cisco wlc mac filtering not working when switchover to active

[kmnii]

Hi.

When switchover from backup to active, Some users could not access the ssid.

For example, there were 20 people on the macfiltering list, and about 10 of them did not use ssid.
However, as a solution to the problem, all were resolved with disable/re-enable.
Before the switchover, it was using it without any problem.

I do not understand the operation and attach the log and equipment information when it was not joined at the time.

Additionally, the redundancy state is sso mode.

[log]
%DOT1X-3-PSK_CONFIG_ERR: [PA]1x_ptsm.c:749 Client xx:xx:xx:xx:xx:xx may be using an incorrect PSK
Aug 13 13:56:35.610: [WARNING] apf_policy.c 4593: Either Vlan Name id Template invalid or no name to id mapping exist for interface 'management'

[show]
---------------Show boot---------------

Primary Boot Image............................... 8.5.140.0 (active)
Backup Boot Image................................ 8.3.143.0

---------------Show udi---------------
NAME: "Chassis" , DESCR: "Cisco 5520 Wireless Controller"
PID: AIR-CT5520-K9, VID: V01, SN:

Is there any problem you can guess?

[balaji.bandi]

Not sure at this stage, but look at the bug :

https://quickview.cloudapps.cisco.com/quickview/bug/CSCvm61048

[Rich R]

1. Upgrade to latest release: https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc10 or https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc4 (if all your APs are supported on 8.10).  If that fixes the problem - great.  If you still see the problem then ...

2. Open a case with Cisco TAC.

[Arshad Safrulla]

Did you check the bulk sync status before initialing the switchover? It is always recommended that you check the "show redundancy summary" command to make sure that you HA cluster health is perfect before initiating a failover. If the bulk sync status was pending or in-orogress when you initiated the failover the behavior you explained is expected. Bulk sync status shows whether the AP's and client information is synced to the hot standby wlc from the active wlc. When WLC standby boots up and forms HA with an Active WLC, the Active WLC will send the configuration to the standby unit. Depending on the size of the DB, like number of clients connected, APs joined, etc, it may take up to 20 mins to the configuration and database sync to complete.

As @Rich R advised please try to run the latest Cisco recommended releases as much as possible.

[kmnii]

thank you for reply arshadsaf

We made sure the sync status was OK before making the switch.

Also, no action was taken for about 3 hours after the failure occurred, and the problem continued.

At first, I thought it would be a synchronization problem, but considering the fact that it was not resolved over time and that it occurred between the two transitions, it does not seem to be a synchronization problem.

Additionally, I have confirmed that the problem does not occur when active conversion from Unit 1 to Unit 2 occurs, and only occurs when active conversion from Unit 2 to Unit 1 occurs.

Lastly, I'm sorry I used Google Translate.

[Arshad Safrulla]

Is the AP's on Flex connect? 

Are you using multiple authentication for a client (PSK+MAC filter etc.)?

I would strongly suggest you to look @Rich R recommendation to consider a new AireOS with less bug as well.

[kmnii]

yes, AP is Flex mode and Our security policy is '[WPA2][Auth(PSK)], MAC Filtering'

[Arshad Safrulla · Accepted solution]

Do you have Flex AP fast heart beat enabled? If not can you have it enabled and try again. 

Also in AireOS  I am yet to come across any documentation which says they support PSK+MAC Filter authentication. Most of the documentation where MAC filtering is referred uses No Layer 2 authentication. 

[Rich R]

Good point @Arshad Safrulla and there are actually a number of bugs which can cause bulk-sync to get stuck in the older code - another reason to update.