04-03-2012 08:33 AM - edited 07-03-2021 09:56 PM
In my trap logs, I'm seeing this message over and over: AAA Authentication Failure for UserName:username@company.com User Type: WLAN USER
The user in question no longer works with the company. How do I track were this authentication attempt is coming from? I tried looking at the syslogs but couldn't find any information that would help.
I'm running a WLC 5508 with 7.2.103.0. Thanks.
04-03-2012 08:38 AM
If you have NCS / WCS track the user name or device mac address and it should show you history for that user / mac address including aps associated and times. I hope this helps!
04-03-2012 08:55 AM
As much as I would love to use NCS / WCS, we unfortunatly don't have either at this time.
04-03-2012 12:57 PM
If the client is online you can do a client debug and see what ap its asscoiated to. If its not online, you will not be able to track it without WCS/NCS.
Are you using radius for authenctation ? If so there should be some information like time and attempts in the logs ..
04-03-2012 08:55 AM
To piggy back on George if you have NCS / WCS installed not only will you get past historical data of what AP they were connected on you can do a single device on demand location tracking using your configured floor plans with AP placements.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: