topic Group mismatch would be the in Wireless

WLC Mobility (Guest Anchor)

spencermoore — Mon, 05 Jul 2021 10:27:30 GMT

Hello. I'm unable to initialize a mobility tunnel between a foreign and anchor WLC in my DMZ. The controllers are separated by a firewall, but I have allowed all traffic between the two devices as well as configured NAT in order to achieve connectivity. I can ping both devices, but e and m pings fail. When I perform a packet capture on my firewall, I see packets traversing the firewall destined to the anchor controller and visa versa, but every other packet or so says "association request; malformed packet". Note, there is a two or so minute time discrepancy between the two controllers and a 30 minute discrepancy on both controllers from the actual time. Does this need to be corrected? Cisco documentation doesn't mention time has to match.

Steps I've completed:

1. Verified ping

2. Setup Mobility Group named "Guest" on foreign using anchor ip and MAC (from inventory screen)

3. Setup Mobility Group named "Guest" on anchor using foreign ip and MAC (from inventory screen)

Hardware:

Foreign: 5508 7.6.110.0

Anchor: 4402 7.0.252.0

Update: Debug shows Anchor sending keep-alives. Debug on foreign shows:

Keepalive:INVALID(GroupMismatch):ETHOIP_OP_REQ:Received from 172.1 6.x.x:version=02:SeqNo=36:receiverStatusOnTransmitter=0
*mmMobility: Jun 24 10:18:27.449: Keepalive:Mobility Member 172.16.x.x detected DOWN status 3, cleaning up client entries

Thanks for your help!

Yes, the times need to be

Stephen Rodriguez — Wed, 24 Jun 2015 13:54:43 GMT

Yes, the times need to be insync or at least close. The mobility messaging is time sensitive.

I'd also check if the NAT is manipulating a MAC address, pcap and check the src and dst on both sides.

HTH,

Steve

Thanks. I just updated the

spencermoore — Wed, 24 Jun 2015 13:56:38 GMT

Thanks. I just updated the post. I'm getting a "group mismatch" on foreign. Does this have to do with the group name? I've confirmed they're both identical.

Group mismatch would be the

Stephen Rodriguez — Wed, 24 Jun 2015 14:01:06 GMT

Group mismatch would be the mobility group name, make sure you dont' have a trailing space

HTH,

Steve

No trailing space; however,

spencermoore — Wed, 24 Jun 2015 20:21:37 GMT

No trailing space; however, the 5505 has an "hash" option which is currently set to "none". The 4400 has no such option. Could this be the issue? I also manually set the Anchor controller time to be within a few seconds of the foreign. Issues resolved: removed the group and just used the default name. Not ideal, but it works.

The lack of "hash" option is

J. Adams — Wed, 24 Jun 2015 23:28:02 GMT

The lack of "hash" option is not related. I have peering and MA anchoring between 4400s and 5500s with OS types 7.0.252.0 and 7.6.130.0 and various Group Names without any issues but with NTP servers. Regards