Cisco WLC 5508 LWAPP-3-INVALID_AID2

[omer shtivi]

Hi,

We have a cisco 5508 WLC with software version 7.4.121.0.

All our APs works in flexconnect mode, with local authentication for all SSIDs (PSK).

We keep receiving the following log messages:

*apfReceiveTask: Jul 09 07:34:49.464: #LWAPP-3-INVALID_AID2: spam_api.c:1370 Association identifier 3 for client 88:30:8a:5b:68:4e is already in use by 5c:f8:a1:13:85:9c
Jul 09 07:34:49.216: [ERROR] ews.c 871: ewsRun: Bad State - should be suspended: 0x0
*apfMsConnTask_4: Jul 09 07:34:47.710: #APF-3-AID_UPDATE_FAILED: apf_80211.c:9214 Error updating Association ID for REAP AP Client00:1f:27:55:51:40 - AID 7
*apfMsConnTask_4: Jul 09 07:34:47.710: #LWAPP-3-INVALID_AID2: spam_api.c:1370 Association identifier 7 for client 30:a8:db:6a:cf:fa is already in use by 60:21:c0:1d:91:f1
*apfReceiveTask: Jul 09 07:34:38.247: #LWAPP-3-INVALID_AID2: spam_api.c:1370 Association identifier 1 for client 58:94:6b:7a:c0:74 is already in use by dc:2b:61:33:ac:7e
*apfReceiveTask: Jul 09 07:34:29.425: #LWAPP-3-INVALID_AID2: spam_api.c:1370 Association identifier 14 for client 20:64:32:45:27:a2 is already in use by a0:ed:cd:c6:9c:e9
*apfReceiveTask: Jul 09 07:34:26.181: #LWAPP-3-INVALID_AID2: spam_api.c:1370 Association identifier 17 for client 84:00:d2:d2:42:19 is already in use by 3c:d0:f8:cd:67:86
*apfMsConnTask_4: Jul 09 07:34:22.942: #APF-3-AID_UPDATE_FAILED: apf_80211.c:9214 Error updating Association ID for REAP AP Client00:3a:98:c1:0f:70 - AID 9
*apfMsConnTask_4: Jul 09 07:34:22.942: #LWAPP-3-INVALID_AID2: spam_api.c:1370 Association identifier 9 for client c4:62:ea:8f:56:c1 is already in use by 60:21:c0:1d:91:f1
*apfMsConnTask_6: Jul 09 07:34:15.598: #APF-3-AID_UPDATE_FAILED: apf_80211.c:9214 Error updating Association ID for REAP AP Client64:d8:14:6e:28:a0 - AID 12

When we googled it we found the following bug:

CSCub21596

But in the bug affected version there is no 7.4.121.0

Any ideas?

[mohanak]

AP association counter versus WLC association counter do not fit.

CSCtn52995

Description

Symptom:HREAP - Reached max limit on the association ID for AP

or

Messages similar to the following in the msglog:

*apfMsConnTask_6: May 29 10:15:57.758: #APF-3-AID_UPDATE_FAILED: apf_80211.c:9041 Error updating Association ID for REAP AP Client00:ac:fd:00:8f:00 - AID 41
*apfMsConnTask_6: May 29 10:15:57.758: #LWAPP-3-INVALID_AID2: spam_api.c:1357 Association identifier 41 for client 00:d2:d1:01:11:f2 is already in use by 00:d2:d1:01:10:29

At this time, clients are unable to associate on the given BSSID on the given AP.
Conditions:0. FlexConnect AP.
1. Client 1 is associated to the controller with AID =1 on ssid x
2. Client 1 sends 802.11 Auth frame on ssid y, at this point AID = 1 is
freed at the AP. Auth frames are not honored at the controller, so
controller is not informed
3. No association frame arrives from client 1 at ssid 2
4. Client 2 associates to the AP and gets AID = 1
5. AP updates the controller about client 2 and AID =1, at this point the
controller adds duplicate entries and increments the count (controller
already has client 1 AID =1).

Counter is getting incremented and reaching 256.
It is due to the network conditions at the
customer site in which the 802.11 authentication frames are sent(sometimes
on different WLAN), but is not followed by association frames.

Known Affected Releases:

(8)

6.0(200.21)

7.0(230.0)

7.3(101.0)

7.4(100.103)

7.5(1.43)

7.5(1.22)

7.6(1.94)

7.5(1.72)

Known Fixed Releases:

(14)

10.2(1.5)

8.0(72.31)

7.6(95.14)

7.6(11.28)

7.6(93.8)

12.4(25e)JAO3

15.2(4)JB3

7.6(94.3)

7.6(93.10)

[omer shtivi]

Yes,

But this is not a known bug in version  7.4.121.0 .

Is it a bug? or just mis-configuration?

[omer shtivi]

Hi,

Any idea?

[Ravi Singh]

It's Bug Please open a case with TAC team at tac@cisco.com.

[Abha Jha]

Problem Summary : AP association counter versus WLC association counter do not fit. 
Workaround : upgrade software
Solution : upgrade software
Root Cause : CSCtn52995