topic Re: 9800 ARP in Wireless

9800 ARP

yuricyrino — Fri, 24 Jan 2025 17:04:49 GMT

Hello ALL
Morning
We are facing many disconections from clients, all points to Windows behaviour, but double checking this kind of log was identified in 9800 logging.

Have you guys faced this issue before?

WLC#show logging | i 28a0.6bXXXXXX
Jan 22 11:42:14.632: %SISF-4-EXCESS_ARP_ACTIVITY: Chassis 1 R0/3: wncd: Excessive ARP activity detected for the client 28a0.6bXXXXXX. client is brought down and added to the exclusion list
Jan 22 11:42:14.633: %CLIENT_EXCLUSION_SERVER-5-ADD_TO_EXCLUSIONLIST_REASON_DYNAMIC: Chassis 1 R0/0: wncmgrd: Client MAC: 28a0.6bXXXXXX was added to exclusion list associated with AP Name:XXXXX, BSSID:MAC: XXXXX, reason:Excessive ARP activity

Update: APs are running as Local Mode, using inteface on /23 subnet

Re: 9800 ARP

Mark Elsen — Wed, 22 Jan 2025 12:18:06 GMT

- What software version is the 9800 controller running ?

Re: 9800 ARP

Rich R — Wed, 22 Jan 2025 15:59:43 GMT

First make sure your software version is up to date as per the TAC recommended list (link below).

Then make sure you have ARP proxy configured as per best practice guide:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#AddressResolutionProtocolARPproxy

Also make sure the Windows wireless drivers are up to date. If using Intel see:
https://www.intel.com/content/www/us/en/download/19351/intel-wireless-wi-fi-drivers-for-windows-10-and-windows-11.html

And finally check your WLC config with the Config Analyzer (link below) for any other possible issues.

Re: 9800 ARP

MHM Cisco World — Wed, 22 Jan 2025 16:22:05 GMT

client is brought down and added to the exclusion list <<- check why client is add to exclusion' moslty it casue by mismatch of re-auth timer and/or aaa server

MHM

Re: 9800 ARP

MHM Cisco World — Wed, 22 Jan 2025 16:23:15 GMT

No more PM promise you.

I am so respect you and Mr @Mark Elsen .

Have a nice day.

MHM

Re: 9800 ARP

Rich R — Wed, 22 Jan 2025 16:46:05 GMT

@MHM Cisco World The log already tells us the answer: reason:Excessive ARP activity

Re: 9800 ARP

yuricyrino — Wed, 22 Jan 2025 16:50:29 GMT

Hello
Here is the version

#sh ver
Cisco IOS XE Software, Version V1712_4_ESW13
Cisco IOS Software [Dublin], C9800 Software (C9800_IOSXE-K9), Version 17.12.4, C UST-SPECIAL:V1712_4_ESW13
This software is supported for a limited time under special agreement with Cisco Systems, Inc. ESW13
Copyright (c) 1986-2024 by Cisco Systems, Inc.
Compiled Thu 21-Nov-24 09:34 by mcpre

Re: 9800 ARP

MHM Cisco World — Wed, 22 Jan 2025 16:54:20 GMT

Exclusion reason are

1- authc failure

2- IP-theft

I.e. there is no mention about arp rate led to exclusion.

He need to check authc failure if not

Then he will check ip theft'

Cisco recommends to reduce idle timeout of ssid to solve complicate of ip theft

MHM

Re: 9800 ARP

Rich R — Wed, 22 Jan 2025 17:08:02 GMT

9800#show wireless wps summary
Client Exclusion Policy
Excessive 802.11-association failures : Disabled
Excessive 802.1x-authentication : Enabled
Mac and IP-theft : Enabled
Excessive Web authentication failure : Disabled
Failed Qos Policy : Enabled
Excessive NDP Activity : Enabled
Excessive ARP Activity : Enabled

But ARP seems to be always on by default because it is not configurable:
9800(config)#wireless wps client-exclusion ?
all Configure response to all of these events
dot11-assoc Configure response to excess 802.11 association failures
dot1x-auth Configure response to excess 802.1x credential failures
dot1x-timeout Configure response to excess 802.1x authentication timeout
ip-theft Configure response to IP theft or re-use
web-auth Configure response to excess web authentication failures

but it's definitely a whole lot more than just IP theft and auth failure <wink>

Re: 9800 ARP

Rich R — Wed, 22 Jan 2025 17:10:36 GMT

Well 17.12.4 ESW13 is fully up to date so that's good.

So check out the other things I mentioned below in my previous reply.

Re: 9800 ARP

MHM Cisco World — Wed, 22 Jan 2025 17:14:47 GMT

He can more clarify reason by do

Show wireless exclusionlist <<- check if it ip theft or arp

MHM

Re: 9800 ARP

Rich R — Wed, 22 Jan 2025 18:09:13 GMT

and:
9800#show wireless exclusionlist client mac-address 28a0.6ba9.c21b
but I expect that will just show exactly what the logs already say.

Re: 9800 ARP

yuricyrino — Fri, 24 Jan 2025 14:32:54 GMT

Hello All

Thanks for the tips.
We identified an behaviour in a software named Adaptiva, that is responsible for Windows Updates inside the company, the application downloads the patches from a central location. The distribution happens P2P betwen neighbors computers, the discovering process use ARP.
The appication was configured to seach in a /20 subnet 4096 IPs to perform ARP.
After a change to /24 subnet 256 IPs, there is no issues reported anymore.

In my point of view, we need do create a kind os assignature to classify the application to not identify like a theath.

9800#show wireless wps summary
Client Exclusion Policy
Excessive 802.11-association failures : Enabled
Excessive 802.1x-authentication : Enabled
Mac and IP-theft : Enabled
Excessive Web authentication failure : Enabled
Failed Qos Policy : Enabled
Excessive NDP Activity : Enabled
Excessive ARP Activity : Enabled

Management Frame Protection
Global Infrastructure MFP state : Enabled
AP Impersonation detection : Enabled
Key refresh interval : 24

Re: 9800 ARP

Rich R — Fri, 24 Jan 2025 15:05:18 GMT

Another badly designed application written by a developer that doesn't understand networks! <sigh>

Re: 9800 ARP

MHM Cisco World — Sat, 25 Jan 2025 20:21:35 GMT

You are so welcome,

Thanks for update us

Have a nice weekend

MHM