'Anchor Denied for Mobile' - Secure Mobility Tunnel 8540 - 9800 WLC

[phil_carter]

Hello,

I have configured a new secure mobility tunnel between an 8540 foreign WLC (img: 8.10.190.0) and a 9800 anchor WLC (img: 17.9.4a) which has come up (both data/control paths). I have assigned the anchor mobility to a test SSID (MACB enabled) on the foreign WLC & selected 'Export Anchor' under the WLAN policy on the anchor WLC. However, testing with a client to use this new tunnel fails with log entries in the foreign controller showing:

*apfReceiveTask: Mar 08 11:57:40.699: %APF-1-MM_ANCHOR_DENIED: [PA]apf_mm.c:1861 Anchor denied for mobile: <mac-address>.
*apfReceiveTask: Mar 08 11:57:37.430: %APF-1-MM_ANCHOR_DENIED: [PA]apf_mm.c:1861 Anchor denied for mobile: <mac-address>.

The monitor>client detail on the foreign WLC shows the client 'Mobility Peer IP Address' as 'unassociated'. 

I've been using the below links to tshoot so far, but not joy:

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/216500-catalyst-9800-central-web-authenticati.html#anc10

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810/mobility_groups.html

Any guidance on best way to troubleshoot further is greatly appreciated.

Thanks - Phil

[marce1000]

 - Have a checkup of  the 9800 WLC configuration using the CLI command show tech wireless and feed the output into : Wireless Config Analyzer

 M.

[phil_carter]

Thanks - tried the config analyzer, however nothing reported suggesting any tunnel/mobility issues

[marce1000]

- Check WLAN authenticating schemes on both boxes , make sure there are no
conflicts such as ACLs - mab or other.

M.