Showing results for 
Search instead for 
Did you mean: 

Fab Mode APs - Wireless Client Authentication Sessions on switch int


Hi all, hoping that somebody out there might have seen something similar to what we're currently experiencing?

Basically, we are seeing issues whereby clients are associating to a SSID configured for 802.1x, being authenticated successfully (ISE Policy Set filtering on the WLC) and then allowed connection to the appropriate network as per defined VNID... However, at some point after that authentication, approx 45mins according to support chaps the users report a loss of connectivity and have to connect to the wired network.

This is where it gets interesting, when we look in ISE we can see that the clients wireless MAC address is now hitting authentication policies within a policy set that is filtered on the Switch hostnames and where the MAB request is coming from the switch interface where the AP is configured. This means that we see a load of MACs on the switch port;


After extensive searching I've found a bug CSCwb87363 : Bug Search Tool ( which appears to be along similar lines however there's no detail.

We've had a TAC case open for this whereby it was intimated that there was an ISE policy configuration issue, I've guided my support colleagues to go back to TAC with the above bug reference.

The affected users if they physically roam to another AP immediately authenticate and get onboarded as expected, I'm not sure if the problem follows them around as we've not ascertained that. 


2 Replies 2

Rich R
VIP Advisor VIP Advisor
VIP Advisor

I see you never got a reply to this - hopefully you've solved it now.

But you're quite right it's a bug - which CSCwb87363 is pointing to now -

It's fixed in 17.6.4 which I'd recommend anyway.

TAC recommended codes for AireOS WLC's
Best Practices for AireOS WLC's
TAC recommended codes for 9800 WLC's
Best Practices for 9800 WLC's
Cisco Wireless compatibility matrix
Field Notice: FN-72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Recommended
WARNING - see CSCwd37092 Throughput degraded after upgrading to code - 2800/3800/4800 series
- The fix for CSCwd37092 is now released in and
- For IOS-XE 17.3.6 select controller model, go to IOS XE Software AP Service Pack, select CSCwd40096 17.3.6 APSP2
Field Notice: FN-63942 Lightweight APs and WLCs Fail to Create CAPWAP Connections Due to Certificate
                      Expiration - Software Upgrade Recommended
Field Notice: FN-72524 - During Software Upgrade/Downgrade IOS APs Might Remain in Downloading State
                     After 4 Dec 2022 Due to Certificate Expiration - Fixed in and 17.3.6 APSP5 (APSP_CSCwd83653)
                     Also fixed in (8.5 mainline) and (8.5 IRCM) if you can't upgrade to 8.10
                     Note that and have been deferred (withdrawn) and are effectively unsupported by Cisco
Richard R

Hi Rich, thanks so much for pointing us in this direction.

We're currently running 17.6.3 so the bugfix note aligns perfectly. We've been guided by TAC to go to higher release for another issue we have related to RSSI value collection so we're going to reach out to TAC in regards to this case to give them a chance to confirm formally that this bugfix relates to the issue and will be covered in the suggested release.

Will update this once confirmed

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers