cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1931
Views
10
Helpful
6
Replies

Disable Client Exclusion on EWC

brentpavlovich
Level 1
Level 1

Ran into a weird problem that all started when I changed the PSK a WLAN uses. The SSID of the WLAN stayed the same, only the PSK changed. Since changing the PSK, even though we went through and updated the password on the wireless devices connecting to the WLAN that changed, they all initially connected fine. But soon we noticed randomly, devices were disconnecting from the network. Watching logs on the controller it shows the clients are getting added to the exclusion list due to the wrong PSK. Eventually all those same devices time out of the exclusion list, then connect fine without issue. Some time passes and they get added to the exclusion list again. I can't figure out if the problem is due to an issue with the wireless APs/controller or the clients themselves. All i can say though is this is happening to multiple types of clients (computers, phones, smart devices (plugs, Alexa, etc.)) so there isn't any commonality there. Thinking it was a bug with the IOS, i upgraded the firmware but the problem persisted. Tried wiping the entire config of the APs/controller and added back the PSK with the new config but the problem remained. So now I'm out of ideas and want to instead figure out how to just disable the client exclusion feature hoping that keeps devices connected. I understand the security ramifications of this, but for now am running out of options. Any and all responses on either what might be causing clients to get added to the exclusion list or how to disable it all together are much appreciated! 

 

I am running two C9130AXI-B access points which are configured as an embedded wireless controller. Firmware version Cisco IOS XE Software, Version 17.09.02. 

1 Accepted Solution

Accepted Solutions

Scott Fella
Hall of Fame
Hall of Fame

I don't have an EWC but from a 9800 controller, you define this on the Policy Profile:

wireless profile policy <your policy profile>
no exclusionlist
exclusionlist timeout 0

-Scott
*** Please rate helpful posts ***

View solution in original post

6 Replies 6

marce1000
VIP
VIP

 

 - You may try : (Cisco EWC Controller) >config wps client-exclusion all disable 

 M.



-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
    When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Unfortunately i believe that command only works in AireOS. It doesn't accept the command on the EWC. 

 

    >...Unfortunately i believe that command only works in AireOS. It doesn't accept the command on the EWC. 
                   Check if these commands can provide more insights :
                          show wireless stats client detail
                              show wireless stats client delete reasons 
                          show wireless client history disconnected summary
                          show logging  profile wireless filter <CLIENTMAC>

  Also have a checkup of the EWC controller configuration with the CLI command : show  tech   wireless , have the output analyzed by  https://cway.cisco.com/tools/WirelessAnalyzer/  , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer.               Checkout all advisories!

    - Look into client debugging : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity , you can have client debugs analyzed with : https://cway.cisco.com/wireless-debug-analyzer

 M.


  



-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
    When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Rich R
VIP
VIP

Haven't tried it myself but I see these in "show run all" (handy for looking for default config):
wireless wps client-exclusion all
wireless wps client-exclusion dot11-assoc
wireless wps client-exclusion dot1x-auth
wireless wps client-exclusion dot1x-timeout
wireless wps client-exclusion ip-theft
wireless wps client-exclusion web-auth

So try no xxxx on those?

Scott Fella
Hall of Fame
Hall of Fame

I don't have an EWC but from a 9800 controller, you define this on the Policy Profile:

wireless profile policy <your policy profile>
no exclusionlist
exclusionlist timeout 0

-Scott
*** Please rate helpful posts ***

I tried  "no wireless wps client-exclusion all" in global config and that didn't have any affect. On the actual wireless profile policy though "no exclusionlist" has seemed to work. Ill give it a day or so before calling it completely resolved, but so far watching the logs no clients have been added. Thank you all for the suggestions! 

Review Cisco Networking for a $25 gift card