Need help tracking WLAN USER

[sean.graham]

In my trap logs, I'm seeing this message over and over: AAA Authentication Failure for UserName:username@company.com User Type: WLAN USER

The user in question no longer works with the company. How do I track were this authentication attempt is coming from? I tried looking at the syslogs but couldn't find any information that would help.

I'm running a WLC 5508 with 7.2.103.0. Thanks.

[George Stefanick]

If you have NCS / WCS track the user name or device mac address and it should show you history for that user / mac address including aps associated and times. I hope this helps!

[sean.graham]

As much as I would love to use NCS / WCS, we unfortunatly don't have either at this time.

[George Stefanick]

If the client is online you can do a client debug and see what ap its asscoiated to. If its not online, you will not be able to track it without WCS/NCS.

Are you using radius for authenctation ? If so there should be some information like time and attempts in the logs ..

[blakekrone]

To piggy back on George if you have NCS / WCS installed not only will you get past historical data of what AP they were connected on you can do a single device on demand location tracking using your configured floor plans with AP placements.