Wireless Access

Hi All

We are having an issue with deauth issues on our Controller which is resulting in clients not able to authenticate. I have done some debugging and see the following:

Nov 21 21:02:34               stm[841]: <501105> <NOTI> |AP emfihelnp57003@10.102.148.152 stm| Deauth from sta: 5c:87:9c:b9:49:43: AP 10.102.148.152-6c:f3:7f:17:aa:18-emfihelnp57003 Reason Unspecified Failure

Nov 21 21:02:34               stm[841]: <501065> <DBUG> |AP emfihelnp57003@10.102.148.152 stm| handle_deauth: bss(6c:f3:7f:17:aa:18), before send_wifi_frame reason 1536, internal 0

I am also seeing this a ‘show auth-tracebuf mac’ –

22:10:52:Nov 21 21:28:52  dot1x-timeout          *  e4:a7:a0:98:d4:6a  6c:f3:7f:17:aa:18           8    3     server timeout

22:10:52:Nov 21 21:28:52  dot1x-timeout          *  e4:a7:a0:98:d4:6a  6c:f3:7f:17:aa:18           9    2     station timeout

Does anyone have any experience or insights with these sort of errors?

Many thanks

If this is 802.1x, make sure that your radius server certificate did not expire.

Thanks for the response.

It is just associated with one office. Most other sites aren't having the same issue with the certificates. What is odd is that the actual requests (we are using user/computer certs for authentication) do make it to the NPS server, but for whatever reason the entries aren't added, so this ties in with the time outs on Aruba. 

When did it start happening?  Can the same users connect at a different office?  Please post the untruncated "show auth-tracebuf"

Also can we get a "show ap client trail-info" and a "show ap debug client-stats client-mac" for that client?

It started when we moved our Checkpoint equipment out and replaced this with Cisco. Once we did this, we started to see issues, but the network paths are correct and other active directory features work fine.

So once I put the certificate into the two factor, neither report in to the NPS server. It just spins its wheels and doesn't do anything.

Attached is my output for your commands. At the moment, some of the output is blank as the AP itself isn't actually processing much outside of the Guest wireless.

Thanks!

Attachment(s)

10.102.255.37 (10.102.255.37)--13-47.txt   29 KB 1 version

BTW - I am very much a novice with the Aruba stuff, so some of the output will reflect that ;-)

So there is a firewall between the remote site and the headend site?  Is there a controller locally at the site or is it at the headend?

Those commands need a mac address to obtain more specific information about the clients.