Controllerless Networks

We have 16 IAP-105-US Installed at a co-op 60 and over apartment complex.

8-On east side of building Connected to a Comcast Business Class Modem.. 

8-On west side building.. Connected to a Comcast Business Class Modem.. 

Since updating to firmware : 6.2.1.0-3.4.0.3_40346

We had MANY DHCP TIMEOUTS – Also people are having a hard time connecting ..

– Really NEVER saw this with other Firmware Ver’s – Not Sure What Ver’s Were OK !

AP’s Are setup to hand out DCHP … And I see from the ALERTS – DCHP Timeout

When I login to the IAP web page I see 2-3 people that have a 0.0.0.0 IP

 

Really Could Use Some Help! Suggestions ? Please ?

 

version 6.2.1.0-3.4.0
virtual-controller-country US
virtual-controller-key c1abcf9d01b1e68bf1f8c96187eab3bcf1d26ddc9b33c365e2
name Instant-CD:EF:AE
terminal-access
ntp-server time.nist.gov
clock timezone Central-Time -06 00
clock summer-time CDT recurring second sunday march 02:00 first sunday november 02:00
rf-band all

allow-new-aps
allowed-ap 24:de:c6:cd:ef:ae
allowed-ap 24:de:c6:cd:ef:e8
allowed-ap 24:de:c6:cd:ef:b5
allowed-ap 24:de:c6:cd:f0:04
allowed-ap 24:de:c6:cd:f0:ba
allowed-ap 24:de:c6:cd:f0:0a
allowed-ap 24:de:c6:cd:f0:86

arm
 wide-bands 5ghz
 min-tx-power 127
 max-tx-power 127
 band-steering-mode disable
 air-time-fairness-mode default-access
 client-aware
 scanning
 spectrum-load-balancing
rf dot11g-radio-profile
 spectrum-monitor
 interference-immunity 4

rf dot11a-radio-profile
 spectrum-monitor
 interference-immunity 4


syslog-level warn ap-debug 
syslog-level warn network 
syslog-level warn security 
syslog-level warn system 
syslog-level warn user 
syslog-level warn user-debug 
syslog-level warn wireless 






mgmt-user admin 240403e085c4fb83b72d66d1d1e5b7c536e9717c34d5d36a

wlan access-rule default_wired_port_profile
 index 0
 rule any any match any any any permit

wlan access-rule Green-House-Village
 index 1
 rule any any match any any any permit

wlan access-rule wired-instant
 index 2
 rule 10.1.10.10 255.255.255.255 match tcp 80 80 permit
 rule 10.1.10.10 255.255.255.255 match tcp 4343 4343 permit
 rule any any match udp 67 68 permit
 rule any any match udp 53 53 permit

wlan ssid-profile Green-House-Village
 enable
 index 0
 type guest
 essid Green-House-Village
 wpa-passphrase 3f05e201865e34794899ce5695172bd1f580305235a85fb4
 opmode wpa-psk-tkip,wpa2-psk-aes
 max-authentication-failures 0
 vlan guest
 rf-band all
 captive-portal disable
 dtim-period 1
 inactivity-timeout 1000
 broadcast-filter none
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

auth-survivability cache-time-out 24



wlan external-captive-portal
 server localhost
 port 80
 url "/"
 auth-text "Authenticated"


blacklist-time 3600
auth-failure-blacklist-time 3600

ids classification

ids
 wireless-containment none


wired-port-profile default_wired_port_profile
 switchport-mode trunk
 allowed-vlan all
 native-vlan 1
 shutdown
 access-rule-name default_wired_port_profile
 speed auto
 duplex full
 no poe
 type employee
 captive-portal disable
 no dot1x

wired-port-profile wired-instant
 switchport-mode access
 allowed-vlan all
 native-vlan guest
 no shutdown
 access-rule-name wired-instant
 speed auto
 duplex auto
 no poe
 type guest
 captive-portal disable
 no dot1x


enet0-port-profile default_wired_port_profile

uplink
 preemption
 enforce none
 failover-internet-pkt-lost-cnt 10
 failover-internet-pkt-send-freq 30
 failover-vpn-timeout 180

airgroup
 disable

airgroupservice airplay
 disable
 description AirPlay

airgroupservice airprint
 disable
 description AirPrint

 

#3600

Please open a case for this.

I have opened a ticket :  Case # 1481656 : DHCP TIMEOUT issue: [ ref:_00D3008G4._50040VpEjw:ref ]

 

However .. No One seems to beable to fix this .. nor help.

 

1. Updated and Down Graded to different firmware ver's

2. Set =  broadcast filter all - And ARP

3. Set All IAP's to a static IP's Instead of DHCP

 

Does anyone know how to set the IAP DHCP Lease times  ???

 

Does Anyone Have a Suggestions ??????

 

 

 

version 6.3.1.0-4.0.0
virtual-controller-country US
virtual-controller-key c1abcf9d01b1e68bf1f8c96187eab3bcf1d26ddc9b33c365e2
name Instant-CD:EF:AE
terminal-access
led-off
ntp-server time.nist.gov
clock timezone Central-Time -06 00
rf-band all

allow-new-aps
allowed-ap 24:de:c6:cd:ef:ae
allowed-ap 24:de:c6:cd:ef:e8
allowed-ap 24:de:c6:cd:ef:b5
allowed-ap 24:de:c6:cd:f0:04
allowed-ap 24:de:c6:cd:f0:ba
allowed-ap 24:de:c6:cd:f0:0a
allowed-ap 24:de:c6:cd:f0:86



arm
 wide-bands 5ghz
 min-tx-power 127
 max-tx-power 127
 band-steering-mode prefer-5ghz
 air-time-fairness-mode default-access
 client-aware
 scanning

rf dot11g-radio-profile
 interference-immunity 4

rf dot11a-radio-profile
 interference-immunity 4

ip dhcp pool
 lease-time 60


syslog-level warn ap-debug 
syslog-level warn network 
syslog-level warn security 
syslog-level warn system 
syslog-level warn user 
syslog-level warn user-debug 
syslog-level warn wireless 






mgmt-user admin 9af989b52feb59a734571041deea557eb3734fff626efa0f

wlan access-rule Green-House-Village
 index 0
 rule any any match any any any permit

wlan access-rule default_dev_rule
 index 1
 rule any any match any any any permit

wlan access-rule default_wired_port_profile
 index 2
 rule any any match any any any permit

wlan access-rule wired-instant
 index 3
 rule 10.1.10.11 255.255.255.255 match tcp 80 80 permit
 rule 10.1.10.11 255.255.255.255 match tcp 4343 4343 permit
 rule any any match udp 67 68 permit
 rule any any match udp 53 53 permit

wlan ssid-profile Green-House-Village
 enable
 index 0
 type guest
 essid Green-House-Village
 wpa-passphrase be85d10c2930763a6a3f9882479a4460b20ae79b28ab9f19
 opmode wpa-psk-tkip,wpa2-psk-aes
 max-authentication-failures 0
 vlan guest
 rf-band all
 captive-portal disable
 dtim-period 1
 inactivity-timeout 1800
 broadcast-filter arp
 blacklist
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

auth-survivability cache-time-out 24



wlan external-captive-portal
 server localhost
 port 80
 url "/"
 auth-text "Authenticated"


blacklist-time 3600
auth-failure-blacklist-time 3600

ids classification

ids
 wireless-containment none


wired-port-profile default_wired_port_profile
 switchport-mode trunk
 allowed-vlan all
 native-vlan 1
 shutdown
 access-rule-name default_wired_port_profile
 speed auto
 duplex full
 no poe
 type employee
 captive-portal disable
 no dot1x

wired-port-profile wired-instant
 switchport-mode access
 allowed-vlan all
 native-vlan 1
 no shutdown
 access-rule-name wired-instant
 speed auto
 duplex auto
 no poe
 type employee
 captive-portal disable
 no dot1x


enet0-port-profile default_wired_port_profile

uplink
 preemption
 enforce none
 failover-internet-pkt-lost-cnt 10
 failover-internet-pkt-send-freq 30
 failover-vpn-timeout 180
 failover-internet-check-timeout 10


airgroup
 disable

airgroupservice airplay
 disable
 description AirPlay

airgroupservice airprint
 disable
 description AirPrint

 

 

Can you share the output of "show tech-support" from the VC? Are the 16 APs organized into two separate clusters, each with 8 APs?

THANK YOU FOR THE REPLY !

My Customer is getting very un-happy with me and the system :(

 

We have ( 2 ) Total IAP-105-us Systems ..  Both Setup Exactly the Same ... Not ( 8 )  My Bad Typing Sorry.

 

Organized into two separate clusters, each with 7 APs?

 

7 - IAP-105's On east side of building .. Connected to a Comcast Business Class Modem and 8-Port 10/100Mbps PoE Switch - TPE-S80

7 - IAP-105's On west side building .. Connected to a Comcast Business Class Modem and 8-Port 10/100Mbps PoE Switch - TPE-S80

 

What is: APAS provision failed, code: fail-prov-no-rule   ??????

 

Please look at : Console.txt  < Attched as Link - 60 pages

https://www.dropbox.com/s/hcjsbj3ct2tiqgf/Console.txt

 

 

show log system

12/9/13 Console 
51/60 
Dec 9 15:08:04 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:08:08 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:08:40 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 94:44:52:9e:71:70 connect fail because DHCP request timed out 
Dec 9 15:11:41 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 04:54:53:ed:78:e2 connect fail because DHCP request timed out 
Dec 9 15:13:07 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:13:11 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:18:10 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:18:13 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:22:41 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 94:44:52:9e:71:70 connect fail because DHCP request timed out 
Dec 9 15:22:41 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 00:26:5e:07:08:c1 connect fail because DHCP request timed out 
Dec 9 15:23:12 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:23:16 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:26:42 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.12: Client d4:9a:20:5c:17:0b connect fail because DHCP request timed out 
Dec 9 15:28:16 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:28:19 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:30:42 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 94:44:52:9e:71:70 connect fail because DHCP request timed out 
Dec 9 15:33:19 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:33:23 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:33:30 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.16: Client 00:22:6b:a3:10:5c connect fail because DHCP request timed out 
Dec 9 15:36:42 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 94:44:52:9e:71:70 connect fail because DHCP request timed out 
Dec 9 15:37:42 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.12: Client 28:6a:ba:35:af:65 connect fail because DHCP request timed out 
Dec 9 15:38:21 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:38:25 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:38:42 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.12: Client 00:22:69:61:bd:10 connect fail because DHCP request timed out 
Dec 9 15:42:43 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 94:44:52:9e:71:70 connect fail because DHCP request timed out 
Dec 9 15:43:24 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:43:27 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:44:13 cli[1110]: <341102> |AP 1-East@10.1.10.11 cli| Incorrect format for message type 126:220:46:10:10.1.10.15:15200. 
Dec 9 15:45:30 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.16: Client 18:e7:f4:b0:47:3a connect fail because DHCP request timed out 
Dec 9 15:48:26 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:48:30 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:49:34 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.11: Client 7c:c3:a1:b5:7a:37 connect fail because DHCP request timed out 
Dec 9 15:49:43 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client b8:e8:56:69:94:68 connect fail because DHCP request timed out 
Dec 9 15:51:43 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.12: Client 88:cb:87:e6:f1:87 connect fail because DHCP request timed out 
Dec 9 15:53:28 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:53:32 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:57:44 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 04:54:53:ed:78:e2 connect fail because DHCP request timed out 
Dec 9 15:57:44 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 94:44:52:9e:71:70 connect fail because DHCP request timed out 
Dec 9 15:58:31 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 15:58:35 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 15:58:38 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.15: Client 00:12:17:9b:4a:f8 connect fail because DHCP request timed out 
Dec 9 16:03:33 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 16:03:37 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 16:04:36 cli[1110]: <341102> |AP 1-East@10.1.10.11 cli| Incorrect format for message type 126:220:46:10:10.1.10.15:15200. 
Dec 9 16:07:44 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.12: Client 00:1b:9e:bd:1d:50 connect fail because DHCP request timed out 
Dec 9 16:08:35 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 16:08:39 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 16:11:39 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.15: Client a4:d1:d2:0b:95:8a connect fail because DHCP request timed out 
Dec 9 16:11:45 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 94:44:52:9e:71:70 connect fail because DHCP request timed out 
Dec 9 16:13:38 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 16:13:38 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.17: Client 70:de:e2:a1:26:7e connect fail because DHCP request timed out 
Dec 9 16:13:38 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 16:13:41 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 16:15:45 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.14: Client 00:26:5e:07:08:c1 connect fail because DHCP request timed out 
Dec 9 16:16:32 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.16: Client 00:22:6b:a3:10:5c connect fail because DHCP request timed out 
Dec 9 16:16:45 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.12: Client d4:9a:20:5c:17:0b connect fail because DHCP request timed out 
Dec 9 16:18:40 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 16:18:44 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 16:23:43 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 16:23:46 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 16:26:39 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.15: Client 18:e7:f4:b0:47:3a connect fail because DHCP request timed out 
Dec 9 16:28:45 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| Isc_send_request 
Dec 9 16:28:49 cli[1110]: <341005> |AP 1-East@10.1.10.11 cli| APAS provision failed, code: fail-prov-no-rule 
Dec 9 16:29:46 cli[1110]: <341004> |AP 1-East@10.1.10.11 cli| AP 10.1.10.12: Client 68:a8:6d:4e:bb:de connect fail because DHCP request timed out

 

Could the wired network be using the subnet 172.31.98.0? Could we try manually configure the DHCP pool to a different subnet (say 192.168.10.0), to see if anything changes?

No ... the Comcast modem uses : 10.1.10.19/250 - 255.255.255.0 - 10.1.10.1  - See Pic

I have set ALL IAP's To a Static IP To get from Comast Modem To See If that Helped Used: 10.1.10.11/17

( It Was Set As DHCP )   DID NOT SEEM TO HELP!   :(

 

What is: APAS provision failed, code: fail-prov-no-rule   ??????

How to set the IAP DHCP Lease times  ??????

 

 

 

 

I understand your frustration and appreciate your patience in bearing with us. I know it may still take a few more tries before we get this working but I am confident that it will be resolved in the end.

For now, could you recall which subnet was the client getting its IP from before the recent upgrade that caused all these problems? Is it 192.168.10.0?

Thanks,

Yan

Hmmm ... I have no Idea any more ..

( Bangs Head On Desk )

 

I think ORG Firmware Gave Out : 192.168.1.-

The Newest Firmware Gives Out : 172.31.98.-

 

But I see a Few People Complaining about DHCP On The IAP-105's Here On This Fourm ..

 

I have a feeling that the newest Firmware has a DHCP bug!

Because I never had problems before with DHCP ... After Updating Firmware .. Is When problems started with DHCP.

( Now No Matter What Ver Firmware I Try It Still Has Problems )

 

I Also think maybe whats happing is .. the IAP-105 is running out of IP's to hand out

Because the DHCP Lease Time is not working or not set  ???

 

Anyway ...

 

Do we know what is : APAS provision failed, code: fail-prov-no-rule   ???

How do we set the IAP DHCP Lease times  ???

 

 

 

 

 

 

The lease time can be set in the UI via 'System > Show Advanced Options > DHCP'. You can also try changing the subnet here back to 192.168.10.0, mask 255.255.255.0, to see if it helps.

The 'APAS provision failed' message is due to the fact that this network is provisioned manually instead of via our cloud-based activation system to provision your IAPs, so there is no cause for concern.

THANK YOU FOR YOU REPLY ...

 

I have set the DHCP Time Out To 1-Hour at about 10am today.

I found this today about 10AM But was not sure that was the correct place.

( This does not seemed to help )   :(

 

Would be be so kind and help me fill in whats needed ?

 

Domain Name =  ?

DNS Servers = ?

Network = ?

Mask =?

 

 

I would leave domain name and DNS servers blank, but fill in "192.168.10.0" for the network and "255.255.255.0" for the mask, to see if there is any improvement.

Ok I set the DHCP In Settings ...

I also set the DNS to OPEN DNS ..

I was Kinda worried about not setting a DNS Server LOL

 

Seems Weird .. that the people connecting are now getting very HIGH IP's  like : .199 or .170  ect

( See Pic )

 

 

 

Hmmmm .. Still getting DHCP Time Outs Ater Setting up DHCP In Settings :(

( See Pic )

 

Did the number of timeouts reduce at all or everything looks about the same?

BTW if we do not configure a DNS server in the DHCP pool, the IAP will give out its own DNS server to the clients.

Its the same amount  :(

 

From the screen-shot, we can see every client in alert table can get IP address finally because they displayed with clients in client table.This alert in this scenario is harmless. And it is trying to tell us there was DHCP request timed out ever when client cannot get DHCP request in 30s in that time.

 

How about we focus on the clients that still in 0.0.0.0 status? Can we know which kinds of client they are? And how about the its wireless enviornment that time? And get show tech-support in that AP that the 0.0.0.0 client tring to connect.

 

If we did not set DHCP lease time in system, the default value for DHCP Server is 12 hours.

Yes .. you are correct ... clients do get an IP after a while ..

( However this was never an issue before firmware update .. Never saw DHCP error untill now )

 

This is because of me rebooting the AP's

However after 1-3 days they start getting 0.0.0.0 IPs

 

The Orignal 7 IAP-105's on the WEST Side of Bulding

Have been installed for 8-9 months with NO PROBLEMS - NO DHCP ERRORS - NO REBOOTS - WORKED VERY WELL

( Till Firmware Update - 1 month ago )

 

Worked So Good In Fact .. The Customer Bought 7 more for east side

 

Here is a link to ALL IAP's TECH Dump .. 14 - Txt Docs

https://www.dropbox.com/s/w002cc98d5b4252/SYSTEM-DUMP-FILES.zip

 

here is what it looks like when that happens ...

( Older Pic from 11-26-13  - 4:57 PM )

 

 

From the currently log, there is only one client connected to 6-West cannot connect to IAP because of wrong passphase, its mac-address is 34:23:ba:3d:c2:3f,

 

Dec 6 08:38:55 wpa2-key1 <- 34:23:ba:3d:c2:3f 6c:f3:7f:c4:c7:12 - 117
Dec 6 08:38:55 wpa2-key2 -> 34:23:ba:3d:c2:3f 6c:f3:7f:c4:c7:12 - 117 mic failure

 

Can we get the same logs when lots of clients cannot connect to IAP? We'd like to analyse what happen that time.

 

I Will Update when I see this happen ...

I have Updated to this firmware today ...

 

Build Time:	2013-11-26 12:32:36 PST
Version:	6.3.1.1-4.0.0.1_41049

 

Still Getting DHCP Errors .. However sofar no 0.0.0.0 Ip's

Here is the log from Client 94:44:52:9e:71:70 - Who Showed up as a DHCP Timeout Error

 

show datapath user
Datapath User Table Entries
---------------------------
Flags: P - Permanent, W - WEP, T- TKIP, A - AESCCM
       R - ProxyARP to User, N - VPN, L - local, I - Intercept
FM(Forward Mode): S - Split, B - Bridge, N - N/A

       IP              MAC           ACLs    Contract   Location  Age    Sessions   Flags     Vlan  FM
---------------  -----------------  -------  ---------  --------  -----  ---------  -----     ----  --
10.1.10.14       24:DE:C6:CD:F0:04   105/0      0/0     0         1        1/65535  P           1   N
0.0.0.0          B8:E8:56:69:94:68   131/0      0/0     0         0        0/65535  P        3333   B
192.168.10.251   94:44:52:9E:71:70   131/0      0/0     0         0       62/65535           3333   B
192.168.10.1     24:DE:C6:CD:F0:04   105/0      0/0     0         656      0/65535  P        3333   B
192.168.10.65    04:54:53:ED:78:E2   131/0      0/0     0         23       2/65535           3333   B
192.168.10.71    B8:E8:56:69:94:68   131/0      0/0     0         12       2/65535           3333   B
0.0.0.0          04:54:53:ED:78:E2   131/0      0/0     0         0        0/65535  P        3333   B
0.0.0.0          94:44:52:9E:71:70   131/0      0/0     0         0        0/65535  P        3333   B
0.0.0.0          24:DE:C6:CD:F0:04   105/0      0/0     0         0        1/65535  P           1   N
end of show datapath user
========================================================

<active_objs><num_objs><active_slabs><num_slabs>Dec 10 14:18:43  stm[1117]: stm_send_sta_offline: Sending sta offline msg to CLI0, mac='94:44:52:9e:71:70'
Dec 10 14:18:43  cli[1109]: <541004>  |AP 4-East@10.1.10.14 cli|  recv_sta_offline: receive station msg, mac-94:44:52:9e:71:70 bssid-00:00:00:00:63:6c ssid-.


Dec 10 14:18:43  stm[1117]: update_ip_mac_role_acl_vlan: 12587: user entry deleted for '192.168.10.251' '94:44:52:9e:71:70'
Dec 10 14:18:43  sapd[1113]: sapd_proc_stm_reset_key: Got STM Reset key bss=24:de:c6:5f:00:42 mac=94:44:52:9e:71:70, idx=0
Dec 10 14:18:53  sapd[1113]: sapd_papi_rcv_cb: Packet received from unknown port 15208
Dec 10 14:19:46  stm[1117]: add dhcp ageout alert >>>> 
Dec 10 14:19:54  sapd[1113]: sapd_papi_rcv_cb: Packet received from unknown port 15208
Dec 10 14:20:50  stm[1117]: stm_alert_send: 2313: send 1 new alerts to send to master
Dec 10 14:20:54  sapd[1113]: sapd_papi_rcv_cb: Packet received from unknown port 15208
Dec 10 14:21:54  sapd[1113]: sapd_papi_rcv_cb: Packet received from unknown port 15208
Dec 10 14:23:54  sapd[1113]: sapd_papi_rcv_cb: Packet received from unknown port 15208
Dec 10 14:24:40  stm[1117]: VLAN_HIGHER_PRECEDENCE_THAN_STORED: 1020: vlan_rule_index=ff, sap_sta->vlanhow=ff, precedence_result=1
Dec 10 14:24:40  stm[1117]: __HIGHER_PRECEDENCE_COMPARE: 997: matched_rule_index=37fff, sap_sta->acl_rule_index=0, precedence_result=1
Dec 10 14:24:40  stm[1117]: stm_send_sta_update: Sending sta update msg to CLI0, mac='94:44:52:9e:71:70'
Dec 10 14:24:40  cli[1109]: <541004>  |AP 4-East@10.1.10.14 cli|  recv_sta_online: receive station msg, mac-94:44:52:9e:71:70 bssid-24:de:c6:5f:00:42 ssid-Green-House-Village.
Dec 10 14:24:40  cli[1109]: <541004>  |AP 4-East@10.1.10.14 cli|  recv_stm_sta_update: receive station msg, mac-94:44:52:9e:71:70 bssid-24:de:c6:5f:00:42 ssid-Green-House-Village.
Dec 10 14:24:40  stm[1117]: recv_radius_acct_multi_session_id: 14254: got mac='94:44:52:9e:71:70', name='', start_time='1386703314 (Tue Dec 10 13:21:54 2013 )'
Dec 10 14:24:40  stm[1117]: stm_start_acct_for_post_1xauth_user: 14295: ip not ready for sta '94:44:52:9e:71:70' 
Dec 10 14:24:40  stm[1117]: wpa2_encrypt_key() called
Dec 10 14:24:40  sapd[1113]: sapd_proc_stm_reset_key: Got STM Reset key bss=24:de:c6:5f:00:42 mac=94:44:52:9e:71:70, idx=0
Dec 10 14:24:40  sapd[1113]: sapd_proc_stm_keys:klen=16, bssid=24:de:c6:5f:00:42, mac=94:44:52:9e:71:70, standby=0
Dec 10 14:24:40  sapd[1113]: sap_recv_keys: default type=30816
Dec 10 14:24:40  sapd[1113]: do_madwifi_set_key:isgroup=0 isigtk=0 dev=aruba102 bssid=24:de:c6:5f:00:42 klen=16 idx=65535
Dec 10 14:24:40  sapd[1113]: sapd_proc_stm_txkey: Got STM Tx key msg
Dec 10 14:24:43  stm[1117]: rap_bridge_user_handler: 11687: rbs update: flags:1/1 aclnum:131 ip:192.168.10.251 mac:94:44:52:9e:71:70 bssid:24:de:c6:5f:00:42 vlan:3333 wired:0
Dec 10 14:24:43  stm[1117]: rap_bridge_user_handler: 11706: user entry created for '192.168.10.251' '94:44:52:9e:71:70'
Dec 10 14:24:43  stm[1117]: stm_start_acct_for_post_1xauth_user: 14314: not authenticated for sta '94:44:52:9e:71:70' 
Dec 10 14:24:43  stm[1117]: rap_bridge_user_handler: 11687: rbs update: flags:1/2 aclnum:131 ip:192.168.10.251 mac:94:44:52:9e:71:70 bssid:24:de:c6:5f:00:42 vlan:3333 wired:0
Dec 10 14:24:43  stm[1117]: rap_bridge_user_handler: 11706: user entry created for '192.168.10.251' '94:44:52:9e:71:70'
Dec 10 14:24:43  stm[1117]: stm_start_acct_for_post_1xauth_user: 14314: not authenticated for sta '94:44:52:9e:71:70' 
Dec 10 14:24:54  sapd[1113]: sapd_papi_rcv_cb: Packet received from unknown port 15208
Dec 10 14:25:16  stm[1117]: Client 94:44:52:9e:71:70 connect successfully
Dec 10 14:25:54  sapd[1113]: sapd_papi_rcv_cb: Packet received from unknown port 15208
Dec 10 14:26:54  sapd[1113]: sapd_papi_rcv_cb: Packet received from unknown port 15208
Dec 10 14:28:54  sapd[1113]: sapd_papi_rcv_cb: Packet received from unknown port 15208
Dec 10 14:30:15  stm[1117]: VLAN_HIGHER_PRECEDENCE_THAN_STORED: 1020: vlan_rule_index=ff, sap_sta->vlanhow=ff, precedence_result=1
Dec 10 14:30:15  stm[1117]: __HIGHER_PRECEDENCE_COMPARE: 997: matched_rule_index=37fff, sap_sta->acl_rule_index=0, precedence_result=1
Dec 10 14:30:15  stm[1117]: stm_send_sta_update: Sending sta update msg to CLI0, mac='b8:e8:56:69:94:68'

 

 

Thanks the update.

As we said before, the alert is harmless because clients could get IP address. 

UPDATE:

 

I was able to talk on the phone with: Joe Powell | Territory Manager Minnesota, North Dakota & South Dakota
And Elliott Patterson Systems Engineer | Aruba Networks Minnesota

 

Elliott Patterson - Systems Engineer | Aruba Networks Minnesota
Came to the job site! At 5pm - 5:30pm at night to help me!
( Way Beyond The Call Of Duty And Very Very Nice Of Him To Help! )

 

He found that the configuration files on BOTH East and West Side was somehow corrupted.
Both East and West Side Systems were NOT Working - Client DHCP and IAP to Modem DHCP Was Not Functioning Correctly.
( Possibly got corrupted from firmware updates ??? )

 

After trying to fix the IAP AND CLIENT DHCP problems for about an hour or more .. He / We were unable to correct the problems!
We both decided to DELETE ALL CONFIGURATION FILES AND FACTORY RESET ALL IAP-105'S

 

We Then Updated Both West and East Side IAP's With New Firmware ...
Build Time: 2013-11-26 12:32:36 PST - Version: 6.3.1.1-4.0.0.1_41049
And Then Re-Setup Both: West And East Systems With New Configurations.

 

We Setup the configuration file to use the MODEM Assigned DHCP
We Are Not Using the IAP-105 Virtual Controller Assigned DHCP

 

We Are Now Getting: Very Little DHCP ERRORS AND ( 0-2 ) DHCP ALERTS IN THE WEB GUI
Were As We Were Getting: MANY DHCP ALERTS AND 0.0.0.0 IP FAILS ( 2-6 ) IN THE WEB GUI
And clients are not getting 0.0.0.0 Ips any more!

 

The Above Actions Seems To Have Fixed The Problems We Were Having!
( Well So far Anyway  LOL  - Time Will Tell If This Was A Permanent Fix )

 

I REALLY WANT TO THANK: Elliott Patterson And Joe Powell And Everyone At Aruba Networks
For going way beyond the call of duty. And Helping Us Resolve This Problem!

FWIW, we are seeing the DHCP timeout alerts in the logs of an IAP-105 group comprised of 5 APs.  The VC has two SSIDs, and the timeouts occur on both.  Both SSIDs get DHCP from the network.  

 

We are running 6.2.1.0-3.4.0.3_40346.