WLSE can´t authenticate with WDS access Points

[a.vallejo]

I Have WLSE v. 2.11 and there is a problem with authentication between WLSE and WDS access points. I am using Cisco secure ACS v.3,3 and the infrastructure AP´s are being authenticated but the WLSE can´t authenticate with WDS and it´s impossible obtain information for the reports. I appreciate your comments,

[stschmidt]

If this is ACS version 3.3.3 there is a known bug which does not allow the completion of the authentication between WDS/WLSE. You can "debug radius" on the WDS primary device and will most likely see that there are access-request and challenges but no access-accepts. The workaround is to downgrade the ACS to 3.3.2. The fix will be in ACS 4.0.x.

If the version is not ACS 3.3.3 make sure the wlccp credentials in wlse match what is on radius. If the version of IOS on the WDS primary is 12.3(7)JA make sure there is a MAC address associated with the WLSE when doing a "sh arp". If there is not you can add a static arp entry pointing the WLSE IP/ARP to the default gateway of the WDS device or configure proxy arp on the same interface.

Hope this helps.

[barryfowles]

Hi,

I am getting a similar problem with a new WLSE Express with software ver 2.11. I have connected it up to an AP1200 set up as a WDS and the AP shows the NM as being not authenticated. But the WDS is showing up as an active session in the WLSE Express's AAA. I have checked the credentials match and have put a static arp entry in the AP for the WLSE Express. The AP1200 IOS was 12.3(4) and I downgraded to 12.2(15)XR2 (usually sound s/w) with same problem. Running debug on the AP for Radius shows unsupported AAA. I am not using a dns but should that make a difference?

Anyone have any tips or experienced similar problems?

Thanks for any help.

[stschmidt]

Can you enable "debug radius" on the WDS primary and allow the WDS to attempt to authenticate the WLSE. After the attempt can you attach the debug output here.

[barryfowles]

I hope this helps.

Thanks

[stschmidt]

This definitely looks like the same problem with the radius server I have seen before. There is no response to the access challenge. What do you see in the radius logs if you check them at the same time as the "debug radius" is running?

[hogoqo]

I have a similar problem. Same version of ACS and running 12.3(7)-JA1 on APs.My WLSE authenticates intermitently. Some times it will show authenticated and sometimes Not authenticated. I am running PEAP with WPA on my clients and once i enable WDS clients can authenticate but no traffic is passing through. Actually i have two SSID configured on different VLANs. One SSID has does not require authentication and the other requires PEAP. It works fine without WDS. Both SSIDs can not send traffic once i enable WDS. The clients show Registered on teh WDS but no traffic is passed from both SSIDs. Any ideas? Is WDS compatible with WPA.

[barryfowles]

I am unable you check the logs at the moment but it would help if you could verify the config procedure. The WDS AP has the MN IP address and a shared secret configured under WDS general setup. On the WLSE Express the matching configs. are placed in Device - Discover - WLCCP Credentials. Also on the WDS AP under security settings - servers I have entered the WLSE IP address and a shared key as the Radius server, is this info. entered on the WLSE AAA Admin Client as the WDS. Finally I'm not sure of the config for the WLSE as a client on the AAA server, i.e., Name and secret key.

I have a feeling this might be contributing to the problem.

[bmacmahon]

I just ran into the ACS version 3.3.3 and WDS/WLSE bug related problem. As a work around I enabled Radius on the WDS root AP, created a username/password for the infrastructure APs, and WLSE. Set the infrastructure group under the WDS settings to authenticate against the Radius AP and everything came right up.

[shh5455]

Make sure that you have SNMP set up correctly on the WLSM. I had this same problem too. If you have your APs in WLSE then use that same SNMP info in the WLSM. That fixed my problem. (Not sure why though).

Also, do a "no wlccp wnm ip address" and then add it back in to reset the WLSM/WLSE link.