Hi guys,
I want to track/log successful user connections on our 4402 wlc (OS 4.2 and 7.0) with activating the following "client related" snmp traps:
802.11 Association
802.11 Disassociation
802.11 Deauthentication
Authentication
In the local wlc trap log now I see the following messages for a normal client session:
===
239 Fri Feb 4 12:13:47 2011 Client Association: Client MAC Address:b8:f9:34:73:be:ea, AP Base Radio MAC :00:1f:ca:cc:8a:40, Slot: 0, User Name:unknown
238 Fri Feb 4 12:13:47 2011 Client Authenticated: MAC Address:b8:f9:34:73:be:ea base Radio MAC:00:1f:ca:cc:8a:40 Slot: 0 User Name:unknown IP Addr:10.40.13.205 SSID:test-ssid
232 Fri Feb 4 12:20:07 2011 Client Deauthenticated: Client MAC Address:b8:f9:34:73:be:ea, AP Base Radio MAC:00:1f:ca:cc:8a:40, Slot: 0, Reason:Unspecified, ReasonCode: 1
===
On our nms (where we use the latest mibs from cco) I only see the associaton and the deauthentication trap but not the authentication trap:
===
04.02.2011 12:13:43 MEZ","wlan-vhzu52-c3","Client ''b8:f9:34:73:be:ea'' is associated with AP ''00:1f:ca:cc:8a:40'', interface ''0''.
,"04.02.2011 12:20:03 MEZ","wlan-vhzu52-c3","Client ''b8:f9:34:73:be:ea'' is deauthenticated from AP ''00:1f:ca:cc:8a:40'', interface ''0'' with reason code ''1''.
===
Wireshark approves that there are only two traps send.
Does anybody know why
- the wlc don't send the authenticated traps?
- the wlc don't log disassociate traps?
Furthermore, is there any alternative way to log successful user sessions without using radius/tacacs server?
Many thanks in advance,
Thorsten
