In my trap logs, I'm seeing this message over and over: AAA Authentication Failure for UserName:email@example.com User Type: WLAN USER
The user in question no longer works with the company. How do I track were this authentication attempt is coming from? I tried looking at the syslogs but couldn't find any information that would help.
I'm running a WLC 5508 with 22.214.171.124. Thanks.
If you have NCS / WCS track the user name or device mac address and it should show you history for that user / mac address including aps associated and times. I hope this helps!
If the client is online you can do a client debug and see what ap its asscoiated to. If its not online, you will not be able to track it without WCS/NCS.
Are you using radius for authenctation ? If so there should be some information like time and attempts in the logs ..
To piggy back on George if you have NCS / WCS installed not only will you get past historical data of what AP they were connected on you can do a single device on demand location tracking using your configured floor plans with AP placements.