topic Re: Disable Client Exclusion on EWC in Wireless

Disable Client Exclusion on EWC

brentr678 — Tue, 14 Feb 2023 01:15:34 GMT

Ran into a weird problem that all started when I changed the PSK a WLAN uses. The SSID of the WLAN stayed the same, only the PSK changed. Since changing the PSK, even though we went through and updated the password on the wireless devices connecting to the WLAN that changed, they all initially connected fine. But soon we noticed randomly, devices were disconnecting from the network. Watching logs on the controller it shows the clients are getting added to the exclusion list due to the wrong PSK. Eventually all those same devices time out of the exclusion list, then connect fine without issue. Some time passes and they get added to the exclusion list again. I can't figure out if the problem is due to an issue with the wireless APs/controller or the clients themselves. All i can say though is this is happening to multiple types of clients (computers, phones, smart devices (plugs, Alexa, etc.)) so there isn't any commonality there. Thinking it was a bug with the IOS, i upgraded the firmware but the problem persisted. Tried wiping the entire config of the APs/controller and added back the PSK with the new config but the problem remained. So now I'm out of ideas and want to instead figure out how to just disable the client exclusion feature hoping that keeps devices connected. I understand the security ramifications of this, but for now am running out of options. Any and all responses on either what might be causing clients to get added to the exclusion list or how to disable it all together are much appreciated!

I am running two C9130AXI-B access points which are configured as an embedded wireless controller. Firmware version Cisco IOS XE Software, Version 17.09.02.

Re: Disable Client Exclusion on EWC

Mark Elsen — Tue, 14 Feb 2023 07:50:46 GMT

- You may try : (Cisco EWC Controller) >config wps client-exclusion all disable

Re: Disable Client Exclusion on EWC

brentr678 — Tue, 14 Feb 2023 12:57:59 GMT

Unfortunately i believe that command only works in AireOS. It doesn't accept the command on the EWC.

Re: Disable Client Exclusion on EWC

Rich R — Tue, 14 Feb 2023 14:29:58 GMT

Haven't tried it myself but I see these in "show run all" (handy for looking for default config):
wireless wps client-exclusion all
wireless wps client-exclusion dot11-assoc
wireless wps client-exclusion dot1x-auth
wireless wps client-exclusion dot1x-timeout
wireless wps client-exclusion ip-theft
wireless wps client-exclusion web-auth

So try no xxxx on those?

Re: Disable Client Exclusion on EWC

Scott Fella — Tue, 14 Feb 2023 16:33:39 GMT

I don't have an EWC but from a 9800 controller, you define this on the Policy Profile:

wireless profile policy <your policy profile>
no exclusionlist
exclusionlist timeout 0

Re: Disable Client Exclusion on EWC

Mark Elsen — Tue, 14 Feb 2023 16:42:09 GMT

>...Unfortunately i believe that command only works in AireOS. It doesn't accept the command on the EWC.
Check if these commands can provide more insights :
show wireless stats client detail
show wireless stats client delete reasons
show wireless client history disconnected summary
show logging profile wireless filter <CLIENTMAC>

Also have a checkup of the EWC controller configuration with the CLI command : show tech wireless , have the output analyzed by https://cway.cisco.com/tools/WirelessAnalyzer/ , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer. Checkout all advisories!

- Look into client debugging : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity , you can have client debugs analyzed with : https://cway.cisco.com/wireless-debug-analyzer

Re: Disable Client Exclusion on EWC

brentr678 — Tue, 14 Feb 2023 17:21:53 GMT

I tried "no wireless wps client-exclusion all" in global config and that didn't have any affect. On the actual wireless profile policy though "no exclusionlist" has seemed to work. Ill give it a day or so before calling it completely resolved, but so far watching the logs no clients have been added. Thank you all for the suggestions!

Re: Disable Client Exclusion on EWC

rui-b-rodrigues — Wed, 23 Oct 2024 09:44:35 GMT

Via cli, it asks to disable policy before that change, unfortunally.