02-13-2023 05:15 PM
Ran into a weird problem that all started when I changed the PSK a WLAN uses. The SSID of the WLAN stayed the same, only the PSK changed. Since changing the PSK, even though we went through and updated the password on the wireless devices connecting to the WLAN that changed, they all initially connected fine. But soon we noticed randomly, devices were disconnecting from the network. Watching logs on the controller it shows the clients are getting added to the exclusion list due to the wrong PSK. Eventually all those same devices time out of the exclusion list, then connect fine without issue. Some time passes and they get added to the exclusion list again. I can't figure out if the problem is due to an issue with the wireless APs/controller or the clients themselves. All i can say though is this is happening to multiple types of clients (computers, phones, smart devices (plugs, Alexa, etc.)) so there isn't any commonality there. Thinking it was a bug with the IOS, i upgraded the firmware but the problem persisted. Tried wiping the entire config of the APs/controller and added back the PSK with the new config but the problem remained. So now I'm out of ideas and want to instead figure out how to just disable the client exclusion feature hoping that keeps devices connected. I understand the security ramifications of this, but for now am running out of options. Any and all responses on either what might be causing clients to get added to the exclusion list or how to disable it all together are much appreciated!
I am running two C9130AXI-B access points which are configured as an embedded wireless controller. Firmware version Cisco IOS XE Software, Version 17.09.02.
Solved! Go to Solution.
02-14-2023 08:33 AM
I don't have an EWC but from a 9800 controller, you define this on the Policy Profile:
wireless profile policy <your policy profile>
no exclusionlist
exclusionlist timeout 0
02-13-2023 11:50 PM
- You may try : (Cisco EWC Controller) >config wps client-exclusion all disable
M.
02-14-2023 04:57 AM
Unfortunately i believe that command only works in AireOS. It doesn't accept the command on the EWC.
02-14-2023 08:42 AM
>...Unfortunately i believe that command only works in AireOS. It doesn't accept the command on the EWC.
Check if these commands can provide more insights :
show wireless stats client detail
show wireless stats client delete reasons
show wireless client history disconnected summary
show logging profile wireless filter <CLIENTMAC>
Also have a checkup of the EWC controller configuration with the CLI command : show tech wireless , have the output analyzed by https://cway.cisco.com/
- Look into client debugging : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity , you can have client debugs analyzed with : https://cway.cisco.com/wireless-debug-analyzer
M.
02-14-2023 06:29 AM
Haven't tried it myself but I see these in "show run all" (handy for looking for default config):
wireless wps client-exclusion all
wireless wps client-exclusion dot11-assoc
wireless wps client-exclusion dot1x-auth
wireless wps client-exclusion dot1x-timeout
wireless wps client-exclusion ip-theft
wireless wps client-exclusion web-auth
So try no xxxx on those?
02-14-2023 08:33 AM
I don't have an EWC but from a 9800 controller, you define this on the Policy Profile:
wireless profile policy <your policy profile>
no exclusionlist
exclusionlist timeout 0
02-14-2023 09:21 AM
I tried "no wireless wps client-exclusion all" in global config and that didn't have any affect. On the actual wireless profile policy though "no exclusionlist" has seemed to work. Ill give it a day or so before calling it completely resolved, but so far watching the logs no clients have been added. Thank you all for the suggestions!
10-23-2024 02:44 AM
Via cli, it asks to disable policy before that change, unfortunally.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide