(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >show debug
MAC address ................................ 00:0e:35:f3:60:53
Debug Flags Enabled:
aaa detail enabled.
aaa events enabled.
aaa packet enabled.
aaa packet enabled.
aaa ldap enabled.
aaa local-auth db enabled.
aaa local-auth eap framework errors enabled.
aaa local-auth eap framework events enabled.
aaa local-auth eap framework packets enabled.
aaa local-auth eap framework state machine enabled.
aaa local-auth eap method errors enabled.
aaa local-auth eap method events enabled.
aaa local-auth eap method packets enabled.
aaa local-auth eap method state machine enabled.
aaa local-auth shim enabled.
aaa tacacs enabled.
dhcp message enabled.
dhcp packet enabled.
--More-- or (q)uit
dot11 mobile enabled.
dot11 state enabled
dot1x events enabled.
dot1x states enabled.
pem events enabled.
pem state enabled.
pm ssh-appgw enabled.
pm ssh-tcp enabled.
(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >Sat Sep 27 10:45:15 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019
192.168.0.25:68
Sat Sep 27 10:45:20 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 Adding mobile on Remote AP 00:00:00:00:00:00(0)
The anchor controller is informed of the association request from the client by the foreign controller.
However, the anchor is not aware of the AP to which the client is associating, since the L1 and L2 parts of
the connection are managed by the foreign controller.
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 START (0) Initializing policy
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 START (0) Change state to AUTHCHECK (2) last state
AUTHCHECK (2)
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 AUTHCHECK (2) Change state to L2AUTHCOMPLETE (4) last
state L2AUTHCOMPLETE (4)
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 L2AUTHCOMPLETE (4) Change state to DHCP_REQD (7) last
state DHCP_REQD (7)
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 Stopping deletion of Mobile Station: (callerId: 53)
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) State Update from Mobility-Incomplete to
Mobility-Complete, mobility role=ExpAnchor
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) Change state to DHCP_REQD (7) last state
DHCP_REQD (7)
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) pemAdvanceState2 3949, Adding TMP rule
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) Adding Fast Path rule
type = Airespace AP - Learn IP address
on AP 00:00:00:00:00:00, slot 0, interface = 1, QOS = 0
ACL Id = 255, Jumbo Frames = NO, 802.1P = 0, DSCP = 0, TokenID = 5006
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 DHCP_REQD (7) Successfully plumbed mobile rule (ACL ID
255)
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 Set bi-dir guest tunnel for 00:0e:35:f3:60:53 as in Export
Anchor role
The anchor controller is being informed that the client passed the L2 authentication and that, after
successful association, it is now going into the DHCP_REQD state.
Also, the controller is updating its status to be the Export Anchor for this client.
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 0.0.0.0 Added NPU entry of type 9
The client entry is added to the Network Processing Unit (NPU) of the controller with an IP address of
0.0.0.0: this means that the client is successfully associated, but it does not have an IP address yet.
Sat Sep 27 10:45:39 2008: 00:0e:35:f3:60:53 Sent an XID frame
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP received op BOOTREQUEST (1) (len 308, port 1, encap
0xec00)
The anchor controller is called into the game only after the client completes the association through the
foreign controller and after the client entry is correctly passed through the EoIP mobility tunnel.
Starting from the IP address assignment (static or via DHCP), all the rest is managed by the anchor
controller.
This is important for troubleshooting:
- If the client can associate, but cannot obtain an IP address or fails the authentication, look at the
configuration/debugs on the anchor controller.
- If the client cannot even associate, look at the configuration/debugs on both controllers and
eventually at the EoIP mobility tunnel setup.
Sat
Sat
Sat
Sat
Sat
Sat
Sat
Sat
Sat
Sep
Sep
Sep
Sep
Sep
Sep
Sep
Sep
Sep
27
27
27
27
27
27
27
27
27
10:45:41
10:45:41
10:45:41
10:45:41
10:45:41
10:45:41
10:45:41
10:45:41
10:45:41
2008: 00:0e:35:f3:60:53 DHCP option len (including the magic cookie) 72
2008: 00:0e:35:f3:60:53 DHCP option: message type = DHCP DISCOVER
2008: 00:0e:35:f3:60:53 DHCP option: 116 (len 1) - skipping
2008: 00:0e:35:f3:60:53 DHCP option: 61 (len 7) - skipping
2008: 00:0e:35:f3:60:53 DHCP option: 12 (len 7) - skipping
2008: 00:0e:35:f3:60:53 DHCP option: vendor class id = MSFT 5.0 (len 8)
2008: 00:0e:35:f3:60:53 DHCP option: 55 (len 11) - skipping
2008: 00:0e:35:f3:60:53 DHCP options end, len 72, actual 64
2008: 00:0e:35:f3:60:53 DHCP selecting relay 1 - control block settings:
dhcpServer: 0.0.0.0, dhcpNetmask: 0.0.0.0,
dhcpGateway: 0.0.0.0, dhcpRelay: 0.0.0.0 VLAN: 0
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP selected relay 1 - 192.168.51.1 (local address
192.168.51.203, gateway 192.168.51.1, VLAN 601, port 1)
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP transmitting DHCP DISCOVER (1)
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 1
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
xid: 0xd5771135 (3581350197), secs: 0, flags: 0
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
chaddr: 00:0e:35:f3:60:53
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
ciaddr: 0.0.0.0, yiaddr: 0.0.0.0
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
siaddr: 0.0.0.0, giaddr: 192.168.51.203
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP Forwarding DHCP packet (332 octets)
-packet received on direct-connect port requires forwarding to external DHCP server. Next-hop is
192.168.51.1
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP sending REQUEST to 192.168.51.1 (len 350, port 1, vlan
601)
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP selecting relay 2 - control block settings:
dhcpServer: 0.0.0.0, dhcpNetmask: 0.0.0.0,
dhcpGateway: 0.0.0.0, dhcpRelay: 192.168.51.203 VLAN: 601
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP selected relay 2 - NONE
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP received op BOOTREPLY (2) (len 308, port 1, encap 0xec00)
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option len (including the magic cookie) 72
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: message type = DHCP OFFER
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: server id = 192.168.51.1
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: lease time = 86035 seconds
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: 58 (len 4) - skipping
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: 59 (len 4) - skipping
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: netmask = 255.255.255.0
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: gateway = 192.168.51.1
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP option: DNS server, cnt = 1, first = 144.254.10.123
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP options end, len 72, actual 64
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP setting server from OFFER (server 192.168.51.1, yiaddr
192.168.51.23)
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP sending packet in EoIP tunnel to foreign 192.168.9.2 (len
346)
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP transmitting DHCP OFFER (2)
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
xid: 0xd5771135 (3581350197), secs: 0, flags: 0
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
chaddr: 00:0e:35:f3:60:53
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
ciaddr: 0.0.0.0, yiaddr: 192.168.51.23
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
siaddr: 0.0.0.0, giaddr: 0.0.0.0
Sat Sep 27 10:45:41 2008: 00:0e:35:f3:60:53 DHCP
server id: 1.1.1.1 rcvd server id: 192.168.51.1
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP received op BOOTREQUEST (1) (len 327, port 1, encap
0xec00)
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option len (including the magic cookie) 91
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: message type = DHCP REQUEST
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: 61 (len 7) - skipping
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: requested ip = 192.168.51.23
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: server id = 1.1.1.1
Sat
Sat
Sat
Sat
Sat
Sat
Sep
Sep
Sep
Sep
Sep
Sep
27
27
27
27
27
27
10:45:45
10:45:45
10:45:45
10:45:45
10:45:45
10:45:45
2008: 00:0e:35:f3:60:53 DHCP option: 12 (len 7) - skipping
2008: 00:0e:35:f3:60:53 DHCP option: 81 (len 20) - skipping
2008: 00:0e:35:f3:60:53 DHCP option: vendor class id = MSFT 5.0 (len 8)
2008: 00:0e:35:f3:60:53 DHCP option: 55 (len 11) - skipping
2008: 00:0e:35:f3:60:53 DHCP options end, len 91, actual 83
2008: 00:0e:35:f3:60:53 DHCP selecting relay 1 - control block settings:
dhcpServer: 192.168.51.1, dhcpNetmask: 0.0.0.0,
dhcpGateway: 0.0.0.0, dhcpRelay: 192.168.51.203 VLAN: 601
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP selected relay 1 - 192.168.51.1 (local address
192.168.51.203, gateway 192.168.51.1, VLAN 601, port 1)
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP transmitting DHCP REQUEST (3)
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP
op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 1
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP
xid: 0xd5771135 (3581350197), secs: 0, flags: 0
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP
chaddr: 00:0e:35:f3:60:53
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP
ciaddr: 0.0.0.0, yiaddr: 0.0.0.0
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP
siaddr: 0.0.0.0, giaddr: 192.168.51.203
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP
requested ip: 192.168.51.23
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP
server id: 192.168.51.1 rcvd server id: 1.1.1.1
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP Forwarding DHCP packet (348 octets)
-packet received on direct-connect port requires forwarding to external DHCP server. Next-hop is
192.168.51.1
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP sending REQUEST to 192.168.51.1 (len 366, port 1, vlan
601)
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP selecting relay 2 - control block settings:
dhcpServer: 192.168.51.1, dhcpNetmask: 0.0.0.0,
dhcpGateway: 0.0.0.0, dhcpRelay: 192.168.51.203 VLAN: 601
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP selected relay 2 - NONE
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP received op BOOTREPLY (2) (len 308, port 1, encap 0xec00)
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option len (including the magic cookie) 72
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: message type = DHCP ACK
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: server id = 192.168.51.1
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: lease time = 86400 seconds
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: 58 (len 4) - skipping
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: 59 (len 4) - skipping
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: netmask = 255.255.255.0
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: gateway = 192.168.51.1
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP option: DNS server, cnt = 1, first = 144.254.10.123
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 DHCP options end, len 72, actual 64
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 192.168.51.23 DHCP_REQD (7) Change state to WEBAUTH_REQD (8)
last state WEBAUTH_REQD (8)
Sat Sep 27 10:45:45 2008: 00:0e:35:f3:60:53 192.168.51.23 WEBAUTH_REQD (8) pemAdvanceState2 4616, Adding
TMP rule
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 192.168.51.23 WEBAUTH_REQD (8) Replacing Fast Path rule
type = Airespace AP Client - ACL passthru
on AP 00:00:00:00:00:00, slot 0, interface = 1, QOS = 0
ACL Id = 255, Jumbo Frames = NO, 802.1P = 0, DSCP = 0, TokenID = 5006
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 192.168.51.23 WEBAUTH_REQD (8) Successfully plumbed mobile rule
(ACL ID 255)
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 Plumbing web-auth redirect rule due to user logout
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 Adding Web RuleID 3415 for mobile 00:0e:35:f3:60:53
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 Assigning Address 192.168.51.23 to mobile
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 DHCP sending packet in EoIP tunnel to foreign 192.168.9.2 (len
346)
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 DHCP transmitting DHCP ACK (5)
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 DHCP
op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 DHCP
xid: 0xd5771135 (3581350197), secs: 0, flags: 0
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 DHCP
chaddr: 00:0e:35:f3:60:53
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 DHCP
ciaddr: 0.0.0.0, yiaddr: 192.168.51.23
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 DHCP
siaddr: 0.0.0.0, giaddr: 0.0.0.0
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 DHCP
server id: 1.1.1.1 rcvd server id: 192.168.51.1
The DHCP address assignment completes successfully, the DHCP ACK is sent back to the client via the EoIP
tunnel and through the foreign controller.
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 Set bi-dir guest tunnel for 00:0e:35:f3:60:53 as in Export
Anchor role
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53 192.168.51.23 Added NPU entry of type 2
The current controller is again confirmed as the Export Anchor one and the client entry is added to the NPU
with the corresponding IP address.
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:45:49 2008: 00:0e:35:f3:60:53
w:0x0 aalg:0x0, PMState: WEBAUTH_REQD
Sent
Copy
Copy
Copy
an XID frame
AP LOCP - mode:0 slotId:0, apMac 0x0:0:0:0:0:0
WLAN LOCP EssIndex:3 aid:0 ssid:GuestTunnel
Security LOCP ecypher:0x3 ptype:0x4, p:0x1, eaptype:0x6
Sat Sep 27
statuscode
Sat Sep 27
Sat Sep 27
10:45:49 2008: 00:0e:35:f3:60:53 Copy 802.11 LOCP a:0x0 b:0x0 c:0x0 d:0x0 e:0x0 protocol2:0x5
0, reasoncode 99, status 3
10:45:49 2008: 00:0e:35:f3:60:53 Copy IP LOCP: 0xc0a83317
10:45:49 2008: 00:0e:35:f3:60:53 Copy MobilityData LOCP status:4, anchorip:0xc0a80902
Location protocol (LOCP) data are updated and among these we have:
- apMac of the AP to which the client is associated to; the anchor controller is not aware of the AP to
which the client is associated, since the L1 and L2 parts of the connection are managed by the
foreign controller.
- Extended Service Set Index is the WLAN Id of the client on the anchor.
- Servive Set Identifier to which the client is associated to.
- Policy Manager State (PMState) showing the status of the client.
- Copy IP LOCP is the IP address of the guest client in hexadecimal values (0xc0a83317 = 192.168.51.23).
- Anchorip in this case indicates the management IP address of the foreign controller in hexadecimal
values (0xc0a80902 = 192.168.9.2).
Sat Sep 27 10:46:07 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
(Cisco Controller) >
(Cisco Controller) >show client summary
Number of Clients................................ 1
MAC Address
AP Name
Status
WLAN Auth Protocol Port Wired
----------------- ----------------- ------------- ---- ---- -------- ---- ----00:0e:35:f3:60:53 192.168.9.2
Associated
3
No
Mobile
1
No
(Cisco Controller) >Sat Sep 27 10:46:12 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019
192.168.0.25:68
(Cisco
(Cisco
(Cisco
Client
Client
AP MAC
Client
Controller) >
Controller) >
Controller) >show client detail 00:0e:35:f3:60:53
MAC Address............................... 00:0e:35:f3:60:53
Username ................................. N/A
Address................................... 00:00:00:00:00:00
State..................................... Associated
Wireless LAN Id..................................
BSSID............................................
Channel..........................................
IP Address.......................................
Association Id...................................
Authentication Algorithm.........................
Reason Code......................................
Status Code......................................
Session Timeout..................................
Client CCX version...............................
3
00:00:00:00:00:02
N/A
192.168.51.23
0
Open System
0
0
1800
No CCX support
On the foreign controller, the CCX version of the client is correctly shown as ‘3’.
However, the anchor does not know it because this is part of the L1/L2 connectivity, which is managed by
the foreign.
Mirroring........................................
QoS Level........................................
Diff Serv Code Point (DSCP)......................
802.1P Priority Tag..............................
WMM Support......................................
Mobility State...................................
Mobility Foreign IP Address......................
Disabled
Silver
disabled
disabled
Disabled
Export Anchor
192.168.9.2
In the client details we can see the Mobility State of the controller for this client: Export Anchor means
that the controller from where we took the client details is the foreign one for this client.
The Mobility Foreign IP Address tells us which the foreign controller for this client is.
Mobility Move Count.............................. 1
--More-- or (q)uit
Security Policy Completed........................ No
Policy Manager State............................. WEBAUTH_REQD
The client at this point didn’t authenticate via the web browse yet, so its state is marked as WEBAUTH_REQD.
Policy Manager Rule Created......................
NPU Fast Fast Notified...........................
Policy Type......................................
Encryption Cipher................................
Yes
Yes
N/A
None
Management Frame Protection......................
EAP Type.........................................
Interface........................................
VLAN.............................................
Client Capabilities:
CF Pollable................................
CF Poll Request............................
Short Preamble.............................
PBCC.......................................
Channel Agility............................
Listen Interval............................
Client Statistics:
Number of Bytes Received...................
Number of Bytes Sent.......................
Number of Packets Received.................
Number of Packets Sent.....................
Number of Policy Errors....................
--More-- or (q)uit
Radio Signal Strength Indicator............
Signal to Noise Ratio......................
Nearby AP Statistics:
TxExcessiveRetries: 0
TxRetries: 0
RtsSuccessCnt: 0
RtsFailCnt: 0
TxFiltered: 0
TxRateProfile: [0,0,0,0,0,0,0,0,0,0,0,0]
No
Unknown
client1
601
Not
Not
Not
Not
Not
0
implemented
implemented
implemented
implemented
implemented
0
0
0
0
0
Unavailable
Unavailable
Here we have no information on which AP the client is associated to.
Only the foreign controller takes care of all the steps up to the successful client association, so the AP
is unknown to the anchor controller.
(Cisco
(Cisco
(Cisco
(Cisco
(Cisco
Controller)
Controller)
Controller)
Controller)
Controller)
>
>
>
>
>
(Cisco Controller) >Sat Sep 27 10:46:39 2008: SshPmAppgw/pm_appgw.c:1234/ssh_pm_appgw_request: New
application gateway request for `alg-http@ssh.com': 192.168.51.23.41605 > 1.1.1.1.80 (nat: 1.1.1.1.80) tcp
ft=0x00000000 tt=0x00000000
Here I opened a web browser and I typed in the address http://1.1.1.1/login.html
“192.168.51.23.41605 > 1.1.1.1.80 (nat: 1.1.1.1.80) tcp” means that there is a TCP request from
192.168.51.23 (port 41605) to 1.1.1.1 (port 80)
Sat Sep 27 10:46:39 2008: SshPmAppgw/pm_appgw.c:1239/ssh_pm_appgw_request: Packet attributes:
trigger_rule=0x4eb8, tunnel_id=0x0, trd_index=0xddffffff, prev_trd_index=0xddffffff
Sat Sep 27 10:46:39 2008: SshPmAppgw/pm_appgw.c:1240/ssh_pm_appgw_request: Packet:
Sat Sep 27 10:46:39 2008: 00000000: 4500 0030 ac45 4000 8006 58c1 c0a8 3317 E..0.E@...X...3.
Sat Sep 27 10:46:39 2008: 00000010: 0101 0101 a285 0050 4496 d72c 0000 0000 .......PD..,....
Sat Sep 27 10:46:39 2008: 00000020: 7002 4000 8ec5 0000 0204 05b4 0101 0402 p.@.............
Sat Sep 27 10:46:39 2008: SshPmStAppgw/pm_st_appgw.c:403/ssh_pm_st_appgw_start: Calling redirection
callback
Sat Sep 27 10:46:39 2008: SshPmAppgw/pm_appgw.c:155/ssh_appgw_redirect: Application gateway redirect:
1.1.1.1.80 -> 1.1.1.1.80
Here the web redirect to the login page starts.
On the bottom of the window from the web browser (IE), we can see the indication
“Opening page https://1.1.1.1/login.html?redirect=1.1.1.1/login.html...”
Sat Sep 27 10:46:39 2008: SshPmStAppgw/pm_st_appgw.c:445/ssh_pm_st_appgw_mappings: Creating application
gateway mappings: 192.168.51.23.41605 > 1.1.1.1.80 (1.1.1.1.80)
Sat Sep 27 10:46:39 2008: SshPmStAppgw/pm_st_appgw.c:102/ssh_pm_appgw_mappings_cb: appgw connection cached:
init flow_index=3644 resp flow_index=5254 event_cnt=209151
Sat Sep 27 10:46:39 2008: SshPmStAppgw/pm_st_appgw.c:493/ssh_pm_st_appgw_mappings_done: NAT on initiator
side
Sat Sep 27 10:46:39 2008: SshPmStAppgw/pm_st_appgw.c:583/ssh_pm_st_appgw_tcp_responder_stream_done:
ssh_pm_st_appgw_tcp_responder_stream_done: conn->context.responder_stream=0x0
Sat Sep 27 10:46:39 2008: SshPmStAppgw/pm_st_appgw.c:624/ssh_pm_st_appgw_tcp_responder_stream_done: Opening
initiator stream 192.168.51.23:40352 > 10.48.76.25:2012
Sat Sep 27 10:46:39 2008: SshPmStAppgw/pm_st_appgw.c:154/ssh_pm_appgw_i_flow_enabled: Initiator flow mode
has now been set.
Sat Sep 27 10:46:39 2008: SshPmAppgw/pm_appgw.c:507/ssh_appgw_tcp_listener_callback: New initiator stream:
src=192.168.51.23:40352, dst=10.48.76.25:2012
Sat Sep 27 10:46:39 2008: SshPmStAppgw/pm_st_appgw.c:646/ssh_pm_st_appgw_tcp_open_initiator_stream:
Initiator stream opened
Sat Sep 27 10:46:39 2008: SshAppgwHttp/appgw_http.c:531/ssh_appgw_http_conn_cb: New TCP HTTP connection
192.168.51.23.41605 > 1.1.1.1.80
Sat Sep 27 10:46:39 2008: SshAppgwHttp/appgw_http.c:535/ssh_appgw_http_conn_cb: Responder sees initiator as
`192.168.0.25.41605'
Sat Sep 27 10:46:39 2008: SshAppgwHttp/appgw_http.c:539/ssh_appgw_http_conn_cb: Initiator sees responder as
`1.1.1.1.80'
Sat Sep 27 10:46:39 2008: SshAppgwHttp/appgw_http.c:99/ssh_appgw_http_st_wait_input: entering state
st_wait_input: (i) reading_hdr 1 nmsgs 0
Sat Sep 27 10:46:39 2008: SshAppgwHttpState/appgw_http_state.c:2077/ssh_appgw_http_handle_state: handling:
0 bytes:
Sat Sep 27 10:46:39 2008: SshAppgwHttp/appgw_http.c:136/ssh_appgw_http_st_wait_input: read 289 bytes
(offset 0 data 0)
Sat Sep 27 10:46:39 2008: SshAppgwHttpState/appgw_http_state.c:2077/ssh_appgw_http_handle_state: handling:
289 bytes:
Sat Sep 27 10:46:39 2008: 00000000: 4745 5420 2f6c 6f67 696e 2e68 746d 6c20 GET /login.html
Sat Sep 27 10:46:39 2008: 00000010: 4854 5450 2f31 2e31 0d0a 4163 6365 7074 HTTP/1.1..Accept
Sat Sep 27 10:46:39 2008: 00000020: 3a20 696d 6167 652f 6769 662c 2069 6d61 : image/gif, ima
Sat Sep 27 10:46:39 2008: 00000030: 6765 2f78 2d78 6269 746d 6170 2c20 696d ge/x-xbitmap, im
Sat Sep 27 10:46:39 2008: 00000040: 6167 652f 6a70 6567 2c20 696d 6167 652f age/jpeg, image/
Sat Sep 27 10:46:39 2008: 00000050: 706a 7065 672c 2061 7070 6c69 6361 7469 pjpeg, applicati
Sat Sep 27 10:46:39 2008: 00000060: 6f6e 2f78 2d73 686f 636b 7761 7665 2d66 on/x-shockwave-f
Sat Sep 27 10:46:39 2008: 00000070: 6c61 7368 2c20 2a2f 2a0d 0a41 6363 6570 lash, */*..Accep
Sat Sep 27 10:46:39 2008: 00000080: 742d 4c61 6e67 7561 6765 3a20 656e 2d75 t-Language: en-u
Sat Sep 27 10:46:39 2008: 00000090: 730d 0a41 6363 6570 742d 456e 636f 6469 s..Accept-Encodi
Sat Sep 27 10:46:39 2008: 000000a0: 6e67 3a20 677a 6970 2c20 6465 666c 6174 ng: gzip, deflat
Sat Sep 27 10:46:43 2008: 000000b0: 650d 0a55 7365 722d 4167 656e 743a 204d e..User-Agent: M
Sat Sep 27 10:46:43 2008: 000000c0: 6f7a 696c 6c61 2f34 2e30 2028 636f 6d70 ozilla/4.0 (comp
Sat Sep 27 10:46:43 2008: 000000d0: 6174 6962 6c65 3b20 4d53 4945 2036 2e30 atible; MSIE 6.0
Sat Sep 27 10:46:43 2008: 000000e0: 3b20 5769 6e64 6f77 7320 4e54 2035 2e31 ; Windows NT 5.1
Sat Sep 27 10:46:43 2008: 000000f0: 3b20 5356 3129 0d0a 486f 7374 3a20 312e ; SV1)..Host: 1.
Sat Sep 27 10:46:43 2008: 00000100: 312e 312e 310d 0a43 6f6e 6e65 6374 696f 1.1.1..Connectio
Sat Sep 27 10:46:43 2008: 00000110: 6e3a 204b 6565 702d 416c 6976 650d 0a0d n: Keep-Alive...
Sat Sep 27 10:46:43 2008: 00000120: 0a
.
Sat Sep 27 10:46:43 2008: SshAppgwHttpState/appgw_http_state.c:985/ssh_appgw_parse_request_line: parsing
request line GET /login.html HTTP/1.1
Sat Sep 27 10:46:43 2008: SshAppgwHttpState/appgw_http_state.c:1018/ssh_appgw_parse_request_line: internal
http version 3
Sat Sep 27 10:46:43 2008: SshAppgwHttpState/appgw_http_state.c:1155/ssh_appgw_add_method: caching method 2
for reply 0
Sat Sep 27 10:46:43 2008: SshAppgwHttpState/appgw_http_state.c:1604/ssh_appgw_check_msg: examining request
using service id 10
Sat Sep 27 10:46:43 2008: SshAppgwHttpState/appgw_http_state.c:594/ssh_appgw_http_get_dst_host: destination
host: 1.1.1.1
Sat Sep 27 10:46:43 2008: SshAppgwHttpState/appgw_http_state.c:1474/ssh_appgw_inject_reply: injecting 404
reply as msg 0
Sat Sep 27 10:46:43 2008: SshAppgwHttp/appgw_http.c:284/ssh_appgw_http_st_write_data: entering state
st_write_data
Sat Sep 27 10:46:43 2008: SshAppgwHttp/appgw_http.c:99/ssh_appgw_http_st_wait_input: entering state
st_wait_input: (i) reading_hdr 1 nmsgs 1
Sat Sep 27 10:46:43 2008: SshAppgwHttpState/appgw_http_state.c:2077/ssh_appgw_http_handle_state: handling:
0 bytes:
Sat Sep 27 10:46:43 2008: SshAppgwHttp/appgw_http.c:136/ssh_appgw_http_st_wait_input: read -1 bytes (offset
0 data 0)
Sat Sep 27 10:46:43 2008: SshAppgwHttp/appgw_http.c:99/ssh_appgw_http_st_wait_input: entering state
st_wait_input: (r) reading_hdr 1 nmsgs 0
Sat Sep 27 10:46:43 2008: SshAppgwHttpState/appgw_http_state.c:1851/ssh_appgw_http_is_inject: next inject
is msg# 0 current msg# 0
Sat Sep 27 10:46:43 2008: SshAppgwHttp/appgw_http.c:207/ssh_appgw_http_st_inject: entering state st_inject
(r): msgs 0
Sat Sep 27 10:46:43 2008: SshAppgwHttp/appgw_http.c:259/ssh_appgw_http_st_inject: closing connection after
inject
Sat Sep 27 10:46:43 2008: SshAppgwHttp/appgw_http.c:400/ssh_appgw_http_st_terminate: entering state
st_terminate (r): teardown 0 terminate i: 1 r: 1
Sat Sep 27 10:47:01 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
Sat Sep 27 10:47:06 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
Sat Sep 27 10:47:27 2008: SshAppgwHttp/appgw_http.c:99/ssh_appgw_http_st_wait_input: entering state
st_wait_input: (i) reading_hdr 1 nmsgs 1
Sat Sep 27 10:47:27 2008: SshAppgwHttpState/appgw_http_state.c:2077/ssh_appgw_http_handle_state: handling:
0 bytes:
Sat Sep 27 10:47:27 2008: SshAppgwHttp/appgw_http.c:400/ssh_appgw_http_st_terminate: entering state
st_terminate (i): teardown 0 terminate i: 1 r: 1
Sat Sep 27 10:47:27 2008: SshAppgwHttp/appgw_http.c:732/ssh_appgw_http_connection_terminate: service HTTPREDIR: TCP HTTP connection 192.168.51.23.41605 > 1.1.1.1.80 terminated
This corresponds to the moment when we are prompted with the web login page to enter the guest user
credentials, after I accepted the certificate security alert (I was using the default web server
certificate installed on the anchor controller).
Sat Sep 27
instance
Sat Sep 27
Sat Sep 27
Sat Sep 27
Sat Sep 27
Sat Sep 27
Sat Sep 27
Sat Sep 27
Sat Sep 27
Sat Sep 27
Sat Sep 27
Sat Sep 27
bytes)
Sat Sep 27
bytes)
10:47:27 2008: SshPmStAppgw/pm_st_appgw.c:1094/ssh_pm_st_appgw_terminate: terminating appgw
10:47:31
10:47:36
10:47:36
10:47:36
10:47:36
10:47:36
10:47:36
10:47:36
10:47:36
10:47:36
10:47:36
2008:
2008:
2008:
2008:
2008:
2008:
2008:
2008:
2008:
2008:
2008:
dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
00:0e:35:f3:60:53 Username entry (guest) created for mobile
User guest authenticated
00:0e:35:f3:60:53 Returning AAA Success for mobile 00:0e:35:f3:60:53
AuthorizationResponse: 0x375348f0
structureSize................................70
resultCode...................................0
protocolUsed.................................0x00000008
proxyState...................................00:0E:35:F3:60:53-00:00
Packet contains 2 AVPs:
AVP[01] Service-Type.............................0x00000001 (1) (4
10:47:36 2008:
AVP[02] Airespace / WLAN-Identifier..............0x00000003 (3) (4
The credentials were
Username = guest
Password = guest
If the user <your_user> is authenticated successfully, we can see “User <your_user> authenticated”.
Sat Sep 27 10:47:36 2008: Authentication failed for guest, Service Type: 1
Cosmetic / Crazy WLC
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 Applying new AAA override for station 00:0e:35:f3:60:53
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 Override values for station 00:0e:35:f3:60:53
source: 48, valid bits: 0x1
qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1
dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1
vlanIfName: '', aclName:
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 Unable to apply override policy for station 00:0e:35:f3:60:53 VapAllowRadiusOverride is FALSE
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 192.168.51.23 WEBAUTH_REQD (8) Change state to WEBAUTH_NOL3SEC
(14) last state WEBAUTH_NOL3SEC (14)
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 192.168.51.23 WEBAUTH_NOL3SEC (14) Change state to RUN (20)
last state RUN (20)
After the successful login, the PMState of the client changes from WEBAUTH_REQD to WEBAUTH_NOL3SEC.
Then, it finally goes into the RUN state.
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 Session Timeout is 1800 - starting session timer for the mobile
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 192.168.51.23 RUN (20) Reached PLUMBFASTPATH: from line 4536
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 192.168.51.23 RUN (20) Replacing Fast Path rule
type = Airespace AP Client
on AP 00:00:00:00:00:00, slot 0, interface = 1, QOS = 0
ACL Id = 255, Jumbo Frames = NO, 802.1P = 0, DSCP = 0, TokenID = 5006
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 Sending Accounting request (0) for station 00:0e:35:f3:60:53
Sat Sep 27 10:47:36 2008: AccountingMessage Accounting Start: 0x151f3f80
Sat Sep 27 10:47:36 2008:
Packet contains 14 AVPs:
Sat Sep 27 10:47:36 2008:
AVP[01] User-Name................................guest (5 bytes)
Sat Sep 27 10:47:36 2008:
AVP[02] Nas-Port.................................0x00000001 (1) (4
bytes)
Sat Sep 27 10:47:36 2008:
AVP[03] Nas-Ip-Address...........................0xc0a80019 (1062731751) (4 bytes)
Sat Sep 27 10:47:36 2008:
AVP[04] Framed-IP-Address........................0xc0a83317 (1062718697) (4 bytes)
Sat Sep 27 10:47:36 2008:
AVP[05] NAS-Identifier...........................w-4404-1 (8 bytes)
Sat Sep 27 10:47:36 2008:
AVP[06] Airespace / WLAN-Identifier..............0x00000003 (3) (4
bytes)
Sat Sep 27 10:47:36 2008:
AVP[07] Acct-SessionId..........................48ddf328/00:0e:35:f3:60:53/60 (29 bytes)
Sat Sep 27 10:47:36 2008:
AVP[08] Acct-Authentic...........................0x00000002 (2) (4
bytes)
Sat Sep 27 10:47:36 2008:
AVP[09] Tunnel-Type..............................0x0000000d (13) (4
bytes)
Sat Sep 27 10:47:36 2008:
AVP[10] Tunnel-Medium-Type.......................0x00000006 (6) (4
bytes)
Sat Sep
Sat Sep
bytes)
Sat Sep
bytes)
Sat Sep
bytes)
27 10:47:36 2008:
27 10:47:36 2008:
AVP[11] Tunnel-Group-Id..........................601 (3 bytes)
AVP[12] Acct-Status-Type.........................0x00000001 (1) (4
27 10:47:36 2008:
AVP[13] Calling-Station-Id.......................192.168.51.23 (13
27 10:47:36 2008:
AVP[14] Called-Station-Id........................192.168.0.25 (12
A Radius Airespace accounting start packet is sent to the Radius server (in this case the controller
itself) to indicate that the user session is starting.
Note that “Calling-Station-Id” is the IP address of the client and the “Tunnel-Group-Id” is the vlan Id of
the client: this matches the vlan Id of the interface on the anchor controller to which the guest WLAN is
linked.
Sat Sep 27 10:47:36 2008: 00:0e:35:f3:60:53 192.168.51.23 RUN (20) Successfully plumbed mobile rule (ACL ID
255)
Sat Sep 27 10:47:40 2008: SshPmAppgw/pm_appgw.c:1139/ssh_pm_appgw_flow_free_notification: received flow
free notification for flow index 5254 event cnt 209160
Sat Sep 27 10:47:40 2008: SshPmAppgw/pm_appgw.c:1145/ssh_pm_appgw_flow_free_notification: no valid appgw
found for flow index 5254 event cnt 209160.
Sat Sep 27 10:47:40 2008: SshPmAppgw/pm_appgw.c:1139/ssh_pm_appgw_flow_free_notification: received flow
free notification for flow index 3644 event cnt 209161
Sat Sep 27 10:47:40 2008: SshPmAppgw/pm_appgw.c:1145/ssh_pm_appgw_flow_free_notification: no valid appgw
found for flow index 3644 event cnt 209161.
Sat Sep 27 10:47:40 2008: 00:0e:35:f3:60:53 Set bi-dir guest tunnel for 00:0e:35:f3:60:53 as in Export
Anchor role
Sat Sep 27 10:47:40 2008: 00:0e:35:f3:60:53 192.168.51.23 Added NPU entry of type 1
Sat Sep 27 10:47:40 2008: 00:0e:35:f3:60:53 Sending a gratuitous ARP for 192.168.51.23, VLAN Id 601
The client sends a gratuitous ARP for its own IP, in order to verify that there are no duplicate addresses.
Sat Sep 27 10:47:40 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
Sat Sep 27 10:47:45 2008: 00:0e:35:f3:60:53 Copy AP LOCP - mode:0 slotId:0, apMac 0x0:0:0:0:0:0
Sat Sep 27 10:47:45 2008: 00:0e:35:f3:60:53 Copy WLAN LOCP EssIndex:3 aid:0 ssid:GuestTunnel
Sat Sep 27 10:47:45 2008: 00:0e:35:f3:60:53 Copy Security LOCP ecypher:0x3 ptype:0x4, p:0x0, eaptype:0x6
w:0x0 aalg:0x0, PMState:
RUN
Sat Sep 27 10:47:45 2008: 00:0e:35:f3:60:53 Copy 802.11 LOCP a:0x0 b:0x0 c:0x0 d:0x0 e:0x0 protocol2:0x5
statuscode 0, reasoncode 99, status 3
Sat Sep 27 10:47:45 2008: 00:0e:35:f3:60:53 Copy Username LOCP :
guest
Sat Sep 27 10:47:45 2008: 00:0e:35:f3:60:53 Copy IP LOCP: 0xc0a83317
Sat Sep 27 10:47:45 2008: 00:0e:35:f3:60:53 Copy MobilityData LOCP status:4, anchorip:0xc0a80902
The Location Protocol data for the client are updated accordingly.
Now we have the PMState updated to RUN and username of the client (Copy Username LOCP :
(Cisco
(Cisco
(Cisco
(Cisco
Controller)
Controller)
Controller)
Controller)
>
>
>
>show client summary
Number of Clients................................ 1
MAC Address
AP Name
Status
WLAN Auth Protocol Port Wired
----------------- ----------------- ------------- ---- ---- -------- ---- ----00:0e:35:f3:60:53 192.168.9.2
Associated
3
Yes
Mobile
(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >show client detail 00:0e:35:f3:60:53
Client MAC Address............................... 00:0e:35:f3:60:53
Client Username ................................. guest
AP MAC Address................................... 00:00:00:00:00:00
Client State..................................... Associated
Wireless LAN Id.................................. 3
BSSID............................................ 00:00:00:00:00:02
Channel.......................................... N/A
IP Address....................................... 192.168.51.23
Association Id................................... 0
Authentication Algorithm......................... Open System
Reason Code...................................... 0
Status Code...................................... 0
Session Timeout.................................. 1800
Client CCX version............................... No CCX support
Mirroring........................................ Disabled
QoS Level........................................ Silver
1
No
guest)
Diff Serv Code Point (DSCP)......................
802.1P Priority Tag..............................
WMM Support......................................
Mobility State...................................
Mobility Foreign IP Address......................
Mobility Move Count..............................
--More-- or (q)uit
Security Policy Completed........................
Policy Manager State.............................
disabled
disabled
Disabled
Export Anchor
192.168.9.2
1
Yes
RUN
The security policy is now completed and the client is in the RUN state.
Policy Manager Rule Created......................
NPU Fast Fast Notified...........................
Policy Type......................................
Encryption Cipher................................
Management Frame Protection......................
EAP Type.........................................
Interface........................................
VLAN.............................................
Client Capabilities:
CF Pollable................................
CF Poll Request............................
Short Preamble.............................
PBCC.......................................
Channel Agility............................
Listen Interval............................
Client Statistics:
Number of Bytes Received...................
Number of Bytes Sent.......................
Number of Packets Received.................
Number of Packets Sent.....................
Number of Policy Errors....................
--More-- or (q)uit
Radio Signal Strength Indicator............
Signal to Noise Ratio......................
Nearby AP Statistics:
TxExcessiveRetries: 0
Yes
Yes
N/A
None
No
Unknown
client1
601
Not
Not
Not
Not
Not
0
implemented
implemented
implemented
implemented
implemented
0
0
0
0
0
Unavailable
Unavailable
TxRetries: 0
RtsSuccessCnt: 0
RtsFailCnt: 0
TxFiltered: 0
TxRateProfile: [0,0,0,0,0,0,0,0,0,0,0,0]
(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >Sat Sep 27 10:48:24 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019
192.168.0.25:68
Sat Sep 27 10:48:29 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
Sat Sep 27 10:49:16 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
Sat Sep 27 10:49:21 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 Sending Accounting request (2) for station 00:0e:35:f3:60:53
Now I log out from the web authentication by clicking on the Logout button.
Sat Sep 27 10:49:44 2008: AccountingMessage Accounting Stop: 0x15073df4
Sat Sep 27 10:49:44 2008:
Packet contains 21 AVPs:
Sat Sep 27 10:49:44 2008:
AVP[01] User-Name................................guest (5 bytes)
Sat Sep 27 10:49:44 2008:
AVP[02] Nas-Port.................................0x00000001 (1) (4
bytes)
Sat Sep 27 10:49:44 2008:
AVP[03] Nas-Ip-Address...........................0xc0a80019 (1062731751) (4 bytes)
Sat Sep 27 10:49:44 2008:
AVP[04] Framed-IP-Address........................0xc0a83317 (1062718697) (4 bytes)
Sat Sep 27 10:49:44 2008:
AVP[05] NAS-Identifier...........................w-4404-1 (8 bytes)
Sat Sep 27 10:49:44 2008:
AVP[06] Airespace / WLAN-Identifier..............0x00000003 (3) (4
bytes)
Sat Sep 27 10:49:44 2008:
AVP[07] Acct-SessionId..........................48ddf328/00:0e:35:f3:60:53/60 (29 bytes)
Sat Sep 27 10:49:44 2008:
AVP[08] Acct-Authentic...........................0x00000002 (2) (4
bytes)
Sat Sep 27 10:49:44 2008:
AVP[09] Tunnel-Type..............................0x0000000d (13) (4
bytes)
Sat Sep 27 10:49:44 2008:
AVP[10] Tunnel-Medium-Type.......................0x00000006 (6) (4
bytes)
Sat Sep
Sat Sep
bytes)
Sat Sep
bytes)
Sat Sep
bytes)
Sat Sep
bytes)
Sat Sep
bytes)
Sat Sep
bytes)
Sat Sep
bytes)
Sat Sep
bytes)
Sat Sep
bytes)
Sat Sep
bytes)
27 10:49:44 2008:
27 10:49:44 2008:
AVP[11] Tunnel-Group-Id..........................601 (3 bytes)
AVP[12] Acct-Status-Type.........................0x00000002 (2) (4
27 10:49:44 2008:
AVP[13] Acct-Input-Octets........................0x00000000 (0) (4
27 10:49:44 2008:
AVP[14] Acct-Output-Octets.......................0x00000000 (0) (4
27 10:49:44 2008:
AVP[15] Acct-Input-Packets.......................0x00000000 (0) (4
27 10:49:44 2008:
AVP[16] Acct-Output-Packets......................0x00000000 (0) (4
27 10:49:44 2008:
AVP[17] Acct-Terminate-Cause.....................0x00000001 (1) (4
27 10:49:44 2008:
AVP[18] Acct-Session-Time........................0x00000080 (128) (4
27 10:49:44 2008:
AVP[19] Acct-Delay-Time..........................0x00000000 (0) (4
27 10:49:44 2008:
AVP[20] Calling-Station-Id.......................192.168.51.23 (13
27 10:49:44 2008:
AVP[21] Called-Station-Id........................192.168.0.25 (12
An accounting stop packet is sent to indicate to the Radius server (in this case the controller itself)
that the user session is finishing.
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 192.168.51.23 RUN (20) Change state to L2AUTHCOMPLETE (4) last
state RUN (20)
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 192.168.51.23 L2AUTHCOMPLETE (4) Change state to DHCP_REQD (7)
last state RUN (20)
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 192.168.51.23 DHCP_REQD (7) pemAdvanceState2 4744, Adding TMP
rule
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 192.168.51.23 DHCP_REQD (7) Adding Fast Path rule
type = Airespace AP - Learn IP address
on AP 00:00:00:00:00:00, slot 0, interface = 1, QOS = 0
ACL Id = 255, Jumbo Frames = NO, 802.1P = 0, DSCP = 0, TokenID = 5006
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 192.168.51.23 DHCP_REQD (7) Successfully plumbed mobile rule
(ACL ID 255)
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 192.168.51.23 DHCP_REQD (7) Change state to WEBAUTH_REQD (8)
last state RUN (20)
The association and the IP address assignment are still valid, so L2 authentication and DHCP are
reconfirmed.
However, the client is no more web-authenticated, so its state changes back to WEBAUTH_REQD.
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 192.168.51.23 WEBAUTH_REQD (8) pemAdvanceState2 4761, Adding
TMP rule
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 192.168.51.23 WEBAUTH_REQD (8) Replacing Fast Path rule
type = Airespace AP Client - ACL passthru
on AP 00:00:00:00:00:00, slot 0, interface = 1, QOS = 0
ACL Id = 255, Jumbo Frames = NO, 802.1P = 0, DSCP = 0, TokenID = 5006
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 192.168.51.23 WEBAUTH_REQD (8) Successfully plumbed mobile rule
(ACL ID 255)
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 Plumbing web-auth redirect rule due to user logout for
00:0e:35:f3:60:53
Sat Sep 27 10:49:44 2008: 00:0e:35:f3:60:53 Adding Web RuleID 3416 for mobile 00:0e:35:f3:60:53
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53 Username entry deleted for mobile
The wireless client is no longer “linked” to the username that he used for the login.
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
Anchor role
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
Anchor role
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
w:0x0 aalg:0x0, PMState: WEBAUTH_REQD
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
statuscode 0, reasoncode 99, status 3
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53
192.168.51.23 Removed NPU entry.
Set bi-dir guest tunnel for 00:0e:35:f3:60:53 as in Export
192.168.51.23 Added NPU entry of type 9
Set bi-dir guest tunnel for 00:0e:35:f3:60:53 as in Export
192.168.51.23 Added NPU entry of type 2
Sent an XID frame
Copy AP LOCP - mode:0 slotId:0, apMac 0x0:0:0:0:0:0
Copy WLAN LOCP EssIndex:3 aid:0 ssid:GuestTunnel
Copy Security LOCP ecypher:0x3 ptype:0x4, p:0x1, eaptype:0x6
Copy 802.11 LOCP a:0x0 b:0x0 c:0x0 d:0x0 e:0x0 protocol2:0x5
Copy Username LOCP :
guest
Copy IP LOCP: 0xc0a83317
Sat Sep 27 10:49:48 2008: 00:0e:35:f3:60:53 Copy MobilityData LOCP status:4, anchorip:0xc0a80902
The Location Protocol info is updated.
Now the PMState is set back to WEBAUTH_REQD and the old username used by the client can still be seen (Copy
Username LOCP :
guest).
Sat Sep 27 10:49:48 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
Sat Sep 27 10:49:52 2008: dhcpd: Received 300 byte dhcp packet from 0xc0a80019 192.168.0.25:68
(Cisco Controller) >
(Cisco Controller) >show client summary
Number of Clients................................ 1
MAC Address
AP Name
Status
WLAN Auth Protocol Port Wired
----------------- ----------------- ------------- ---- ---- -------- ---- ----00:0e:35:f3:60:53 192.168.9.2
Associated
3
No
Mobile
(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >show client detail 00:0e:35:f3:60:53
Client MAC Address............................... 00:0e:35:f3:60:53
Client Username ................................. guest
AP MAC Address................................... 00:00:00:00:00:00
Client State..................................... Associated
Wireless LAN Id.................................. 3
BSSID............................................ 00:00:00:00:00:02
Channel.......................................... N/A
IP Address....................................... 192.168.51.23
Association Id................................... 0
Authentication Algorithm......................... Open System
Reason Code...................................... 0
Status Code...................................... 0
Session Timeout.................................. 1800
Client CCX version............................... No CCX support
Mirroring........................................ Disabled
QoS Level........................................ Silver
1
No
Diff Serv Code Point (DSCP)......................
802.1P Priority Tag..............................
WMM Support......................................
Mobility State...................................
Mobility Foreign IP Address......................
Mobility Move Count..............................
--More-- or (q)uit
Security Policy Completed........................
Policy Manager State.............................
disabled
disabled
Disabled
Export Anchor
192.168.9.2
1
No
WEBAUTH_REQD
The security policy changes back to uncompleted and the client goes into the WEBAUTH_REQD state again.
Policy Manager Rule Created......................
NPU Fast Fast Notified...........................
Policy Type......................................
Encryption Cipher................................
Management Frame Protection......................
EAP Type.........................................
Interface........................................
VLAN.............................................
Client Capabilities:
CF Pollable................................
CF Poll Request............................
Short Preamble.............................
PBCC.......................................
Channel Agility............................
Listen Interval............................
Client Statistics:
Number of Bytes Received...................
Number of Bytes Sent.......................
Number of Packets Received.................
Number of Packets Sent.....................
Number of Policy Errors....................
--More-- or (q)uit
Radio Signal Strength Indicator............
Signal to Noise Ratio......................
Nearby AP Statistics:
TxExcessiveRetries: 0
Yes
Yes
N/A
None
No
Unknown
client1
601
Not
Not
Not
Not
Not
0
implemented
implemented
implemented
implemented
implemented
0
0
0
0
0
Unavailable
Unavailable
TxRetries: 0
RtsSuccessCnt: 0
RtsFailCnt: 0
TxFiltered: 0
TxRateProfile: [0,0,0,0,0,0,0,0,0,0,0,0]
(Cisco
(Cisco
(Cisco
(Cisco
Controller)
Controller)
Controller)
Controller)
>
>
>
>show wlan summary
Number of WLANs.................................. 3
WLAN ID
------1
2
3
WLAN Profile Name / SSID
------------------------------------serge-ssid-nds-1 / serge-ssid-nds-1
testssid / testssid
GuestTunnel / GuestTunnel
Status
-------Disabled
Disabled
Enabled
Interface Name
-------------------management
management
client1
(Cisco Controller) >
(Cisco Controller) >show wlan 3
WLAN Identifier..................................
Profile Name.....................................
Network Name (SSID)..............................
Status...........................................
MAC Filtering....................................
Broadcast SSID...................................
AAA Policy Override..............................
Number of Active Clients.........................
Exclusionlist Timeout............................
Session Timeout..................................
Interface........................................
3
GuestTunnel
GuestTunnel
Enabled
Disabled
Enabled
Disabled
1
60 seconds
1800 seconds
client1
The WLAN Id and the interface linked to the guest WLAN can be different between the foreign and the anchor
controller. All the other settings have to be the same.
The subnet/vlan where the guest client receives an IP address depends exclusively on the interface selected
in the WLAN settings of the anchor controller.
WLAN ACL.........................................
DHCP Server......................................
DHCP Address Assignment Required.................
Quality of Service...............................
WMM..............................................
CCX - AironetIe Support..........................
CCX - Gratuitous ProbeResponse (GPR).............
CCX - Diagnostics Channel Capability.............
Dot11-Phone Mode (7920)..........................
--More-- or (q)uit
Wired Protocol...................................
IPv6 Support.....................................
Peer-to-Peer Blocking Action.....................
Radio Policy.....................................
Local EAP Authentication.........................
Security
unconfigured
Default
Disabled
Silver (best effort)
Allowed
Enabled
Disabled
Disabled
Disabled
None
Disabled
Disabled
All
Disabled
802.11 Authentication:........................ Open System
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Disabled
CKIP ......................................... Disabled
IP Security................................... Disabled
IP Security Passthru.......................... Disabled
Web Based Authentication...................... Enabled
ACL............................................. Unconfigured
Web-Passthrough............................... Disabled
Conditional Web Redirect...................... Disabled
Auto Anchor................................... Enabled
Cranite Passthru.............................. Disabled
Fortress Passthru............................. Disabled
H-REAP Local Switching........................ Disabled
Infrastructure MFP protection................. Enabled (Global Infrastructure MFP Disabled)
--More-- or (q)uit
Client MFP.................................... Optional but inactive (WPA2 not configured)
Tkip MIC Countermeasure Hold-down Timer....... 60
Mobility Anchor List
WLAN ID
IP Address
--------------------3
192.168.0.25
Status
-----Up
(Cisco Controller) >
(Cisco Controller) >show mobility summary
Symmetric Mobility Tunneling (current) ..........
Symmetric Mobility Tunneling (after reboot) .....
Mobility Protocol Port...........................
Mobility Security Mode...........................
Default Mobility Domain..........................
Mobility Keepalive interval......................
Mobility Keepalive count.........................
Mobility Group members configured................
Disabled
Disabled
16666
Disabled
NDS-IL
10
3
2
Controllers configured in the Mobility Group
MAC Address
IP Address
Group Name
00:0b:85:40:8f:40
192.168.0.25
NDS-IL
00:15:2c:e8:b2:00
192.168.9.2
wlaaan
Status
Up
Up
The foreign and the anchor controller need to be both in the mobility list, but they do not have to be
necessarily in the same mobility group.
(Cisco Controller) >show interface detailed management
Interface Name...................................
MAC Address......................................
IP Address.......................................
IP Netmask.......................................
IP Gateway.......................................
VLAN.............................................
Active Physical Port.............................
Primary Physical Port............................
management
00:0b:85:40:8f:40
192.168.0.25
255.255.255.0
192.168.0.1
10
1
1
Backup Physical Port.............................
Primary DHCP Server..............................
Secondary DHCP Server............................
DHCP Option 82...................................
ACL..............................................
AP Manager.......................................
Guest Interface..................................
Unconfigured
192.168.0.1
Unconfigured
Disabled
Unconfigured
No
No
(Cisco Controller) >show interface detailed virtual
Interface Name................................... virtual
MAC Address...................................... 00:0b:85:40:8f:40
IP Address....................................... 1.1.1.1
The IP address of the virtual interface must be the same for the foreign and for the anchor controller.
DHCP Option 82...................................
Virtual DNS Host Name............................
AP Manager.......................................
Guest Interface..................................
Disabled
Disabled
No
No
(Cisco Controller) >show sysinfo
Manufacturer's Name..............................
Product Name.....................................
Product Version..................................
RTOS Version.....................................
Bootloader Version...............................
Build Type.......................................
Cisco Systems Inc.
Cisco Controller
4.2.130.0
4.2.130.0
4.2.112.0
DATA + WPS
System Name......................................
System Location..................................
System Contact...................................
System ObjectID..................................
IP Address.......................................
System Up Time...................................
w-4404-1
1.3.6.1.4.1.14179.1.1.4.3
192.168.0.25
38 days 1 hrs 3 mins 0 secs
Configured Country............................... Multiple Countries:BE,US
Operating Environment............................ Commercial (0 to 40 C)
Internal Temp Alarm Limits....................... 0 to 65 C
Internal Temperature............................. +38 C
State of 802.11b Network......................... Disabled
State of 802.11a Network......................... Disabled
--More-- or (q)uit
(Cisco Controller) >