Wireless Connection issues

[alex-cooney]

Site with a 3 months old Cisco Catalyst 9800-L Wireless Controller installed, S/W version 17.9.5. Using 10 x CW9162I-Z Access Points, 3 SSIDs using 2.4 & 5GHz range

Since installation, most devices will need multiple attempts to connect to wifi. Enter password, will just come back & say some variation of 'Could Not Connect'. After trying anywhere from 3-10 times, it will eventually connect & will work fine after that.

Happens on computers (Windows & Mac), phones, tablets, on multiple Access Points. Most of the troubleshooting I can find relates to the devices not being able to connect at all. I inherited this setup, so am not super-familiar with Ciso interfaces. Site is remote, so have not been able to get there to try power-cycling access points (or controller)

[ammahend]

How did you conclude this ? "Most of the troubleshooting I can find relates to the devices not being able to connect at all"

to start with not a bad idea to run config through analyzer to see if something stands out

 https://community.cisco.com/t5/wireless-mobility-knowledge-base/wlc-config-analyzer/ta-p/3119057

also run controller basic KPI checks.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html

More specific to the issue, you need to do a capture an over the air capture (assuming you are not encrypting management frames) , this will give more details on if the failure is at L2 if not then for higher layer you can do capture on controller itself (assuming you are centralized).  follow this document for capture, reproduce the issue and share the capture as well as radio active trace for the client .

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-mobility/217042-collect-packet-captures-over-the-air-on.html

[alex-cooney]

Ammahend, I will look into these, but it's starting to get outside of my knowledge base.

[Leo Laohoo]

Reboot the APs.

[alex-cooney]

Thanks Leo. Probably a silly question - will this one restart, or reset (wipe), the AP? I know a lot of places use these words interchangeably, so never sure which way it will go!

[Rich R]

That will reload the AP @alex-cooney 
On CLI: ap name <ap-name> reset
And to do a CAPWAP restart (without reloading): ap name <ap-name> reset capwap

[TTA]

Rich,

Thanks for that. Sorry to probably ask the obvious, but I am looking to just restart the AP (same as turning it off & back on) rather than wipe the configuration.
From what I can see, the command ap name <ap-name> reset will wipe the config, rather than just restart the AP? Someone mentioned the ap boot command, but that doesn't seem to be an option in ssh/cli

Thanks for that. Sorry to 

[Rich R]

No problem - that's why I said it will reload the AP (reload in Cisco speak is reboot) - normally the same as power cycling the box.  A CAPWAP restart does not reload the device - it just re-initialises the CAPWAP connection to the controller and will then pick up new settings etc (and clear some bugs).

Wiping the config = factory default reset which is a different command.
9800#clear ap config <apname> ?
chassis Chassis
eventlog Clear the event log contents on Cisco AP(s)
keep-ip-config Do not erase the static IP configuration of the Cisco AP
<cr> <cr>

[marce1000]

 - Start with a checkup of the 9800-L controller's configuration using the CLI command show tech wireless
   (not 'show tech' )and feed the output from that into Wireless Config Analyzer

   + Use full client debugging for problematic clients according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity , these debugs can be analyzed with Wireless Debug Analyzer

  +    Outputs from the commands mentioned in https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5  may also help to get additional insights

 + Since 17.9.x is now EOL , consider upgrading to 17.12.3 (latest advisory)

 M.

[JPavonM]

- Check how it looks like by setting your production SSID to only broadcast in one band (I have seen some devices continuosly roaming between bands during negotiation)
- Disable vendor features like band select or load balance in the WLAN settings.
- If using fast roaming disable it to see how it looks like (802.11r).
- Check how it looks like by lowering the security settings. (If you are using WPA3 like features, disable them: wpa3, dot11w, sha-256)
- Check your devices have the latest OS patches and wNIC drivers.
- Check there is no radio interference in the channels your APs are operating. (even check for DFS events in the vicinity)
- Less probable but still possible, check you're not impacted by a DoS attacks llike deauth or disassociation floods. (perform a packet capture in some channels your APs are operating and look for tons of these packets)

[Rich R]

As already mentioned you should seriously consider upgrading the software version as per TAC recommended list (below).

How is your WLAN configured?
What authentication is it using?

What you're describing can also be a symptom of misconfigured radius CoA so the CoA from radius server cannot update the WLC on client authentication status dynamically.

[TTA]

We've managed to get a remote restart of the AP done, & so far it seems stable. Will test it over the next few days, & come back if problems persist. Thanks for all the advice