topic Re: Disable All Client exclusion policies WLC 9800-L in Wireless

Disable All Client exclusion policies WLC 9800-L

mgonzalez15 — Mon, 24 Apr 2023 17:34:29 GMT

Hi everyone!

I have a client that is experiencing disconnection problems in the SSIDs that it has active, this includes 802.1x and 802.11 authentication, one of the logs that was constantly presented is the following:

%CLIENT_EXCLUSION_SERVER-5-ADD_TO_BLACKLIST_REASON_DYNAMIC: Chassis 1 R0/0: wncmgrd: Client MAC: aa42.2ab3.c605 was added to exclusion list associated with AP Name:AP11, BSSID:MAC: e44e.2d67.68ae, reason:Wrong PSK

Reading a bit, the only workaround that has worked is disabling all client exclusion policies, the client confirms that it has had a considerable improvement with the disconnections that the devices presented.

I know that this workaround is not the definitive one, because these exclusion lists should not be disabled, it seems to be an issue related to a bug, probably, since the clients are not writing the PSK wrongly.

If someone found a definitive solution, your comments and support would greatly help me.

Greetings.

WLC 9800-L
Version 17.03.05a

Re: Disable All Client exclusion policies WLC 9800-L

Mark Elsen — Tue, 25 Apr 2023 06:25:55 GMT

- https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu47560 , seems somewhat similar I would go for (and or test with) IOS-XE 17.9.3 and verify if the problem remains , or not ,

Re: Disable All Client exclusion policies WLC 9800-L

rwaskowski — Fri, 28 Apr 2023 12:35:51 GMT

Hi,

just for records and for those who experience the same issue: it is present in IOS-XE 17.6.4 & 17.6.5 too. And even turning off the whole feature does not help: if a clients sends one time the wrong PSK, it still gets on the exclusion list.

So far the workaround in the mentioned bug is the only way to mitigate the issue: set "exclusionlist timeout 1" [=one second]. Unfortunatly this makes the whole feature quite useless. Next I will try with 17.9.3 ...

best regards

Re: Disable All Client exclusion policies WLC 9800-L

Rich R — Wed, 17 May 2023 13:55:47 GMT

> "since the clients are not writing the PSK wrongly"
> "if a clients sends one time the wrong PSK"

Hmmm so the first statement may not have been true? The client has actually sent the wrong PSK?

Anyway - 17.9.3 is now the TAC recommended version as per the link below.