Troubleshooting Client Connectivity from WLC
discusses how to use a WLC as a troubleshooting tool to diagnose problems with wireless clients.
- Most of your time managing and monitoring a wireless network will be spent in the WLC GUI.
- You can access a wealth of troubleshooting information from the controller, if you know the client’s MAC address.
Troubleshooting Client Connectivity from WLC
When one or more network users report that they are having problems, your first course of action should be to gather more information, ask questions, and try to notice patterns or similarities in the answers you receive.
- Information from the user such as, “I cannot connect” or “The Wi-Fi is down” might mean that the user’s device cannot associate, cannot get an IP address, or cannot authenticate.
- If you get reports from many people in the same area, perhaps an AP is misconfigured or malfunctioning.
- Reports from many areas or from a single SSID may indicate problems with a controller configuration.
Conditions for a Successful Wireless Association
If you receive a report of only one wireless user having problems, it might not make sense to spend time troubleshooting a controller, where many users are supported. Instead, you should focus on that one user’s client device and its interaction with an AP.
conditions that must be met for a successful association:
- The client is within RF range of an AP and asks to associate.
- The client authenticates.
- The client requests and receives an IP address.
GUI
The default screen displays network summary dashboard information on the right portion and monitoring tools in the list on the left.
Searching for a Client in the WLC GUI
- If you know a specific wireless client’s MAC address, you can enter it into the search bar at the top right of the screen.
- MAC 78:4b:87:7b:af:96 is the target of the search. Because that MAC known to the controller, a match is shown with a client icon below the search bar.
Client Search Results
From this output, you can see many details about the client device listed in the left portion of the screen, and you can see connectivity and application information displayed on the right.
Checking the Client’s Connection Status
Before a controller will permit a client to fully associate with a BSS, the client must progress through a sequence of states. Each state refers to a policy that the client must meet before moving on to the next state:
- Start – Client activity has just begun.
- Association – The client has requested 802.11 authentication and association with an AP.
- Authentication – The client must pass a L2 PSK or 802.1x authentication policy.
- DHCP – The WLC is waiting to learn the client’s IP address from a DHCP server.
- Online – The client has passed L2 and L3 policies, successfully associated, and can pass traffic.
Checking the Client’s Association and Signal Status
- Information such as the wireless client’s username (if known), hostname, MAC, wireless connection uptime, and the SSID used can be viewed in the left portion of the Client View.
- In Figure, the username is not known because the client does not authenticate itself with a username.
WLC Information About a Poorly Performing Client
- In Figure 21-5 the AP is receiving the client’s signal strength at −76 dBm and the SNR at 18 dB (both rather low values), causing the current data rate to fall to 29 Mbps. A quick look at the Connection Score value reveals a low 20%.
- It is safe to assume that the client has moved too far away from the AP where it is associated, causing the signal strength to become too low to support faster performance.
WLC Information About a Poorly Performing Client
- Clicking on the Connection Score value displays further details in a popup window.
- The 20% value is the result of the client’s current data rate (29 Mbps) divided by the lower of the AP or client maximum data rate (144 Mbps).
- The Client Actual Rate and Connection Score values are indicators of current performance, and the other graphs show what is possible on the AP and the client.
Checking the Client’s Mobility State
- The WLC Client Search information includes a handy end-to-end graphical representation of a client’s wireless connection.
- When you scroll down below the General and Connectivity sections, you see a topology diagram.
- The WLC’s name, management IP address, and model are displayed. Following the connection toward the right, you can see the AP name, IP address, and model where the client is associated. Moving further to the right, you can see that the client is associated to the AP. The client device is displayed with identifying information such as the device name, device type, VLAN number, and IP address.
Checking the Client’s Wireless Policies
- By scrolling further down in the Client Search information, you can verify information about network, QoS, security, and other policies that affect the client.
- You can quickly learn the client’s IP address, VLAN number, QoS policy level used by the WLAN, security policy (WPA2), encryption cipher (CCMP AES), and authentication type (PSK with no EAP).
Testing a Wireless Client
- When you search for a specific client, the information displayed is of a static nature because it is obtained as a snapshot at the time of the search. The client search will need to be refreshed to get up-to-date data. You can also obtain dynamic data by testing a client in real time.
- By scrolling to the bottom of the client search information, you can see the Client Test section, which offers links to four client testing tools:
Ping Test: The WLC sends five ICMP echo packets to the client’s IP address and measures the response time. 
Connection: The WLC debugs the client for up to three minutes and checks each policy step as the client attempts to join the wireless network.
Figure 21-10 shows a client that has successfully joined, and Figure 21-11 shows a client that failed Layer 2 authentication with a pre-shared key because its key did not match the key configured on the WLC.
Event Log: The WLC collects and displays a log of events as the client attempts to join the wireless network. This information is very complex and detailed and is usually more suited for Cisco TAC engineers.
Packet Capture: The WLC enables a wireless packet capture at the AP where the client attempts to join. The captured data is saved to a specified FTP server, where it can be downloaded and analyzed using a packet analysis tool like Wireshark or LiveAction Omnipeek.
Troubleshooting Connectivity at the AP
- In cases where you get reports from multiple users who are all having problems in the same general area, you might need to focus your efforts on an AP.
- The problem could be as simple as a defective radio, where no clients are receiving a signal. In that case, you might have to go onsite to confirm that the transmitter is not working correctly.