Showing results for 
Search instead for 
Did you mean: 

Community Helping Community


CWA Flexconnect Preauth ACL not applied.

Hello, I have a WLC-7510 version and AP models AIR-AP1832I and IW3702.

After upgrade from to, we have the following problem:
Sometimes clients are not redirected to captive web portal.

Same client, same AP, sometimes it works, sometimes fails.
We see in a sniffer trace, that when it fails, traffic to the web portal is going tunnelized in CAPWAP to the controller, instead going directly to the portal server( his IP address is in the Preauth_ACL ).

When it works, we see at the end of "show controllers dot11Radio 1 client xx:xx:xx:xx:xx:xx" command in the AP, it appears the preauth ACL:

webauth done:
webauth preauth acl:
allow true and dst mask,allow true and src mask, ...............

But when it fails, there's nothing below "webauth preauth acl".

Executing a "debug client 00:cd:fe:d3:34:23" on the AP, there's a difference when it fails, it appears the messages:

Nov 20 13:23:04 syslog: failed writing /click/client_ip_table/set_cli_capwap_webauthdone len 22 data: "0:CD:FE:D3:34:23 false"
Nov 20 13:23:04 kernel: [*11/20/2019 13:23:04.2730] !!!!! {/usr/sbin/capwapd} failed writing /click/client_ip_table/set_cli_capwap_webauthdone len 22 data: "0:CD:FE:D3:34:23 false"


Has anyone seen this bug?


Re: CWA Flexconnect Preauth ACL not applied.

No but it looks like a possible match for
It looks like Cisco are treating the first 2 as low priority (sev 4) but CSCvm18063 is fixed in ap-, 8.9(100.0), 8.9(1.134).
Give one of those a try and if no luck then you'll need to open a TAC case.
Judging by the logs (referring to click) and the bug notes this bug seems specific to ClickOS APs (wave 2) so I'd be surprised if you see it on a 37xx AP.


Re: CWA Flexconnect Preauth ACL not applied.

Thanks,  RR,

I can't upgrade the 7510 WLC, because the last release for this platform is .


I have tried in the lab using a vWLC:   with vWLC,  the problem is reproduced.   But with vWLC new version,  it works fine.

Cisco Employee

Re: CWA Flexconnect Preauth ACL not applied.



if you were able to reproduce this on your lab and you got same result on version, please open a TAC case and you would have a new bug for this on version


Re: CWA Flexconnect Preauth ACL not applied.

Polo that would be pointless - CSCvm18063 already covers 8.5 code!
He could ask TAC to escalate it to BU in hope of getting it fixed in next 8.5 MR but since MR6 is already in beta will probably miss MR6 and therefore likely wouldn't be for some time to catch next MR (if there is one) if BU agree to fix it in 8.5. Having another case attached to the bug would strengthen the business case for getting it fixed.
CreatePlease to create content
Content for Community-Ad

August's Community Spotlight Awards