Solved: WGB AP1300 : Line protocol on Interface Dot11Radio0, changed state to down

Abmas Sidi · ‎01-15-2013

Hi everybody

I have a problem with a WGB AP1300 whose Dot11Radio0 interface automatically turn to DOWN once Root AP connectivity is lost.

Here's my environment :

I have several WGB AP1300. Each WGB is installed on a Bus in order to connect Ethernet equipments (PC's) on the bus. As buses are mobile, roaming is enabled on the WGB AP. The WGB is connected to a AP3502i (Root AP) managed by a WLC5508 controller.

Once started the WGB AP works fine, PC's in the bus can connect succefully to the main Network infrastructure.

The proble occurs when the bus moves out of the WiFi coverage area, connectivity is lost (that's normal) and then comes back to the WiFi coverage area. The WiFi connectivity is not restablished (no re-association), between the WGB AP and the Root AP. And I observe that the status of the Dot11Radio0 is DOWN. I've tried the commad line with no success:

AP1300_1(config)# int d0

AP1300_1(config-if)# no shutdown

AP1300_1(config-if)# exit

Restaring the WGB AP1300 did not solve my problem.

I get on the following log errors on the WGB AP1300 :

Interface Dot11Radio0, cannot associate: No Response

Line protocol on Interface Dot11Radio0, changed state to down

Interface Dot11Radio0, changed state to down

Interface Dot11Radio0, parent lost: Too many retries

Can anyone help me please.

Many thanks.

Abmas

The config of the WGB AP1300 is :

=====================================================

!

version 12.3

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

!

hostname AP1300_1

enable secret 5 $1$vDNk$N2pPvLVGRfCv8R5f/gn1Y.

!

ip subnet-zero

ip domain name mydomain.com

!

ip ssh version 2

no aaa new-model

!

dot11 ssid MySSID

authentication open

authentication key-management wpa

wpa-psk ascii 7 105D1D1644191D1D0D063F38

!

username admin privilege 7 secret 5 $1$jlwK$ll1c3f.qEblnWj/hExNeC1

!

bridge irb

!

interface Dot11Radio0

no shutdown

no ip address

no ip route-cache

!

encryption mode ciphers tkip

!

ssid MySSID

speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0

station-role workgroup-bridge

mobile station period 20 threshold 70

bridge-group 1

bridge-group 1 spanning-disabled

!

interface FastEthernet0

no ip address

no ip route-cache

bridge-group 1

bridge-group 1 spanning-disabled

hold-queue 80 in

!

interface BVI1

ip address XX.XX.XX.XX 255.255.255.0

no ip route-cache

!

ip default-gateway XX.XX.XX.XX

ip http server

no ip http secure-server

ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag

!

control-plane

!

bridge 1 route ip

bridge 1 aging-time 86400

!

line con 0

line vty 0 4

login local

transport input ssh

!

workgroup-bridge client-vlan XX

end

=====================================================

Amjad Abdullah · ‎01-15-2013

Hi Abmas,

First, what is the exact security configuration on the controller's SSID? Are you have bot WPA and WPA2 enabled on the controller with both TKIP and AES enabed? I see you only have WPA-TKIP configured on the WGB.

I would suggest that you give a look into the controller and see what is the status of the WGB there.

In controller's CLI you can also enabled debugs to see the process of the associatoin of the WGB.

Enable the following debugs on the WLC CLI and let the WGB try again to enter the coverage area:

debug client .

After taking sometime and the WGB does not associate while it is in the coverage area, issue this command:

show client detail

Provide us with the output of the above command. that will possibly point a finger to where the issue resides.

Regards,

Amjad

Rating useful replies is more useful than saying "Thank you"

View solution in original post

Amjad Abdullah · ‎01-15-2013

Hi Abmas,

First, what is the exact security configuration on the controller's SSID? Are you have bot WPA and WPA2 enabled on the controller with both TKIP and AES enabed? I see you only have WPA-TKIP configured on the WGB.

I would suggest that you give a look into the controller and see what is the status of the WGB there.

In controller's CLI you can also enabled debugs to see the process of the associatoin of the WGB.

Enable the following debugs on the WLC CLI and let the WGB try again to enter the coverage area:

debug client .

After taking sometime and the WGB does not associate while it is in the coverage area, issue this command:

show client detail

Provide us with the output of the above command. that will possibly point a finger to where the issue resides.

Regards,

Amjad

Rating useful replies is more useful than saying "Thank you"

Abmas Sidi · ‎01-23-2013

Hi Amjad,

On the controller's SSID security conf, I've only enabled WPA-TKIP.

Also folowing your instruactions, I've enabled debugging on the WLC CLI for the concerned WGB. Here are the outputs of the "show client detail " command.

1- First output : the WGB is in the WiFi coverage area and it's successfully associated to the (root) AP.

2 - Second Output : the WGB came back to in the WiFi coverage area and it's NOT associated anymore to the (root) AP. After a while the output of the command is "Invalid Client MAC address provided".

Hope those outputs let you known the source of my problem.

Once again many thanks.

Abmas

1- First output : the WGB is in the WiFi coverage area and it's successfully associated to the (root) AP

==========================================================================

(Cisco Controller) >debug client

(Cisco Controller) >show client detail

Client MAC Address...............................

Client Username ................................. N/A

AP MAC Address...................................

AP Name..........................................

Client State..................................... Associated

Client NAC OOB State............................. Access

Workgroup Bridge................................. 2 client(s)

Wireless LAN Id.................................. 3

BSSID............................................

Connected For ................................... 221 secs

Channel.......................................... 1

IP Address.......................................

Association Id................................... 2

Authentication Algorithm......................... Open System

Reason Code...................................... 1

Status Code...................................... 0

Session Timeout.................................. 1800

Client CCX version............................... 1

QoS Level........................................ Silver

802.1P Priority Tag.............................. disabled

WMM Support...................................... Enabled

Power Save....................................... OFF

--More-- or (q)uit

Current Rate..................................... 11.0

Supported Rates.................................. 1.0,2.0,5.5,11.0,6.0,9.0,

............................................. 12.0,18.0,24.0,36.0,48.0

Mobility State................................... Local

Mobility Move Count.............................. 0

Security Policy Completed........................ Yes

Policy Manager State............................. RUN

Policy Manager Rule Created...................... Yes

ACL Name......................................... none

ACL Applied Status............................... Unavailable

Policy Type...................................... WPA1

Authentication Key Management.................... PSK

Encryption Cipher................................ TKIP-MIC

Management Frame Protection...................... No

EAP Type......................................... Unknown

Interface........................................ vlanXX

VLAN............................................. XX

Quarantine VLAN.................................. 0

Access VLAN...................................... XX

Client Capabilities:

CF Pollable................................ Not implemented

CF Poll Request............................ Not implemented

Short Preamble............................. Implemented

--More-- or (q)uit

PBCC....................................... Not implemented

Channel Agility............................ Not implemented

Listen Interval............................ 200

Fast BSS Transition........................ Not implemented

Fast BSS Transition Details:

Client Statistics:

Number of Bytes Received................... 38701

Number of Bytes Sent....................... 8473

Number of Packets Received................. 278

Number of Packets Sent..................... 33

Number of EAP Id Request Msg Timeouts...... 0

Number of EAP Request Msg Timeouts......... 0

Number of EAP Key Msg Timeouts............. 0

Number of Data Retries..................... 32

Number of RTS Retries...................... 0

Number of Duplicate Received Packets....... 13

Number of Decrypt Failed Packets........... 0

Number of Mic Failured Packets............. 0

Number of Mic Missing Packets.............. 0

Number of Policy Errors.................... 0

Radio Signal Strength Indicator............ -87 dBm

Signal to Noise Ratio...................... 10 dB

Nearby AP Statistics:

--More-- or (q)uit

(slot 0) .................

antenna0: 10 seconds ago -86 dBm................. antenna1: 10 seconds ago -83 dBm

(Cisco Controller) >

======================================================================================

2 - Second Output :the WGB came back to in the WiFi coverage area and it's NOT associated anymore to the (root) AP.

======================================================================================

(Cisco Controller) >show client detail

Client MAC Address...............................

Client Username ................................. N/A

AP MAC Address...................................

AP Name..........................................

Client State..................................... Associated

Client NAC OOB State............................. Access

Workgroup Bridge................................. 2 client(s)

Wireless LAN Id.................................. 3

BSSID............................................

Connected For ................................... 880 secs

Channel.......................................... 1

IP Address.......................................

Association Id................................... 2

Authentication Algorithm......................... Open System

Reason Code...................................... 1

Status Code...................................... 0

Session Timeout.................................. 1800

Client CCX version............................... 1

QoS Level........................................ Silver

802.1P Priority Tag.............................. disabled

WMM Support...................................... Enabled

Power Save....................................... OFF

--More-- or (q)uit

Current Rate..................................... 48.0

Supported Rates.................................. 1.0,2.0,5.5,11.0,6.0,9.0,

............................................. 12.0,18.0,24.0,36.0,48.0

Mobility State................................... Local

Mobility Move Count.............................. 0

Security Policy Completed........................ Yes

Policy Manager State............................. RUN

Policy Manager Rule Created...................... Yes

ACL Name......................................... none

ACL Applied Status............................... Unavailable

Policy Type...................................... WPA1

Authentication Key Management.................... PSK

Encryption Cipher................................ TKIP-MIC

Management Frame Protection...................... No

EAP Type......................................... Unknown

Interface........................................ vlanXX

VLAN............................................. XX

Quarantine VLAN.................................. 0

Access VLAN...................................... XX

Client Capabilities:

CF Pollable................................ Not implemented

CF Poll Request............................ Not implemented

Short Preamble............................. Implemented

--More-- or (q)uit

PBCC....................................... Not implemented

Channel Agility............................ Not implemented

Listen Interval............................ 200

Fast BSS Transition........................ Not implemented

Fast BSS Transition Details:

Client Statistics:

Number of Bytes Received................... 75003

Number of Bytes Sent....................... 12486

Number of Packets Received................. 852

Number of Packets Sent..................... 48

Number of EAP Id Request Msg Timeouts...... 0

Number of EAP Request Msg Timeouts......... 0

Number of EAP Key Msg Timeouts............. 0

Number of Data Retries..................... 125

Number of RTS Retries...................... 0

Number of Duplicate Received Packets....... 19

Number of Decrypt Failed Packets........... 0

Number of Mic Failured Packets............. 0

Number of Mic Missing Packets.............. 0

Number of Policy Errors.................... 0

Radio Signal Strength Indicator............ -88 dBm

Signal to Noise Ratio...................... 69 dB

Nearby AP Statistics:

--More-- or (q)uit

(slot 0) .................

antenna0: 0 seconds ago -92 dBm.................. antenna1: 0 seconds ago -92 dBm

(slot 0) .................

antenna0: 1 seconds ago -92 dBm.................. antenna1: 1 seconds ago -93 dBm

(Cisco Controller) >

======================================================================================

Abmas Sidi · ‎02-01-2013

Can anyone help us ?

Thanks.

Abmas

Amjad Abdullah · ‎02-02-2013

Hello Ambas,

Both output show that WGS is OK! actually the command output while the WGB is not supposed to be working shows that the WGB in good status!!

Can you please allow sometime after the WGB enters the area again before taking the output?

Also, there is no debug output! can you please enable the debug client again and collect the output? I can see no output from the above.

One quick quesion: are we sure that the WGB leaves the covered area completely? i.e. are the radio interface on the WGB become in down status before it come back to the coverage again?

Regards,

Amjad

Rating useful replies is more useful than saying "Thank you"

Abmas Sidi · ‎02-05-2013

Hi Amjad,

- When I allow a while after the WGB enters the WiFi area, the output of the

show client detail is : "Invalide client MAC address provided".

Indeed the MAC address of the WGB is no longer in the list of the associated clients on the WLC.

- Yes I am sure that the WGB leaves completely the area. During the bus movement (leaving the area), I launch a continous ping from my laptop (connected to the LAN side of the WGB) to Server (connected to the LAN side of the Root AP). And ping starts failing once the bus is outside of the WiFi area. At that time I check the WGB Radio interface status and it's Down. Coming back to the WiFi area, it reamains Down.

I took two (2) Debug Outputs.

- First one : The WGB is in the WiFi area (associated)

- Second one :The WGB has left the WiFi area (disassociated)

====== First output : The WGB is in the WiFi area (associated) =======================

*pemReceiveTask: Feb 04 15:15:22.322: Removed NPU entry.

*apfMsConnTask_0: Feb 04 15:15:22.322: AUTHCHECK (2) Change state to 8021X_REQD (3) last state RUN (20)

*apfMsConnTask_0: Feb 04 15:15:22.322: 8021X_REQD (3) DHCP required on AP vapId 3 apVapId 3for this client

*apfMsConnTask_0: Feb 04 15:15:22.322: Not Using WMM Compliance code qosCap 00

*apfMsConnTask_0: Feb 04 15:15:22.322: 8021X_REQD (3) Plumbed mobile LWAPP rule on AP vapId 3 apVapId 3

*apfMsConnTask_0: Feb 04 15:15:22.322: apfPemAddUser2 (apf_policy.c:223) Changing state for mobile on AP from Associated to Associated

*apfMsConnTask_0: Feb 04 15:15:22.322: Scheduling deletion of Mobile Station: (callerId: 49) in 1800 seconds

*apfMsConnTask_0: Feb 04 15:15:22.322: Sending Assoc Response to station on BSSID (status 0) ApVapId 3 Slot 0

*apfMsConnTask_0: Feb 04 15:15:22.322: apfProcessAssocReq (apf_80211.c:5241) Changing state for mobile on AP from Associated to Associated

*dot1xMsgTask: Feb 04 15:15:22.324: Creating a PKC PMKID Cache entry for station (RSN 0)

*dot1xMsgTask: Feb 04 15:15:22.324: Initiating WPA PSK to mobile

*dot1xMsgTask: Feb 04 15:15:22.324: dot1x - moving mobile into Force Auth state

*dot1xMsgTask: Feb 04 15:15:22.324: Skipping EAP-Success to mobile

*dot1xMsgTask: Feb 04 15:15:22.324: Starting key exchange to mobile , data packets will be dropped

*dot1xMsgTask: Feb 04 15:15:22.324: Sending EAPOL-Key Message to mobile

state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.331: Received EAPOL-Key from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.331: Received EAPOL-key in PTK_START state (message 2) from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.331: Stopping retransmission timer for mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.331: Sending EAPOL-Key Message to mobile

state PTKINITNEGOTIATING (message 3), replay counter 00.00.00.00.00.00.00.01

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.335: Received EAPOL-Key from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.335: Received EAPOL-key in PTKINITNEGOTIATING state (message 4) from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.335: apfMs1xStateInc

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.335: 8021X_REQD (3) Change state to L2AUTHCOMPLETE (4) last state RUN (20)

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.335: L2AUTHCOMPLETE (4) DHCP required on AP vapId 3 apVapId 3for this client

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.335: Not Using WMM Compliance code qosCap 00

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP vapId 3 apVapId 3

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: apfMsRunStateInc

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: L2AUTHCOMPLETE (4) Change state to RUN (20) last state RUN (20)

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: RUN (20) Reached PLUMBFASTPATH: from line 4864

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: RUN (20) Adding Fast Path rule

type = Airespace AP Client

on AP , slot 0, interface = 1, QOS = 0

ACL Id = 255, Jumbo Frames = NO

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: RUN (20) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 7006 IPv6 Vlan = 99, IPv6 intf id = 14

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: RUN (20) Successfully plumbed mobile rule (ACL ID 255)

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: Stopping retransmission timer for mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: Key exchange done, data packets from mobile should be forwarded shortly

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.336: Sending EAPOL-Key Message to mobile

state PTKINITDONE (message 5 - group), replay counter 00.00.00.00.00.00.00.02

*pemReceiveTask: Feb 04 15:15:22.336: Added NPU entry of type 1, dtlFlags 0x0

*spamApTask0: Feb 04 15:15:22.336: Sent EAPOL-Key M5 for mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.345: Received EAPOL-Key from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.345: Received EAPOL-key in REKEYNEGOTIATING state (message 6) from mobile

66*Dot1x_NW_MsgTask_6: Feb 04 15:15:22.345: Stopping retransmission timer for mobile

*apfMsConnTask_0: Feb 04 15:16:08.174: Reassociation received from mobile on AP

*apfMsConnTask_0: Feb 04 15:16:08.174: Received association request from a work-group bridge (WGB)!

*apfMsConnTask_0: Feb 04 15:16:08.174: RUN (20) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1621)

*apfMsConnTask_0: Feb 04 15:16:08.174: Applying site-specific IPv6 override for station - vapId 3, site 'default-group', interface 'vlan99'

*apfMsConnTask_0: Feb 04 15:16:08.174: Applying IPv6 Interface Policy for station - vlan 99, interface id 14, interface 'vlan99'

*apfMsConnTask_0: Feb 04 15:16:08.174: STA - rates (8): 130 132 139 12 18 150 24 36 48 72 96 0 0 0 0 0

*apfMsConnTask_0: Feb 04 15:16:08.174: STA - rates (11): 130 132 139 12 18 150 24 36 48 72 96 0 0 0 0 0

*apfMsConnTask_0: Feb 04 15:16:08.174: Processing WPA IE type 221, length 24 for mobile

*apfMsConnTask_0: Feb 04 15:16:08.174: apfMsRunStateDec

*apfMsConnTask_0: Feb 04 15:16:08.174: apfMs1xStateDec

*apfMsConnTask_0: Feb 04 15:16:08.174: RUN (20) Change state to START (0) last state RUN (20)

*apfMsConnTask_0: Feb 04 15:16:08.174: START (0) Initializing policy

*apfMsConnTask_0: Feb 04 15:16:08.174: START (0) Change state to AUTHCHECK (2) last state RUN (20)

*apfMsConnTask_0: Feb 04 15:16:08.175: AUTHCHECK (2) Change state to 8021X_REQD (3) last state RUN (20)

*pemReceiveTask: Feb 04 15:16:08.175: Removed NPU entry.

*apfMsConnTask_0: Feb 04 15:16:08.175: 8021X_REQD (3) DHCP required on AP vapId 3 apVapId 3for this client

*apfMsConnTask_0: Feb 04 15:16:08.175: Not Using WMM Compliance code qosCap 00

*apfMsConnTask_0: Feb 04 15:16:08.175: 8021X_REQD (3) Plumbed mobile LWAPP rule on AP vapId 3 apVapId 3

*apfMsConnTask_0: Feb 04 15:16:08.175: apfPemAddUser2 (apf_policy.c:223) Changing state for mobile on AP from Associated to Associated

*apfMsConnTask_0: Feb 04 15:16:08.175: Scheduling deletion of Mobile Station: (callerId: 49) in 1800 seconds

*apfMsConnTask_0: Feb 04 15:16:08.175: Sending Assoc Response to station on BSSID (status 0) ApVapId 3 Slot 0

*apfMsConnTask_0: Feb 04 15:16:08.175: apfProcessAssocReq (apf_80211.c:5241) Changing state for mobile on AP from Associated to Associated

*dot1xMsgTask: Feb 04 15:16:08.177: Creating a PKC PMKID Cache entry for station (RSN 0)

*dot1xMsgTask: Feb 04 15:16:08.177: Initiating WPA PSK to mobile

*dot1xMsgTask: Feb 04 15:16:08.177: dot1x - moving mobile into Force Auth state

*dot1xMsgTask: Feb 04 15:16:08.177: Skipping EAP-Success to mobile

*dot1xMsgTask: Feb 04 15:16:08.177: Starting key exchange to mobile , data packets will be dropped

*dot1xMsgTask: Feb 04 15:16:08.177: Sending EAPOL-Key Message to mobile

state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.185: Received EAPOL-Key from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.185: Received EAPOL-key in PTK_START state (message 2) from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.185: Stopping retransmission timer for mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.185: Sending EAPOL-Key Message to mobile

state PTKINITNEGOTIATING (message 3), replay counter 00.00.00.00.00.00.00.01

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.189: Received EAPOL-Key from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.189: Received EAPOL-key in PTKINITNEGOTIATING state (message 4) from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: apfMs1xStateInc

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: 8021X_REQD (3) Change state to L2AUTHCOMPLETE (4) last state RUN (20)

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: L2AUTHCOMPLETE (4) DHCP required on AP vapId 3 apVapId 3for this client

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: Not Using WMM Compliance code qosCap 00

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP vapId 3 apVapId 3

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: apfMsRunStateInc

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: L2AUTHCOMPLETE (4) Change state to RUN (20) last state RUN (20)

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: RUN (20) Reached PLUMBFASTPATH: from line 4864

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: RUN (20) Adding Fast Path rule

type = Airespace AP Client

on AP , slot 0, interface = 1, QOS = 0

ACL Id = 255, Jumbo Frames = NO

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: RUN (20) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 7006 IPv6 Vlan = 99, IPv6 intf id = 14

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: RUN (20) Successfully plumbed mobile rule (ACL ID 255)

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: Stopping retransmission timer for mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: Key exchange done, data packets from mobile should be forwarded shortly

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.190: Sending EAPOL-Key Message to mobile

state PTKINITDONE (message 5 - group), replay counter 00.00.00.00.00.00.00.02

*pemReceiveTask: Feb 04 15:16:08.190: Added NPU entry of type 1, dtlFlags 0x0

*spamApTask0: Feb 04 15:16:08.192: Sent EAPOL-Key M5 for mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.201: Received EAPOL-Key from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.201: Received EAPOL-key in REKEYNEGOTIATING state (message 6) from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:16:08.201: Stopping retransmission timer for mobile

====== Second one :The WGB has left the WiFi area (disassociated) ==================

EAP Type......................................... Unknown

Interface........................................ vlan99

VLAN............................................. 99

Quarantine VLAN.................................. 0

Access VLAN...................................... 99

Client Capabilities:

CF Pollable................................ Not implemented

CF Poll Request............................ Not implemented

Short Preamble............................. Implemented

--More-- or (q)uit

PBCC....................................... Not implemented

Channel Agility............................ Not implemented

Listen Interval............................ 200

Fast BSS Transition........................ Not implemented

Fast BSS Transition Details:

Client Statistics:

Number of Bytes Received................... 198314

Number of Bytes Sent....................... 29425

Number of Packets Received................. 1601

Number of Packets Sent..................... 120

Number of EAP Id Request Msg Timeouts...... 0

Number of EAP Request Msg Timeouts......... 0

Number of EAP Key Msg Timeouts............. 0

Number of Data Retries..................... 71

Number of RTS Retries...................... 0

Number of Duplicate Received Packets....... 116

Number of Decrypt Failed Packets........... 0

Number of Mic Failured Packets............. 0

Number of Mic Missing Packets.............. 0

Number of Policy Errors.................... 0

Radio Signal Strength Indicator............ -92 dBm

Signal to Noise Ratio...................... 5 dB

Nearby AP Statistics:

--More-- or (q)uit

CGJP-WiFi-0006-En(slot 0) .................

antenna0: 1 seconds ago -91 dBm.................. antenna1: 1 seconds ago -94 dBm

CGNO-WiFi-0004-Pl(slot 0) .................

antenna0: 142 seconds ago -93 dBm................ antenna1: 142 seconds ago -92 dBm

(Cisco Controller) >debug client

(Cisco Controller) >show client detail

Client MAC Address...............................

Client Username ................................. N/A

AP MAC Address...................................

AP Name.......................................... CGJP-WiFi-0006-Entretien

Client State..................................... Associated

Client NAC OOB State............................. Access

Workgroup Bridge................................. 2 client(s)

Wireless LAN Id.................................. 3

BSSID............................................

Connected For ................................... 135 secs

Channel.......................................... 1

IP Address.......................................

Association Id................................... 67

Authentication Algorithm......................... Open System

Reason Code...................................... 1

Status Code...................................... 0

Session Timeout.................................. 1800

Client CCX version............................... 1

QoS Level........................................ Silver

802.1P Priority Tag.............................. disabled

WMM Support...................................... Enabled

Power Save....................................... OFF

--More-- or (q)uit

Current Rate..................................... 5.5

Supported Rates.................................. 1.0,2.0,5.5,11.0,6.0,9.0,

............................................. 12.0,18.0,24.0,36.0,48.0

Mobility State................................... Local

Mobility Move Count.............................. 0

Security Policy Completed........................ Yes

Policy Manager State............................. RUN

Policy Manager Rule Created...................... Yes

ACL Name......................................... none

ACL Applied Status............................... Unavailable

Policy Type...................................... WPA1

Authentication Key Management.................... PSK

Encryption Cipher................................ TKIP-MIC

Management Frame Protection...................... No

EAP Type......................................... Unknown

Interface........................................ vlan99

VLAN............................................. 99

Quarantine VLAN.................................. 0

Access VLAN...................................... 99

Client Capabilities:

CF Pollable................................ Not implemented

CF Poll Request............................ Not implemented

Short Preamble............................. Implemented

--More-- or (q)uit*apfMsConnTask_0: Feb 04 15:17:38.555: Deleting the client immediatly since WLAN is changed

*apfMsConnTask_0: Feb 04 15:18:30.565: Reassociation received from mobile on AP

*apfMsConnTask_0: Feb 04 15:18:30.565: Received association request from a work-group bridge (WGB)!

*apfMsConnTask_0: Feb 04 15:18:30.565: RUN (20) Changing ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:1621)

*apfMsConnTask_0: Feb 04 15:18:30.565: Applying site-specific IPv6 override for station - vapId 3, site 'default-group', interface 'vlan99'

*apfMsConnTask_0: Feb 04 15:18:30.565: Applying IPv6 Interface Policy for station - vlan 99, interface id 14, interface 'vlan99'

*apfMsConnTask_0: Feb 04 15:18:30.565: STA - rates (8): 130 132 139 12 18 150 24 36 48 72 96 0 0 0 0 0

*apfMsConnTask_0: Feb 04 15:18:30.565: STA - rates (11): 130 132 139 12 18 150 24 36 48 72 96 0 0 0 0 0

*apfMsConnTask_0: Feb 04 15:18:30.565: Processing WPA IE type 221, length 24 for mobile

*apfMsConnTask_0: Feb 04 15:18:30.566: apfMsRunStateDec

*apfMsConnTask_0: Feb 04 15:18:30.566: apfMs1xStateDec

*apfMsConnTask_0: Feb 04 15:18:30.566: RUN (20) Change state to START (0) last state RUN (20)

*apfMsConnTask_0: Feb 04 15:18:30.566: START (0) Initializing policy

*apfMsConnTask_0: Feb 04 15:18:30.566: START (0) Change state to AUTHCHECK (2) last state RUN (20)

*apfMsConnTask_0: Feb 04 15:18:30.566: AUTHCHECK (2) Change state to 8021X_REQD (3) last state RUN (20)

*pemReceiveTask: Feb 04 15:18:30.566: Removed NPU entry.

*apfMsConnTask_0: Feb 04 15:18:30.566: 8021X_REQD (3) DHCP required on AP vapId 3 apVapId 3for this client

*apfMsConnTask_0: Feb 04 15:18:30.566: Not Using WMM Compliance code qosCap 00

*apfMsConnTask_0: Feb 04 15:18:30.566: 8021X_REQD (3) Plumbed mobile LWAPP rule on AP vapId 3 apVapId 3

*apfMsConnTask_0: Feb 04 15:18:30.566: apfPemAddUser2 (apf_policy.c:223) Changing state for mobile on AP from Associated to Associated

*apfMsConnTask_0: Feb 04 15:18:30.566: Scheduling deletion of Mobile Station: (callerId: 49) in 1800 seconds

*apfMsConnTask_0: Feb 04 15:18:30.566: Sending Assoc Response to station on BSSID (status 0) ApVapId 3 Slot 0

*apfMsConnTask_0: Feb 04 15:18:30.566: apfProcessAssocReq (apf_80211.c:5241) Changing state for mobile on AP from Associated to Associated

*dot1xMsgTask: Feb 04 15:18:30.568: Creating a PKC PMKID Cache entry for station (RSN 0)

*dot1xMsgTask: Feb 04 15:18:30.568: Initiating WPA PSK to mobile

*dot1xMsgTask: Feb 04 15:18:30.568: dot1x - moving mobile into Force Auth state

*dot1xMsgTask: Feb 04 15:18:30.569: Skipping EAP-Success to mobile

*dot1xMsgTask: Feb 04 15:18:30.569: Starting key exchange to mobile , data packets will be dropped

*dot1xMsgTask: Feb 04 15:18:30.569: Sending EAPOL-Key Message to mobile

state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.578: Received EAPOL-Key from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.578: Received EAPOL-key in PTK_START state (message 2) from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.578: Stopping retransmission timer for mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.578: Sending EAPOL-Key Message to mobile

state PTKINITNEGOTIATING (message 3), replay counter 00.00.00.00.00.00.00.01

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.583: Received EAPOL-Key from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.583: Received EAPOL-key in PTKINITNEGOTIATING state (message 4) from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.583: apfMs1xStateInc

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.583: 8021X_REQD (3) Change state to L2AUTHCOMPLETE (4) last state RUN (20)

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: L2AUTHCOMPLETE (4) DHCP required on AP vapId 3 apVapId 3for this client

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: Not Using WMM Compliance code qosCap 00

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP vapId 3 apVapId 3

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: apfMsRunStateInc

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: L2AUTHCOMPLETE (4) Change state to RUN (20) last state RUN (20)

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: RUN (20) Reached PLUMBFASTPATH: from line 4864

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: RUN (20) Adding Fast Path rule

type = Airespace AP Client

on AP , slot 0, interface = 1, QOS = 0

ACL Id = 255, Jumbo Frames = NO

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: RUN (20) Fast Path rule (contd...) 802.1P = 0, DSCP = 0, TokenID = 7006 IPv6 Vlan = 99, IPv6 intf id = 14

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: RUN (20) Successfully plumbed mobile rule (ACL ID 255)

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: Stopping retransmission timer for mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: Key exchange done, data packets from mobile should be forwarded shortly

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.584: Sending EAPOL-Key Message to mobile

state PTKINITDONE (message 5 - group), replay counter 00.00.00.00.00.00.00.02

*pemReceiveTask: Feb 04 15:18:30.584: Added NPU entry of type 1, dtlFlags 0x0

*spamApTask0: Feb 04 15:18:30.585: Sent EAPOL-Key M5 for mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.594: Received EAPOL-Key from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.594: Received EAPOL-key in REKEYNEGOTIATING state (message 6) from mobile

*Dot1x_NW_MsgTask_6: Feb 04 15:18:30.594: Stopping retransmission timer for mobile

Hope the will help you to debug.

Best regards.

Abmas

adriansoh83 · ‎02-02-2013

Try the following WGB timer changes:

mobile station scan 1 6 11 ! note this should align with the available channels on WLC.

mobile station period 2 threshold 75

mobile station minimum-rate 6.0

Issue may be related to 1300 not resetting interface after so many association failures..

What does debug - debug dot11 dot11 0 trace print uplink - show?

Abmas Sidi · ‎02-06-2013

Hi Adrian,

I issued the following commands :

AP1300_1(config)# int d0

AP1300_1(config-if)# mobile station period 2 threshold 75

I can only issue "mobile station period 2 threshold 75". I can not have other option than "period" in the "mobile station .... "

like "mobile station scan ..." or "mobile station minimum-rate ...."

Best regards.

Abmas

adriansoh83 · ‎02-06-2013

show version?

From memory, the latest IOS ver is 12.4.25d. The prevoius ver 12.4.10b may not have additional WGB mobile station comands.

Some links I found for you...

Hope this helps

Adrian.