Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 

Wireless Client frequent disconnects RLDP and or Rogue Containment activat on Local mode

     

     

    Introduction

    Wireless Client frequent disconnects when RLDP and or Rogue Containment activated on Local mode AP

    Symptom

    Wireless Client frequently disconnects.

    Condition/Environment

    RLDP and Rogue Containment were found to be enabled on WLC. This affects client disconnection, same is demonstrated using logs and debugs.

    Fix/Workaround

    Disable RLDP
    Disable Rogue containment
    Use Monitor mode for RLDP
    Don't contain APs if they're not malicious

    Note: can't use Monitor mode only for Rogue containment, nearby detecting AP will contain the Rogue, However preference is given to nearby Monitor mode AP.

    issue: client frequent disconnectsFound RLDP and Rogue containment were enabled with a Rogue being contained by cisco AP(s). With these config enabled what we're seeing is an expected behavior.
    
    5500 - 7.3.101.0
    AP - 12 - 3602i - local mode
    
     http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080b40901.shtml 
    *During the RLDP process, the AP is unable to serve clients. This will negatively impact performance and connectivity for local mode APs.
    
    *Because containment uses a portion of the managed AP's radio time to send the de-authentication frames, the performance to both data and voice clients is negatively impacted by up to 20%. For data clients, the impact is reduced throughput. For voice clients, containment can cause interruptions in conversations and reduced voice quality. Containment works by spoofing de-authentication packets with the spoofed source address of the rogue AP so that any clients associated are kicked off.
    
    Effect of RLDP(AP log showing Radio Resets):-
    We can see the Radio going up and down. At this time it can't talk to wireless client.
    *Apr 30 09:41:03.847:  LINK-5-CHANGED  Interface Dot11Radio0, changed state to reset
    *Apr 30 09:41:04.839:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to down
    *Apr 30 09:41:04.871:  LINK-6-UPDOWN  Interface Dot11Radio0, changed state to up
    *Apr 30 09:41:04.875: d8c7.c8a4.ba30-no legacy rates; default to lowest CCK/OFDM rate
    *Apr 30 09:41:05.871:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to up
    *Apr 30 09:41:20.119:  LWAPP-5-RLDP  RLDP stopped on slot 0.
    *Apr 30 09:41:20.263:  LINK-6-UPDOWN  Interface Dot11Radio0, changed state to down
    *Apr 30 09:41:20.271:  LINK-5-CHANGED  Interface Dot11Radio0, changed state to reset
    *Apr 30 09:41:21.263:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to down
    *Apr 30 09:41:21.311:  LINK-6-UPDOWN  Interface Dot11Radio0, changed state to up
    *Apr 30 09:41:22.311:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to up
    *Apr 30 20:35:59.683:  LWAPP-5-RLDP  RLDP started on slot 0.
    *Apr 30 20:35:59.687:  LINK-6-UPDOWN  Interface Dot11Radio0, changed state to down
    *Apr 30 20:35:59.695:  LINK-5-CHANGED  Interface Dot11Radio0, changed state to reset
    *Apr 30 20:36:00.687:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to down
    *Apr 30 20:36:00.719:  LINK-6-UPDOWN  Interface Dot11Radio0, changed state to up
    *Apr 30 20:36:00.723: c08a.de01.7698-no legacy rates; default to lowest CCK/OFDM rate
    *Apr 30 20:36:01.719:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to up
    *Apr 30 20:36:16.279:  LWAPP-5-RLDP  RLDP stopped on slot 0.
    *Apr 30 20:36:16.283:  LINK-6-UPDOWN  Interface Dot11Radio0, changed state to down
    *Apr 30 20:36:16.291:  LINK-5-CHANGED  Interface Dot11Radio0, changed state to reset
    *Apr 30 20:36:17.283:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to down
    *Apr 30 20:36:17.319:  LINK-6-UPDOWN  Interface Dot11Radio0, changed state to up
    *Apr 30 20:36:18.319:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to up
    *Apr 30 23:36:28.247:  LWAPP-5-RLDP  RLDP started on slot 0.
    *Apr 30 23:36:28.255:  LINK-6-UPDOWN  Interface Dot11Radio0, changed state to down
    *Apr 30 23:36:28.263:  LINK-5-CHANGED  Interface Dot11Radio0, changed state to reset
    *Apr 30 23:36:29.255:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to down
    *Apr 30 23:36:29.283:  LINK-6-UPDOWN  Interface Dot11Radio0, changed state to up
    *Apr 30 23:36:29.287: 0026.3e8f.5802-no legacy rates; default to lowest CCK/OFDM rate
    *Apr 30 23:36:30.283:  LINEPROTO-5-UPDOWN  Line protocol on Interface Dot11Radio0, changed state to up
    
    Effect of containment(AP debug showing AP sending bcast deauth packets):-
    we can see the containment sent by AP. At this time AP can't talk to client.
    DOC-HQ-AP18.1#sh deb
    DTLS:
      DTLS ERROR debugging is on
    LWAPP:
      LWAPP Client ERROR display debugging is on
    CAPWAP:
      CAPWAP Client ERROR display debugging is on
      CAPWAP IDS Rogue Containment debugging is on
      CAPWAP IDS Active Rogue Containment debugging is on
      CAPWAP console CLI allow/disallow debugging is on
    
    *May  1 22:07:08.651: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:09.135: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:09.623: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:10.139: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:10.623: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:11.143: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:11.663: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:12.159: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:12.631: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:13.127: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:13.635: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:14.155: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:14.667: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:15.179: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:15.691: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON
    
    *May  1 22:07:16.191: IDS ROGUE CONTAIN: 00:1C:10:AA:15:4E: Normal AP, Sending Deauth Bcast on channel = 6, Seq = 0, MIC ON

    Fix/Workaround

    Disable RLDP
    Disable Rogue containment
    Use Monitor mode for RLDP
    Don't contain APs if they're not malicious.

    http://www.cisco.com/en/US/prod/collateral/modules/ps12859/ps12867/white_paper_c11-723471.html


    the current deployment guideline is to use one monitor mode access point for every five local mode access points In order to get similar detection times, we recommend that two out of five local mode access points.

    More Information

    Cisco Aironet Access Point Module for Wireless Security and Spectrum Intelligence (WSSI)

    1517
    Views
    0
    Helpful
    0
    Comments