topic Re: Cisco 9120 in EWC with WLAN MAC local filtering issue in Wireless

Cisco 9120 in EWC with WLAN MAC local filtering issue

Edgar078 — Fri, 26 Jan 2024 17:21:41 GMT

Good day,

I have an EWC Access Point 9120 which has an SSID with PSK and MAC filtering local, however it is not allowing me to connect the devices, it gives me a message:

Jan 26 17:11:30.353: %MAB-5-FAIL: Chassis 1 R0/0: wncd: Authentication failed for client (0c9a.3cd2.bab3) with reason (AAA Server Down) on Interface capwap_90000004 AuditSessionID 00000000000001ED3D5C65E8

Jan 26 17:11:30.494: %CLIENT_EXCLUSION_SERVER-5-ADD_TO_EXCLUSIONLIST_REASON_DYNAMIC: Chassis 1 R0/0: wncd: Client MAC: 0c9a.3cd2.bab3 was added to exclusion list associated with AP Name:AP-SALA-JUNTAS, BSSID:MAC: 0000.0000.0000, reason:802.11 association failure

Jan 26 17:11:30.494: %SESSION_MGR-5-FAIL: Chassis 1 R0/0: wncd: Authorization failed or unapplied for client (0c9a.3cd2.bab3) on Interface capwap_90000004 AuditSessionID 00000000000001F23D5C6675. Failure reason: Authc fail. Authc failure reason: AAA Server Down.

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Mark Elsen — Fri, 26 Jan 2024 17:59:16 GMT

>... with reason (AAA Server Down) on Interface ...
- For some reason an AAA server is being contacted ; review the running configuration with : show running-config | inc aaa

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Rich R — Sun, 28 Jan 2024 13:18:54 GMT

Did you configure as per the guide?
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213922-configure-mac-authentication-ssid-on-cis.html#toc-hId-2036295870

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Haydn Andrews — Sun, 28 Jan 2024 21:22:05 GMT

It appears that you have AAA configured on the SSID, as its trying to send the auth to a AAA server

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Edgar078 — Mon, 29 Jan 2024 17:09:23 GMT

Hello @Haydn Andrews

I have configured this part according to the guide.

Authentication is local, there is no external radius server or tacacs.

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Edgar078 — Mon, 29 Jan 2024 17:10:51 GMT

Hello @Rich R

Yes, I have it configured like the guide you shared with me.

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Rich R — Mon, 29 Jan 2024 17:35:52 GMT

What version of software are you using?

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Edgar078 — Mon, 29 Jan 2024 17:47:15 GMT

17.09.04

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

MHM Cisco World — Mon, 29 Jan 2024 18:35:51 GMT

Can i see the wlan l2 secuirty page

Thanks

MHM

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Edgar078 — Mon, 29 Jan 2024 19:54:25 GMT

Hi @MHM Cisco World

This is the WLAN configuration

Regards!

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

MHM Cisco World — Mon, 29 Jan 2024 20:18:09 GMT

Authorization list name is different between l2 secuirty and what you previously share?

Also if you match name make sure thst ypu select Local and not click authc.

Do that and make sure the mac is add to authz and check again.

Thanks

MHM

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

ChaseFF — Tue, 30 Jan 2024 15:21:10 GMT

I have the same issue on 17.9.4a. Without the Authorization List, my PSK Authentication works and can join the SSID, but as soon I add the Authorization List, the PSK stops working, and I get Authentication failures "Authentication failed for client (abcd.1234.5678) with reason (AAA Server Down)" even though I did not add AAA Server Authentication.

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Rich R — Tue, 30 Jan 2024 23:51:48 GMT

I have just tested it on my EWC running 17.13.1 and it works fine.

Note that error message is misleading. That actually just means it did not find a username (MAC) match in the local list. I confirmed that in my testing.

If you followed the instructions precisely per the guide then your MAC address username is entered in lower case without any punctuation (no dots, no colons, no dashes). If you put . : or - in your mac then it won't match.

Also make sure you have Allow AAA Override enabled on your Policy Profile.

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

ChaseFF — Wed, 31 Jan 2024 02:39:00 GMT

There it was plain as day.

"Write the mac address in all lowercase without a separator"!!!!

Thanks Rich for the smack in the back of the head 🙂

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Rich R — Wed, 31 Jan 2024 08:58:21 GMT

<smile>

Re: Cisco 9120 in EWC with WLAN MAC local filtering issue

Edgar078 — Tue, 06 Feb 2024 16:54:27 GMT

Thank you all for your support, the problem has now been resolved.

I also disabled the Attribute List Name that you had created and in the device authentication.

Best Regards!