Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Walter Astori
Stats
Member since
01-21-2014
133
Posts
37
Helpful
3
Solutions
Created by
Walter Astori
in Wireless and Mobility
in Wireless and Mobility
09-19-2019
03:10 AM
09-19-2019
03:10 AM
HI, here there is the complete Debug made on WLC with debug MAC .... . This is the reply for you help on my post "Cisco WLC 5508 WLAN SSID 802.1x. Thank you in advance for your help 68:ec:c5:XX:XX:XX = MAC ADDRESS CLIENT 00:c1:64:XX:XX:XX = BSSID MAC ADDRESS 00:C1:64:YY:YY:YY = MAC ADDRESS Base Radio of AP (ITSSG-X-WLC0003) >debug mac addr 68:ec:c5:XX:XX:XX (ITSSG-X-WLC0003) >*dot1xSocketTask: Sep 06 16:42:31.615: [PA] 1x: frame too short (dataLen 82) - min size 7374 *apfOpenDtlSocket: Sep 06 16:43:07.716: [PA] 68:ec:c5:XX:XX:XX Recevied management frame ASSOCIATION REQUEST on BSSID 00:c1:64:XX:XX:XX destination addr 00:c1:64:XX:XX:XX *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Station: 68:ec:c5:XX:XX:XX 11v BSS Transition not enabled on the AP 00:C1:64:YY:YY:YY *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Association received from mobile on BSSID 00:c1:64:XX:XX:XX AP ITVNT-LAP2 *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Station: 68:ec:c5:XX:XX:XX 11v BSS Transition not enabled on the AP 00:C1:64:YY:YY:YY *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Global 200 Clients are allowed to AP radio *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Max Client Trap Threshold: 0 cur: 7 *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Rf profile 600 Clients are allowed to AP wlan *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX override for default ap group, marking intgrp NULL *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX apfApplyWlanPolicy: Apply WLAN Policy over PMIPv6 Client Mobility Type, Tunnel User - 0 *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX In processSsidIE:6609 setting Central switched to FALSE *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Set Clinet MSCB as Central Association Disabled *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Applying site-specific Local Bridging override for station 68:ec:c5:XX:XX:XX - vapId 1, site 'Vignate', interface 'management' *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Applying Local Bridging Interface Policy for station 68:ec:c5:XX:XX:XX - vlan 202, interface id 0, interface 'management' *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX override from ap group, removing intf group from mscb *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Applying site-specific override for station 68:ec:c5:XX:XX:XX - vapId 1, site 'Vignate', interface 'management' *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Applying Interface(management) policy on Mobile, role Local. Ms NAC State 2 Quarantine Vlan 0 Access Vlan 7 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Not re-applying interface policy for local switching Client *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2922) *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Changing Url ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2942) *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2963) *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Setting the NAS Id to AP group specific Id 'ITSSG-X-WLC0003' *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Set Clinet AP specific apfMsAccessVlan = 7 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX This apfMsAccessVlan may be changed later from AAA after L2 Auth *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Cleared localSwitchingVlan, may be assigned later based on AAA override *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX processSsidIE statusCode is 0 and status is 0 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX processSsidIE ssid_done_flag is 0 finish_flag is 0 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX STA - rates (8): 140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX AID 5 in Assoc Req from flex AP 00:C1:64:YY:YY:YY is same as in mscb 68:ec:c5:XX:XX:XX *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX apfMs1xStateDec *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Change state to START (0) last state DHCP_REQD (7) *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX pemApfAddMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0. *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 START (0) Initializing policy *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state START (0) *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX apfVapSecurity=0x2 L2=2 SkipWeb=0 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX AuthenticationRequired = 1 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state AUTHCHECK (2) *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Encryption policy is set to 0x80000001 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 8021X_REQD (3) DHCP required on AP 00:C1:64:YY:YY:YY vapId 1 apVapId 1for this client *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Vlan while overriding the policy = -1 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX sending to spamAddMobile vlanId -1 flex aclName = , flexAclId 65535 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 8021X_REQD (3) Plumbed mobile LWAPP rule on AP 00:C1:64:YY:YY:YY vapId 1 apVapId 1 flex-acl-name: *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX apfPemAddUser2 (apf_policy.c:416) Changing state for mobile 68:ec:c5:XX:XX:XX on AP 00:C1:64:YY:YY:YY from Associated to Associated *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX apfPemAddUser2:session timeout forstation 68:ec:c5:XX:XX:XX - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is 0 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Stopping deletion of Mobile Station: (callerId: 48) *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Func: apfPemAddUser2, Ms Timeout = 0, Session Timeout = 0 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Sending assoc-resp with status 0 station:68:ec:c5:XX:XX:XX AP:00:C1:64:YY:YY:YY-01 on apVapId 1 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Sending Assoc Response (status: '0') to station on AP ITVNT-LAP2 on BSSID 00:c1:64:XX:XX:XX ApVapId 1 Slot 1, mobility role 1 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX apfProcessAssocReq (apf_80211.c:11039) Changing state for mobile 68:ec:c5:XX:XX:XX on AP 00:C1:64:YY:YY:YY from Associated to Associated *spamApTask6: Sep 06 16:43:07.720: [PA] 68:ec:c5:XX:XX:XX Successful transmission of LWAPP Add-Mobile to AP 00:C1:64:YY:YY:YY *spamApTask6: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX Received ADD_MOBILE ack - Initiating 1x to STA 68:ec:c5:XX:XX:XX (idx 2) *spamApTask6: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX Sent dot1x auth initiate message for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX reauth_sm state transition 1 ---> 0 for mobile 68:ec:c5:XX:XX:XX at 1x_reauth_sm.c:53 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX EAP-PARAM Debug - eap-params for Wlan-Id :1 is disabled - applying Global eap timers and retries *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX Disable re-auth, use PMK lifetime. *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX dot1x - moving mobile 68:ec:c5:XX:XX:XX into Connecting state *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX Received EAPOL START, dot1x state = 2 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX Reset the reauth counter since EAPOL START has been received!!! *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX reauth_sm state transition 0 ---> 1 for mobile 68:ec:c5:XX:XX:XX at 1x_reauth_sm.c:47 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX Received EAPOL START from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX dot1x - moving mobile 68:ec:c5:XX:XX:XX into Connecting state *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX Sending EAP-Request/Identity to mobile 68:ec:c5:XX:XX:XX (EAP Id 2) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX Received EAPOL EAPPKT from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX Received Identity Response (count=1) from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX Resetting reauth count 1 to 0 for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX EAP State update from Connecting to Authenticating for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX dot1x - moving mobile 68:ec:c5:XX:XX:XX into Authenticating state *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Response state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.882: [PA] 68:ec:c5:XX:XX:XX Processing Access-Challenge for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.882: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Req state (id=3) for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.882: [PA] 68:ec:c5:XX:XX:XX Sending EAP Request from AAA to mobile 68:ec:c5:XX:XX:XX (EAP Id 3) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.882: [PA] 68:ec:c5:XX:XX:XX Allocating EAP Pkt for retransmission to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.889: [PA] 68:ec:c5:XX:XX:XX Received EAPOL EAPPKT from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.889: [PA] 68:ec:c5:XX:XX:XX Received EAP Response from mobile 68:ec:c5:XX:XX:XX (EAP Id 3, EAP Type 25) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.889: [PA] 68:ec:c5:XX:XX:XX Resetting reauth count 0 to 0 for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.889: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Response state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.891: [PA] 68:ec:c5:XX:XX:XX Processing Access-Challenge for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.891: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Req state (id=4) for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.891: [PA] 68:ec:c5:XX:XX:XX Sending EAP Request from AAA to mobile 68:ec:c5:XX:XX:XX (EAP Id 4) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.891: [PA] 68:ec:c5:XX:XX:XX Reusing allocated memory for EAP Pkt for retransmission to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.905: [PA] 68:ec:c5:XX:XX:XX Received EAPOL EAPPKT from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.905: [PA] 68:ec:c5:XX:XX:XX Received EAP Response from mobile 68:ec:c5:XX:XX:XX (EAP Id 4, EAP Type 25) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.905: [PA] 68:ec:c5:XX:XX:XX Resetting reauth count 0 to 0 for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.905: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Response state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.907: [PA] 68:ec:c5:XX:XX:XX Processing Access-Challenge for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.907: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Req state (id=7) for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.907: [PA] 68:ec:c5:XX:XX:XX WARNING: updated EAP-Identifier 4 ===> 7 for STA 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.907: [PA] 68:ec:c5:XX:XX:XX Sending EAP Request from AAA to mobile 68:ec:c5:XX:XX:XX (EAP Id 7) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.908: [PA] 68:ec:c5:XX:XX:XX Reusing allocated memory for EAP Pkt for retransmission to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.914: [PA] 68:ec:c5:XX:XX:XX Received EAPOL EAPPKT from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.914: [PA] 68:ec:c5:XX:XX:XX Received EAP Response from mobile 68:ec:c5:XX:XX:XX (EAP Id 7, EAP Type 25) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.914: [PA] 68:ec:c5:XX:XX:XX Resetting reauth count 0 to 0 for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.914: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Response state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Processing Access-Accept for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Resetting web IPv4 acl from 255 to 255 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Resetting web IPv4 Flex acl from 65535 to 65535 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Received MPPE_SEND_KEY: KeyLen: 32 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Received MPPE_RECV_KEY: KeyLen: 32 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX override for default ap group, marking intgrp NULL *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX apfApplyWlanPolicy: Apply WLAN Policy over PMIPv6 Client Mobility Type, Tunnel User - 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Inserting AAA Override struct for mobile MAC: 68:ec:c5:XX:XX:XX, source 4 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Setting re-auth timeout to 0 seconds, got from WLAN config. *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Station 68:ec:c5:XX:XX:XX setting dot1x reauth timeout = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Stopping reauth timeout for 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Creating a PKC PMKID Cache entry for station 68:ec:c5:XX:XX:XX (RSN 0) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Setting active key cache index 0 ---> 8 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Setting active key cache index 8 ---> 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Sending EAP-Success to mobile 68:ec:c5:XX:XX:XX (EAP Id 7) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Freeing AAACB from Dot1xCB as AAA auth is done for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX Sending default RC4 key to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX Sending Key-Mapping RC4 key to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX Freeing EAP Retransmit Bufer for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX apfMs1xStateInc *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 8021X_REQD (3) Change state to L2AUTHCOMPLETE (4) last state 8021X_REQD (3) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) DHCP required on AP 00:C1:64:YY:YY:YY vapId 1 apVapId 1for this client *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX Not Using WMM Compliance code qosCap 00 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX Vlan while overriding the policy = -1 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX sending to spamAddMobile vlanId -1 flex aclName = , flexAclId 65535 *spamApTask6: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX Successful transmission of LWAPP Add-Mobile to AP 00:C1:64:YY:YY:YY *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP 00:C1:64:YY:YY:YY vapId 1 apVapId 1 flex-acl-name: *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) pemAdvanceState2 6728, Adding TMP rule *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Adding Fast Path rule type = Airespace AP - Learn IP address on AP 00:C1:64:YY:YY:YY, slot 1, interface = 13, QOS = 0 IPv4 ACL ID = 25 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 15206, IntfId = 0 Local Bridging Vlan = 202, Local Bridging intf id = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255,URL ACL ID 255) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Change state to DHCP_REQD (7) last state L2AUTHCOMPLETE (4) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 6757, Adding TMP rule *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Replacing Fast Path rule type = Airespace AP - Learn IP address on AP 00:C1:64:YY:YY:YY, slot 1, interface = 13, QOS = 0 IPv4 ACL ID = 255, *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 15206, IntfId = 0 Local Bridging Vlan = 202, Local Bridging intf id = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255,URL ACL ID 255) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) NO release MSCB *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Success state (id=7) for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX Received Auth Success while in Authenticating state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX dot1x - moving mobile 68:ec:c5:XX:XX:XX into Authenticated state *pemReceiveTask: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 Added NPU entry of type 9, dtlFlags 0x0
... View more
Created by
Walter Astori
in Wireless and Mobility
in Wireless and Mobility
09-19-2019
03:09 AM
09-19-2019
03:09 AM
Here there is the debug complete made on the WLC with the command debug mac ... 1. You have the right wlan-vlan mapping for that site (If local switching) Yes it's correct 2. If the vlan has ip helper enabled (if using an external DHCP server) Yes, we have an external DHCP and ip helper configured 3. Also confirm if you can reach the DHCP server from that location sourcing from the SVI (layer 3 interface) Yes, I can reach the DHCP from SVI 4. APs are assigned to correct flexconnect group Yes 5. Ensure that if you have Flex ACL or any ACL on WLC is not dropping that traffic. There is no ACL configured 68:ec:c5:XX:XX:XX = MAC ADDRESS CLIENT 00:c1:64:XX:XX:XX = BSSID MAC ADDRESS 00:C1:64:YY:YY:YY = MAC ADDRESS Base Radio of AP (ITSSG-X-WLC0003) >debug mac addr 68:ec:c5:XX:XX:XX (ITSSG-X-WLC0003) >*dot1xSocketTask: Sep 06 16:42:31.615: [PA] 1x: frame too short (dataLen 82) - min size 7374 *apfOpenDtlSocket: Sep 06 16:43:07.716: [PA] 68:ec:c5:XX:XX:XX Recevied management frame ASSOCIATION REQUEST on BSSID 00:c1:64:XX:XX:XX destination addr 00:c1:64:XX:XX:XX *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Station: 68:ec:c5:XX:XX:XX 11v BSS Transition not enabled on the AP 00:C1:64:YY:YY:YY *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Association received from mobile on BSSID 00:c1:64:XX:XX:XX AP ITVNT-LAP2 *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Station: 68:ec:c5:XX:XX:XX 11v BSS Transition not enabled on the AP 00:C1:64:YY:YY:YY *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Global 200 Clients are allowed to AP radio *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Max Client Trap Threshold: 0 cur: 7 *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Rf profile 600 Clients are allowed to AP wlan *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX override for default ap group, marking intgrp NULL *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX apfApplyWlanPolicy: Apply WLAN Policy over PMIPv6 Client Mobility Type, Tunnel User - 0 *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX In processSsidIE:6609 setting Central switched to FALSE *apfMsConnTask_0: Sep 06 16:43:07.717: [PA] 68:ec:c5:XX:XX:XX Set Clinet MSCB as Central Association Disabled *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Applying site-specific Local Bridging override for station 68:ec:c5:XX:XX:XX - vapId 1, site 'Vignate', interface 'management' *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Applying Local Bridging Interface Policy for station 68:ec:c5:XX:XX:XX - vlan 202, interface id 0, interface 'management' *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX override from ap group, removing intf group from mscb *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Applying site-specific override for station 68:ec:c5:XX:XX:XX - vapId 1, site 'Vignate', interface 'management' *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Applying Interface(management) policy on Mobile, role Local. Ms NAC State 2 Quarantine Vlan 0 Access Vlan 7 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Not re-applying interface policy for local switching Client *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2922) *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Changing Url ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2942) *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2963) *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Setting the NAS Id to AP group specific Id 'ITSSG-X-WLC0003' *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Set Clinet AP specific apfMsAccessVlan = 7 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX This apfMsAccessVlan may be changed later from AAA after L2 Auth *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX Cleared localSwitchingVlan, may be assigned later based on AAA override *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX processSsidIE statusCode is 0 and status is 0 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX processSsidIE ssid_done_flag is 0 finish_flag is 0 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX STA - rates (8): 140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0 *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX AID 5 in Assoc Req from flex AP 00:C1:64:YY:YY:YY is same as in mscb 68:ec:c5:XX:XX:XX *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX apfMs1xStateDec *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Change state to START (0) last state DHCP_REQD (7) *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX pemApfAddMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0. *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 START (0) Initializing policy *apfMsConnTask_0: Sep 06 16:43:07.718: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state START (0) *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX apfVapSecurity=0x2 L2=2 SkipWeb=0 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX AuthenticationRequired = 1 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 AUTHCHECK (2) Change state to 8021X_REQD (3) last state AUTHCHECK (2) *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Encryption policy is set to 0x80000001 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 8021X_REQD (3) DHCP required on AP 00:C1:64:YY:YY:YY vapId 1 apVapId 1for this client *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Vlan while overriding the policy = -1 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX sending to spamAddMobile vlanId -1 flex aclName = , flexAclId 65535 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 8021X_REQD (3) Plumbed mobile LWAPP rule on AP 00:C1:64:YY:YY:YY vapId 1 apVapId 1 flex-acl-name: *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX apfPemAddUser2 (apf_policy.c:416) Changing state for mobile 68:ec:c5:XX:XX:XX on AP 00:C1:64:YY:YY:YY from Associated to Associated *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX apfPemAddUser2:session timeout forstation 68:ec:c5:XX:XX:XX - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is 0 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Stopping deletion of Mobile Station: (callerId: 48) *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Func: apfPemAddUser2, Ms Timeout = 0, Session Timeout = 0 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Sending assoc-resp with status 0 station:68:ec:c5:XX:XX:XX AP:00:C1:64:YY:YY:YY-01 on apVapId 1 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX Sending Assoc Response (status: '0') to station on AP ITVNT-LAP2 on BSSID 00:c1:64:XX:XX:XX ApVapId 1 Slot 1, mobility role 1 *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX apfProcessAssocReq (apf_80211.c:11039) Changing state for mobile 68:ec:c5:XX:XX:XX on AP 00:C1:64:YY:YY:YY from Associated to Associated *spamApTask6: Sep 06 16:43:07.720: [PA] 68:ec:c5:XX:XX:XX Successful transmission of LWAPP Add-Mobile to AP 00:C1:64:YY:YY:YY *spamApTask6: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX Received ADD_MOBILE ack - Initiating 1x to STA 68:ec:c5:XX:XX:XX (idx 2) *spamApTask6: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX Sent dot1x auth initiate message for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX reauth_sm state transition 1 ---> 0 for mobile 68:ec:c5:XX:XX:XX at 1x_reauth_sm.c:53 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX EAP-PARAM Debug - eap-params for Wlan-Id :1 is disabled - applying Global eap timers and retries *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX Disable re-auth, use PMK lifetime. *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.726: [PA] 68:ec:c5:XX:XX:XX dot1x - moving mobile 68:ec:c5:XX:XX:XX into Connecting state *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX Received EAPOL START, dot1x state = 2 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX Reset the reauth counter since EAPOL START has been received!!! *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX reauth_sm state transition 0 ---> 1 for mobile 68:ec:c5:XX:XX:XX at 1x_reauth_sm.c:47 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX Received EAPOL START from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX dot1x - moving mobile 68:ec:c5:XX:XX:XX into Connecting state *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.821: [PA] 68:ec:c5:XX:XX:XX Sending EAP-Request/Identity to mobile 68:ec:c5:XX:XX:XX (EAP Id 2) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX Received EAPOL EAPPKT from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX Received Identity Response (count=1) from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX Resetting reauth count 1 to 0 for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX EAP State update from Connecting to Authenticating for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX dot1x - moving mobile 68:ec:c5:XX:XX:XX into Authenticating state *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.872: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Response state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.882: [PA] 68:ec:c5:XX:XX:XX Processing Access-Challenge for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.882: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Req state (id=3) for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.882: [PA] 68:ec:c5:XX:XX:XX Sending EAP Request from AAA to mobile 68:ec:c5:XX:XX:XX (EAP Id 3) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.882: [PA] 68:ec:c5:XX:XX:XX Allocating EAP Pkt for retransmission to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.889: [PA] 68:ec:c5:XX:XX:XX Received EAPOL EAPPKT from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.889: [PA] 68:ec:c5:XX:XX:XX Received EAP Response from mobile 68:ec:c5:XX:XX:XX (EAP Id 3, EAP Type 25) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.889: [PA] 68:ec:c5:XX:XX:XX Resetting reauth count 0 to 0 for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.889: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Response state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.891: [PA] 68:ec:c5:XX:XX:XX Processing Access-Challenge for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.891: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Req state (id=4) for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.891: [PA] 68:ec:c5:XX:XX:XX Sending EAP Request from AAA to mobile 68:ec:c5:XX:XX:XX (EAP Id 4) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.891: [PA] 68:ec:c5:XX:XX:XX Reusing allocated memory for EAP Pkt for retransmission to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.905: [PA] 68:ec:c5:XX:XX:XX Received EAPOL EAPPKT from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.905: [PA] 68:ec:c5:XX:XX:XX Received EAP Response from mobile 68:ec:c5:XX:XX:XX (EAP Id 4, EAP Type 25) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.905: [PA] 68:ec:c5:XX:XX:XX Resetting reauth count 0 to 0 for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.905: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Response state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.907: [PA] 68:ec:c5:XX:XX:XX Processing Access-Challenge for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.907: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Req state (id=7) for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.907: [PA] 68:ec:c5:XX:XX:XX WARNING: updated EAP-Identifier 4 ===> 7 for STA 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.907: [PA] 68:ec:c5:XX:XX:XX Sending EAP Request from AAA to mobile 68:ec:c5:XX:XX:XX (EAP Id 7) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.908: [PA] 68:ec:c5:XX:XX:XX Reusing allocated memory for EAP Pkt for retransmission to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.914: [PA] 68:ec:c5:XX:XX:XX Received EAPOL EAPPKT from mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.914: [PA] 68:ec:c5:XX:XX:XX Received EAP Response from mobile 68:ec:c5:XX:XX:XX (EAP Id 7, EAP Type 25) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.914: [PA] 68:ec:c5:XX:XX:XX Resetting reauth count 0 to 0 for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.914: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Response state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Processing Access-Accept for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Resetting web IPv4 acl from 255 to 255 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Resetting web IPv4 Flex acl from 65535 to 65535 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Received MPPE_SEND_KEY: KeyLen: 32 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Received MPPE_RECV_KEY: KeyLen: 32 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX override for default ap group, marking intgrp NULL *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX apfApplyWlanPolicy: Apply WLAN Policy over PMIPv6 Client Mobility Type, Tunnel User - 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Inserting AAA Override struct for mobile MAC: 68:ec:c5:XX:XX:XX, source 4 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Setting re-auth timeout to 0 seconds, got from WLAN config. *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Station 68:ec:c5:XX:XX:XX setting dot1x reauth timeout = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Stopping reauth timeout for 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Creating a PKC PMKID Cache entry for station 68:ec:c5:XX:XX:XX (RSN 0) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Setting active key cache index 0 ---> 8 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Setting active key cache index 8 ---> 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Sending EAP-Success to mobile 68:ec:c5:XX:XX:XX (EAP Id 7) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.917: [PA] 68:ec:c5:XX:XX:XX Freeing AAACB from Dot1xCB as AAA auth is done for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX Sending default RC4 key to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX Sending Key-Mapping RC4 key to mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX Freeing EAP Retransmit Bufer for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX apfMs1xStateInc *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.918: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 8021X_REQD (3) Change state to L2AUTHCOMPLETE (4) last state 8021X_REQD (3) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) DHCP required on AP 00:C1:64:YY:YY:YY vapId 1 apVapId 1for this client *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX Not Using WMM Compliance code qosCap 00 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX Vlan while overriding the policy = -1 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX sending to spamAddMobile vlanId -1 flex aclName = , flexAclId 65535 *spamApTask6: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX Successful transmission of LWAPP Add-Mobile to AP 00:C1:64:YY:YY:YY *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.919: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP 00:C1:64:YY:YY:YY vapId 1 apVapId 1 flex-acl-name: *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) pemAdvanceState2 6728, Adding TMP rule *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Adding Fast Path rule type = Airespace AP - Learn IP address on AP 00:C1:64:YY:YY:YY, slot 1, interface = 13, QOS = 0 IPv4 ACL ID = 25 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 15206, IntfId = 0 Local Bridging Vlan = 202, Local Bridging intf id = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.920: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255,URL ACL ID 255) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Change state to DHCP_REQD (7) last state L2AUTHCOMPLETE (4) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 6757, Adding TMP rule *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Replacing Fast Path rule type = Airespace AP - Learn IP address on AP 00:C1:64:YY:YY:YY, slot 1, interface = 13, QOS = 0 IPv4 ACL ID = 255, *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 15206, IntfId = 0 Local Bridging Vlan = 202, Local Bridging intf id = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 0, AppToken = 15206 AverageRate = 0, BurstRate = 0 *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255,URL ACL ID 255) *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) NO release MSCB *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX Entering Backend Auth Success state (id=7) for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX Received Auth Success while in Authenticating state for mobile 68:ec:c5:XX:XX:XX *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX dot1x - moving mobile 68:ec:c5:XX:XX:XX into Authenticated state *pemReceiveTask: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 Added NPU entry of type 9, dtlFlags 0x0
... View more
Created by
Walter Astori
in Wireless and Mobility
in Wireless and Mobility
09-17-2019
12:13 AM
09-17-2019
12:13 AM
Hi, I have a Cisco 5508 WLC (8.3.150 release) with 25 WLAN SSID configured and 352 Acess Point. In particular there is a WLAN SSID configured as Layer 2 Security as 802.1x (WEP). These 352 Access Point are installed in more location and each location communicate each other with MPLS. The WLAN SSID configured as 802.1x communicate with Windows 2012 R2 NPS and this WLAN SSID is enabled on 352 access point and works fine on 350 access point, on 2 access point doesn't work. In one location there are two access points AIR-CAP1702I-E-K9 that broadcast the WLAN SSID, but the Windows 10 clients when they try to connect it answer with "Can't connect the client". On the WLC the Policy Manager State associate with clients is DHCP_REQ. If I change the WLAN SSID in WPA, WPA2 or WEP it works on this location. It seems that the DHCP request from AP never seen by WLC. Here some rows about debug on MAC address in this location : *apfMsConnTask_0: Sep 06 16:43:07.719: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 8021X_REQD (3) DHCP required on AP 00:c1:64:XX:XX:XX vapId 1 apVapId 1for this client After some rows : *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.921: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 L2AUTHCOMPLETE (4) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255,URL ACL ID 255) The debug end with : *Dot1x_NW_MsgTask_1: Sep 06 16:43:07.922: [PA] 68:ec:c5:XX:XX:XX 0.0.0.0 DHCP_REQD (7) NO release MSCB For troubleshooting the same scenario, I have configured the WLAN SSID only for that location and only for that 2 access point with WPA+WPA2 only without 802.1x, and it works. Here the same rows of the debug : *Dot1x_NW_MsgTask_4: Sep 12 14:10:12.491: [PA] f0:d5:bf:XX:XX:XX0.0.0.0 L2AUTHCOMPLETE (4) DHCP required on AP 00:6c:bc:c2:d0:40 vapId 1 apVapId 1for this client *Dot1x_NW_MsgTask_4: Sep 12 14:10:12.491: [PA] f0:d5:bf:XX:XX:XX 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255,URL ACL ID 255) The WLC Policy Manager State at the end of this step is RUN My opinion is that there is communication between NPS and WLC with some errors, but I haven't found they since I started with this issue. Other counters : Authentication Servers: Server Index..................................... 1 Server Address................................... XX.XX.XX.XXX Msg Round Trip Time.............................. 2 (msec) First Requests................................... 2389308 Retry Requests................................... 36742 Accept Responses................................. 365911 Reject Responses................................. 32449 Challenge Responses.............................. 1981628 Malformed Msgs................................... 0 Bad Authenticator Msgs........................... 2 Pending Requests................................. 2 Timeout Requests................................. 42987 Consecutive Drops ............................... 0 Unknowntype Msgs................................. 0 Other Drops...................................... 72 Server Index..................................... 2 Server Address................................... XX.XX.XX.XXX Msg Round Trip Time.............................. 0 (msec) First Requests................................... 1195 Retry Requests................................... 139 Accept Responses................................. 0 Reject Responses................................. 0 Challenge Responses.............................. 0 Malformed Msgs................................... 0 Bad Authenticator Msgs........................... 0 Pending Requests................................. 0 Timeout Requests................................. 253 Consecutive Drops ............................... 0 Unknowntype Msgs................................. 0 Other Drops...................................... 0 Server Index..................................... 3 Server Address................................... XX.XX.XX.XX Msg Round Trip Time.............................. 0 (msec) First Requests................................... 1828 Retry Requests................................... 1746 Accept Responses................................. 0 Reject Responses................................. 0 Challenge Responses.............................. 0 Malformed Msgs................................... 0 Bad Authenticator Msgs........................... 0 Pending Requests................................. 0 Timeout Requests................................. 2587 Consecutive Drops ............................... 5 Unknowntype Msgs................................. 0 Other Drops...................................... 0 show wlan ssid : WLAN Identifier.................................. 1 Profile Name..................................... XXXXXXXXXXXXXXXXXXX Network Name (SSID).............................. XXXXXXXXXXXXXXXXXXXXXX Status........................................... Enabled MAC Filtering.................................... Disabled Broadcast SSID................................... Enabled AAA Policy Override.............................. Enabled Network Admission Control Client Profiling Status Radius Profiling ............................ Disabled DHCP ....................................... Disabled HTTP ....................................... Disabled Local Profiling ............................. Disabled DHCP ....................................... Disabled HTTP ....................................... Disabled Radius-NAC State............................... Disabled SNMP-NAC State................................. Disabled Quarantine VLAN................................ 0 Maximum Clients Allowed.......................... Unlimited Maximum number of Clients per AP Radio........... 200 --More-- or (q)uit ATF Policy....................................... 0 Number of Active Clients......................... 935 Exclusionlist Timeout............................ 60 seconds Session Timeout.................................. 86400 seconds User Idle Timeout................................ Disabled Sleep Client..................................... disable Sleep Client Timeout............................. 720 minutes User Idle Threshold.............................. 0 Bytes NAS-identifier................................... none CHD per WLAN..................................... Enabled Webauth DHCP exclusion........................... Disabled Interface........................................ management Multicast Interface.............................. Not Configured WLAN IPv4 ACL.................................... unconfigured WLAN IPv6 ACL.................................... unconfigured WLAN Layer2 ACL.................................. unconfigured WLAN URL ACL..................................... unconfigured mDNS Status...................................... Disabled mDNS Profile Name................................ unconfigured DHCP Server...................................... Default DHCP Address Assignment Required................. Disabled Static IP client tunneling....................... Disabled Tunnel Profile................................... Unconfigured PMIPv6 Mobility Type............................. none PMIPv6 MAG Profile........................... Unconfigured PMIPv6 Default Realm......................... Unconfigured PMIPv6 NAI Type.............................. Hexadecimal PMIPv6 MAG location.......................... AP Quality of Service............................... Silver Per-SSID Rate Limits............................. Upstream Downstream Average Data Rate................................ 0 0 Average Realtime Data Rate....................... 0 0 Burst Data Rate.................................. 0 0 Burst Realtime Data Rate......................... 0 0 Per-Client Rate Limits........................... Upstream Downstream Average Data Rate................................ 0 0 Average Realtime Data Rate....................... 0 0 Burst Data Rate.................................. 0 0 Burst Realtime Data Rate......................... 0 0 Scan Defer Priority.............................. 4,5,6 Scan Defer Time.................................. 100 milliseconds WMM.............................................. Allowed WMM UAPSD Compliant Client Support............... Disabled Media Stream Multicast-direct.................... Disabled CCX - AironetIe Support.......................... Disabled CCX - Gratuitous ProbeResponse (GPR)............. Disabled --More-- or (q)uit CCX - Diagnostics Channel Capability............. Disabled Dot11-Phone Mode (7920).......................... Disabled Wired Protocol................................... 802.1P (Tag=0) Passive Client Feature........................... Disabled Peer-to-Peer Blocking Action..................... Disabled Radio Policy..................................... All DTIM period for 802.11a radio.................... 2 DTIM period for 802.11b radio.................... 2 Radius Servers Authentication................................ 10.39.1.201 1645 * Authentication................................ 10.39.1.203 1645 * Accounting.................................... 10.39.1.201 1646 * Accounting.................................... 10.39.1.203 1646 * Interim Update............................. Enabled Interim Update Interval.................... 0 Framed IPv6 Acct AVP ...................... Prefix Dynamic Interface............................. Disabled Dynamic Interface Priority.................... wlan Local EAP Authentication......................... Disabled Radius NAI-Realm................................. Disabled Mu-Mimo.......................................... Enabled Security 802.11 Authentication:........................ Open System FT Support.................................... Disabled Static WEP Keys............................... Disabled 802.1X........................................ Enabled Encryption:..................................... 104-bit WEP 802.1X on MAC Auth failure:..................... Disabled Wi-Fi Protected Access (WPA/WPA2)............. Disabled Wi-Fi Direct policy configured................ Disabled EAP-Passthrough............................... Disabled CKIP ......................................... Disabled Web Based Authentication...................... Disabled Web Authentication Timeout.................... 300 Web-Passthrough............................... Disabled Mac-auth-server............................... 0.0.0.0 Web-portal-server............................. 0.0.0.0 Conditional Web Redirect...................... Disabled Splash-Page Web Redirect...................... Disabled Auto Anchor................................... Disabled FlexConnect Local Switching................... Enabled FlexConnect Central Association............... Disabled flexconnect Central Dhcp Flag................. Disabled flexconnect nat-pat Flag...................... Disabled flexconnect Dns Override Flag................. Disabled flexconnect PPPoE pass-through................ Disabled flexconnect local-switching IP-source-guar.... Disabled FlexConnect Vlan based Central Switching ..... Disabled FlexConnect Local Authentication.............. Disabled FlexConnect Learn IP Address.................. Enabled Client MFP.................................... Disabled PMF........................................... Disabled PMF Association Comeback Time................. 1 PMF SA Query RetryTimeout..................... 200 Tkip MIC Countermeasure Hold-down Timer....... 60 Eap-params.................................... Enabled EAP-Identity-Request Timeout (seconds)..... 40 EAP-Identity-Request Max Retries........... 2 EAP-Request Timeout (seconds).............. 30 EAP-Request Max Retries.................... 2 EAPOL-Key Timeout (milliseconds)........... 1000 EAPOL-Key Max Retries...................... 2 AVC Visibilty.................................... Disabled AVC Profile Name................................. None Flex Avc Profile Name............................ None Flow Monitor Name................................ None Split Tunnel Configuration Split Tunnel................................. Disabled --More-- or (q)uit Call Snooping.................................... Disabled Roamed Call Re-Anchor Policy..................... Disabled SIP CAC Fail Send-486-Busy Policy................ Enabled SIP CAC Fail Send Dis-Association Policy......... Disabled KTS based CAC Policy............................. Disabled Assisted Roaming Prediction Optimization......... Disabled 802.11k Neighbor List............................ Disabled 802.11k Neighbor List Dual Band.................. Disabled 802.11v Directed Multicast Service............... Disabled 802.11v BSS Max Idle Service..................... Enabled 802.11v BSS Transition Service................... Disabled 802.11v BSS Transition Disassoc Imminent......... Disabled 802.11v BSS Transition Disassoc Timer............ 200 802.11v BSS Transition OpRoam Disassoc Timer..... 40 DMS DB is empty Band Select...................................... Disabled Load Balancing................................... Disabled Multicast Buffer................................. Disabled Universal Ap Admin............................... Disabled Broadcast Tagging................................ Disabled Mobility Anchor List WLAN ID IP Address Status Priority 802.11u........................................ Disabled MSAP Services.................................. Disabled Local Policy ---------------- Priority Policy Name -------- --------------- Lync State ...................................... Disabled Audio QoS Policy................................. Silver Video QoS Policy................................. Silver App-Share QoS Policy............................. Silver File Transfer QoS Policy......................... Silver QoS Fastlane Status.............................. Disable Selective Reanchoring Status..................... Disable The DHCP on the WLC is configured global on the management interface the show arp stats output command : ARP counts: Max number of entries...............7724 ARP switchdriver entries............2459 Max kernel ARP cache entries........8024 ARP kernel entries..................148 ARP statistics: Dup Additions 947686 Bad Additions 0 Bad Deletions 0 ARP statistics for Passive client Arp: Total Arp Packets received 0 Total Arp Packets Forwarded 0 Arp Breached upper limit packets/sec 0
... View more
- Tags:
- 5508 DHCP_REQD
Labels:
06-11-2015
07:57 AM
Thanks, i modified my configuration so : no nat (INSIDE,OUTSIDE) source static VPNnonat.-SRC VPNnonat-SRC destination static VPNL2L-DST VPNL2L-DST After with capture ASP type asp-drop, i see the flow from 10.168.0.85 to 94.125.239.242. I studied the configuration of my ASA and i write the configuration about traffic uncrypted Ip address of inside lan to outside for Internet with the source nat 94.125.239.252 and the vpn is ok. From nat (INSIDE,OUTSIDE) source dynamic INSIDE-LAN-src INSIDE-LAN-src IP-94.125.239.242 destination static Any-dst Any-dst To object-group network INSIDE-INTERNET-OUTSIDE host 192.168.0.1 nat (INSIDE,OUTSIDE) source dynamic IP-94.125.239.252 Now the vpn is OK. Thanks
... View more
06-08-2015
01:06 AM
When i try to ping the destination 10.168.0.85 from my inside host 192.168.93.164 (NAT-SRC to 10.195.10.164) i can see on my ASA this output : peer address: 78.6.254.7 Crypto map tag: outside_map, seq num: 145, local addr: 94.125.239.251 access-list VPNL2LCrypto extended permit ip 10.195.10.164 255.255.255.5 10.168.0.85 255.255.255.255 local ident (addr/mask/prot/port): (10.195.10.164/255.255.255.0/0/0) remote ident (addr/mask/prot/port): (10.168.0.85/255.255.255.0/0/0) current_peer: 78.6.254.7 #pkts encaps: 380, #pkts encrypt: 380, #pkts digest: 380 #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0 #pkts compressed: 0, #pkts decompressed: 0 #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0 #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0 #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0 #pkts no sa (send): 0, #pkts invalid sa (rcv): 0 #pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0 #pkts invalid prot (rcv): 0, #pkts verify failed: 0 #pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0 #pkts invalid pad (rcv): 0, #pkts invalid ip version (rcv): 0, #pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0 #pkts replay failed (rcv): 0 #pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0 #pkts internal err (send): 0, #pkts internal err (rcv): 0 local crypto endpt.: 94.125.239.251/4500, remote crypto endpt.: 78.6.254.7/4500 path mtu 1500, ipsec overhead 82, media mtu 1500 current outbound spi: 59D2316F current inbound spi : 9DC7F1C5 As you can see there are the numbers in the pkts encaps, but there aren't any numbers in pkts decaps. Obviously when the other side try to ping my inside host the other side with the same command see the same output. From this issue i can suppose that in my ASA the packets from other side to my INSIDE there aren't encrypted.
... View more
06-04-2015
07:29 AM
Here my VPN Lan To Lan configuration : object VPNL2L-src host 192.168.93.164 nat(INSIDE,OUTSIDE) static 10.195.10.164 object network VPNL2L-SRC-NAT host 10.195.10.164 object network VPNnonat-SRC host 10.195.10.164 object network VPNL2L-DST host 10.168.0.85 nat (INSIDE,OUTSIDE) source static VPNnonat.-SRC VPNnonat-SRC destination static VPNL2L-DST VPNL2L-DST nat (INSIDE,OUTSIDE) source static VPNL2L-src VPNL2L-SRC-NAT destination static VPNL2L-DST VPNL2L-DST The flow show me that the packets go out from my OUTSIDE, but when the packets come in my OUTSIDE there is no flow in VPN traffic.
... View more
Labels:
10-27-2014
01:49 AM
Hi guys, i have ASA 5520 with many VPN LAN To LAN and VPN Remote Access. I have a issue with one VPN Lan To Lan where there is a overlap network between our inside network and the remote peer. There is a VPN Lan To Lan with this configuration : LAN (INSIDE) - 192.168.0.0/22 INSIDE ASA - 172.16.0.3 - OUTSIDE ASA 94.125.239.251 192.168.1.10 --------------------------------------------192.168.198.7 ---------------------------------------------192.168.201.221 Real IP IP SOURCE NAT IP DESTINATION NAT Server (REMOTE PEER) Flow without translation : From 192.168.1.10/32 TO 192.168.201.221/32 (NONAT) Flow with translation : From 192.168.1.10/32 TO 192.168.201.221/32 (IP SOURCE NAT 192.168.198.7) - CRYPTO Flow without translation : From 192.168.201.221/32 TO 192.168.198.7/32 ---------------> FROM REMOTE PEER TO ASA - CRYPTO Flow with translation : From 192.168.198.7/32 TO 192.168.1.10/32 ------------------> STATIC NAT ASA Below the configuration : access-group Traffico-Outbound-Inside-Outside in interface INSIDE access-list Traffico-Outbound-Inside-Outside extended permit ip host 192.168.1.10 host 192.168.201.221 access-list VPNL2LCryptoOasi extended permit ip host 192.168.198.7 host 192.168.201.221 access-list VPNL2LFilterOasi extended permit icmp host 192.168.201.221 host 192.168.198.7 access-list VPNL2LFilterOasi extended permit tcp host 192.168.201.221 range 1024 65535 host 192.168.198.7 eq 7006 access-list VPNL2LFilterOasi extended permit tcp host 192.168.201.221 eq 6006 host 192.168.198.7 range 1024 65535 nat (INSIDE,OUTSIDE) source dynamic VPNL2LOasiNAT-192.168.1.10-src VPNL2LOasiNAT-IPSRC destination static VPNL2LOasiNAT-192.168.201.221-dst VPNL2LOasiNAT-192.168.201.221-dst nat (INSIDE,OUTSIDE) source static VPNnonat-192.168.198.7-src VPNnonat-192.168.198.7-src destination static VPNnonat-192.168.201.221-dst VPNnonat-192.168.201.221-dst object network VPNL2LOasiNAT-IPSRC nat (OUTSIDE,INSIDE) static 192.168.1.10 crypto ipsec transform-set OasiBeeInsSet esp-aes esp-md5-hmac crypto map outside_map 110 match address VPNL2LCryptoOasi crypto map outside_map 110 set peer 194.185.233.36 crypto map outside_map 110 set transform-set OasiBeeInsSet tunnel-group 194.185.233.36 type ipsec-l2l tunnel-group 194.185.233.36 general-attributes default-group-policy 194.185.233.36 tunnel-group 194.185.233.36 ipsec-attributes pre-shared-key ***** group-policy 194.185.233.36 internal group-policy 194.185.233.36 attributes vpn-filter value VPNL2LFilterOasi When the server 192.168.1.10 in the INSIDE network try to telnet 192.168.201.221 6006 is all ok. But when the 192.168.201.221 telnet the 192.168.198.7 in the log i see : Oct 24 06:29:57 172.16.0.3 Oct 24 2014 06:29:57 IDC-CISCOFWUS-02 : %ASA-6-302014: Teardown TCP connection 2051276 for OUTSIDE:192.168.201.221/59712 to OUTSIDE:192.168.198.7/7006 duration 0:00:00 bytes 0 Flow is a loopback i tried to follow link http://www.packetu.com/2012/01/02/asa-vpn-with-address-overlap/ which in most discussion on cisco forum it is the example. In my configuration there is my situation : For their 192.168.1.0/24 -> My host network is 192.168.1.10 For their 192.168.2.0/24 -> My host network is 192.168.198.7 For their 192.168.3.0/24 -> My host network is 192.168.201.221 So, here the my configuration : nat (INSIDE,OUTSIDE) source dynamic VPNL2LOasiNAT-192.168.1.10-src VPNL2LOasiNAT-IPSRC destination static VPNL2LOasiNAT-192.168.201.221-dst VPNL2LOasiNAT-192.168.201.221-dst nat (inside,outside) source static VPNnonat-192.168.1.10-src VPNL2LOasiNAT-IPSRC destination static VPNL2LOasiNAT-192.168.201.221-dst VPNnonat-192.168.1.10-src object network VPNL2LOasiNAT-192.168.1.10-src nat (outside,inside) static 192.168.201.221 With this configuration, is not possible telnet 192.168.201.221 6006. I tried to route INSIDE the 192.168.198.7 and there isn't the error in the log, but there is a SYN timeout on the packet about 192.168.198.7
... View more
Labels:
Created by
Walter Astori
in VPN and AnyConnect
in VPN and AnyConnect
10-24-2014
02:00 AM
10-24-2014
02:00 AM
Hi guys, i have ASA 5520 with many VPN LAN To LAN and VPN Remote Access. There is a VPN Lan To Lan with this configuration : 192.168.1.10 ---------------------------------192.168.251.5 --------------------------------------------------192.168.198.8 Real IP IP SOURCE NAT IP DESTINATION NAT (Server) (ASA 5520) (REMOTE PEER) (INSIDE - 192.168.0.0/22) (INSIDE - SNAT 192.168.251.5) Flow without translation : From 192.168.1.10/32 TO 192.168.198.8/32 Flow with translation : From 192.168.1.10/32 TO 192.168.198.8/32 -------------------> SERVER From 192.168.251.5/32 TO 192.168.198.8/32 ------------------> ASA Flow without translation : From 192.168.198.8/32 TO 192.168.251.5/32 ---------------> REMOTE PEER Flow with translation : From 192.168.251.5/32 TO 192.168.1.10/32 -------------------> ASA Below the configuration : access-group Traffico-Inbound-Outside in interface OUTSIDE access-group Traffico-Outbound-Inside-Outside in interface INSIDE access-list Traffico-Inbound-Outside extended permit ip any host 192.168.251.5 access-list Traffico-Outbound-Inside-Outside extended permit ip host 192.168.1.10 host 192.168.198.8 nat (INSIDE,OUTSIDE) source dynamic VPNL2LIdmNAT-192.168.1.10-SRC VPNL2LIdmNAT-IPSRC destination static VPNL2LIdmNAT-192.168.198.8-dst VPNL2LIdmNAT-192.168.198.8-dst nat (INSIDE,OUTSIDE) source static VPNnonat-192.168.1.10-src VPNnonat-192.168.1.10-src destination static VPNnonat-192.168.198.8-dst VPNnonat-192.168.198.8-dst access-list VPNL2LFilterIDM extended permit tcp host 192.168.198.8 range 1024 65535 host 192.168.251.5 eq 7002 access-list VPNL2LFilterIDM extended permit tcp host 192.168.198.8 eq 7002 host 192.168.251.5 range 1024 65535 access-list VPNL2LCryptoIDM extended permit ip host 192.168.251.5 host 192.168.198.8 crypto map outside_map 120 match address VPNL2LCryptoIDM crypto map outside_map 120 set peer 81.208.86.190 crypto map outside_map 120 set transform-set IDMSet crypto ipsec transform-set IDMSet esp-aes-256 esp-sha-hmac tunnel-group 81.208.86.190 type ipsec-l2l tunnel-group 81.208.86.190 general-attributes default-group-policy 81.208.86.190 tunnel-group 81.208.86.190 ipsec-attributes pre-shared-key ***** group-policy 81.208.86.190 internal group-policy 81.208.86.190 attributes vpn-filter value VPNL2LFilterIDM When the server 192.168.1.10 in the INSIDE network try to telnet 192.168.198.8 7002 is all ok. But when the 192.168.198.8 telnet the 192.168.251.5 in the log i see : Oct 23 10:08:24 172.16.0.3 Oct 23 2014 10:08:24 IDC-CISCOFWUS-02 : %ASA-6-302014: Teardown TCP connection 227467 for OUTSIDE:192.168.198.8/42689 to OUTSIDE:192.168.251.5/7002 duration 0:00:00 bytes 0 Flow is a loopback i tried to follow link http://www.packetu.com/2012/01/02/asa-vpn-with-address-overlap/ with this configuration : nat (inside,outside) source static VPNnonat-192.168.1.10-src VPNL2LIdmNAT-IPSRC destination static VPNL2LIdmNAT-192.168.198.8-dst VPNnonat-192.168.1.10-src object network VPNnonat-192.168.1.10-src nat (outside,inside) static 192.168.198.8 In this situation is not possible telnet 192.168.198.8 7002 from 192.168.1.10
... View more
Labels:
10-10-2014
01:08 AM
Why the MTU is set to 9000 ? Do you have set jumbo frame ? The file transfer between two computer does support TCP offload ? The MTU size 9000 are set on switch ?
... View more
10-09-2014
11:32 PM
Can you set speed 1000 and duplex full on every port of the switch where the ASA is connected ?
... View more
10-09-2014
08:06 AM
Can you set speed 1000 and duplex full on every interface of your ASA ?
... View more
10-09-2014
05:55 AM
Can you try to execute this command : object network OWA-server-ip host 10.100.30.20 nat (dmz,outside) static OWA-external-ip service 80 object network OWA-server-ip host 10.100.30.20 nat (dmz,outside) static OWA-external-ip service 443
... View more
10-09-2014
01:08 AM
I think that you must set speed 100 and duplex full on every port of your switch
... View more
10-09-2014
12:56 AM
i think that the number of the instruction crypto isakmp policy "number" must be equal to the instruction crypto map "name" "number" set ........
... View more
You Have No Messages
Public Statistics
| Date Registered | 01-21-2014 01:58 AM |
| Date Last Visited | 09-25-2019 12:21 AM |
| Total Messages Posted | 133 |
| Total Helpful Votes Received | 37 |
Helpful Votes From
