Can the WLC capture be trusted?

[patoberli]

Hi All

I'm debugging a EAP-TLS issue at the moment, between some iPads a WLC 8540 with 8.10.181.3 and 2800 APs. 
It works with 2700 AP models on this WLC, but nearly always fails with 2800 APs.

I've now captured the radius communication between the WLC and ISE and it seems that either the WLC doesn't receive all (fragmented) packets, or the capture on the WLC is not trustworthy. The whole setup worked fine with 8.5.140.0. Disabling 802.11r (Fast Transition) didn't help. The ISE shows a lot of Radius communication, until the client starts a new session.

I've used this information for the capture: http://wifinigel.blogspot.com/2014/08/cisco-wlc-per-client-packet-capture.html

On the left side is the capture from the WLC, on the right side is the capture from the firewall interface between the WLC and ASA. Please note, I didn't do the captures at the exact same time, but the symptom is the same always. ASA interface and WLC Management Interface are on the same VLAN/segment. As you can see, the third fragmented Radius packet, is either not completely captured by the WLC capture function, or indeed lost.

Have you seen something like this already?

I haven't yet had the possibility to capture on the switch where the WLC is attached to.

Thanks
Patrick

[patoberli]

Quick update, we are now officially hitting this bug: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe07802

Should be fixed in the next release, I assume 8.10.19x.x. 

[Leo Laohoo]

Thanks for sharing the Bug ID.  

This is another notch to the issues facing the 2800/3800/4800/1562.

[Leo Laohoo]

This is a different bug altogether.  We never had issues with Apple devices and all our controllers operate in 40 Mhz.

[Rich R]

Just a warning - the workaround on CSCwe07802 says to use mesh mode - but we currently have a TAC case open for mesh mode APs (1562) flapping CAPWAP frequently on 8.10.183.0 so watch them carefully if you try the workaround.

[Leo Laohoo]

Better yet, use 20- or 40 Mhz.  

[noc]

Been tshooting this issue for days with ipads on 2802 APs with 9800 wlc with both 17.9.2 & 17.6.5 versions. Solved by changing from 80mhz to 40mhz. 

[Leo Laohoo]

Hey @patoberli, 

I am going to use this thread and update the list of Bug IDs related to 2800/3800/4800/1560 generation of APs.  

Please update this thread if someone finds any more Bug IDs (public or private) outside my LIST.

Thank you very much.

[patoberli]

Hi @Leo Laohoo 

8.10.185.0 was just released, including a fix for the bug for which I opened this thread initially. It's MR9, but still called 8.10.185.0, no idea why.

Release notes: https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn810mr9.html#resolved-caveats

[Rich R]

The official explanation for the version number: "it is running out of version numbers, so it was decided to avoid using 190, and extend 18x , just in case"

[Leo Laohoo]

---

@Rich R wrote:

The official explanation for the version number: "it is running out of version numbers, so it was decided to avoid using 190, and extend 18x , just in case"

---

LOL. 

Unofficially, they're just being lazy.  Take CSCvy47982 as an example. 

The Bug ID was first created on 27 May 2021.  End of Software Maintenance Release for AireOS was 31 January 2023.

From 27 March 2021 until 31 January 2023, nothing was improved, nothing was fixed. However, on 22 March 2023, someone decided to update the Bug ID with "Cisco does not intend to fix this design limitation, as AireOS is past End of Software Maintenance."

How f**king convenient.  

[Rich R]

I think we'll see that getting added to many AireOS bugs that are still open now.  It's just a reality of the devs prioritising fixes for 9800 now and only fixing critical security issues on AireOS till it goes end of security fixes too.

[patoberli]

Thanks for the radar bug @Leo Laohoo my new favorite bug. Radar detection partly broken since ~5 years and nobody realized it. 

[Rich R]

Yep my own thoughts precisely @patoberli LOL
But might explain why we were asked to turn off 5GHz on some 3802's last year when they were suspected of interfering with airport weather radar (from considerable distance mind you) - we just assumed it was because the radar could hear the AP but not vice-versa but maybe it was this!

[Leo Laohoo]

@patoberli, 

It is "troubling" (for lack of a better word) that the Bug IDs enumerated is getting longer and longer than first time I've listed.  

[Leo Laohoo]

@patoberli 

I am beginning to see this issue rearing it's ugly head in IOS-XE in the form of CSCwh03842.