done the cotroler check and this is the output, is there anything obvious causing my issue
WLC Config Analyzer - Report
Controller Messages
MartyNet-WiFi
10023,Parsing error catch while generating WLANs per AP slot.
10011,Error parsing AP Groups, 5 GHz band..................
10011,Error parsing AP Groups, Capwap Prefer Mode....
10023,Parsing error catch while generating WLANs per AP slot.
10011,Error parsing RF Profiles. Line Transmit Power Threshold v1
10011,Error parsing RF Profiles. Line 802.11g 54M Rate...................
10011,Error parsing RF Profiles. Line 802.11b/g 1M Rate..............
10019,General: Error while parsing, Duplicated AP name:isco AP Name...................
30111,General: It is recommended to have the DHCP proxy enabled.
30057,General: Disabling low data rates/11b can help to optimize the channel utilization on the 2.4 band. Depending on RF coverage, or if using legacy clients, this may cause problems. Please validate before enforcing the changes, as this may have important RF dependencies. Global Configuration
30057,General: Disabling low data rates/11b can help to optimize the channel utilization on the 2.4 band. Depending on RF coverage, or if using legacy clients, this may cause problems. Please validate before enforcing the changes, as this may have important RF dependencies.. For RF Profile: Low-Client-Density-802.11bg
30064,General: EAPoL request timeout larger than 400ms. EAP key requests may benefit for faster recovery, and better behavior on bad RF, by using higher counts, lower retry timeout. Please validate on your specific client types before enforcing the changes
30065,General: EAP request retries lower than 3. EAP requests may benefit for faster recovery, and better behavior on bad RF, by using higher counts, lower retry timeout. Please validate on your specific client types before enforcing the changes
30067,General: Minimum Rogue RSSI detection threshold should be set to -80 or higher, unless mandated by your security policies. Current Value: -90
30101,General: Detected channels on band 100-140 as not in use for DCA. If country regulations allows it, it is advisable to enable to improve channel distribution on 802.11a band
120003,Security: It is recommended to monitor all channels for rogue detection. Band:5 GHz
120003,Security: It is recommended to monitor all channels for rogue detection. Band:2.4 GHz
120009,Security: it is recommended to set a CPU ACL, to control the management access to the controller
120015,Security: HTTP access to management is enabled, it is recommended to only allow https for security reasons
120016,Security: High encryption for management is not enabled
120001,Security: It is recommended to disable Management over wireless for security reasons
120013,Security: Minimum management password length should be 8 or higher
110011,BYOD: It is recommended to have EAPOL Request Timeout less than 3 seconds.
10011,Exception catch parsing file . Partially missing configuration for AP: Kitchen-AP
10011,Exception catch parsing file . Partially missing configuration for AP: isco AP Name...................
120012,Security: it is recommended to set policy to reject WiFi Direct clients for security purposes. Be aware this will impact association on some smartphone models. WLAN:MartyNet
110001,BYOD: Radius NAC should be enabled to allow Radius Change of Authorization between ISE and WLC. WLAN: 1
110002,BYOD: MAC filter is recommended to enable. WLAN: 1
110003,BYOD: AAA override is recommended to enable. WLAN: 1
110005,BYOD: Longer session timeout is better for AAA load up to a value of 86400 seconds for 802.1x SSIDs or 65535 seconds for open/CWA SSIDs, shorter is better from security point of view. Do not leave the session timeout unset as ISE will remove ''inactive sessions'' after 5 days leading to a possible session miss-match between ISE and the WLC for long lasting connections. WLAN: 1
110006,BYOD: Interim Accounting should be disabled to prevent unneeded accounting load on ISE Exception is for ISPs, which provide tracking on byte based services. WLAN: 1
110008,BYOD: Recommended Client Exclusion value with ISE is 180 sec, to prevent misconfigured clients cause intensive radius traffic for ISE. WLAN: 1
110001,BYOD: Radius NAC should be enabled to allow Radius Change of Authorization between ISE and WLC. WLAN: 2
110002,BYOD: MAC filter is recommended to enable. WLAN: 2
110003,BYOD: AAA override is recommended to enable. WLAN: 2
110005,BYOD: Longer session timeout is better for AAA load up to a value of 86400 seconds for 802.1x SSIDs or 65535 seconds for open/CWA SSIDs, shorter is better from security point of view. Do not leave the session timeout unset as ISE will remove ''inactive sessions'' after 5 days leading to a possible session miss-match between ISE and the WLC for long lasting connections. WLAN: 2
110006,BYOD: Interim Accounting should be disabled to prevent unneeded accounting load on ISE Exception is for ISPs, which provide tracking on byte based services. WLAN: 2
110008,BYOD: Recommended Client Exclusion value with ISE is 180 sec, to prevent misconfigured clients cause intensive radius traffic for ISE. WLAN: 2
120012,Security: it is recommended to set policy to reject WiFi Direct clients for security purposes. Be aware this will impact association on some smartphone models. WLAN:KidsNet
110001,BYOD: Radius NAC should be enabled to allow Radius Change of Authorization between ISE and WLC. WLAN: 3
110002,BYOD: MAC filter is recommended to enable. WLAN: 3
110003,BYOD: AAA override is recommended to enable. WLAN: 3
110005,BYOD: Longer session timeout is better for AAA load up to a value of 86400 seconds for 802.1x SSIDs or 65535 seconds for open/CWA SSIDs, shorter is better from security point of view. Do not leave the session timeout unset as ISE will remove ''inactive sessions'' after 5 days leading to a possible session miss-match between ISE and the WLC for long lasting connections. WLAN: 3
110006,BYOD: Interim Accounting should be disabled to prevent unneeded accounting load on ISE Exception is for ISPs, which provide tracking on byte based services. WLAN: 3
110008,BYOD: Recommended Client Exclusion value with ISE is 180 sec, to prevent misconfigured clients cause intensive radius traffic for ISE. WLAN: 3
120012,Security: it is recommended to set policy to reject WiFi Direct clients for security purposes. Be aware this will impact association on some smartphone models. WLAN:IoT
110001,BYOD: Radius NAC should be enabled to allow Radius Change of Authorization between ISE and WLC. WLAN: 4
110002,BYOD: MAC filter is recommended to enable. WLAN: 4
110003,BYOD: AAA override is recommended to enable. WLAN: 4
110005,BYOD: Longer session timeout is better for AAA load up to a value of 86400 seconds for 802.1x SSIDs or 65535 seconds for open/CWA SSIDs, shorter is better from security point of view. Do not leave the session timeout unset as ISE will remove ''inactive sessions'' after 5 days leading to a possible session miss-match between ISE and the WLC for long lasting connections. WLAN: 4
110006,BYOD: Interim Accounting should be disabled to prevent unneeded accounting load on ISE Exception is for ISPs, which provide tracking on byte based services. WLAN: 4
110008,BYOD: Recommended Client Exclusion value with ISE is 180 sec, to prevent misconfigured clients cause intensive radius traffic for ISE. WLAN: 4
30081,Enterprise: Aggresive Load Balancing is a recommended best practice for enterprise environments with proper AP density, for local mode APs. Do not use for WLANs with interactive applications (voice/video)
120004,Security: No 802.1x WLAN was detected, it is recommended to use proper authentication for security reasons. This may not be applicable on some deployment models
AP Messages
UpStairs-AP
20024,AP: Missing configuration, information not present in file. Possible corrupted file
20017,AP: Syslog messages are sent to broadcast address, if there are errors reported by many APs, and there are too many APs per vlan, this can cause broadcast storms. For best practices, it is better to configure to individual server
120008,Security: AP Local credentials to access point CLI are not configured. For best security practices, it is desirable to configure to Username/passwords to all APs
20029,AP: TCP-MSS feature should be enabled
120011,Security: if high security is needed, AP should use dot1x authentication towards switch port. AP:UpStairs-AP
60014,RF: AP has channel utilization for 2.4 GHz radio higher than a threshold of 29%. Effect depends on RF conditions
DownStairs-AP
20017,AP: Syslog messages are sent to broadcast address, if there are errors reported by many APs, and there are too many APs per vlan, this can cause broadcast storms. For best practices, it is better to configure to individual server
120008,Security: AP Local credentials to access point CLI are not configured. For best security practices, it is desirable to configure to Username/passwords to all APs
20029,AP: TCP-MSS feature should be enabled
120011,Security: if high security is needed, AP should use dot1x authentication towards switch port. AP:DownStairs-AP
60014,RF: AP has channel utilization for 2.4 GHz radio higher than a threshold of 29%. Effect depends on RF conditions
60005,RF: Interference Profile Failed in radio 2.4GHz, per controller profile settings
Kitchen-AP
20024,AP: Missing configuration, information not present in file. Possible corrupted file
120008,Security: AP Local credentials to access point CLI are not configured. For best security practices, it is desirable to configure to Username/passwords to all APs
20029,AP: TCP-MSS feature should be enabled
isco AP Name...................
20024,AP: Missing configuration, information not present in file. Possible corrupted file
120008,Security: AP Local credentials to access point CLI are not configured. For best security practices, it is desirable to configure to Username/passwords to all APs
20029,AP: TCP-MSS feature should be enabled
Use at your own risk
Report Generated at:11:36:02 20/07/2020
Questions?: WLC Config Analyzer Mail List.
