This document describes the SNMP (Simple Network Manager Protocol) traps that an AireOS WLC sends for AP association/disassociation.
Cisco recommends that you have knowledge of these topics:
Wireless LAN Controller (WLC)
Access Points (AP)
SNMP (Simple Network Manager Protocol)
This document is not restricted to specific software and hardware versions.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any step.
For each AP dissociation/association event, the WLC must send a SNMP trap with the following Object Identifiers (OIDs):
Dissociation trap (variable bindings)
126.96.36.199.188.8.131.52.0 (sysUpTime) <---- included in traps as the first variable binding
184.108.40.206.220.127.116.11.4.1 (snmpTrapOID) <---- second variable binding (the value of this is another OID, indicating the AP dissociation event)
18.104.22.168.4.1.1422.214.171.124.8 (bsnAPDisassociated) <---- OID indicating the event
126.96.36.199.4.1.14188.8.131.52.20 (bsnAPMacAddrTrapVariable) <---- trap component, base radio MAC (Media Access Control) address of the AP
MIB: CISCO-LWAPP-AP-MIB (all OIDs except sysUpTime and snmpTrapOID).
SNMP Traps for AP Association/Disassociation on AirOS WLC
The trap control configuration can be set on the WLC GUI with the AP Register control (Management > SNMP > Trap Controls > AP > AP Register). This is enabled by default. Also, the WLC needs a trap receiver configured (Management > SNMP > Trap Receivers) on the GUI as well.
Verify Association and dissociation of the AP:
The output of show traplog on the WLC shows counters for both associated and dissociated traps, in addition to messages for each event as shown below:
(Cisco Controller) >show trap log
AP Traps Statistics
AP Associated Traps ............... 1 AP Disassociated Traps ............ 1
23 Fri Jun 14 23:32:22 2019 AP 'torres-3802', MAC: 40:01:7a:73:fd:c0 disassoc iated previously due to AP Reset. Uptime: 0 days, 00 h 02 m 05 s . Reason: controller reboot comman d. 24 Fri Jun 14 23:29:32 2019 AP Disassociated. Base Radio MAC:40:01:7a:73:fd:c 0 ApName - torres-3802
2. Packet Capture
Disassociation will appear in the packet captures as shown in the image:
184.108.40.206.4.1.14220.127.116.11.8 is the OID to indicate that the AP disconnected, followed by instance of bsnAPMacAddrTrapVariable with the base radio MAC of the AP (40:01:7a:73:fd:c0) and instance of bsnAPName with the AP name (torres-3802 is translated from the hexadecimal value).
Association will appear in the packet captures as shown in the image:
18.104.22.168.22.214.171.124.513.0.4 is the OID to indicate that the AP connected back to the WLC, followed by instance of cLApName with the AP name (torres-3802 is translated from the hexadecimal value) and instance of cLApLastRebootReason (in this case it is number 4 to indicate a manual reboot from the WLC).
Below Wireshark filters can be used for the SNMP packets:
snmp.value.oid == 126.96.36.199.4.1.14188.8.131.52.8
snmp.value.oid == 184.108.40.206.220.127.116.11.513.0.4
(snmp.value.oid == 18.104.22.168.4.1.1422.214.171.124.8 or snmp.value.oid == 126.96.36.199.188.8.131.52.513.0.4) and snmp.value.octets == "<AP name>"