WLC Datapath verification

[Robo123]

Hi All,

I have a Foreign WLC located in one my infra T8 and Anchor WLC is in T1 we have the mobility tunnel Between these two WLC.inbetween these controllers we have Serveral L2 devices.Currently i am facing intermettent discunnection issue towords my teams window by using Guest SSID.i want to check whether my datapath is fine (Between Foreign and anchor WLC) via Wireshark capture .Is it possible to identify the same via Span since we have tunnel inbetween these ontroller.if possible please help me to know the procedure to do the same.

Note : Both controllers are connected in cisco switches.

[marce1000]

 - Which controller models are you talking about (you may want to include their software versions too) ?

 M.

[Robo123]

C9800-40-K9

Version 17.6.4

I have done the SPAN on the Foreign WLC  connected interface of the switch (Pinged Anchor WLC ip src as Foreign WLC IP) and tried filtering the trafic using Src as Foreign WLC IP and DEST as Anchor WLC IP but i cant see only the UDP packet.can you please help me to know how can i analyze the same to check if any issue in data path.

[marce1000]

 - If you are seeing this with MS Teams only  , then it's probably not related to your Foreign-Anchor setup , you could look at link counters of the major (up)links and or in between switches and look for port errors or mtu problems , I doubt this will be the case.
                     These commands can also be useful on the controllers :
        show wireless mobility summary
       show wireless stats mobility
       show wireless stats mobility messages 
       show platform hardware chassis active qfp feature wireless punt  statistics 

                  Also note : https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe50033

 You can also have a configuration checkup and or review on both controllers with the CLI command show tech wireless ; have the output analyzed with : https://cway.cisco.com/wireless-config-analyzer/

 M.

[Robo123]

Seems CSCwe50033 not related to the curent platform.

I have verified all the uplink no issues observed.I did SPAN already in the WLC connected interface ,Filtered the logs based on SRC and DEST wlc ip and i can see only UDP packets .Can you please confirm how can we confirm is nay issue there between thsese WLC based on these packet.

[Flavio Miranda]

Hi

 The link between WLC is supposed to be encrypted and you are not suppose to  see the traffic otherwise you would be doing a "main in the middle" attack.

   But, for troubleshooting purpose, you could disable the encryption. Just keep in mind that encrypted tunnel uses UDP port 16667 wihle unencrypted uses port 16666. If you have firewall or any filter in between, be aware of this change.