Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

SAE client exclusion visibility

Updated: April 10, 2026

Want to summarize with AI?

Log in

Introduces SAE client exclusion visibility, enabling controllers to access client exclusion list data in Flex central authentication deployments with SAE-enabled WLANs, and reducing the need for manual log collection for enhanced operational efficiency.

SAE client exclusion visibility is a feature that

  • addresses a limitation in Flex central authentication deployments with SAE-enabled WLANs

  • makes client exclusion list data available on the controller, and

  • reduces manual log collection for customers.

In FlexConnect central authentication deployments with SAE enabled WLANs, the controller does not have access to client exclusion list data because SAE authentication messages are processed at the AP, and authentication failures are not reported to the controller. As a result, you must collect logs manually, which increases operational costs. This feature provides a solution to this issue.

This feature addresses only Flex central authentication, WPA3 + SAE/FT-SAE/SAE-EXT-KEY/FT-SAE- EXT-KEY WLANs.

Feature history for SAE client exclusion visibility

Table 1. Feature history

Feature Name

Release Information

Feature Description

SAE client exclusion visibility

Cisco IOS XE 17.18.2

The SAE authentication client exclusion feature overcomes the limitations of Flex central authentication deployments with SAE-enabled WLANs. The feature reports client authentication failures and exclusion data to the controller. It generates syslog messages for these events and allows administrators to configure the duration that a client remains excluded.

It centralizes troubleshooting information that was previously only available on individual APs, reducing the need for manual log collection.

Configure client exclusion timeout (GUI)

To set the duration for which a client remains excluded from the system using the GUI.

Procedure

1.

Choose Configuration > Tags & Profiles > Policy.
2.

In the General tab, specify the name and description for the policy profile.
3.

Click the Advanced tab.
4.

In the WLAN Timeout section, enter a value for the Client Exclusion Timeout field, in seconds. This option is enabled by default. The valid range is 0 to 2,147,483,647 seconds. The default is 60 seconds.
5.

Click Apply to Device.

The system enables and configures the SAE authentication client exclusion feature for the selected wireless policy profile.

What to do next

Monitor excluded clients.

Monitor client exclusion

Monitor excluded clients.

Procedure

1.

Choose Monitoring > Wireless > Clients.
2.

Click the Excluded Clients tab.

The excluded clients and their details are listed on this page. Additionally, you can add an excluded client by clicking the Add button and entering the MAC address and the description.

Configure client exclusion timeout (CLI)

Set the duration for which a client remains excluded from the system.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Configure a policy profile for the WLAN.

Example:

Device# wireless profile policy policy-profile-name

Replace policy-profile-name with the name of your wireless policy profile. For example, flex-profile-policy.
3.

Disable central DHCP for locally switched clients.

Example:

Device(config-wireless-policy)# no central dhcp
4.

Disable central switching.

Example:

Device(config-wireless-policy)# no central switching
5.

Enable or disable exclusion listing on the WLAN by setting the exclusion time for the client. This feature is enabled by default.

Example:

Device(config-wireless-policy)# [no] exclusionlist timeout seconds

The timeout is set in seconds. The default is 60 seconds. The valid range is from 0 to 2,147,483,647 seconds. If you set the value to 0, the client remains excluded indefinitely.

Use the no form of this command to disable the feature.

The specified exclusion timeout is applied to the WLAN policy profile. This duration determines how long the excluded clients remain unable to connect.

Device# configure terminal
Device(config)# wireless profile policy default-policy-profile
Device(config-wireless-policy)# no central dhcp 
Device(config-wireless-policy)# no central switching 
Device(config-wireless-policy)# [no] exclusionlist timeout 60

Verify client exclusion data

Verify client exclusion data using these commands.

Verify the wireless policy profile information, including the exclusion status and timeout for clients, using this command:

Device# show wireless profile policy detailed flex-profile-policy
WLAN Switching Policy
  Flex Central Switching            : DISABLED
  Flex Central Authentication       : ENABLED
  Flex Central DHCP                 : DISABLED
  Flex NAT PAT                      : DISABLED

Exclusionlist Params
  Exclusionlist                     : ENABLED
  Exclusion Timeout                 : 60

View a summary of wireless clients, including information about excluded clients, using this command: 

Device# show wireless client summary 
Number of Clients: 0 
Number of Excluded Clients: 1 
MAC Address AP Name Type ID State Protocol Method
 ------------------------------------------------------------------------------------------------ 
90XX.84XX.63XX WLAN 3 Excluded N/A None

Verify the list of excluded wireless clients using this command:

Device# show wireless exclusionlist
Number of Excluded Clients : 1 
MAC Address Description Exclusion Reason Time Remaining
------------------------------------------------------------------------------------------------------ 
90XX.84XX.63XX          SAE authentication failure 49