Symptoms 802.1x using MAB is working until you reboot the switch. After shut/no shut or re-auth is required to get MAB working.   Cause / Problem Description Race condition for radius server communication task and eap task (MAB). Conditions / Environment 802.1x using MAB   Seems to be common known issue (race condition). There is a bug id CSCtj46641 which is J-Status pointing to CSCsu90538 .   Resolution Suggest some test to customer and potential workaround to test. 1. Either adjust the config from a networking perspective (e.g. no spanning-tree) to ensure the RADIUS connection is up asap. If we configure: 'no spanning-tree vlan x' then this issue should no longer seen.   This maybe still not working as we still relay on short time. --------------------------------------------------​---------------------------------------- 2. Adjust the mab config so that it either re-tries to authenticate periodically or else re-initialises when the server comes back. The former can be done with the following config: authentication timer restart 60 authentication event server dead action authorize vlan 11 authentication event server alive action reinitialize   This is not a good choice since we would have very short authentication periode in a life system --------------------------------------------------​----------------------------------------   3. Create system-startup kron job which is run once at system startup.   This is not possible since running again and again Create a policy-list which clears all authentication sessions (manual re-auth) kron occurrence autostart in 2 recurring system-startup policy-list force-reauth ! kron policy-list force-reauth cli clear authentication session ! This will clear all sessions every 2 minutes after the system is up and again and again. Not what we like to have. Option 3 is not an option. --------------------------------------------------​----------------------------------------   4. This is the configuration solution work around event manager applet onboot event timer cron cron-entry "@reboot" action 1.10 wait 20 action 2.10 cli command "enable" action 2.20 cli command “clear authentication session " action 6.10 syslog msg "cleared auth sessions" This is the solution! --------------------------------------------------​---------------------------------------- ... View more

These instructions are of relevance if you have a server certificate for the Guest Server for installation that has been issued by an intermediate CA. These instructions are valid for Guest Server 2.0.x only. NGS use certificate from intermediate CA server but client managing NGS only has root CA certificate trust installed. Hence NGS will have to send the full certificate chain to allow client validate the server NGS certificate. NOTE:   This is not a official Cisco document and you use it on your own risk. Best regards Roger Nobel ... View more

Gives an overview about logical steps and possibilities to troubelshoot wireless voice deployment. ============================== Please rate document that you find useful ... View more

If you get error msg 40xxx and you wonder how to configure. Below I try to summarize cli command you need to fix the msg. Mostly focused on Cisco 792x Series deployments. ----------------------------------------------------------------------------------------------------------- 40001, Voice: 802.11a network has RRM Transmit Power Control set to automatic. Unless using WLC 4.1.185.0 (or later), using Radio Resource Management (RRM) can cause radio setting changes during the day, which trigger client disconnections. If this happens during a call, it will be disrupted, or end on one-way voice situation. How much affects this, depends a lot on RF conditions in the site, so it is not a black or white situation, and should be evaluated case by case. After 4.1.185.0 and above, using DCA is possible if correctly configured. REFERENCE: Radio Resource Management under Unified Wireless Networks >config 802.11a txPower global <power level>/auto OR >config 802.11a txPower ap <ap-name> <power level> 40002, Voice: 802.11b network has RRM Transmit Power Control set to automatic. Unless using WLC 4.1.185.0 (or later), using Radio Resource Management (RRM) can cause radio setting changes during the day, which trigger client disconnections. If this happens during a call, it will be disrupted, or end on one-way voice situation. How much affects this, depends a lot on RF conditions in the site, so it is not a black or white situation, and should be evaluated case by case. After 4.1.185.0 and above, using DCA is possible if correctly configured. REFERENCE: Radio Resource Management under Unified Wireless Networks >config 802.11b txPower global <power level>/auto OR >config 802.11b txPower ap <ap-name> <power level> 40003, Voice: 802.11a network has RRM Dynamic Channel Assignment set to automatic. Unless using WLC 4.1.185.0 (or later), using Radio Resource Management (RRM) can cause radio setting changes during the day, which trigger client disconnections. If this happens during a call, it will be disrupted, or end on one-way voice situation. How much affects this, depends a lot on RF conditions in the site, so it is not a black or white situation, and should be evaluated case by case. After 4.1.185.0 and above, using DCA is possible if correctly configured. REFERENCE: Radio Resource Management under Unified Wireless Networks >config 802.11a channel global auto OR >config 802.11a channel ap <ap-name> <channel#> 40004, Voice: 802.11b network has RRM Dynamic Channel Assignment set to automatic. Unless using WLC 4.1.185.0 (or later), using Radio Resource Management (RRM) can cause radio setting changes during the day, which trigger client disconnections. If this happens during a call, it will be disrupted, or end on one-way voice situation. How much affects this, depends a lot on RF conditions in the site, so it is not a black or white situation, and should be evaluated case by case. After 4.1.185.0 and above, using DCA is possible if correctly configured. REFERENCE: Radio Resource Management under Unified Wireless Networks >config 802.11b channel global auto OR >config 802.11b channel ap <ap-name> <channel#> 40005, Voice: 802.11a Power Threshold %Controller Current Threshold% , is higher than recommended value of  % App Configured Setting% Original value of -65 dBm is in general, too high. Recommended value is -70 dBm. If the version is before 4.1.185.0. REFERENCE: Radio Resource Management under Unified Wireless Networks >config advanced 802.11a tx-power-control-thresh -70 40006, Voice: 802.11b Power Threshold %Controller Current Threshold% , is higher than recommended value of  % App Configured Setting% Original value of -65 dBm is in general, too high. Recommended value is -70 dBm. If the version is before 4.1.185.0. REFERENCE: Radio Resource Management under Unified Wireless Networks >config advanced 802.11a tx-power-control-thresh -70 40007, Voice: Aggressive load balancing is enabled. Check if providing voice services or low density of APs to disable it Do not enable aggressive load balancing unless the network has available a high density of access points in the area, and never if there is voice over wireless. If you enable this feature with access points spaced to far away from each other, it might confuse the roaming algorithm of some clients, and induce coverage holes in some cases. In the latest software versions, this feature is disabled by default. REFERENCE: Wireless LAN Controller (WLC) Configuration Best Practices >config load-balancing status disable 40008, Voice: arpunicast is enabled, it must be disabled. arpunicast setting should not be enabled in normal circumstances. It may cause connectivity problems between devices on the same VLAN. Note that the original 7920 Deployment Guide incorrectly recommended that arpunicast should be enabled. >config network arpunicast disable 40009, Voice: DTIM value should be 2, currently it is  %DTIM value% , check in %band% Configuration for optimal battery life and performance, we recommend setting the DTIM period to “2”. REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config 802.11b dtim 2 >config 802.11a dtim 2 40010, Voice: Beacon Interval should be 100, currently it is  %Controller Current Beacon interval% , check in %band% Configuration for optimal battery life and performance, we recommend setting the beacon period to 100 ms. REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config 802.11b beaconperiod 100 >config 802.11a beaconperiod 100 40011, Voice: Short Preamble should be enabled, check in 802.11b Configuration Recommended value for the 792x. Use the short preamble setting in the radio configuration setting on the access point when no legacy clients that require a long preamble are present in the WLAN. By using the short preamble instead of the legacy long preamble, the wireless network performance is improved. REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config 802.11b preamble short 40012, Voice: Low data rates (1 and 2 Mbps) should be disabled for voice, check in 802.11b Network Configuration REFERENCES: Cisco Unified Wireless IP Phone 7921G Deployment Guide, Cisco Unified Wireless IP Phone 7920 Design and Deployment Guide (Chapter 2) >config 802.11b rate disabled 1 >config 802.11b rate disabled 2 40013, Voice: 5.5 Mbps should be disabled for voice, check in 802.11b Network Configuration REFERENCES: Cisco Unified Wireless IP Phone 7921G Deployment Guide, Cisco Unified Wireless IP Phone 7920 Design and Deployment Guide (Chapter 2) >config 802.11b rate disabled 5.5 40014, Voice: 802.11g speed set as mandatory, this will generate association problems with 7920. Check in 802.11b Network Configuration Wrong configuration to support 7920 >config 802.11b rate disabled 6 >config 802.11b rate disabled 9 40015, Voice: ACM is not enabled, check in 802.11b Voice Configuration Reported recommended value for the 792x >config 802.11b cac voice acm enable 40016, Voice: ACM is not enabled, check in 802.11a Voice Configuration Reported recommended value for the 792x >config 802.11a cac voice acm enable 40017, Voice: SSID WLAN has WMM disabled. It should be optional or enabled for voice. Recommended value for the 7921. REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config wlan wmm require <wlan-id> OR >config wlan wmm allow <wlan-id> 40018, Voice: SSID WLAN has DHCP Required enabled. It must be disabled for voice This option might affect some client implementations which do not do a DHCP renew until the lease time expires. For example, Cisco 7920 or 7921 phones might have voice problems while they roam if this option is enabled, as the controller does not allow voice or signaling traffic to pass until the DHCP phase is completed. Some third-party printer servers might also be affected. In general, it is a good idea not to use this option if the WLAN has non-Windows clients. This is because the more strict controls might induce connectivity issues, based on how the DHCP client side is implemented. REFERENCE: Wireless LAN Controller (WLC) Configuration Best Practices >config wlan dhcp_server <wlan-id> 0.0.0.0 40019, Voice: SSID WLAN does not have AP CAC limit enabled Reported recommended value for the 792x >config 802.11b cac voice roam-bandwidth 6 40020, Voice: SSID WLAN has Client CAC limit enabled, must be disabled Reported recommended value for the 792x >config 802.11a cac voice roam-bandwidth 6 40021, Voice: SSID WLAN Client MFP as enabled, must be either optional or disabled Recommended value for the 792x. REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config wlan mfp client disable <wlan-id> OR >config wlan mfp client enable <wlan-id> required 40022, Voice: SSID WLAN Platinum QoS settings are not set to 802.1p. On the 7920, to avoid issues on the time sensitive queue for APs, it is recommended to tag the frames this QoS profile. Check in Controller QoS Profiles. REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config qos dot1p-tag platinum 6 40023, Voice: No platinum level SSID found, possible incorrect configuration, or controller not intended for voice support No SSID found with platinum level QoS configured. This may be intentional (no voice support needed) or an incorrect configuration. REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config wlan qos <wlan-id> platinum 40024, Voice: 802.11a Coverage Min Clients  %Controller Current Threshold%, is less than recommended value of %App settings Current Threshold% In some situations, while using RRM, it may be useful to change the current threshold. The effect is varies depending on the version used (RRM enhancements or not), so use with care. REFERENCE: Radio Resource Management under Unified Wireless Networks >config advanced 802.11a coverage level global 5 40025, Voice: 802.11b Coverage Min Clients  %Controller Current Threshold%, is less than recommended value of %App settings Current Threshold% In some situations, while using RRM, it may be useful to change the current threshold. The effect is varies depending on the version used (RRM enhancements or not), so use with care. REFERENCE: Radio Resource Management under Unified Wireless Networks >config advanced 802.11b coverage level global 5 40026, Voice: 802.11a Tx Power Threshold %Controller Current Threshold%, is higher than recommended value of %App settings Current Threshold% In some situations, while using RRM, it may be useful to change the current transmit power threshold. The effect is varies depending on the version used (RRM enhancements or not), so use with care. REFERENCE: Radio Resource Management under Unified Wireless Networks >config advanced 802.11a tx-power-control-thresh -70 40027, Voice: 802.11b Tx Power Threshold %Controller Current Threshold%, is higher than recommended value of %App settings Current Threshold% In some situations, while using RRM, it may be useful to change the current transmit power threshold. The effect is varies depending on the version used (RRM enhancements or not), so use with care. REFERENCE: Radio Resource Management under Unified Wireless Networks >config advanced 802.11b tx-power-control-thresh -70 40028, Voice: Low data rates (6 and 9 Mbps) should be disabled for voice, check in 802.11a Network Configuration (7921 recommendations) This is a "recommendation", with lots of variations depending on RF conditions, and desired coverage. >config 802.11a rate disabled 6 >config 802.11a rate disabled 9 40029, Voice: Session timeout should be high, to avoid voice disruptions during authentication Warns if the session timeout is less than 24 hours. Frequent reauthentications can disrupt active calls. Configure the session timeout as necessary. REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config wlan session-timeout <wlan-id> 86400 40030, Voice: WLAN with EAP, without CCKM, call quality during roaming may be disrupted When using 802.1x type authentication, you should implement CCKM for authentication. 802.1x can introduce delay during roaming due to its requirement for full re-authentication. CCKM centralizes the key management and reduces the number of key exchanges. REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config wlan security wpa akm  cckm enable <wlan-id> 40031, Voice: Global Peer-to-Peer blocking is enabled, this is not recommended for Voice services REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config wlan peer-blocking disable <wlan-id> 40032, Voice: WLAN Peer-to-Peer blocking is enabled, this is not recommended if using Voice services on this WLAN:XX REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config wlan peer-blocking disable <wlan-id> 40033, Voice: WLAN has TKIP as L2 policy, and Hold Down timer is not disabled, this is not recommended, as it may cause voice problems in case of MIC errors introduced by other devices, TKIP countermeasure mode can occur if the Access Point receives two message integrity check (MIC) errors within a 60 second period. When this occurs, the Access Point will de-authenticate all TKIP clients associated to that 802.11 radio and holdoff any clients for the countermeasure holdoff time (default = 60 seconds). REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config wlan security tkip hold-down 0 <wlan-id> 40034,Voice: WLAN has exclusion timer enabled, it is recommended to disable on voice WLANs to allow faster recovery Clients can be denied association to the network if they do not abide by the default Client Exclusion policies configured on the WLC. >config wlan exclusionlist <wlan-id> disabled 40035,Voice: AP does not have antenna diverstity enabled. It is recommended to use diversity in all voice deployments, as much as possible in the given RF environment. This may not be possible depending on AP model REFERENCE: Cisco Unified Wireless IP Phone 7921G Deployment Guide >config 802.11b antenna diversity enable <ap-name> >config 802.11a antenna diversity enable <ap-name> 40036,Voice: Max RF bandwidth is not matching the recommended: X% >config 802.11b cac voice max-bandwidth 75 >config 802.11a cac voice max-bandwidth 75 40037,Voice: Max reserved roaming bandwidth is not matching the recommended: X% >config 802.11b cac voice roam-bandwidth 6 >config 802.11a cac voice roam-bandwidth 6 40038,Voice: Traffic Stream Metrics collection is disabled. It is recommended, although not mandatory, to enable it" Traffic Stream Metrics (TSM) can be used to monitor voice-related metrics on the client-access point air interface. It reports both packet latency and packet loss. An administrator can isolate poor voice quality issues by studying these reports. REFERENCE: Voice over Wireless LAN 4.1 Design Guide - Voice over WLAN Troubleshooting and Management Tools >config 802.11b tsm enable >config 802.11a tsm enable 40039,Voice: Aironet Extensions are disabled, it is recommended to enable them, WLAN: >config wlan ccx aironetIeSupport enable <wlan-id> 40040,Voice: More than one WLAN with Platinum level found. Check if this is intentional (for example servicing 7920/7921). Not recommended otherwise Platinum QoS level provides a higher quality of service for voice over wireless. >config wlan qos <wlan-id> platinum 40041,Voice: Depending on your RF coverage, and desired call density, it may be recommended to disable high data rates for voice services (36, 48, 54 mbps) Having higher data rates enabled, without a very good RF signal coverage, may result in many dropped frames resulting in reduced voice quality. Enable high data rates only when sufficient RF signal coverage is available. >config 802.11b rate disabled 36 >config 802.11b rate disabled 48 >config 802.11b rate disabled 54 >config 802.11a rate disabled 36 >config 802.11a rate disabled 48 >config 802.11a rate disabled 54 40042,Voice: Mac filtering in voice WLANs is not recommended due to potential delays on association process/roaming" or WLANs with voice services, MAC address filtering can introduce delays on roaming, as association/reassociation requests need to be validated against AAA before they are finally answered. >config wlan mac-filtering disable <wlan-id> 40043,Voice: DCA interval is recommended to be high, to prevent channel changes during working hours." It is good idea to have a long timer for DCA channel calculation, to minimize the possibility to have any disruptive channel change while a phone call is active >config advanced 802.11b channel dca interval 24 >config advanced 802.11b channel dca anchor-time 0 >config advanced 802.11a channel dca interval 24 >config advanced 802.11a channel dca anchor-time 0 ... View more

Configuration example for standalone access point using CCKM with WDS on local radius server with EAP-FAST, include verification and debug command. ... View more

I cover the following two topic. 1.) How to load the PEM Certificate to the WLC also refere to >Working with Win32 OpenSSL< https://supportforums.cisco.com/docs/DOC-12775 2.) How to down load the vendor CA Certificate ... View more

Example based on http://www.cisco.com/en/US/docs/security/nac/guestserver/configuration_guide/20/g_hotspots.html ... View more

Certain devices are only able to accept certificate in PEM format  whereas certain Certificate Authorities are not delivering such formats. Example: WLC, CCA need certficates in PEM format, whereas Windows Server  2003 Enterprise- CA provides only PKCS#12 (PFX format).   WinOpenSSL allows converting certificate between different formats. ... View more

PoE / 802.3af The question frequently comes up if APs do support  802.3af standard with non-cisco switch. It happens that radio interface  are power down due to error msg similar to: Mon Oct 2 17:47:11 2008 AP's Interface:0(802.11b) Operation State  Down: Base Radio MAC:xx:xx:xx:xx:xx:xx Cause=Radio Low Power It is PoE neg problem with switch. Action plan: Turn off the PoE negotiation and try to power on Radio interface. You only have 2 possibilities to solve this problem. A.) Disable the CDP on the switch interface connected to AP. B.) From the controller configure no power negotiation: If you  are using a power injector you will have to make a configuration change  on the controller as follows (e.g check Bug id CSCsc86834 in the Bug Tool ) Depending now on the version you are using please also check Bug  id for commands.      For version <=3.2.78           1) configure ap power pre-standard enable <ap-name> where  <ap-name> is the access point name on the controller <show ap  summary>                   2) configure ap power injector enable <ap-name> <switch  port MAC address in xx:xx:xx:xx:xx:xx format> where <ap-name>  is the access point           name on the controller and <switch port MAC  address> is the MAC address of the switch port to which the access  point is connected)           After doing those changes, you should see on AP console port:  example           - power inline negotiation injector xxxx.xxxx.xxxx - power inline  negotiation prestandard source         For version =>3.2.116.21           After 3.2.116.21, option override and installed are added to  "config ap power injector"; so that the MAC address of the ethernet  switch is not           required. Could you please try it? Try first A.) if you are happy with A.)  and it works you don't need to do B.) Also for your reference about 802.3af / Cisco PoE support using  WLC solution Table 2 Cisco Access Point Power Capabilities Cisco Aironet and WLAN Controller Product Power Options Also for your reference about 802.3af / Cisco PoE support  using IOS (standalone) solution CLI: > power inline negotiation prestandard source > power inline negotiation injector ... View more