Cisco WLC and 1131 AP's - Users unable to connect

[Matthew Ratliff]

Guys,

I've ran into an issue that I haven't seen before.  A client of mine has a WLC that manages AP's at several different sites on the East Coast.  They are all connected via a multilinked T1x2 connection.  One site in particular contains 7 AP's, and users at this site are unable to connect.  The remaining sites have no issue at all connecting.  I noticed that when users began reporting this that all AP's had failed interference profiles.  Also, when I instruct a user to attempt a connection, I don't ever see their mac address come across a debug session on the controller, which I find odd.  Is it possible that a neighboring business is sending deauth packets and containing my AP's?

The client is running code version 4.2.61.0.

[George Stefanick]

When this happens, check the syslog on the controller. You will need to do this quick becuase there is a lot of information. If it was a deauth situation, you will see something like "client being conatined by XXX".If you have a sniffer or you can turn one of the APs at the remote site into a sniffer and use wireshark ...

[Matthew Ratliff]

Thanks George!  I'm gathering syslogs at the moment.  This is what I'm seeing:

Jan 24 10:44:23  spam_lrad.c:2705 LWAPP-3-RX_ERR9: Received a bad sequenced RRM data request message from AP 00:13:80:94:9c:d0
Jan 24 10:44:24  spam_lrad.c:2705 LWAPP-3-RX_ERR9: Received a bad sequenced RRM data request message from AP 00:13:80:94:9c:d0
Jan 24 10:44:25  ethoip.c:110 ETHOIP-3-INVALID_PKT_RECVD: Ethernet over IP pkt too short; pkt size=70, expected min=86
Jan 24 10:44:25  ethoip.c:342 ETHOIP-3-PKT_RECV_ERROR: ethoipSocketTask: ethoipRecvPkt returned error
Jan 24 10:44:25  spam_lrad.c:2705 LWAPP-3-RX_ERR9: Received a bad sequenced RRM data request message from AP 00:19:a9:43:6a:e0

I'll also look into sniffing the traffic to get a bit more.  I appreciate your response.