Showing results for 
Search instead for 
Did you mean: 
Community Manager

ASK THE EXPERTS : Wireless Network Management

With Nael Mohammad

Read the bioWelcome to the Cisco Support Community Ask the Expert conversation. This is an opportunity to learn about how to manage, configure, and troubleshoot your wireless networks using Cisco network management products like Wireless Control System (WCS), Mobility Service Engine (MSE), Location Appliance with Cisco expert . Nael is a customer support engineer at Cisco. He specializes in supporting Cisco Network Management products and technologies which includes WCS, MSE, Location Appliance, as well as Cisco Network Registrar (CNR), and CiscoWorks LAN Management Solution (LMS). Nael graduated from San Francisco State University with a B.S. in Business Administration and holds a CCNA certification.

Remember to use the rating system to let Nael know if you have received an adequate response.

Nael might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Security and Network Management discussion forum shortly after the event. This event lasts through June 17th, 2011. Visit this forum often to view responses to your questions and the questions of other community members.


I configured WCS + CleanAir (ELM enabled) + MSE, but I do not see on WCS the icon on AP to get the spectrum expert data. Do you know what might be wrong?

When will ISE be released? If I trade an ACS appliance with ISE, what do I get on this trade including license and other products?

For the WCS/Clean Air issue with spectrum experts, verify that you have it added to WCS.

To add a Spectrum Expert, follow these steps:

  1. Choose Configure > Spectrum Experts.
  2. From the Select a command drop-down list, choose Add a Spectrum Expert.
  3. Note: This link only appears when no spectrum experts are added. You can also access the Add a  Spectrum Expert page by choosing Add a Spectrum Expert from the Select a command  drop-down list.
  4. Enter the Spectrum Expert's Hostname or IP address. If you use hostname, your spectrum expert must  be registered with DNS in order to be added to WCS.
  5. Note: To be correctly added as a spectrum expert, the spectrum expert client must be running and  configured to communicate to WCS.

    As this discussion is only related to WCS/MSE/Location Appliance, please post the question for ISE in the correct forum with respects to ACS/ISE. For the trade up program, you will need to contact your reseller about current promotions.

    Below are a few links that talk about ISE, Downloading ISO to install on your existing ACS appliance, and migration path from ACS.

    For more info on ISE:

    Release notes:

    Downloading ISE:

    Migrating from ACS to ISE:

    Craig Le-Butt


    My question is regarding Radius Server Fallback.

    Active mode - If the server does not repond to the WLC authentication request, the WLC marks the server as dead.

    Part for clarification, is how does it see if it is dead?  If it can no longer ping the server, or the services on the ACS have failed?

    We've currenlty got 1 * 4.2 ACS Appliance and 1 *  4.2 ACS on Windows.  Does the Active mode take in account the agent for the appliance on a AD box is not reponding?



    Hi Nael,

    i have a Problem with the cisco-av-pair string on the Cisco ACS and a SSID.

    We have here some SSID and some AD Groups. It was no Problem with the old Cisco ACS 4.2. I have here configured the string: cisco-av-pair ssid=myssid. The Clients have only rights to this ssid. It works without Problems.

    On the new ACS 5.2. I have here Problem to configure this.

    My Configuration is a new Identity Policy.

    Compound Condition:

    Radius-Cisco -->cisco-av-pair-->equals-->myssid

    But this string works not.

    Did you have any ideas about this Problem.





    First off ACS is not my area of expertise and this discussion should focus on WCS/MSE/Location Appliance, but I will try my best to assist you.

    What protocol are you using to authenticate the wireless users?

    What version of WCS are you using?

    What version of WLC are you using?

    What errors appear on the ACS?

    Do a “debug aaa all enable” and “debug aaa local-auth” and capture the outputs and post it for review. Keep in mind the data will be available for all to view whatever is posted on the forums if that is ok with you.

    @Craig: How does WLC determine if the acs/radius server is dead?

    WLC uses standard radius traffic to probe the authenticating server to determine if it’s up or not. It uses one of the three statuses:

    “OFF” states if the radius server fails, move to the next radius server in a round robin fashion until you get a response.

    “PASSIVE” states treat the list in an orderly fashion based on radius preferences.  From the top, if one fails, mark it down for a period of time and move on to the next in the list. Each acs/radius attempts to start from the top of the order and continue to that last and skips acs/radius servers if still in dead timer mode.

    “ACTIVE” mode sends a probe packet (radius traffic and requests based on RFC access-request) to see if the radius server responds by checking the username configured in the active mode settings of WLC. The user does not have to exist on the acs/radius, it just needs to respond to the probe coming from WLC to determine if it’s up or down.

    Hi Nael

    Thank for reply, but stil missing the answer.

    Heres what happend, 2 ACS, 1 is on a VM box.  The VM session failed, no clients where authenticating, couldn't connect to ACS on the box, only thing could do is ping the box.  But it didn't fail over.  Had to restart the VM session, then every thing came back..

    How does WCS probe the ACS to see if it is authenticating?



    WCS uses a round robin fashion to probe the ACS server based on the settings you have configured under WCS --> Administration --> AAA --> TACACS+. Post screenshot of this page.

    1. What version of WCS are you running?

    2. Enable tracing from Administration --> Logging --> Change message level to Trace.

    3. Duplicate the problem.

    4. Download and attach the WCS logs from Administration --> Logging --> Download Log.

    Keep in mind this is a WCS discussion so any issues with the ACS server itself, it would be best to post that in the respective forums as to why the ACS session froze.


    Our existing setup is a WLC526 with 6 LAP521G units.  This setup is 4 years old and is still going ok.

    We do have some issues with coverage but it's been rock solid.

    Our office building is 55K sq ft over 3 floors and our sanctuary is 45K sq ft (lots of open space)

    What do you recommend to move to a wireless N solution.

    I have been paying attention to the 2500 controller series and they look sweet.

    We have about 40 people on staff but lots of access to our guest wifi during the week and when we hold conferences.

    Sometimes these are 200 up to 500 people.   Of course not all of these are needing the wifi but with smartphones and iPads and such more and more people are expecting it. 




    @Steve, thanks for the great questions.

    For the WLC 2500 series, there is a 50 AP max, 500 clients, and 500 tags limitation. If you don’t need to scale beyond those limits, then 2500 series controller should suit your needs.

    In addition, it supports 802.11N, Clean Air, and Mesh AP along with other features. The following AP’s are supported with the 2500 series:

    • CAP3500 (Max 400 Clients per AP)
    • LAP1260 (Max 400 Clients per AP)
    • LAP1040 (Max 400 Clients per AP)
    • LAP1250 (Max 400 Clients per AP)
    • LAP1140 (Max 400 Clients per AP)
    • Legacy Cisco Aironet AP’s (LAP1130, LAP1240, LAP1230, LAP1500)

    You mentioned that you occupy a 55k square foot building with 3 floors and outdoor space of 45k. I’d recommend you do a site survey to determine your needs to get an idea of how many AP’s is needed, placement location, antenna type, coverage area, power consideration, wiring requirements, and extra capacity if needed.

    The goal of the site survey should be high availability, scalability, manageability, and interoperability. In WCS, you can use the planning mode option from WCS --> Monitor Maps --> System Campus --> Building --> Floor --> From select command chooses “Planning Mode”. Use the generate proposal option and this will detail the amount of AP’s needed based on the location and size.

    More info can be found here to use this feature:

    This is assuming you have WCS installed and configured to manage your wireless network environment.



    What is the best way to 'decode' the meaning of debug messages on controllers when troubleshooting client connection issues? I have seem multiple messages and I was looking for some kind of documentation/guide that goes into more detail.

    Here are some examples:

      - APF-4-ASSOCREQ_PROC_FAILED: Failed to process an association request from0. WLAN:3, SSID: mobile in database timed out.

    -DOT1X-3-MAX_EAPOL_KEY_RETRANS: Max EAPOL-key M5 retransmissions exceeded for client

    -APF-4-REGISTER_IPADD_ON_MSCB_FAILED: Could not Register IP Add on MSCB. MSCB still in init state. Address

    - usmdb_registry.c:140 USMDB-6-MSGTAG007: Error on call to sysapiRegistryGet routine with keyUDI_PID.

    -RUN (20) State Update from Mobility-Complete to Mobility-Incomplete

    -apfMsExpireCallback (apf_ms.c:433) Expiring Mobile!

    -Received EAPOL-key in REKEYNEGOTIATING state (message 6) from mobile

    -%APF-3-ASSOCREQ: apf_utils.c:1033 START (0) Rejecting association attempt - privacy bit set on WLAN not requiring security

    - %DOT1X-3-INVALID_WPA_KEY_MSG_STATE: 1x_eapkey.c:708 Received invalid EAPOL-key M2 msg in START state - invalid secure bit; len 24, key type 1, client

    Thanks! Ana


    Here is some docs for debug and show commands and understanding debugs on the WLC:

    Understanding Debug Client on WLC:

    WLC Debug and Show Commands:

    Use the Bug Toolkit to decode the errors to see if existing bugs are impacting the WLC:

    Copy the error messages and paste it into the keyword search.


    I have a WCS and (2) 4404-100 controllers with 131 1252 APs. I am going to convert to (2) 5508 controllers and add 125 3502 APs as well as the MSE. I want to know if I can back up ther configs from the 4404 controllers and restore them to the 5508 controllers or do I ahve to configure the 5508 controllers from the ground up.

    @ evarmer, Thanks for the great questions. The steps below will outline how to backup and restore your AP, controllers, and MSE configuration using the WCS 7.0.x.x or later.  Note when backing up the WLC, it will take care of saving your AP configuration for you so no additional steps are needed unless you have custom AP templates.

    Backup Configuration from Controller

    You have two options to backup the configuration from the WLC to WCS.

    Option 1: WCS → Configure → Controller → Select IP address of controller and from the select command menu, choose “refresh config from menu” and go. You will be presented with two options, one that ask to retain configuration in the WCS database or use the configuration on the controller currently. Most likely the second option is what you want when backing up.

    Option 2: Choose Administration > Background Tasks, then click Controller Configuration Backup to access this page.

    From the Administration > Background Tasks page, you can execute, enable, or disable this task. To execute, enable, or disable this task from the Administration > Background Tasks page, follow these steps:

    1. Choose Administration > Background Tasks.
    2. Select the check box of the Background Task that you want to execute, enable, or disable.
    3. Use the Select a command drop-down list to perform one of the following task:
    4. Execute the task now—Select the check box of the task you want to execute. From the Select a command drop-down list, choose Execute Now and click Go. The status changes in the Enabled column.
    5. Enable the task—Select the check box of the task you want to enable. From the Select a command drop-down list, choose Enable Task and click Go.

    Restore Configuration to Controller

    1. Choose Configure > Controllers.
    2. Click the IP address of the applicable controller.
    3. From the left sidebar menu, choose System > Commands. The following parameters appear:
    4. Configuration and select Restore Config To Controller—Choose this command to restore the configuration from the WCS database to the controller.

    Backing Up Mobility Services Engine Historical Data

    To back up mobility services engine data, follow these steps:

    1. In Cisco WCS, click Services > Mobility Services.
    2. Click the name of the mobility services engine that you want to back up.
    3. From the left sidebar menu, choose Maintenance > Backup.
    4. Enter the name of the backup.
    5. Enter the time in seconds after which the backup times out.
    6. Click Submit to back up the historical data to the hard drive of the server running WCS.

    Restoring Mobility Services Engine Historical Data

    To restore a file back into the mobility service, follow these steps:

    1. Choose Services > Mobility Services.
    2. Click the name of the mobility service whose properties you want to edit.
    3. From the left sidebar menu, choose Maintenance > Restore.
    4. Choose the file to restore from the drop-down list.
    5. Select the Delete synchronized service assignments check box if you want to permanently remove all service assignments from the mobility services engine.
    6. Click Submit to start the restoration process.
    7. Click OK to confirm that you want to restore the data from the Cisco WCS Server hard drive.

    When restoration is completed, WCS displays a message to that effect.

    Recognize Your Peers
    Content for Community-Ad