New AP not needing MAC address adding

[tominski]

HI all.  When I  am turning connecting up a new CWB240AC onto the network, the mac address is automatically being added to the allowed MAC list.  I am not adding it myself.  How do I stop this? AP's should not join unless I have added the MAC address to the allow list manually.

Many thanks.

[tominski]

Any ideas on this one please anyone? 

[jamesbos96602]

maybe i seen this cisco got a probem with how wifi and controlers work togather in short they cant get certifices to work,

on new release of ios i seen that ap by pass all secrity on the controller and just join, when i told cisco of this they closed the case

i beleave it is a workaround for there certific probem but what they did was disable all securty. now i might be wrong on yours

but one way find out, on corntroler run debug command on certifices aaa. and all encription what u should see if as wifi trys join it

must change it encription to match if u dont see this it been removed i dont know this of any help as my system is older but ios is newest out , so why i think probem is same

[jamesbos96602]

one thing i should added  this cant be stop this is a ios codeing, there is no way stop it

well one u can config ipsec to handle encription. if u use a certific all units have as meens to encript this

should work, throw it has be config on controler on the swich on each every ap. there no possable way to push this config to the ap's but keep in mind some ports cant be encripted doing so u break it all togather ,  ports 136 137 138. udp 68 udp tcp 53

http https ssh ftp tftp ports 500 4500 i missing a few but doing this only them with certifice will bond to controler