With 802.1x, usernames / passwords or certificates are used. A user's account can be disabled, locked out, or removed, and you'd want to shut off their access.   With PSK, everyone uses the same password. If you were to change the password, you'd have to disconnect everybody from the network anyway, and they'd have to reauthenticate. Can anyone think of why you'd want to set a session timeout on the WLC for a PSK WLAN and force a re-auth at regular intervals? ... View more

Does any one have any documentation for the "EAP Parameters" option in a Cisco 2504 WLC WLAN under WLANs > Security > AAA Servers?   Probably pretty self-explanatory, but what if we don't select the "Enable" checkbox?   Are default values used if we do not have that box checked? And what are the default values that are used if the "Enable" checkbox is not selected? ... View more

Just wondering what Cisco's recommendation on this is.   Also, can I take a backup of all my settings on an earlier software version and import them on a later software version? ... View more

This document shows how to enable / disable sticky key caching (SKC). How do you enable / disable opportunistic key caching (OKC)? ... View more

In all Cisco documentation, I've seen FlexConnect referred to as a per-AP feature (instead of per WLAN). Can I have an AP serve both WLANs that have the "FlexConnect Local Switching" on and off (under the Advanced tab)? I'm using a Cisco WLC 2504 controller. ... View more

I have a Cisco WLC 2504 with a joined Aironet 1140 LWAPP in FlexConnect mode with a few SSIDs broadcasting on both radios. These SSIDs use WPA2-PSK and WPA2-802.1x on different SSIDs.   I'm troubleshooting an issue on a Macbook pro (made in 2015) where it loses all network connectivity all of a sudden. This SSID uses WPA2-802.1x. I have adaptive 802.11r and the "vanilla" 802.11k neighbor list (not cross-band type) enabled. 802.11v is also enabled. PMF 802.11w is set as optional. 802.1x and CCKM are the only authentiation and key mechanisms enabled.   I'm running a trial of Omnipeek on a Windows computer right next to my Macbook pro and have it tuned to the correct channel so that I can passively see the packets going between the access point and the Macbook pro. I see the normal packets - CTS / RTS / 802.11 encrypted data / block acknowledgement during the outage period. Also, none of the packets show a CRC error during the outage period, so I don't think it's an RF interference issue.   I also checked our Microsoft NPS server for denies on the 802.1x user and didn't see any.   I also enabled a "debug dot11 client-event all enable" and "debug client xx:xx:xx:xx:xx:xx" on the WLC and don't see any any debugs during the outage time.   The Cisco WLC shows the client connected (under the summary page, clients) during the entire time of the outage.   I'm pretty new to the Cisco 2504 WLC (or any WLC) and was thinking that maybe the outage could be caused somehow by the radio resource management (RRM)? Maybe the WLC is doing a scan to find the optimal channel and that might be causing the outages?   I'm looking for advice to see if there are any other places I should enable debugging on, or if there are any other places I should check for logs?   This has also happened on a Windows 10 client, although I haven't done as much troubleshooting with it as the Mac client. ... View more

The title pretty says it all. I have the layer 3 webauth enabled on a Cisco WLC 2504 WLAN with a self-signed SSL cert. I installed the root CA cert in the Android phone under Settings > Biometrics and security > Other security settings > Install from device storage for both "VPN and apps" and "Wi-Fi". When I connect to the Wi-Fi and I get redirected to the captive portal, I get this error:   SSL certificate not trusted The security certificate for this network is not from a trusted authority. We do not recommend that you connect to this network. Buttons: Cancel / Connect   I verified that the certificate was installed okay because if I connect to a different Wi-Fi without the layer 3 webauth and open up Google Chrome and go to a different website that chains up to the same cert I trusted, I see a green lock icon an don't get any certificate warnings.   My Android device is a Samsung Galaxy S8 running Android 9, kernel 4.4.153. ... View more