04-03-2012 08:33 AM - edited 07-03-2021 09:56 PM
In my trap logs, I'm seeing this message over and over: AAA Authentication Failure for UserName:username@company.com User Type: WLAN USER
The user in question no longer works with the company. How do I track were this authentication attempt is coming from? I tried looking at the syslogs but couldn't find any information that would help.
I'm running a WLC 5508 with 7.2.103.0. Thanks.
04-03-2012 08:38 AM
If you have NCS / WCS track the user name or device mac address and it should show you history for that user / mac address including aps associated and times. I hope this helps!
04-03-2012 08:55 AM
As much as I would love to use NCS / WCS, we unfortunatly don't have either at this time.
04-03-2012 12:57 PM
If the client is online you can do a client debug and see what ap its asscoiated to. If its not online, you will not be able to track it without WCS/NCS.
Are you using radius for authenctation ? If so there should be some information like time and attempts in the logs ..
04-03-2012 08:55 AM
To piggy back on George if you have NCS / WCS installed not only will you get past historical data of what AP they were connected on you can do a single device on demand location tracking using your configured floor plans with AP placements.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide