Using The Cli To Debug Mfp Issues; Configuring Client Exclusion Policies - Cisco 2100 Series Configuration Manual

Chapter 5 Configuring Security Solutions
BSSID
----------------- ----- ------------- ------------------ ------ ------------ ----- -------
00:0b:85:56:c1:a0
00:0b:85:56:c1:a0

Using the CLI to Debug MFP Issues

Use these commands if you experience any problems with MFP:
•

Configuring Client Exclusion Policies

Follow these steps to configure the controller to exclude clients under certain conditions using the
controller GUI.
Step 1 Click Security > Wireless Protection Policies > Client Exclusion Policies to open the Client Exclusion
Policies page.
Check any of these check boxes if you want the controller to exclude clients for the condition specified.
Step 2
The default value for each exclusion policy is enabled.
•
•
•
OL-17037-01
Radio Validator AP Last Source Addr
a jatwo-1000b 00:01:02:03:04:05 Infra
b/g jatwo-1000b 00:01:02:03:04:05 Infra
debug wps mfp ? {enable | disable}
where ? is one of the following:
client—Configures debugging for client MFP messages.
capwap—Configures debugging for MFP messages between the controller and access points.
detail—Configures detailed debugging for MFP messages.
report—Configures debugging for MFP reporting.
mm—Configures debugging for MFP mobility (inter-controller) messages.
Excessive 802.11 Association Failures—Clients are excluded on the sixth 802.11 association
attempt, after five consecutive failures.
Excessive 802.11 Authentication Failures—Clients are excluded on the sixth 802.11
authentication attempt, after five consecutive failures.
Excessive 802.1X Authentication Failures—Clients are excluded on the fourth 802.1X
authentication attempt, after three consecutive failures.
Configuring Client Exclusion Policies
Found Error Type Count Frame Types
Invalid MIC 183
Infra Out of seq
Infra Unexpected MIC 85 Reassoc Req
Client Decrypt err
Client Replay err
Client Invalid ICV
Client Invalid header174 Assoc Req
Client Brdcst disass 174 Reassoc Req
Out of seq
Client Not encrypted 174 Assoc Resp
Cisco Wireless LAN Controller Configuration Guide
Assoc Req
Probe Req
Beacon
4 Assoc Req
1974 Reassoc Req
Disassoc
74 Assoc Req
Probe Req
Beacon
174 Reassoc Req
Disassoc
Probe Req
Beacon
Disassoc
185 Reassoc Resp
Probe Resp
5-73