@Joseph W. Doherty wrote: "I use nbar as this is required to identify traffic and must be on the same interface as the service policy; the rest of the config has for example "match protocol skinny" which needs nbar I beleive. " NB: BTW, you don't need to activate interface NBAR for CBWFQ class "match protocol xxx". (This command is used to obtain NBAR analysis of what kind of traffic is crossing an interface.) Sorry, I'm still confused over your network management vs. your provider's . Your provider is providing VPN beyond your ATM interface, across the Internet? If so, unclear what "their" QoS is doing. Again, if you have CBR, p2p, what you do on you ATM interface, with QoS, shouldn't really need provider QoS. It's possible, although unusual, they support QoS across their network, but that would generally "stop" once/if they need to forward your Internet traffic to another ISP or backbone provider. Also, if they are providing a CBR service, your QoS markings shouldn't matter once you hand off your traffic to them. It's fine you're not a QoS Guru, but that's why posting to these forums can be useful, as you may obtain responses from those with a bit more experience. Hi, Thanks for that I misunderstood the NBAR which means I can take that off, our DSL connections are not internet connections they don't leave the suppliers network.  They provide a network across their network to our WAN connection on a leased line provided by them also; we then provide internet access to the sites, due to this they can honor our markings and put in place QOS of which they provide three standard profiles.  We select the profile we think would work best and implement that for traffic leaving our DSL sites and the provider does the rest including routing between sites. ... View more

@Joseph W. Doherty wrote: It's unclear to me what your provider is providing vis-à-vis QoS. If you have a p2p CBR ATM PVC, you should be able to perform any QoS you like, independent of your provider. (This because the CBR sets and guarantees a fixed amount of bandwidth.) You've set your LLQ to 50%. The general recommendation is to not exceed 1/3 of the bandwidth. This to insure you have sufficient bandwidth for non-LLQ traffic and to also insure LLQ doesn't self congest. (The latter also depends on the nature of your LLQ traffic. If, for example, your VoIP bearer traffic uses a CODEC that uses a fixed bandwidth per flow it's predictable, while VoIP bearer traffic using a CODEC that uses a variable bandwidth per flow it's not.) It's debatable whether CS6 and CS7 should be in your real-time class. They, like VoIP control traffic (unknown how you're marking it), "by-the-book", often get their own classes, to guarantee their service requirements. (They both might be okay in the class-default if you use FQ as recommended by Georg.) BTW, you're using NBAR discovery for? Your DSL, it's not PPPoE, is it? If so, you lose 8 bytes from your MTU which will cause max size Ethernet packets to be fragmented. (This can possibly be mitigated with further configuration.) Also BTW, if you want to make your real-time class matching a bit more efficient, you can consider matching IP Prec 5 for both DSCP EF and CS5. The policy as I explained is to set up our QOS to match the suppliers QOS which is applied to our ADSL2+ and they supply the IPVPN site to site using PPPoE but the configuration for this is in the rest of the config.  I use nbar as this is required to identify traffic and must be on the same interface as the service policy; the rest of the config has for example "match protocol skinny" which needs nbar I beleive.    The QOS question was just one small part of the set up to make sure I hadn't missed something as I am not a QOS Guru. ... View more

I will download the upgrade files and schedule a change to move the system to the new SW version. ... View more

*******2nd error from WLC******* May 10 11:26:24 BST: *%CAPWAP-3-DTLS_CONN_ERR: 1 wcm: 0041.d28e.7a00: DTLS connection not found forAP xx:xx:191:97 (32412), Controller: xx:xx:xx:54 (5246) send packet May 10 11:26:24 BST: *%CAPWAP-3-RCB_MARKED_FOR_DEL: 1 wcm: Dropping discovery request from AP 0041.d28e.7a00 - cleanup process is in progress May 10 11:26:26 BST: %DOT1X-5-FAIL: Authentication failed for client (a434.d972.9106) on Interface Ca21 AuditSessionID ac1410015af2443b002d0213 May 10 11:26:29 BST: *%LOG-3-Q_IND: 1 wcm: Dropping discovery request from AP 0041.d28e.7a00 - cleanup process is in progress[...It occurred 3 times.!] May 10 11:26:29 BST: *%CAPWAP-3-DTLS_CONN_ERR: 1 wcm: 0041.d28e.7a00: DTLS connection not found forAP xx:xx:191:97 (32412), Controller: xx:xx:xx:54 (5246) send packet May 10 11:26:34 BST: *%CAPWAP-3-DTLS_CONN_ERR: 1 wcm: 0041.d28e.7a00: DTLS connection not found forAP xx:xx:191:97 (32412), Controller: xx:xx:xx:54 (5246) send packet May 10 11:26:34 BST: *%CAPWAP-3-RCB_MARKED_FOR_DEL: 1 wcm: Dropping discovery request from AP 0041.d28e.7a00 - cleanup process is in progress May 10 11:26:39 BST: *%LOG-3-Q_IND: 1 wcm: Dropping discovery request from AP 0041.d28e.7a00 - cleanup process is in progress[...It occurred 3 times.!] May 10 11:26:39 BST: *%CAPWAP-3-DTLS_CONN_ERR: 1 wcm: 0041.d28e.7a00: DTLS connection not found forAP xx:xx:191:97 (32412), Controller: xx:xx:xx:54 (5246) send packet May 10 11:26:39 BST: %LINEPROTO-5-UPDOWN: Line protocol on Interface Capwap12, changed state to down May 10 11:26:43 BST: %DOT1X-5-FAIL: Authentication failed for client (40f0.2f79.cf81) on Interface Ca19 AuditSessionID ac1410015af41a6e002d65b3 ... View more

Disconnection error show DTLS but I don't have encryption on for this AP   *May  9 12:11:37.943: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS. *May  9 12:11:38.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: xx.xx.xx.54 peer_port: 5246 *May  9 12:12:07.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0x627E8280! *May  9 12:12:37.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to xx.xx.xx.54:5246 *May  9 12:12:37.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS. *May  9 12:12:38.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: xx.xx.xx.54 peer_port: 5246 *May  9 12:12:38.487: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: xx.xx.xx.54 peer_port: 5246 *May  9 12:12:38.491: %CAPWAP-5-SENDJOIN: sending Join Request to xx.xx.xx.54 *May  9 12:12:43.851: %CAPWAP-5-JOINEDCONTROLLER: AP has joined controller cisco-wlc ... View more

Hi Ryo, The APs are in Local mode I think to use FlexMode you should use a Cat 3850 switch as a mobility anchor which we don't have, occasionally all the APs  in the other areas will go down together however I have 5 in my area that are very stable (never go down) and of the other 21 APs 5 have been up for 1 Day at the present time and the others have been up for various amounts of time.  when the AP drops it then starts the join process and reconnects to the WLC using another IP, I did think at first that it was a timeout issue but have checked all the timeouts in the WLC.   Management IP Vlan 20 172.20.XX.XX AP-Manger Vlan5 172.16.XX.XX AP-Manager Vlan21 172.21.XX.XX --------------------------------Error from Logs------------------------------------------ May 10 10:33:32 BST: *%CAPWAP-3-DTLS_CONN_ERR: 1 wcm:  f80b.cbf1.a8c0:  DTLS connection not found forAP  10:0:110:166 (16090), Controller: 172:16:16:54 (5246) send packet May 10 10:33:33 BST: *%CAPWAP-3-RCB_MARKED_FOR_DEL: 1 wcm:  Dropping  discovery request from AP f80b.cbf1.a8c0 - cleanup process is in progress   ASA not used by ourselves, there are no unauthorized DHCP servers we monitor for rogue servers/PCs etc.    ... View more