Disable All Client exclusion policies WLC 9800-L

[mgonzalez15]

Hi everyone!

I have a client that is experiencing disconnection problems in the SSIDs that it has active, this includes 802.1x and 802.11 authentication, one of the logs that was constantly presented is the following:

%CLIENT_EXCLUSION_SERVER-5-ADD_TO_BLACKLIST_REASON_DYNAMIC: Chassis 1 R0/0: wncmgrd: Client MAC: aa42.2ab3.c605 was added to exclusion list associated with AP Name:AP11, BSSID:MAC: e44e.2d67.68ae, reason:Wrong PSK

Reading a bit, the only workaround that has worked is disabling all client exclusion policies, the client confirms that it has had a considerable improvement with the disconnections that the devices presented.

I know that this workaround is not the definitive one, because these exclusion lists should not be disabled, it seems to be an issue related to a bug, probably, since the clients are not writing the PSK wrongly.

If someone found a definitive solution, your comments and support would greatly help me.

Greetings.

WLC 9800-L
Version 17.03.05a

[marce1000]

 - https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvu47560 , seems somewhat similar I would go for (and or test with) IOS-XE 17.9.3        and verify if the problem remains , or not  , 

 M.

[rwaskowski]

Hi,

just for records and for those who experience the same issue: it is present in IOS-XE 17.6.4 & 17.6.5 too. And even turning off the whole feature does not help: if a clients sends one time the wrong PSK, it still gets on the exclusion list.

So far the workaround in the mentioned bug is the only way to mitigate the issue: set  "exclusionlist timeout 1"  [=one second]. Unfortunatly this makes the whole feature quite useless.  Next I will try with 17.9.3 ... 

best regards

[Rich R]

> "since the clients are not writing the PSK wrongly"
> "if a clients sends one time the wrong PSK"

Hmmm so the first statement may not have been true?  The client has actually sent the wrong PSK?

Anyway - 17.9.3 is now the TAC recommended version as per the link below.