Aironet 1141N only showing %DOT11-6-ROAMED messages

[justinfielding]

Hi,

I have a bit of a strange issue.  We have five 1141N's scattered around the office.  We had an issue reported whereby some people said that they could get to Google but Outlook would not connect to the mail server.  One of our junior engineers simply rebooted one of the access points in that area which seemed to resolve the issue, unfortunate as that doesn't really help work out what the issue was and prevent reoccurance.

Luckily I have all of the APs logging to a central syslog server.  Looking at the output of the AP in question prior to the reboot I noticed that I only see '

%DOT11-6-ROAMED messages' like so:

SCI-OS-AP05: Jul 24 08:11:12.342: %DOT11-6-ROAMED: Station 8c70.5a46.cc90 Roamed to 1caa.076f.f620

SCI-OS-AP05: Jul 24 08:10:29.295: %DOT11-6-ROAMED: Station 8c70.5a46.cc90 Roamed to 1caa.076f.f620

SCI-OS-AP05: Jul 24 08:10:23.443: %DOT11-6-ROAMED: Station 44d8.8422.9ab5 Roamed to 1caa.07c6.1580

SCI-OS-AP05: Jul 24 08:10:09.356: %DOT11-6-ROAMED: Station 040c.ce71.352a Roamed to 1caa.076f.f620

SCI-OS-AP05: Jul 24 08:09:45.948: %DOT11-6-ROAMED: Station 0021.6ab3.47b4 Roamed to 1caa.07c6.1580

SCI-OS-AP05: Jul 24 08:09:21.697: %DOT11-6-ROAMED: Station 8c70.5a93.b484 Roamed to 1caa.076f.f620

SCI-OS-AP05: Jul 24 08:08:57.492: %DOT11-6-ROAMED: Station 0021.6abb.7b1c Roamed to 1caa.076f.f620

SCI-OS-AP05: Jul 24 08:08:44.112: %DOT11-6-ROAMED: Station 60fb.4231.00b7 Roamed to 1caa.076f.f620

SCI-OS-AP05: Jul 24 08:08:32.152: %DOT11-6-ROAMED: Station 0021.6abb.7b1c Roamed to 1caa.076f.f620

SCI-OS-AP05: Jul 24 08:08:08.481: %DOT11-6-ROAMED: Station 8ca9.822c.4562 Roamed to 1caa.07c6.1580

SCI-OS-AP05: Jul 24 08:08:02.647: %DOT11-6-ROAMED: Station 1474.114f.d117 Roamed to 1caa.07c6.1580

SCI-OS-AP05: Jul 24 08:07:27.834: %DOT11-6-ROAMED: Station 30f7.c5de.59f6 Roamed to 1caa.07c6.1580

SCI-OS-AP05: Jul 24 08:07:17.854: %DOT11-6-ROAMED: Station 8c70.5a93.b484 Roamed to 1caa.076f.f620

SCI-OS-AP05: Jul 24 08:07:07.838: %DOT11-6-ROAMED: Station c09f.4256.b7f9 Roamed to 1caa.076f.f620

SCI-OS-AP05: Jul 24 08:07:05.090: %DOT11-6-ROAMED: Station 8ca9.822c.4562 Roamed to 1caa.07f4.09d0

This is unusual as I usually see a mix of 'DOT11-6-ASSOC', 'DOT11-6-ROAMED' and 'DOT11-6-DISASSOC' messages (which all of the other APs were still logging at this time).

Given this unusual behavious it does suggest that there was some kind of issue.  I wonder if anyone else has observed this behaviour or could suggest which debug flags to enable on the device in question so as to provide more useful information if this happens again in future.

Thanks,

JF.

[Scott Fella]

Do you have multiple SSID's and if they connect to one, is there any limitations where outlook would not be allowed? Almost seems like they might be connected to a different network.

Sent from Cisco Technical Support iPhone App

[justinfielding]

There are internal and guest networks but in theory their Outlook should connect via RPC tunnelling over HTTPS if they were on the guest network. I have asked the 1st liners to perform some basic troubleshooting if this happens again rather than just rebooting the nearest AP. Still the odd log pattern does suggest something was not quite as it should have been.

Sent from Cisco Technical Support iPad App

[Scott Fella]

Well the fact that Internet is working suggest nothing wrong with the AP. I would have them investigate further. Also look to see if there are multiple wireless profiles on the devices.

Sent from Cisco Technical Support iPhone App

[justinfielding]

It seems the claim that Google was working but not the connection to an internal server may have been a red herring, however this issue seems to have appeared on another AP in the same office today.  Same model of AP, same software version.  This time I have managed to get on the device before it's been rebooted.  Very odd.  Shows about 6 associated sessions  (three with each SSID) and then about 15 sessions under "Others:  (not related to any ssid)" with no IP and a state of "Auth_not_A".

I've checked through the syslog.  Very similar story to the last time this happened on the other AP.  All fine then one morning no authen/deauthen messages, just roam messages.  Have reset the radio interface with a shutdown/no shutdown on dot110 and now have 32 active (and working) sessions.  This points to the radio rather than an issue upstream with the switch, VLANs etc.