Yea, you can't apply to the individual interfaces...  I'm used to not being able to apply to the port-channel itself....  Not sure what in the world is going on.... ... View more

The firewall is running 8.2.5 I turned off the UDP IPSec helper and that helped improve issues, It's not about 7 minutes to a reconnection rather than 10 but, its still altering the reciever ID. Dosn't make any sense.  I'm not getting anything back from my TAC case either.  Not too worried as I'm more than willing to route around to my Juniper Firewalls but, it's very odd that this behavior is occuring with just the ASA's...  I'd like to figure it out. policy-map global-default policy-map type inspect dns migrated_dns_map_1 parameters   message-length maximum 512 policy-map global_policy class inspection_default   inspect dns migrated_dns_map_1   inspect ftp   inspect h323 h225   inspect h323 ras   inspect rsh   inspect rtsp   inspect esmtp   inspect sqlnet   inspect skinny   inspect sunrpc   inspect xdmcp   inspect sip   inspect netbios   inspect tftp   inspect icmp   inspect pptp   inspect icmp error class class_netbios   inspect netbios policy-map global_default class class-default   set connection advanced-options mss-map   set connection decrement-ttl ! ... View more

I believe we are looking at some sort of odd bug. Have a TAC case open with Cisco...  Nadda...  It's definitly the ASA however, have rerouted the VPN through a Juniper Firewall and Fortinet, no issues, works without issue every time.  I'll keep this updated... ... View more

I took some packet captures before and after the ASA and it would appear that the ASA is altering the responder cookie in the initial ISAKMP packet...  Very very odd... ... View more

Still down for me also....  This is getting a bit rediculous.... ... View more

I havn't gotten a straight answer to tell you the truth.  I was told based on command line input that it's purely cosmetic on the webpage.  The only way to straighten the web part out is to recreate the WLAN for it to update as far as I know.  I'm still having some dissassociation issues but, not to the degree I was before I would say.  Best of luck! ... View more

David, To tell you the truth, I'm not entirely sure what version we were at.  It was whatever these 5508's came with.  We moved our config on our old 4404's over to the 5508's, ran them at whatever version they came with for a few months and then moved to 7.0.116.0.  I have old config files here from backups that happen nightly but, I don't see an indication in them as to what code was running previous. ... View more

Interesting...  It would appear to be cosmetic in nature...  See the results of the command below: (Cisco Controller) >show wps mfp sum Global Infrastructure MFP state.................. Enabled Controller Time Source Valid..................... True                                     WLAN       Infra.      Client WLAN ID  WLAN Name                  Status     Protection  Protection -------  -------------------------  ---------  ----------  ---------- 1        Wlan 1                Enabled    Enabled     Optional 2        Wlan 2                Enabled    Enabled     Optional 3        Wlan 3                Enabled    Enabled     Optional 4        Wlan 4                Enabled    Enabled     Optional I don't see any remenants in the config of the old disable command which was as follows on the prior version: wlan mfp infrastructure protection disable 1 wlan mfp infrastructure protection disable 3 (This is what was in the old config and is not in the new config!) I've tried the whole several times and it still leaves the cosmetic error in the web interface: (Cisco Controller) >config wps mfp infrastructure disable (Cisco Controller) >config wps mfp infrastructure enable *I have also tried the reboot, didn't help*   I think it if it is truly cosmetic, I'm not going to worry about it, another release will likely fix it.  If it's not cosmetic (Which I should know after running some debug's) I'll have to recreate the WLAN's. ... View more

Sure, I'm just going to Security -> Wireless Protection Policies -> Management Frame Protection -> WLANs and then here is what I see (Obviously editing for formatting and naming) WLAN-ID     WLAN Name     WLAN Status     Infrastructure Protection     Client Protection 1                    WLAN1          Enabled               Disabled                         Optional 2                    WLAN2          Enabled               Enabled                         Optional 3                    WLAN3          Enabled               Disabled                         Optional 4                    WLAN4          Enabled               Enabled                         Optional It is indeed enabled globally...  I can't figure out how in the devil to get these two from disabled to enabled!  I have turned global enablement for Infrastructure MFP on and off and on again and these two are always disabled.  I have old code snippets from the prior version where there was a specific line in the config just for these two WLAN's that disabled infrastructure protection.  I'm not sure why it was there to begin with but, when we did the upgrade, the global enablement never re-enabled these two WLAN's.  ... View more

Maybe I'm not following your response but again, I've enable infrastructure MFP globally.  The issue is even though I've enabled it globally, for whatever reason, it's still disabled on two of the WLAN's which dosn't make sense since it is enabled globally.  I think it's some sort of bug.  Your answer dosn't discuss the possibility that infrastructure MFP is disabled on some WLAN's even after enabling it globally.  I do not have any sort of AP Authenticaion.  All of these WLANs are part of a group 2 of the 4 are showing Infrastructure MFP enabled and the other 2 are showing Infrastructure MFP as disabled which dosn't make sense since I have it enabled globally.  I'm not discussing Client MFP at all so it's irrelevant to the conversation. ... View more

As noted, it is already enabled there globally.  This is an instance where it is disabled on two WLAN's specifically and I have no way to undisable it now that the check box and command line options for per-wlan basis are gone for infrastructure MFP. ... View more