast multicast mode , if it is not working in multicast multicast mode , what could be the problem . How can i begin troubleshoot ?

Thank you

Hi,

wyfy-2015 — Wed, 24 Feb 2016 03:50:20 GMT

Hi,

I have attached a screenshot of an apple phone from the wlc ,which shows currentTxrate 10.5,

I believe it should show mcsindex . If it is mcsindex how come it is 10.5 ?

correct me if am wrong ?

Thanks

Thanks Alex,

Brett Verney — Wed, 24 Feb 2016 06:37:45 GMT

Thanks Alex,

This is some good information!

Much appreciated

-Brett

Hello Brett,

Monica Lluis — Wed, 24 Feb 2016 17:19:28 GMT

Hello Brett,

If Alex was able to help, feel free to rate his answer. This helps all the community members to find quality content faster and encourage experts to continue to provide great answers.

Thanks a lot,

Monica Lluis

Community Manager

Hello Alexander

Daniel Ordóñez Flores — Wed, 24 Feb 2016 17:38:41 GMT

Hello Alexander

This can be a silly question but I'd like to know how to start to do a really deep troubleshooting.

Must of us we can see when a wireless network has an issue in its configuration, but how we can start with a professional trouble shooting?

Thanks for your advice.

Hi Alexander,

Olivier Robin — Wed, 24 Feb 2016 18:03:57 GMT

Hi Alexander,

How do you troubleshoot random AP disassociation ?

"show ap uptime" shows that association uptime differs from ap uptime:

AP03 7 days, 15 h 54 m 38 s   0 days, 06 h 46 m 57 s
AP02  1 days, 09 h 17 m 32 s   0 days, 06 h 46 m 27 s
AP09  1 days, 09 h 15 m 40 s   0 days, 02 h 22 m 00 s
AP08  1 days, 06 h 08 m 55 s   0 days, 02 h 21 m 29 s
AP01  12 days, 07 h 05 m 36 s   0 days, 01 h 11 m 40 s

The AP are not always the same.

Thanks

Hi!

Alexander De Menezes — Wed, 24 Feb 2016 22:21:22 GMT

Hi!

On Prime ,you can use the client troubleshooting tool to get info on client connection state:
http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-0/user/guide/pi_ug/clientmgmt.html#pgfId-1383721

One can check on the details for specific clients from:
Monitor>Monitoring Tools>Clients and Users>your specific client MAC xx:xx:xx:xx:xx:xx

Via above path,there is an association history section under the overview tab which provides info on association/dissociation/deauthentication and other events.

There is also possibility for reports:

Reports>Reports>Report Launch Pad/Client/Client Sessions

Above data helps to get a good overview of problem state,like:
-Is issue happening for all clients or specific clients (example: buggy client which needs updating to latest wireless drivers/firmware).
-Is issue happening across all site or specific floor area (example: interference/high channel utilisation in specific area)

But to get details of the disassociation reason, the troubleshooting then is done on WLC ,so we then run "debug client" until problem is replicated for client disassoc, from WLC cli:

debug client <take a specific Client MAC>

debug disable-all -to disable debug.

Some good info on debug client (this is a debug which is used almost every-time in TAC for client troubleshooting):
http://www.cisco.com/c/en/us/support/docs/wireless/aironet-1200-series/100260-wlc-debug-client.html#intro

Some other useful things to check besides debug client for client disassociation reason, from WLC cli (verify for any odd events during timestamps of client disassociation issue):
show msglog
show traplog

For some more info, on Prime, we will normally not get Client Alarms and Events under the Monitor>Monitoring Tools>Alarms and Events tab since that is for Critical/Major events.
Its best to keep the Client Alarm severity at default info level to avoid performance impact from a lot of client alarms on PI, we can see the Client alarm severity is at default Informational level from path:
Administration>Settings>System Settings>Alarms and Events>Alarm Severity and Auto Clear>Wireless>Clients

-Alex

Hi Daniel

Alexander De Menezes — Wed, 24 Feb 2016 22:39:35 GMT

Hi Daniel

Its a great question, but i won't be able to give a detailed response in this short space, so i will share you some very good info on troubleshooting available under Ciscolive site:

https://www.ciscolive.com/online/connect/speakerDetail.ww?PERSON_ID=9F02F59D10F89B88B09BEEE474B6B34C

There are a lot of troubleshooting sessions on wireless in CiscoLive, i think the 2 below sessions will give you the info you are looking for:

BRKEWN-3011 - Advanced Troubleshooting of Wireless LANs (2016 Berlin)

https://www.ciscolive.com/online/connect/sessionDetail.ww?SESSION_ID=89192&tclass=popup

BRKEWN-3000 - Advanced - Analyzing and fixing WiFi issues - Cisco WLC tools and packet capture analysis techniques(2015 Milan)

https://www.ciscolive.com/online/connect/sessionDetail.ww?SESSION_ID=81865&tclass=popup

Do let me know if you have any specific troubleshooting scenario which is unclear or if any problems with accessing above content from Cisco live:

http://www.ciscolive.com/global/

-Alex

Hi Robinoliv,

Alexander De Menezes — Wed, 24 Feb 2016 23:50:24 GMT

Hi Robinoliv,

Is this for new deployed APs, since i also see AP uptime of 1 day for example for AP02/AP09/AP08.

Short AP uptime would mean AP loosing connectivity to switch port, so example PoE issue (like Switch PoE budget issue or AP switch port flaps or unstable switch to which AP is plugged).

For Aps which have shorter "association up time" as compared to the "AP up time", that would mean the APs are loosing connectivity to the WLC and rejoining back.

In your case there are APs with both short AP uptime and differing association uptime.

To troubleshoot this problem:

1)You may want to check on WLC release, for example on Cisco.com we see 7.6 release marked as deferred release, so you can check on release notes and have WLC moved to a latter Cisco suggested release (can be viewed from cisco.com >software downloads page).

2)If not running on deferred WLC releases and you still see the issue, then

Check on AP event.log/show logging as it will show some info on problem event corresponding to AP uptime data.

For example from telnet/ssh to specific AP:
ap#debug capwap console cli

ap#show logging

Also you can correlate above problem occurrence timestamps to WLC data,from WLC cli:

show msglog

show traplog

3)Enable core dump on APs:

WLC command :
config ap core-dump enable <TFTP server IP> <filename> compress

For this we will then need to make sure the AP can reach the TFTP server.So if any crash event on the AP, the core dump will be automatically sent out by AP to TFTP server.

4)If any crash event seen on AP, we can then retrieve all the relevant "event.log/crash/rcore/coredump/show tech-support" from those specific Aps "dir flash:" for the relevant timestamp of AP problem occurrence.

For example from telnet/ssh to specific AP,you can capture:
ap#debug capwap console cli

ap#show tech-support
ap#show logging

ap#dir flash:

Under AP "dir flash" only check for files which have timestamp corresponding to problem occurrence time on APs.Then to transfer any relevant files to TFPT/FTP, for example:

ap#copy flash:crash.txt tftp:

ap#copy flash:r0.rcore tftp:

Or alternatively to transfer these files via WLC method:

(Cisco Controller) >Show ap crash-file
(Cisco Controller) >show ap core-dump <AP name>
(Cisco Controller) >config ap crash-file get-crash-data <AP name>
(Cisco Controller) >config ap crash-file get-radio-core-dump x <AP name>
(Cisco Controller) >show ap eventlog <AP name>

Should you not see any useful data from the AP "dir flash:" for problem occurrence timestamp,then do let me know, as it may need a Cisco TAC case for detailed troubleshooting.

-Alex

Hi

Alexander De Menezes — Wed, 24 Feb 2016 23:58:57 GMT

This maybe a bug.

What is the WLC version you are running?

Do you see the same output from WLC cli command:

show client detail <mac of wireless client>

And if you are testing with Iperf on another wireless client, do you see the Iperf results differing from what is seen on WLC currentTxrate?

http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/112055-tshoot-11n-speeds-00.html#topicsub1

-Alex

Hi Alex ,

wyfy-2015 — Thu, 25 Feb 2016 03:14:59 GMT

Hi Alex ,

Thank you for the reply . Its an apple iphone 6 device (802.11ac).and some times it shows the txrate 12.5 in another location .

Here is the client details .

Client MAC Address : d003.4b80
Client Username :
AP MAC Address : a46c.
AP Name: N
AP slot : 1
Client State : Associated
Wireless LAN Id : 10
Wireless LAN Name:
BSSID : a46c
Connected For : 522 secs
Protocol : 802.11ac
Channel : 56
Client IIF-ID : 0x7ac1000000b6a2
ASIC : 0
IPv4 Address : 10.0.
IPv6 Address : Unknown
Association Id : 1
Authentication Algorithm : Open System
Status Code : 0
Client CCX version : No CCX support
Re-authentication Timeout : 28246 (28772)
Input Policy Name : unknown
Input Policy State : None
Input Policy Source : Default Policy
Output Policy Name : cldeftoWMM
Output Policy State : Installed
Output Policy Source : Default Policy
802.1P Priority Tag : 0
WMM Support : Enabled
U-APSD Support : Disabled
Device Type : Unknown
Power Save : ON
Current Rate : 12.5
Supported Rates : 12.0,18.0,24.0,36.0,48.0,54.0,12.0,18.0,24.0,36.0,48.0,54.0
Mobility State : Local
Mobility Move Count : 0
Security Policy Completed : Yes
Policy Manager State : RUN
Policy Manager Rule Created : Yes
NPU Fast Fast Notified : Yes
Last Policy Manager State : L2AUTHCOMPLETE
Client Entry Create Time : 5591159 seconds
Policy Type : WPA2
Authentication Key Management : 802.1x
Encryption Cipher : CCMP (AES)
Management Frame Protection : No
Protected Management Frame - 802.11w : No
EAP Type : PEAP
Interface : WIFI
VLAN : 30
Quarantine VLAN : 0
Access VLAN : 30
WFD capable : No
Manged WFD capable : No
Cross Connection capable : No
Support Concurrent Operation : No
Client Capabilities
CF Pollable : Not implemented
CF Poll Request : Not implemented
Short Preamble : Not implemented
PBCC : Not implemented
Channel Agility : Not implemented
Listen Interval : 20
Fast BSS Transition : Not implemented
Fast BSS Transition Details :
Client Statistics:
Number of Bytes Received : 650421
Number of Bytes Sent : 1086810
Number of Packets Received : 4806
Number of Packets Sent : 3479
Number of EAP Id Request Msg Timeouts : 0
Number of EAP Request Msg Timeouts : 0
Number of EAP Key Msg Timeouts : 0
Number of Data Retries : 1821
Number of RTS Retries : 0
Number of Duplicate Received Packets : 35
Number of Decrypt Failed Packets : 0
Number of Mic Failured Packets : 0
Number of Mic Missing Packets : 0
Number of Policy Errors : 0
Radio Signal Strength Indicator : -41 dBm
Signal to Noise Ratio : 55 dB
Assisted-Roaming Prediction List:

-----------------------------------------------------

The below test run on an imac(apple says it supports 3x3 MIMO) which is also 'ac' with channel width 80Mhz .( mac client shows txrate 878 Mbps sometimes 1300 , i dont 't know why )

Iperf -s w 1024k

iperf -c 192.168.1.184 -t 30 -w 1024k -P 5

It gave me maximum 145Mb

------------------------------------------------------------------

wlc version

IOS-XE Software, 5700 Series Wireless LAN Controller Software (CT5760-IPSERVICESK9-M), Version 03.06.03E RELEASE SOFTWARE

ap 3702

Thank you

Alex great reference material

George Stefanick — Thu, 25 Feb 2016 03:17:46 GMT

Alex great reference material !

Hi,

wyfy-2015 — Thu, 25 Feb 2016 03:48:31 GMT

Hi,

I have tried to put ap3702 in sniffing mode ,(CT5760 controller) ,Unfortunately i could not find any 802.11 frames in the remote side?

Please help

Hi Alexander,

AZIZ BOUHMADI — Thu, 25 Feb 2016 10:26:05 GMT

Hi Alexander,

I have 2 questions over Short Guard Interval.

-When SGI is enabled on 2,4 and 5 GHz, is it also applied to legacy client connected only with G or A, without N or AC?

-If I disabled SGI, it will only decrease the performance for N & AC client without any side effect?

Thanks

Aziz