Some Clients unable to connect after WLC upgrade from 8.2 to 8.5 due to AIRONET support

[Emiliano Luca]

After we  upgraded WLC from  rel 8.2 to 8.5  we had a bunch of  WiFi  printers  not able to associate anymore to our Cisco APs.
Seeing that  these printer are very important for the production flow,  we had to perform a downgrade to the  previous release and luckily the roll back solved the issue.

Anyway for more then one reason we ought to perform this upgrade, so we prepared a lab to  better understand what  happened and find a solution.
TAC eng confirmed the different behavior  but, using debug, he saw AP replied to every Probe Request with the relative Probe Response,  so for him all seemed to be fine and  was not able to undestand the reason for the missing association by the printer.

We didn't give up and  using a WiFi sniffer and capturing traffic between APs and Printers   with both releases,  we discovered "Probe  Response"  packets from AP to client  had different sizes:  the 8.5 rel.  adds indeed 4 new TAGs in the IEEE  802.11  portion of the frame  and  Wireshark was even  not able to decode   one of them marking it as "unknown".
Probably printer considers the AP's response as a malformed packet due to this "unknown" field and discards it.

We guessed  these TAGs are  sent for compatibility with Aironet clients and in the lab enviroment we tried to disable the feature in the SSID configuration on WLC. At this point lab printer was  able to  associate normally to AP.

Now we would like to disable this features in the production env.  but  before to do that we would like to check if  any clients currently associated is using it  and could have issue without it.

Is there any show  and/or  debug command able to show us if Aironet Extension is used by any client connected to our WLC ?



PS the issue has been tested on 2500 3500 and 5500 WLCs with same behavior.

We have to admit printer is a very old model but is working fine with 8.2 and also with 8.5 after "workaround".

[Rasika Nayanajith]

Aironet Extension is required for WGB connections (if you have any Cisco AP act as client to connect wired only devices to wireless) & cisco wireless phones -792x/882x . Otherwise you are ok to disable this feature.

It is best practice to disable it (see below Cisco WLC best practice configuration guide )

https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-6/b_Cisco_Wireless_LAN_Controller_Configuration_Best_Practices.html

"Aironet IE is a Cisco proprietary attribute used by Cisco devices for better connectivity and troubleshooting. It contains information, such as the access point name, load, and number of associated clients in the beacon and probe responses of the WLAN that are sent by the access point (AP). Cisco Client Extensions (CCX) clients use this information to choose the best AP with which to associate.

The CCX software is licensed to manufacturers and vendors of third-party client devices. The CCX code on these clients enables them to communicate wirelessly with Cisco APs and to support Cisco features that other client devices do not. The features are related to increased security, enhanced performance, fast roaming, and power management.

The CCX software is licensed to manufacturers and vendors of third-party client devices. The CCX code on these clients enables them to communicate wirelessly with Cisco APs and to support Cisco features that other client devices do not. The features are related to increased security, enhanced performance, fast roaming, and power management.

To disable Aironet IEs for a particular WLAN:

(Cisco Controller) >config wlan ccx aironet-ie disable <wlan_id>Forwarding

Restriction:

Do not disable this if supporting Cisco voice devices (8821/792x, etc) or WGB"

HTH

Rasika

*** Pls rate all useful responses ***

[Emiliano Luca]

Thanks for your answer but unfortunately it is not related to my question.
I've already read document you've posted regarding Aironet extensions and it seems strange to me the fact an optional feature that Best Practice suggests to disable, it is enabled by default when you create a new SSID instead.

Anyway I need to understand if it is possible to detect if any client is currently using it and seeing that we have more then 10K clients on various sites and WLCs it won't be so easy to check all of them.
"Do not disable this if supporting Cisco voice devices (8821/792x, etc) or WGB"
I simply would d like to have a command showing me if these kind of clients are currently in use or not.

Emiliano

[patoberli · Accepted solution]

On Prime Infrastructure you'd see it. 

In any case, I recently disabled it in my BYOD environment and the ~1500 clients didn't see any change. It was completely transparent to them. 

Please note WLC 8.3 and newer support 802.11r, that also adds some fields to the frame header and can cause various compatibility issues with older clients when enabled. Check if maybe that feature is the reason for your outage.