WPA2-PSK 和开放式身份验证（以思科 5760 WLC 配置为例）

下载选项

PDF (428.7 KB)
在各种设备上使用 Adobe Reader 查看
ePub (347.2 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上使用各种应用查看
Mobi (Kindle) (432.6 KB)
在 Kindle 设备上查看或在多个设备上使用 Kindle 应用查看

已更新: 2015 年 11 月 5 日

文档 ID:116880

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍在无线局域网 (WLAN) 中使用 Wi-FiProtected Access 2 (WPA2) 的优势。本文档提供两个在 WLAN 上实施 WPA2 的配置示例：

配置 WPA2 预共享密钥 (PSK)
开放式身份验证配置

先决条件

要求

Cisco 建议您了解以下主题：

无线保护访问 (WPA)
WLAN 安全解决方案

使用的组件

本文档中的信息基于以下软件和硬件版本：

思科 5700 系列无线局域网控制器 (WLC) 与思科 IOS® XE 软件版本 3.3
Cisco Aironet 3600 系列轻型接入点
Microsoft Windows 7 本地无线请求方

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您使用的是真实网络，请确保您已经了解所有命令的潜在影响。

配置

注意：使用命令查找工具（仅限注册用户）可获取有关本部分所使用命令的详细信息。

网络图

此图显示了网络图：

图 1. 网络图

使用 CLI 进行 WPA2-PSK 配置

本示例描述了使用命令行界面 (CLI) 为用于客户端的 VLAN 配置 DHCP 探听的过程。

VLAN20用于客户端，池配置在同一WLC上。Cisco 5700 WLC的TenGigabitEthernet1/0/1连接到上行链路交换机。如果在 WLC 之外的服务器上或外部 DHCP 服务器上配置了 DHCP 服务器，则必须信任 DHCP 探听和中继信息。

ip device tracking
ip dhcp snooping vlan 12,20,30,40
ip dhcp snooping
!
ip dhcp pool vlan20
 network 20.20.20.0 255.255.255.0
 default-router 20.20.20.1

interface Vlan20
 ip address 20.20.20.1 255.255.255.0

interface TenGigabitEthernet1/0/1
 switchport trunk native vlan 12
 switchport mode trunk
 ip dhcp relay information trusted
 ip dhcp snooping trust

wlan wpa2psk 1 wpa2psk
 client vlan 20
 no security wpa akm dot1x
 security wpa akm psk set-key ascii 0 Cisco123
 no shutdown

注意：如果您的配置在 PSK 密码中包含空格，请使用“密码 PSK”格式。如果还使用 GUI 进行配置，则应使用相同的格式。

示例

security wpa akm psk set-key ascii 0 "Cisco 123"

使用 GUI 进行 WPA2-PSK 配置

完成以下步骤以在 WLC GUI 中配置 WPA2 PSK：

导航到配置 > 无线> WLAN> WLANs，并创建新的 WLAN：
启用 WPA2，并将其映射到所需接口：
点击安全选项卡，选中 WPA2 策略复选框，然后选择 AES 作为 WPA2 加密。在身份验证密钥管理下拉列表中，选择 PSK。输入客户端将使用的 PSK 以进行连接：

使用 CLI 进行开放式身份验证配置

这是如何使用 CLI 为用于客户端的 VLAN 配置 DHCP 探听的示例；在本示例中，VLAN20 用于客户端。池在同一 WLC 上配置。

5760 WLC 的 TenGigabitEthernet1/0/1 连接到上行链路交换机。如果在 WLC 之外的服务器上或外部 DHCP 服务器上配置了 DHCP 服务器，则必须信任 DHCP 探听和中继信息。

ip device tracking
ip dhcp snooping vlan 12,20,30,40
ip dhcp snooping
!
ip dhcp pool vlan20
 network 20.20.20.0 255.255.255.0
 default-router 20.20.20.1

interface Vlan20
 ip address 20.20.20.1 255.255.255.0

interface TenGigabitEthernet1/0/1
 switchport trunk native vlan 12
 switchport mode trunk
 ip dhcp relay information trusted
 ip dhcp snooping trust

wlan open 5 open
 client vlan VLAN0020
 no security wpa
 no security wpa akm dot1x
 no security wpa wpa2
 no security wpa wpa2 ciphers aes
 session-timeout 1800
 no shutdown

使用 GUI 进行开放式身份验证配置

本程序介绍如何在 WLC GUI 中配置开放式身份验证：

导航到配置 > 无线> WLAN> WLANs，并创建新的 WLAN：
单击“Security”选项卡。在第 2 层选项卡和第 3 层选项卡上，将所有内容都设置为 none。这是配置结果的示例：

验证

使用本部分可确认配置能否正常运行。

确认 WPA2-PSK 客户端已连接：

确认客户端已连接到开放式身份验证：

故障排除

本部分提供的信息可用于对配置进行故障排除。

注意：

命令输出解释程序工具（仅限注册用户）支持某些 show 命令。使用输出解释器工具来查看 show 命令输出的分析。

使用 debug 命令之前，请参阅有关 Debug 命令的重要信息。

这是有用的调试和跟踪命令的输出示例：

debug client mac XXXX.XXXX.XXXX

Controller#sh debugging 
Nova Platform:
    dot11/state debugging is on 
    pem/events debugging is on 
    client/mac-addr debugging is on 
    dot11/detail debugging is on 
    mac/ filters[string 0021.5c8c.c761] debugging is on 
    dot11/error debugging is on 
    dot11/mobile debugging is on 
    pem/state debugging is on 

set trace group-wireless-client filter mac XXXX.XXXX.XXXX
set trace wcm-dot1x event filter mac XXXX.XXXX.XXXX
set trace wcm-dot1x aaa filter mac XXXX.XXXX.XXXX
set trace aaa wireless events filter mac XXXX.XXXX.XXXX
set trace access-session core sm filter mac XXXX.XXXX.XXXX
set trace access-session method dot1x filter XXXX.XXXX.XXXX

*Sep  1 05:55:01.321: 0021.5C8C.C761 Association received from mobile on AP  
   C8F9.F983.4260  1 wcm: i.D^Iw for client
*Sep  1 05:55:01.321: 0021.5C8C.C761 qos upstream policy is unknown and 
   downstream policy is unknown 1 wcm: r client
*Sep  1 05:55:01.321: 0021.5C8C.C761 apChanged 0 wlanChanged 1 mscb ipAddr 
   20.20.20.3, apf RadiusOverride 0x0, numIPv6Addr=0 1 wcm: nJ^Iwy_status 0 
   attr len^G$8\227v^K
*Sep  1 05:55:01.321: 0021.5C8C.C761 Applying WLAN policy on MSCB. 1 wcm:  
   ipAddr 20.20.20.3, apf RadiusOverride 0x0, numIPv6Addr=0
*Sep  1 05:55:01.321: 0021.5C8C.C761 Scheduling deletion of Mobile Station: 1 
   wcm:   (callerId: 50) in 1 seconds
*Sep  1 05:55:01.321: 0021.5C8C.C761 Disconnecting client due to switch of 
   WLANs from 6(wep) to 5(open) 1 wcm: 
*Sep  1 05:55:02.193: 0021.5C8C.C761 apfMsExpireCallback (apf_ms.c: 1 wcm: 664)
   Expiring Mobile!
*Sep  1 05:55:02.193: 0021.5C8C.C761 apfMsExpireMobileStation (apf_ms.c: 1 wcm:
   6953) Changing state for mobile  0021.5C8C.C761  on AP  C8F9.F983.4260  from
   Associated to Disassociated 
*Sep  1 05:55:02.193: 0021.5C8C.C761 Sent Deauthenticate to mobile on BSSID  
   C8F9.F983.4260  slot 1(caller apf_ms.c: 1 wcm: 7036)
*Sep  1 05:55:02.193: 0021.5C8C.C761 apfMsExpireMobileStation (apf_ms.c: 1 wcm:
   7092) Changing state for mobile  0021.5C8C.C761  on AP  C8F9.F983.4260  from
   Disassociated to Idle 
*Sep  1 05:55:02.193:  0021.5C8C.C761  20.20.20.3 RUN (20) Deleted mobile LWAPP
   rule on AP [ C8F9.F983.4260 ] 1 wcm: 5C8C.C761  on AP  C8F9.F983.4260  from 
   Disassociated to Idle 
*Sep  1 05:55:02.193:  0021.5C8C.C761  20.20.20.3 RUN (20) FastSSID for the 
   client [ C8F9.F983.4260 ] NOTENABLED 1 wcm: C.C761  on AP  C8F9.F983.4260  
   from Disassociated to Idle 
*Sep  1 05:55:02.193: 0021.5C8C.C761 Incrementing the Reassociation Count 1 for
   client (of interface VLAN0020) 1 wcm: D
*Sep  1 05:55:02.193: 0021.5C8C.C761 Clearing Address 20.20.20.3 on mobile  1 
   wcm: for client (of interface VLAN0020)
*Sep  1 05:55:02.193: PEM recv processing msg Del SCB(4)  1 wcm: 0.20.3 on 
   mobile 
*Sep  1 05:55:02.193:  0021.5C8C.C761  20.20.20.3 RUN (20) Skipping TMP rule 
   add 1 wcm: lient (of interface VLAN0020)
*Sep  1 05:55:02.193:  0021.5C8C.C761  20.20.20.3 RUN (20) Change state to 
   DHCP_REQD (7) last state RUN (20) 1 wcm:
*Sep  1 05:55:02.193: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  Client 1 m_vlan 20 
   Radio iif id 0xbfcdc00000003a bssid iif id 0x8959800000004a, bssid 
   C8F9.F983.4260
*Sep  1 05:55:02.193: 0021.5C8C.C761 WCDB_AUTH: 1 wcm:  Adding opt82 len 0
*Sep  1 05:55:02.193: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  Suppressing SPI 
   (client pending deletion) pemstate 7 state LEARN_IP(2) vlan 20 client_id 
   0xac70800000004b mob=Local(1) ackflag 2 dropd 0, delete 1
*Sep  1 05:55:02.193: 0021.5C8C.C761 Sending SPI spi_epm_epm_terminate_session 
   successfull 1 wcm:  pemstate 7 state LEARN_IP(2) vlan 20 client_id 
   0xac70800000004b mob=Local(1) ackflag 2 dropd 0, delete 1
*Sep  1 05:55:02.194: 0021.5C8C.C761 Sending SPI spi_epm_epm_terminate_session 
   successfull 1 wcm:  pemstate 7 state LEARN_IP(2) vlan 20 client_id 
   0xac70800000004b mob=Local(1) ackflag 2 dropd 0, delete 1
*Sep  1 05:55:02.194: 0021.5C8C.C761 Deleting wireless client; Reason code 0, 
   Preset 1, AAA cause 1 1 wcm:  7 state LEARN_IP(2) vlan 20 client_id 
   0xac70800000004b mob=Local(1) ackflag 2 dropd 0, delete 1
*Sep  1 05:55:02.194: 0021.5C8C.C761 WCDB_DEL: 1 wcm:  Successfully sent
*Sep  1 05:55:02.194: 0021.5C8C.C761  Expiring mobile state delete 1 wcm: on 
   code 0, Preset 1, AAA cause 1
*Sep  1 05:55:02.194:  0021.5C8C.C761  0.0.0.0 DHCP_REQD (7) Handling pemDelScb
   Event skipping delete 1 wcm:  state LEARN_IP(2) vlan 20 client_id 
   0xac70800000004b mob=Local(1) ackflag 2 dropd 0, delete 1
*Sep  1 05:55:02.197: 0021.5C8C.C761 WCDB SPI response msg handler client code 
   1 mob state 1 1 wcm: g delete
*Sep  1 05:55:02.197: 0021.5C8C.C761 apfProcessWcdbClientDelete: 1 wcm:  Delete
   ACK from WCDB.
*Sep  1 05:55:02.197: 0021.5C8C.C761 WCDB_DELACK: 1 wcm:  wcdbAckRecvdFlag 
   updated
*Sep  1 05:55:02.197: 0021.5C8C.C761 WCDB_DELACK: 1 wcm:  Client IIF Id dealloc
   SUCCESS w/ 0xac70800000004b.
*Sep  1 05:55:02.197: 0021.5C8C.C761 Invoked platform delete and cleared handle
   1 wcm: w/ 0xac70800000004b.
*Sep  1 05:55:02.197: 0021.5C8C.C761 Deleting mobile on AP  C8F9.F983.4260 (1)
   1 wcm: w/ 0xac70800000004b.
*Sep  1 05:55:02.197: 0021.5C8C.C761 Unlinked and freed mscb 1 wcm: 
   8F9.F983.4260 (1) 
*Sep  1 05:55:02.197: WCDB_IIF: 1 wcm:  Ack Message ID: 0xac70800000004b code
   1003
*Sep  1 05:55:02.379: 0021.5C8C.C761 Adding mobile on LWAPP AP  C8F9.F983.4260
   (1)  1 wcm: xac7080000.D^Iwb.
*Sep  1 05:55:02.379: 0021.5C8C.C761  Creating WL station entry for client -  
   rc 0 1 wcm: 
*Sep  1 05:55:02.379: 0021.5C8C.C761 Association received from mobile on AP  
   C8F9.F983.4260  1 wcm: 0.D^Iwb.
*Sep  1 05:55:02.379: 0021.5C8C.C761 qos upstream policy is unknown and 
   downstream policy is unknown 1 wcm: 
*Sep  1 05:55:02.379: 0021.5C8C.C761 apChanged 0 wlanChanged 0 mscb ipAddr 
   0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0 1 wcm: \2105HnJ^Iwlient_id
   0xac708000^G$8\227v^K
*Sep  1 05:55:02.379: 0021.5C8C.C761 Applying WLAN policy on MSCB. 1 wcm:  
   ipAddr 0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
*Sep  1 05:55:02.379: 0021.5C8C.C761 Applying WLAN ACL policies to client 1 
   wcm:  0.0.0.0, apf RadiusOverride 0x0, numIPv6Addr=0
*Sep  1 05:55:02.379: 0021.5C8C.C761 No Interface ACL used for Wireless client 
   in WCM(NGWC) 1 wcm: usOverride 0x0, numIPv6Addr=0
*Sep  1 05:55:02.379: 0021.5C8C.C761 Applying site-specific IPv6 override for 
   station  0021.5C8C.C761  - vapId 5, site 'default-group', interface 
   'VLAN0020' 1 wcm: 
*Sep  1 05:55:02.379: 0021.5C8C.C761 Applying local bridging Interface Policy 
   for station  0021.5C8C.C761  - vlan 20, interface 'VLAN0020' 1 wcm: erface 
   'VLAN0020'
*Sep  1 05:55:02.379: 0021.5C8C.C761 STA - rates (8): 1 wcm:  
   140 18 152 36 176 72 96 108 0 0 0 0 0 0 0 0
*Sep  1 05:55:02.379: 0021.5C8C.C761 new capwap_wtp_iif_id b6818000000038, 
   sm capwap_wtp_iif_id 0 1 wcm: 8C.C761  - vlan 20, interface 'VLAN0020'
*Sep  1 05:55:02.379: 0021.5C8C.C761 WCDB_ADD: 1 wcm:  Radio IIFID 
   0xbfcdc00000003a, BSSID IIF Id 0xbb30c000000046, COS 4
*Sep  1 05:55:02.379: Load Balancer: 1 wcm:  Success, Resource allocated are: 
   Active Switch number: 1, Active Asic number : 0, Reserve Switch number 0 
   Reserve Asic number 0. AP Asic num 0
*Sep  1 05:55:02.379: 0021.5C8C.C761 WCDB_ADD: 1 wcm:  Anchor Sw  1, Doppler 0
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_ALLOCATE: 1 wcm:  Client IIF Id alloc
   SUCCESS w/ client 8e7bc00000004d (state 0).
*Sep  1 05:55:02.380: 0021.5C8C.C761 iifid Clearing Ack flag 1 wcm: F Id alloc
   SUCCESS w/ client 8e7bc00000004d (state 0).
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_ADD: 1 wcm:  Adding opt82 len 0
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_ADD: 1 wcm:  Cleaering Ack flag
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_ADD: 1 wcm:  ssid open bssid
   C8F9.F983.4260 vlan 20 auth=ASSOCIATION(0) wlan(ap-group/global) 5/5 
   client 0 assoc 1 mob=Unassoc(0) radio 1 m_vlan 20 ip 0.0.0.0 src 
   0xb6818000000038 dst 0x0 cid 0x8e7bc00000004d glob rsc id 14dhcpsrv  
   0.0.0.0  ty
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_ADD: 1 wcm:  mscb iifid 
   0x8e7bc00000004d msinfo iifid 0x0
*Sep  1 05:55:02.380:  0021.5C8C.C761  0.0.0.0 START (0) Initializing policy 1 
   wcm: info iifid 0x0
*Sep  1 05:55:02.380:  0021.5C8C.C761  0.0.0.0 START (0) Change state to 
   AUTHCHECK (2) last state AUTHCHECK (2) 1 wcm: -group/global) 5/5 client 0 
   assoc 1 mob=Unassoc(0) radio 1 m_vlan 20 ip 0.0.0.0 src 0xb6818000000038 
   dst 0x0 cid 0x8e7bc00000004d glob rsc id 14dhcpsrv  0.0.0.0  ty
*Sep  1 05:55:02.380:  0021.5C8C.C761  0.0.0.0 AUTHCHECK (2) Change state to 
   L2AUTHCOMPLETE (4) last state L2AUTHCOMPLETE (4) 1 wcm:  5/5 client 0 assoc 
   1 mob=Unassoc(0) radio 1 m_vlan 20 ip 0.0.0.0 src 0xb6818000000038 dst 0x0 
   cid 0x8e7bc00000004d glob rsc id 14dhcpsrv  0.0.0.0 ty
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  Client 1 m_vlan 20 
   Radio iif id 0xbfcdc00000003a bssid iif id 0xbb30c000000046, bssid 
   C8F9.F983.4260
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_AUTH: 1 wcm:  Adding opt82 len 0
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_LLM: 1 wcm:  NoRun Prev Mob 0, Curr 
   Mob 0 llmReq 1, return False
*Sep  1 05:55:02.380: 0021.5C8C.C761 auth state 1 mob state 0 setWme 0 wme 1 
   roam_sent 0 1 wcm: rn False
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  auth=L2_AUTH(1) vlan 
   20 radio 1 client_id 0x8e7bc00000004d mobility=Unassoc(0) src_int 
   0xb6818000000038 dst_int 0x0 ackflag 0 reassoc_client 0 llm_notif 0 ip  
   0.0.0.0 ip_learn_type UNKNOWN
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  In L2 auth but l2ack 
   waiting lfag not set,so set
*Sep  1 05:55:02.380:  0021.5C8C.C761  0.0.0.0 L2AUTHCOMPLETE (4) DHCP Not 
   required on AP  C8F9.F983.4260  vapId 5 apVapId 5for this client 1 wcm: 
   6818000000038 dst_int 0x0 ackflag 0 reassoc_client 0 llm_notif 0 i$=6v.0.0.0
   it^_Dv^\7HnP6v^D6Hl5Ht^_Dv$6H8^ r^D6H>&5v8^ r^D6H>&5v^D6Ht^M^Lw^\7H8^ r
*Sep  1 05:55:02.380: WCDB_IIF: 1 wcm:  Ack Message ID: 0x8e7bc00000004d code 
   1001
*Sep  1 05:55:02.380: 0021.5C8C.C761 Not Using WMM Compliance code qosCap 00 1
   wcm: quired on AP  C8F9.F983.4260  vapId 5 apVapId 5for this client
*Sep  1 05:55:02.380:  0021.5C8C.C761  0.0.0.0 L2AUTHCOMPLETE (4) Plumbed 
   mobile LWAPP rule on AP  C8F9.F983.4260  vapId 5 apVapId 5 1 wcm: client
*Sep  1 05:55:02.380:  0021.5C8C.C761  0.0.0.0 L2AUTHCOMPLETE (4) Change state 
   to DHCP_REQD (7) last state DHCP_REQD (7) 1 wcm:  apVapId 5
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  Client 1 m_vlan 20 
   Radio iif id 0xbfcdc00000003a bssid iif id 0xbb30c000000046, bssid 
   C8F9.F983.4260
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_AUTH: 1 wcm:  Adding opt82 len 0
*Sep  1 05:55:02.380: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  Suppressing SPI 
   (Mobility state not known) pemstate 7 state LEARN_IP(2) vlan 20 client_id 
   0x8e7bc00000004d mob=Unassoc(0) ackflag 1 dropd 0
*Sep  1 05:55:02.380: 0021.5C8C.C761 Incrementing the Reassociation Count 1 for
   client (of interface VLAN0020) 1 wcm: EARN_IP(2) vlan 20 client_id 
   0x8e7bc00000004d mob=Unassoc(0) ackflag 1 dropd 0
*Sep  1 05:55:02.380: 0021.5C8C.C761 apfPemAddUser2 (apf_policy.c: 1 wcm: 161) 
   Changing state for mobile  0021.5C8C.C761  on AP  C8F9.F983.4260  from Idle 
   to Associated 
*Sep  1 05:55:02.380: 0021.5C8C.C761 Scheduling deletion of Mobile Station: 1 
   wcm:   (callerId: 49) in 1800 seconds
*Sep  1 05:55:02.380: 0021.5C8C.C761 Ms Timeout = 1800, Session Timeout = 1800
   1 wcm: llerId: 49) in 1800 seconds
*Sep  1 05:55:02.381: 0021.5C8C.C761 Sending Assoc Response to station on BSSID
   C8F9.F983.4260  (status 0) ApVapId 5 Slot 1 1 wcm: .F983.4260  from Idle to
   Associated 
*Sep  1 05:55:02.381: 0021.5C8C.C761 apfProcessAssocReq (apf_80211.c: 1 wcm: 
   5260) Changing state for mobile  0021.5C8C.C761  on AP  C8F9.F983.4260  
   from Associated to Associated 
*Sep  1 05:55:02.381:  0021.5C8C.C761  0.0.0.0 DHCP_REQD (7) pemAdvanceState2: 
   1 wcm:  MOBILITY-INCOMPLETE with state 7. 
*Sep  1 05:55:02.381:  0021.5C8C.C761  0.0.0.0 DHCP_REQD (7) pemAdvanceState2: 
   1 wcm:  MOBILITY-INCOMPLETE with state 7. 
*Sep  1 05:55:02.381:  0021.5C8C.C761  0.0.0.0 DHCP_REQD (7) pemAdvanceState2: 
   1 wcm:  MOBILITY-COMPLETE with state 7. 
*Sep  1 05:55:02.381:  0021.5C8C.C761  0.0.0.0 DHCP_REQD (7) State Update from 
   Mobility-Incomplete to Mobility-Complete, mobility role=Local, client 
   state=APF_MS_STATE_ASSOCIATED 1 wcm:  1 dropd 0
*Sep  1 05:55:02.381:  0021.5C8C.C761  0.0.0.0 DHCP_REQD (7) pemAdvanceState2 
   3611, Adding TMP rule 1 wcm: o Mobility-Complete, mobility role=Local, 
   client state=APF_MS_STATE_ASSOCIATED
*Sep  1 05:55:02.381:  0021.5C8C.C761  0.0.0.0 DHCP_REQD (7) Adding Fast Path 
   rule on AP  C8F9.F983.4260 , slot 1 802.1P = 0 1 wcm: role=Local, client 
   state=APF_MS_STATE_ASSOCIATED
*Sep  1 05:55:02.381:  0021.5C8C.C761  0.0.0.0 DHCP_REQD (7) Successfully 
   plumbed mobile rule  1 wcm: F9.F983.4260 , slot 1 802.1P = 0^M 
*Sep  1 05:55:02.381: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  Client 1 m_vlan 20 
   Radio iif id 0xbfcdc00000003a bssid iif id 0xbb30c000000046, bssid 
   C8F9.F983.4260
*Sep  1 05:55:02.381: 0021.5C8C.C761 WCDB_AUTH: 1 wcm:  Adding opt82 len 0
*Sep  1 05:55:02.381: 0021.5C8C.C761 WCDB_LLM: 1 wcm:  NoRun Prev Mob 0, Curr 
   Mob 1 llmReq 1, return False
*Sep  1 05:55:02.381: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  Suppressing SPI (ACK 
   message not recvd) pemstate 7 state LEARN_IP(2) vlan 20 client_id 
   0x8e7bc00000004d mob=Local(1) ackflag 1 dropd 1
*Sep  1 05:55:02.381: 0021.5C8C.C761 Error updating wcdb on mobility complete  
   1 wcm: not recvd) pemstate 7 state LEARN_IP(2) vlan 20 client_id 
   0x8e7bc00000004d mob=Local(1) ackflag 1 dropd 1
*Sep  1 05:55:02.381: PEM recv processing msg Epm spi response(12)  1 wcm:  
   complete 
*Sep  1 05:55:02.381: 0021.5C8C.C761 aaa attribute list length is 79 1 wcm: 
   complete 
*Sep  1 05:55:02.381: 0021.5C8C.C761 Sending SPI spi_epm_epm_session_create 
   successfull 1 wcm: ) pemstate 7 state LEARN_IP(2) vlan 20 client_id 
   0x8e7bc00000004d mob=Local(1) ackflag 1 dropd 1
*Sep  1 05:55:02.381: PEM recv processing msg Add SCB(3)  1 wcm: 
   pm_session_create successfull
*Sep  1 05:55:02.381: 0021.5C8C.C761 0.0.0.0, auth_state 7 mmRole Local !!! 1 
   wcm: successfull
*Sep  1 05:55:02.381: 0021.5C8C.C761 0.0.0.0, auth_state 7 mmRole Local, 
   updating wcdb not needed 1 wcm:  7 state LEARN_IP(2) vlan 20 client_id 
   0x8e7bc00000004d mob=Local(1) ackflag 1 dropd 1
*Sep  1 05:55:02.381: 0021.5C8C.C761 Tclas Plumb needed: 1 wcm:  0
*Sep  1 05:55:02.384: EPM: 1 wcm:  Session create resp - client handle 
   8e7bc00000004d session b8000020 
*Sep  1 05:55:02.384: EPM: 1 wcm:  Netflow session create resp - client handle
   8e7bc00000004d sess b8000020
*Sep  1 05:55:02.384: PEM recv processing msg Epm spi response(12)  1 wcm: 
   le 8e7bc00000004d sess b8000020
*Sep  1 05:55:02.384: 0021.5C8C.C761 Received session_create_response for 
   client handle 40105511256850509 1 wcm:  LEARN_IP(2) vlan 20 client_id 
   0x8e7bc00000004d mob=Local(1) ackflag 1 dropd 1
*Sep  1 05:55:02.384: 0021.5C8C.C761 Received session_create_response with EPM
   session handle 3087007776 1 wcm: 
*Sep  1 05:55:02.384: 0021.5C8C.C761 Send request to EPM 1 wcm: ate_response 
   with EPM session handle 3087007776
*Sep  1 05:55:02.384: 0021.5C8C.C761 aaa attribute list length is 5 1 wcm: e 
   with EPM session handle 3087007776
*Sep  1 05:55:02.384: 0021.5C8C.C761 Sending Activate request for session 
   handle 3087007776 successful 1 wcm: 6
*Sep  1 05:55:02.384: 0021.5C8C.C761 Post-auth policy request sent! Now wait 
   for post-auth policy ACK from EPM 1 wcm: N_IP(2) vlan 20 client_id 
   0x8e7bc00000004d mob=Local(1) ackflag 1 dropd 1
*Sep  1 05:55:02.384: 0021.5C8C.C761 WCDB SPI response msg handler client code 
   0 mob state 0 1 wcm: licy ACK from EPM
*Sep  1 05:55:02.384: 0021.5C8C.C761 WcdbClientUpdate: 1 wcm:  L2 Auth ACK from
   WCDB
*Sep  1 05:55:02.384: 0021.5C8C.C761 WCDB_L2ACK: 1 wcm:  wcdbAckRecvdFlag 
   updated
*Sep  1 05:55:02.384: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  Client 1 m_vlan 20 
   Radio iif id 0xbfcdc00000003a bssid iif id 0xbb30c000000046, bssid 
   C8F9.F983.4260
*Sep  1 05:55:02.384: 0021.5C8C.C761 WCDB_AUTH: 1 wcm:  Adding opt82 len 0
*Sep  1 05:55:02.384: 0021.5C8C.C761 WCDB_LLM: 1 wcm:  NoRun Prev Mob 0, Curr 
   Mob 1 llmReq 1, return False
*Sep  1 05:55:02.385: 0021.5C8C.C761 auth state 2 mob state 1 setWme 0 wme 1 
   roam_sent 0 1 wcm: rn False
*Sep  1 05:55:02.385: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  auth=LEARN_IP(2) vlan
   20 radio 1 client_id 0x8e7bc00000004d mobility=Local(1) src_int 
   0xb6818000000038 dst_int 0x0 ackflag 2 reassoc_client 0 llm_notif 0 ip  
   0.0.0.0 ip_learn_type UNKNOWN
*Sep  1 05:55:02.385: EPM: 1 wcm:  Init feature, client handle 8e7bc00000004d 
   session b8000020 authz ec00000e 
*Sep  1 05:55:02.385: EPM: 1 wcm:  Activate feature client handle 
   8e7bc00000004d sess b8000020 authz ec00000e
*Sep  1 05:55:02.385: PEM recv processing msg Epm spi response(12)  1 wcm: 004d
   sess b8000020 authz ec00000e
*Sep  1 05:55:02.385: 0021.5C8C.C761 Received activate_features_resp for client
   handle 40105511256850509 1 wcm: 004d mobility=Local(1) src_int 
   0xb6818000000038 dst_int 0x0 ackflag 2 reassoc_client 0 llm_notif 0 
   ip$=6v0.0.0 ipt^_Dv^\7HnP6v^D6Hl5Ht^_Dv$6H8^ r^D6H>&5v8^ 
   r^D6H>&5v^D6Ht^M^Lw^\7H8^ r
*Sep  1 05:55:02.385: 0021.5C8C.C761 Received activate_features_resp for EPM 
   session handle 3087007776 1 wcm: 9
*Sep  1 05:55:02.385: EPM: 1 wcm:  Policy enforcement -  client handle 
   8e7bc00000004d session 2800000e authz ec00000e 
*Sep  1 05:55:02.385: EPM: 1 wcm:  Netflow policy enforcement - client handle 
   8e7bc00000004d sess 2800000e authz ec00000e msg_type 0 policy_status 0 attr 
   len 0
*Sep  1 05:55:02.385: PEM recv processing msg Epm spi response(12)  1 wcm: e 
   8e7bc00000004d sess 2800000e authz ec00000e msg_type 0 policy_status 0 attr 
   len 0
*Sep  1 05:55:02.385: 0021.5C8C.C761 Received policy_enforcement_response for 
   client handle 40105511256850509 1 wcm: 00e msg_type 0 policy_status 0 attr 
   len 0
*Sep  1 05:55:02.385: 0021.5C8C.C761 Received policy_enforcement_response for 
   EPM session handle 671088654 1 wcm: 09
*Sep  1 05:55:02.385: 0021.5C8C.C761 Received response for 
   _EPM_SPI_ACTIVATE_FEATURES request sent for client 1 wcm: 00e msg_type 0 
   policy_status 0 attr len 0
*Sep  1 05:55:02.385: 0021.5C8C.C761 Received _EPM_SPI_STATUS_SUCCESS for 
   request sent for client 1 wcm:  for client
*Sep  1 05:55:02.385: 0021.5C8C.C761 Post-auth policy ACK recvd from EPM, unset
   flag on MSCB 1 wcm: ient
*Sep  1 05:55:02.400: 0021.5C8C.C761 WCDB_IP_BIND: 1 wcm:  w/ IPv4 20.20.20.3 
   ip_learn_type DHCP add_delete 1,options_length 0
*Sep  1 05:55:02.400: 0021.5C8C.C761 WcdbClientUpdate: 1 wcm:  IP Binding from
   WCDB ip_learn_type 1, add_or_delete 1
*Sep  1 05:55:02.400: 0021.5C8C.C761 IPv4 Addr: 1 wcm:  20:20:20:3 
*Sep  1 05:55:02.400: 0021.5C8C.C761 MS got the IP, resetting the Reassociation
   Count 0 for client 1 wcm: _delete 1
*Sep  1 05:55:02.400:  0021.5C8C.C761  20.20.20.3 DHCP_REQD (7) Change state to
   RUN (20) last state RUN (20) 1 wcm: length 0
*Sep  1 05:55:02.400: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  Client 1 m_vlan 20 
   Radio iif id 0xbfcdc00000003a bssid iif id 0xbb30c000000046, bssid 
   C8F9.F983.4260
*Sep  1 05:55:02.400: 0021.5C8C.C761 WCDB_AUTH: 1 wcm:  Adding opt82 len 0
*Sep  1 05:55:02.401: 0021.5C8C.C761 WCDB_LLM: 1 wcm:  prev Mob state 1 curr 
   Mob State 1 llReq flag 0
*Sep  1 05:55:02.401: 0021.5C8C.C761 auth state 4 mob state 1 setWme 0 wme 1 
   roam_sent 0 1 wcm: g 0
*Sep  1 05:55:02.401: 0021.5C8C.C761 WCDB_CHANGE: 1 wcm:  auth=RUN(4) vlan 20 
   radio 1 client_id 0x8e7bc00000004d mobility=Local(1) src_int 
   0xb6818000000038 dst_int 0x0 ackflag 2 reassoc_client 0 llm_notif 0 ip  
   20.20.20.3 ip_learn_type DHCP
*Sep  1 05:55:02.401:  0021.5C8C.C761  20.20.20.3 RUN (20) Reached 
   PLUMBFASTPATH: 1 wcm:  from line 4430
*Sep  1 05:55:02.401:  0021.5C8C.C761  20.20.20.3 RUN (20) Replacing Fast Path
   rule on AP  C8F9.F983.4260 , slot 1 802.1P = 0
 1 wcm: 0xb6818000000038 dst_int 0x0 ackflag 2 reassoc_client 0 llm_notif 0 ip
   20.$=6v0.3 ip_lt^_Dv^\7HnP6v^D6Hl5Ht^_Dv$6H8^ r^D6H>&5v8^ 
   r^D6H>&5v^D6Ht^M^Lw^\7H8^ r
*Sep  1 05:55:02.401:  0021.5C8C.C761  20.20.20.3 RUN (20) Successfully plumbed
   mobile rule  1 wcm:  C8F9.F983.4260 , slot 1 802.1P = 0^M 
*Sep  1 05:55:02.401: 0021.5C8C.C761 
 Sending IPv4 update to Controller 10.105.135.176 1 wcm: e 
*Sep  1 05:55:02.401: 0021.5C8C.C761 Assigning Address 20.20.20.3 to mobile  1
   wcm: 05.135.176  
*Sep  1 05:55:02.401: PEM recv processing msg Add SCB(3)  1 wcm: 20.20.3 to 
   mobile 
*Sep  1 05:55:02.401: 0021.5C8C.C761 20.20.20.3, auth_state 20 mmRole Local !!!
   1 wcm: 135.176  
*Sep  1 05:55:02.401: 0021.5C8C.C761 20.20.20.3, auth_state 20 mmRole Local, 
   updating wcdb not needed 1 wcm: 3.4260 , slot 1 802.1P = 0^M 
*Sep  1 05:55:02.401: 0021.5C8C.C761 Tclas Plumb needed: 1 wcm:  0
*Sep  1 05:55:20.083: 0021.5C8C.C761 
Client stats update: 1 wcm:  Time now in sec 1378014920, Last Acct Msg Sent at
   1378014902 sec

修订历史记录

版本	发布日期	备注
1.0	05-Nov-2015	初始版本

由思科工程师提供