Comprendre le flux de trafic dans une configuration d'ancrage étranger entre un WLC 9800

Introduction

Ce document décrit le flux de trafic dans la configuration Foreign-Anchor entre les WLC Cisco 9800, couvrant l'intégration et le dépannage des clients L2/L3.

Conditions préalables

Tunnel de mobilité entre contrôleur étranger et contrôleur d'ancrage.

Les ports UDP 16666 et 16667 sont autorisés entre les deux WLC.

Profil de stratégie configuré pour la commutation centrale.

État du tunnel de mobilité sur le WLC étranger

État du tunnel de mobilité sur le WLC d'ancrage

Exigences

Cisco vous recommande d'avoir connaissance des sujets suivants :

• Accès aux contrôleurs sans fil via l'interface de ligne de commande ou l'interface utilisateur graphique
• Mobilité sur les contrôleurs LAN sans fil (WLC) Cisco
• Contrôleurs sans fil 9800
• Traces radioactives et capture de paquets sur le WLC 9800
  
  

Composants utilisés

Les informations contenues dans ce document sont basées sur les versions de matériel et de logiciel suivantes :

• Modèle WLC 9800
• Cisco IOS XE 17.15.5 version
• Modèle AP gamme 9100
  
  

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. Si votre réseau est en ligne, assurez-vous de bien comprendre l’incidence possible des commandes.

Présentation du scénario d'ancrage étranger

• Contrôleur étranger : Ce WLC gère la couche 2 ou le côté sans fil du réseau. Des points d’accès lui sont connectés et tout le trafic client des WLAN ancrés est encapsulé dans le tunnel de mobilité et envoyé au contrôleur d’ancrage. Le trafic ne sort pas localement sur le contrôleur étranger.
• Contrôleur d'ancrage : Il sert de point de sortie de la couche 3. Il reçoit le trafic client via le tunnel de mobilité des contrôleurs étrangers et décapsule ou termine le trafic client dans le point de sortie (VLAN). C'est là que les clients sont visibles sur le réseau.

Les points d'accès sur le WLC étranger diffusent les SSID WLAN et ont une balise de stratégie attribuée qui lie le profil WLAN au profil de stratégie approprié. Lorsqu'un client sans fil se connecte à ce SSID, le contrôleur étranger envoie le nom SSID et le profil de stratégie dans les informations du client au WLC d'ancrage. À la réception, le WLC d'ancrage vérifie sa propre configuration pour correspondre au nom SSID ainsi qu'au nom du profil de stratégie. Une fois que le WLC d'ancrage a trouvé une correspondance, il applique la configuration correspondante et fournit un point de sortie pour le client sans fil. Par conséquent, il est obligatoire que les noms et configurations du WLAN et du profil de stratégie correspondent sur les WLC étrangers et d'ancrage 9800, à l'exception du VLAN sous le profil de stratégie.

Topologie

Configuration d'ancrage étranger entre WLC 9800

WLAN avec authentification de couche 2

Configuration requise 

1. Assurez-vous que le nom et la configuration du WLAN sont identiques sur les WLC étrangers et d’ancrage et qu’ils sont configurés pour l’authentification de couche 2 (PSK ou 802.1x).
2. Créez un profil de stratégie avec le même nom sur les WLC étrangers et d'ancrage avec la même configuration.
3. Sur le WLC étranger, configurez le mappage du WLC d'ancrage dans le profil de stratégie respectif.
4. Sur le WLC d'ancrage, configurez le profil de stratégie pour désigner le contrôleur en tant qu'ancrage d'exportation.
5. Sur le WLC étranger, mappez le WLAN au profil de stratégie approprié à l'aide d'une balise de stratégie.

Flux pour le SSID basé sur l'ancrage étranger de couche 2

1. Le client initie une connexion au SSID diffusé par le WLC étranger. Le WLC étranger effectue l'authentification de couche 2, en validant les informations d'identification localement ou via un serveur AAA externe, selon la stratégie de sécurité configurée.
2. Une fois l'authentification réussie, la session client est ancrée au WLC d'ancrage. Le client reçoit une adresse IP et passe à l'état RUN sur le WLC d'ancrage.
3. Une fois la session établie, tout le trafic de données client est tunnellisé du WLC étranger au WLC d’ancrage, où il sort dans le réseau.

Diagramme de flux WLAN basé sur des ancres étrangères de couche 2

Analyse du flux SSID de couche 2 dans la configuration d'ancrage étranger via les journaux

Cette section explique le flux de connectivité du client de couche 2 à l'aide de la trace radioactive (RA Trace), des captures de paquets intégrées (EPC) et de l'état du client sur les contrôleurs Foreign et Anchor.

Journaux du contrôleur étranger

Traces radioactives

!! Client Association started !!
[client-orch-sm] Association received. BSSID BSSID-addr, WLAN DMZ_PSK, Slot 1 AP AP_MAC, AP_NAME, Site tag default-site-tag, Policy tag default-policy-tag, Policy profile DMZ_PSK_PP, Switching Central, Socket delay 0ms
[dot11] [17047] (info) MAC Client-MAC dot11 send association response. Sending assoc response of length 137 with resp_status_code 0, DOT11_STATUS DOT11_STATUS_SUCCESS
[dot11] [17047] (info) MAC Client-MAC DOT11 state transition S_DOT11_INIT -> S_DOT11_ASSOCIATED


!! Layer 2 Authentication started !!
[client-orch-state] Client state transition S_CO_ASSOCIATING -> S_CO_L2_AUTH_IN_PROGRESS
[client-auth] L2 Authentication initiated. method PSK, Policy VLAN 31, AAA override = 0, NAC = 0
[client-keymgmt] EAP key M1 Sent successfully
[client-keymgmt] M2 Status EAP key M2 validation success
[client-keymgmt]EAP key M3 Sent successfully
[client-keymgmt] M4 Status EAP key M4 validation is successful

[client-keymgmt] EAP Key management successful. AKMPSK CipherCCMP WPA Version WPA2 >> !! client succesfully authenticated !!

!! Mobility Handoff !!

{mobilityd_R0-0}{1} [mm-dgram-io] [18401] (debug) MAC Client-MAC Sending message mobile_announce to group DMZ
{mobilityd_R0-0}{1} [mm-pmtu] [18401] (debug) Peer IP Anchor-WLC-IP 
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Sending mobile_announce of XID (176280) to (ipv4 Anchor-WLC-IP )
{mobilityd_R0-0}{1} [mm-transition] MMFSM transition S_MC_WAIT_ANNOUNCE_RSP -> S_MC_ANNOUNCE_TIMEDOUT_PROCESSED_TR on E_MC_REQUEST_TIMEDOUT from WNCD[0]

{wncd_x_R0-0}{1} [mm-client] [17047] (debug) MAC Client-MAC Received mobile_announce_nak, sub type 2 of XID (XID) from (MobilityD[0])

{wncd_x_R0-0}{1} [mm-transition] [17047] (info) MAC Client-MAC MMIF FSM transition S_MA_INIT_WAIT_ANNOUNCE_RSP -> S_MA_NAK_PROCESSED_TR on E_MA_NAK_RCVD

{wncd_x_R0-0}{1} [mm-client] [17047] (debug) MAC Client-MAC Sending export_Anchor_req of XID (XID) to (MobilityD[0])
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Received export_Anchor_req, sub type 0 of XID (XID) from (WNCD[0])

{mobilityd_R0-0}{1} [mm-transition] [18401] (info) MAC Client-MAC MMFSM transition S_MC_WAIT_EXP_ANC_REQ -> S_MC_EXP_ANC_REQ_RCVD_TR on E_MC_EXP_ANC_REQ_RCVD from WNCD[0]
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Export Anchor Request successfully processed.
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Sending export_Anchor_req of XID (176282) to (ipv4 Anchor-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Received export_Anchor_rsp, sub type 0 of XID (XID) from (ipv4 Anchor-WLC-IP )

{mobilityd_R0-0}{1} [mm-transition] [18401] (info) MAC Client-MAC MMFSM transition S_MC_WAIT_EXP_ANC_RSP -> S_MC_EXP_ANC_RSP_RCVD_TR on E_MC_EXP_ANC_RSP_RCVD from ipv4 Anchor-WLC-IP 

{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Export Anchor Response successfully processed.

{wncd_x_R0-0}{1} [epm-misc] [17047] (info) Anchor Vlan-id 31 processed
[mm-client] [17047] (info) MAC Client-MAC Mobility role changed - Unassoc -> Export Foreign
[mm-client] Mobility Successful. Roam Type L3 Requested, Sub Roam Type MM_SUB_ROAM_TYPE_NONE, Client IFID 0xa0000004, Client Role Export Foreign >> Client Successfully Anchored
{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS

{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS

{wncd_x_R0-0}{1} [client-orch-sm] [17047] (debug) MAC Client-MAC Received ip learn response. method IPLEARN_METHOD_ROAMING

{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_IP_LEARN_IN_PROGRESS -> S_CO_RUN >> Client went to RUN state

Capture de paquets

Le client envoie une demande d'association et effectue l'authentification de couche 2, gérée par le contrôleur étranger.

Association client + trafic d'authentification de couche 2

 Un transfert de mobilité se déclenche entre les contrôleurs étranger et d'ancrage via le port UDP 16667. Lors d'un événement de mobilité réussi, l'état du client passe à EXÉCUTER avec un rôle Exporter étranger.
Le contrôleur étranger reçoit le trafic DHCP client via le tunnel CAPWAP et le transfère au contrôleur d'ancrage pour un traitement ultérieur.

Le trafic DHCP client reçu sur le contrôleur étranger est transféré au contrôleur d'ancrage à l'aide du tunnel de mobilité

Journaux du contrôleur Anchor 9800

Traces radioactives de l'ancre

!! Mobility Handoff !!
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received mobile_announce, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received mobile_announce, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received export_Anchor_req, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Number of client is BELOW wlan limit
{mobilityd_R0-0}{1} [mm-transition] [26021] (info) MAC Client-MAC MMFSM transition S_MC_INIT -> S_MC_Anchor_EXP_ANC_REQ_RCVD_TR on E_MC_EXP_ANC_REQ_RCVD from ipv4 Foreign-WLC-IP 

{wncd_x_R0-0}{1} [mm-client] [24229] (info) MAC Client-MAC Roam type changed - None -> L3 Requested
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Export Anchor Response successfully processed.
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Forwarding Anchor Response to Foreign.
{mobilityd_R0-0}{1} [mm-client] [26021] (info) MAC Client-MAC Forwarding export_Anchor_rsp, sub type 0 of XID (XID) from (WNCD[0]) to (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Client is AnchorED.
{
wncd_x_R0-0}{1} [mm-client] [24229] (info) MAC Client-MAC Mobility role changed - Unassoc -> Export Anchor
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Client is AnchorED.>> Client is successfully Anchored

!! Client DHCP Traffic !!
{wncd_x_R0-0}{1} [client-orch-state] [24229] (note) MAC Client-MAC Client state transition S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS 
{wncd_x_R0-0}{1} [client-orch-state] [24229] (note) MAC Client-MAC Client state transition S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS {wncd_x_R0-0}{1} [client-iplearn] [24229] (info) MAC Client-MAC IP-learn state transition S_IPLEARN_INIT -> S_IPLEARN_IN_PROGRESS 

{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, giaddr 0.0.0.0, yiaddr 0.0.0.0, CMAC Client-MAC {wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.226, BOOTPREPLY, SISF_DHCPOFFER, giaddr 0.0.0.0, yiaddr 10.105.60.226, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.226, BOOTPREPLY, SISF_DHCPOFFER, giaddr 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, giaddr 0.0.0.0, yiaddr 0.0.0.0, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.226, BOOTPREPLY, SISF_DHCPACK, giaddr 0.0.0.0, yiaddr 10.105.60.226, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.226, BOOTPREPLY, SISF_DHCPACK, giaddr 0.0.0.0, yiaddr 10.105.60.226, CMAC Client-MAC 
{wncd_x_R0-0}{1} [client-iplearn] [24229] (note) MAC Client-MAC Client IP learn successful. Method DHCP IP 10.105.60.226 {wncd_x_R0-0}{1} [auth-mgr-feat_acct] [24229] (info) [Client-MACmobility_a0000001] SM Notified attribute Add/Update addr 10.105.60.226 
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Sending ipv4_address_update of XID (XID) to (ipv4 Foreign-WLC-IP )
{wncd_x_R0-0}{1} [client-iplearn] [24229] (info) MAC Client-MAC IP-learn state transition S_IPLEARN_IN_PROGRESS -> S_IPLEARN_COMPLETE {wncd_x_R0-0}{1}Received ip learn response. method IPLEARN_METHOD_DHCP >> IP Learn 
Complete

{wncd_x_R0-0}{1} [avc-afc] [24229] (info) ReAnchor [client MAC Client-MAC] Client has Anchor role {wncd_x_R0-0}{1} [client-orch-state] [24229] (note) MAC Client-MAC Client state transition S_CO_IP_LEARN_IN_PROGRESS -> S_CO_RUN >> Client went to RUN state

Capture de paquets sur l’ancre

Après le transfert de mobilité, le contrôleur d'ancrage reçoit le trafic DHCP du contrôleur étranger via le tunnel de mobilité.
Une fois le processus DORA terminé, le client passe à l'état EXÉCUTÉ avec un rôle d'ancrage d'exportation. À partir de ce point, le contrôleur d’ancrage sert de point de sortie pour le trafic de données client.

Trafic DHCP client sur le contrôleur d'ancrage reçu du contrôleur étranger

État du client sur le contrôleur étranger et le contrôleur d'ancrage

État du client sur étranger  État du client au point d'ancrage

Propriétés du client sur les  Propriétés du client sur l'ancre

WLAN avec authentification de couche 3

Authentification Web locale

Flux pour SSID Webauth local dans la configuration d'ancrage étranger

1. Le client initie une connexion au SSID annoncé par le WLC étranger.
2. Comme aucune authentification de couche 2 n'est effectuée, le client est immédiatement ancré au WLC d'ancrage. Le client passe à l'état EXÉCUTÉ sur le WLC étranger, avec son rôle de mobilité désigné comme Exportation étrangère.
3. Le client obtient une adresse IP et est redirigé vers une page Web. Ce trafic est géré par le contrôleur d'ancrage.
4. Une fois l'authentification réussie sur le portail, le client passe à l'état d'exécution sur le WLC d'ancrage, avec le rôle d'ancrage d'exportation.

Diagramme de flux de connectivité client pour SSID Webauth local dans la configuration d'ancrage étranger

Analyse du flux SSID Webauth local dans la configuration d'ancrage étranger via les journaux

Cette section explique le flux de connectivité client pour le SSID d'authentification Web locale à l'aide de la trace radioactive (RA Trace), des captures de paquets intégrées (EPC) et de l'état du client sur les contrôleurs étranger et d'ancrage.

Journaux du contrôleur étranger

Traces radioactives

!! Client Association Phase !!
{wncd_x_R0-0}{1}: [client-orch-sm] [17047]: (note): MAC: Client_MAC Association received. BSSID BSSID_MAC, WLAN DMZ_LWA, Slot 1 AP AP_MAC, AP_NAME, Site tag default-site-tag, Policy tag default-policy-tag, Policy profile DMZ_LWA_PP, Switching Central, Socket delay 0ms
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_INIT -> S_CO_ASSOCIATING

{wncd_x_R0-0}{1}: [dot11] [17047]: (info): MAC: Client_MAC dot11 send association response. Sending assoc response of length: 137 with resp_status_code: 0, DOT11_STATUS: DOT11_STATUS_SUCCESS

!! L2 Auth : None !!
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_ASSOCIATING -> S_CO_L2_AUTH_IN_PROGRESS
{wncd_x_R0-0}{1}: [client-auth] [17047]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_L2_WEBAUTH_PENDING -> S_AUTHIF_WEBAUTH_DONE
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_L2_AUTH_IN_PROGRESS -> S_CO_MOBILITY_DISCOVERY_IN_PROGRESS

!! Mobility Handoff Phase !!

{mobilityd_R0-0}{1} [mm-dgram-io] [18401] (debug) MAC Client-MAC Sending message mobile_announce to group DMZ
{mobilityd_R0-0}{1} [mm-pmtu] [18401] (debug) Peer IP Anchor-WLC-IP 
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Sending mobile_announce of XID (176280) to (ipv4 Anchor-WLC-IP )
{mobilityd_R0-0}{1} [mm-transition] MMFSM transition S_MC_WAIT_ANNOUNCE_RSP -> S_MC_ANNOUNCE_TIMEDOUT_PROCESSED_TR on E_MC_REQUEST_TIMEDOUT from WNCD[0]

{wncd_x_R0-0}{1} [mm-client] [17047] (debug) MAC Client-MAC Received mobile_announce_nak, sub type 2 of XID (XID) from (MobilityD[0])

{wncd_x_R0-0}{1} [mm-transition] [17047] (info) MAC Client-MAC MMIF FSM transition S_MA_INIT_WAIT_ANNOUNCE_RSP -> S_MA_NAK_PROCESSED_TR on E_MA_NAK_RCVD

{wncd_x_R0-0}{1} [mm-client] [17047] (debug) MAC Client-MAC Sending export_Anchor_req of XID (XID) to (MobilityD[0])
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Received export_Anchor_req, sub type 0 of XID (XID) from (WNCD[0])

{mobilityd_R0-0}{1} [mm-transition] [18401] (info) MAC Client-MAC MMFSM transition S_MC_WAIT_EXP_ANC_REQ -> S_MC_EXP_ANC_REQ_RCVD_TR on E_MC_EXP_ANC_REQ_RCVD from WNCD[0]
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Export Anchor Request successfully processed.
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Sending export_Anchor_req of XID (176282) to (ipv4 Anchor-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Received export_Anchor_rsp, sub type 0 of XID (XID) from (ipv4 Anchor-WLC-IP )

{mobilityd_R0-0}{1} [mm-transition] [18401] (info) MAC Client-MAC MMFSM transition S_MC_WAIT_EXP_ANC_RSP -> S_MC_EXP_ANC_RSP_RCVD_TR on E_MC_EXP_ANC_RSP_RCVD from ipv4 Anchor-WLC-IP 

{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Export Anchor Response successfully processed.

{wncd_x_R0-0}{1} [epm-misc] [17047] (info) Anchor Vlan-id 31 processed
[mm-client] [17047] (info) MAC Client-MAC Mobility role changed - Unassoc -> Export Foreign
[mm-client] Mobility Successful. Roam Type L3 Requested, Sub Roam Type MM_SUB_ROAM_TYPE_NONE, Client IFID 0xa0000004, Client Role Export Foreign >> Client Successfully Anchored
{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS
{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS
{wncd_x_R0-0}{1} [client-orch-sm] [17047] (debug) MAC Client-MAC Received ip learn response. method IPLEARN_METHOD_ROAMING
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_IP_LEARN_IN_PROGRESS -> S_CO_RUN

!! Client AAA Traffic handling !!
{mobilityd_R0-0}{1}: [mm-transition] [18401]: (info): MAC: Client_MAC MMFSM transition: S_MC_RUN -> S_MC_AAA_HANDOFF_PROCESSED_TR on E_MC_AAA_HANDOFF_RCVD from ipv4: Anchor-WLC-IP 
{mobilityd_R0-0}{1}: [mm-client] [18401]: (info): MAC: Client_MAC Forwarding aaa_handoff, sub type: 0 of XID (10452) from (ipv4: Anchor-WLC-IP ) to (WNCD[0])
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC Sending aaa_handoff of XID (10452) to (WNCD[0])
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC AAA Handoff successfully forwarded.
{wncd_x_R0-0}{1}: [mm-client] [17047]: (debug): MAC: Client_MAC Received aaa_handoff, sub type: 0 of XID (10452) from (MobilityD[0])
{wncd_x_R0-0}{1}: [mm-transition] [17047]: (info): MAC: Client_MAC MMIF FSM transition: S_MA_Foreign -> S_MA_AAA_HANDOFF_PROCESSED_TR on E_MA_AAA_HANDOFF
{wncd_x_R0-0}{1}: [mm-client] [17047]: (debug): MAC: Client_MAC Mobile AAA Handoff update received.
{wncd_x_R0-0}{1}: [sanet-shim-miscellaneous] [17047]: (info): MAC: Client_MAC Received username=Guest1 username_len=6
{wncd_x_R0-0}{1}: [sanet-shim-miscellaneous] [17047]: (info): MAC: Client_MAC IPv6 Client payload is received in aaa handoff
{wncd_x_R0-0}{1}: [mm-client] [17047]: (debug): MAC: Client_MAC Sending aaa_handoff_ack of XID (10452) to (MobilityD[0])
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC Received aaa_handoff_ack, sub type: 0 of XID (10452) from (WNCD[0])
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC AAA Handoff Ack successfully handled.
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC aaa_handoff_ack base check is VALID 
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC aaa_handoff_ack is VALID 
{mobilityd_R0-0}{1}: [mm-transition] [18401]: (info): MAC: Client_MAC MMFSM transition: S_MC_RUN -> S_MC_AAA_HANDOFF_ACK_PROCESSED_TR on E_MC_AAA_HANDOFF_ACK_RCVD from WNCD[0]
{mobilityd_R0-0}{1}: [mm-client] [18401]: (info): MAC: Client_MAC Forwarding aaa_handoff_ack, sub type: 0 of XID (10452) from (WNCD[0]) to (ipv4: Anchor-WLC-IP )
{mobilityd_R0-0}{1}: [mm-pmtu] [18401]: (debug): Peer IP: Anchor-WLC-IP PMTU size is 1006 and calculated additional header length is 76
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC Sending aaa_handoff_ack of XID (10452) to (ipv4: Anchor-WLC-IP )
{wncd_x_R0-0}{1}: [auth-mgr] [17047]: (info): [Client_MAC:capwap_90000003] auth mgr attr add/change notification is received for attr username(450)
{wncd_x_R0-0}{1}: [auth-mgr-feat_acct] [17047]: (info): [Client_MAC:capwap_90000003] SM Notified attribute Add/Update username Guest1
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC aaa handoff ack successfully forwarded.

Capture de paquets

Le client envoie une demande d'association que le contrôleur étranger traite.

Phase d'association client avec contrôleur étranger

Un transfert de mobilité se déclenche entre les contrôleurs étranger et d'ancrage via le port UDP 16667. Lors d'un événement de mobilité réussi, l'état du client passe à EXÉCUTER avec un rôle Exporter étranger.
Le contrôleur étranger reçoit le trafic DHCP client via le tunnel CAPWAP et le transfère au contrôleur d'ancrage pour un traitement ultérieur.

Le trafic DHCP client reçu sur le contrôleur étranger est transféré au contrôleur d'ancrage à l'aide du tunnel de mobilité

De même, le client envoie l'état de connectivité réseau et le trafic de vérification d'accès à la page Web au WLC étranger via le tunnel CAPWAP ; le WLC étranger transfère ceci au WLC d'ancrage à l'aide du tunnel de mobilité, où le contrôleur d'ancrage intercepte ou traite le trafic.

Vérification de l'état de la connectivité réseau sur le contrôleur étranger

Rediriger l'URL envoyée au client

Page Client Access to Local Webauth pour fournir les détails d'authentification

Journaux du contrôleur d'ancrage

Traces radioactives

!! Mobility Handoff !!
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received mobile_announce, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received mobile_announce, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received export_Anchor_req, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Number of client is BELOW wlan limit
{mobilityd_R0-0}{1} [mm-transition] [26021] (info) MAC Client-MAC MMFSM transition S_MC_INIT -> S_MC_Anchor_EXP_ANC_REQ_RCVD_TR on E_MC_EXP_ANC_REQ_RCVD from ipv4 Foreign-WLC-IP 

{wncd_x_R0-0}{1} [mm-client] [24229] (info) MAC Client-MAC Roam type changed - None -> L3 Requested

!! Session Created for Client !!
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_ASSOCIATING -> S_CO_CREATE_SM_SESSION_IN_PROGRESS
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_INIT -> S_AUTHIF_AWAIT_L2_WEBAUTH_START_RESP
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): [Client_MAC][ 0.0.0.0]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-acl] [24229]: (info): mobility_a0000001[Client_MAC][ 0.0.0.0]Applying IPv4 intercept ACL via SVM, name: IP-Adm-V4-Int-ACL-global, priority: 50, IIF-ID: 0
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_AWAIT_L2_WEBAUTH_START_RESP -> S_AUTHIF_L2_WEBAUTH_PENDING
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_CREATE_SM_SESSION_IN_PROGRESS -> S_CO_MOBILITY_DISCOVERY_IN_PROGRESS
{wncd_x_R0-0}{1}: [mm-transition] [24229]: (info): MAC: Client_MAC MMIF FSM transition: S_MA_INIT -> S_MA_AnchorING_ASSOC_RESP_PROCESSED_TR on E_MA_CO_EXP_Anchor_REQ_ASSOC_RCVD
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Export Anchor Response successfully processed.
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Forwarding Anchor Response to Foreign.
{mobilityd_R0-0}{1} [mm-client] [26021] (info) MAC Client-MAC Forwarding export_Anchor_rsp, sub type 0 of XID (XID) from (WNCD[0]) to (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Client is AnchorED.
{
wncd_x_R0-0}{1} [mm-client] [24229] (info) MAC Client-MAC Mobility role changed - Unassoc -> Export Anchor
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Client is AnchorED.>> Client is successfully Anchored


!! Client DHCP Traffic !!
{wncd_x_R0-0}{1} [client-orch-state] [24229] (note) MAC Client-MAC Client state transition S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS 
{wncd_x_R0-0}{1} [client-orch-state] [24229] (note) MAC Client-MAC Client state transition S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS {wncd_x_R0-0}{1} [client-iplearn] [24229] (info) MAC Client-MAC IP-learn state transition S_IPLEARN_INIT -> S_IPLEARN_IN_PROGRESS 

{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, giaddr 0.0.0.0, yiaddr 0.0.0.0, CMAC Client-MAC {wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.226, BOOTPREPLY, SISF_DHCPOFFER, giaddr 0.0.0.0, yiaddr 10.105.60.226, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.226, BOOTPREPLY, SISF_DHCPOFFER, giaddr 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, giaddr 0.0.0.0, yiaddr 0.0.0.0, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.226, BOOTPREPLY, SISF_DHCPACK, giaddr 0.0.0.0, yiaddr 10.105.60.226, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.226, BOOTPREPLY, SISF_DHCPACK, giaddr 0.0.0.0, yiaddr 10.105.60.226, CMAC Client-MAC 
{wncd_x_R0-0}{1} [client-iplearn] [24229] (note) MAC Client-MAC Client IP learn successful. Method DHCP IP 10.105.60.226 {wncd_x_R0-0}{1} [auth-mgr-feat_acct] [24229] (info) [Client-MACmobility_a0000001] SM Notified attribute Add/Update addr 10.105.60.226 
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Sending ipv4_address_update of XID (XID) to (ipv4 Foreign-WLC-IP )
{wncd_x_R0-0}{1} [client-iplearn] [24229] (info) MAC Client-MAC IP-learn state transition S_IPLEARN_IN_PROGRESS -> S_IPLEARN_COMPLETE {wncd_x_R0-0}{1}Received ip learn response. method IPLEARN_METHOD_DHCP >> IP Learn 
Complete
{wncd_x_R0-0}{1}: [client-orch-sm] [24229]: (debug): MAC: Client_MAC Received ip learn response. method: IPLEARN_METHOD_DHCP

!! Local Web Athentication !!
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_IP_LEARN_IN_PROGRESS -> S_CO_L3_AUTH_IN_PROGRESS
{wncd_x_R0-0}{1}: [client-auth] [24229]: (note): MAC: Client_MAC L3 Authentication initiated. LWA 
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52910/195 IO state NEW -> READING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52911/235 IO state NEW -> READING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52911/235 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]GET rcvd when in GET_REDIRECT state
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]HTTP GET request
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Parse GET, src [10.105.60.226] dst [Resolved IP] url [http://www.connectivity check url/redirect]
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Read complete: parse_request return 8
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]State GET_REDIRECT -> GET_REDIRECT
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52911/235 IO state READING -> WRITING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52911/235 IO state WRITING -> END
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52911/235 Remove IO ctx and close socket, id [1F000051]
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52910/195 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]GET rcvd when in GET_REDIRECT state
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]HTTP GET request
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Parse GET, src [10.105.60.226] dst [Resolved IP] url [http://www.connectivity check url/favicon.ico]
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Read complete: parse_request return 8
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]State GET_REDIRECT -> GET_REDIRECT
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52910/195 IO state READING -> WRITING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52910/195 IO state WRITING -> END
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52910/195 Remove IO ctx and close socket, id [86000054]
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52919/195 IO state NEW -> READING
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52919/195 Remove IO ctx and close socket, id [4200004C]
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52923/195 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52924/195 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]52924/195 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]GET rcvd when in GET_REDIRECT state
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]HTTP GET request
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Parse GET, src [10.105.60.226] dst [192.0.2.1] url [https://192.0.2.1:443/login.html?redirect=http://www.connectivity check url/redirect]
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Read complete: parse_request return 10
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]State GET_REDIRECT -> LOGIN
{wncd_x_R0-0}{1}: [webauth-page] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Sending Webauth login form, len 8137
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53007/195 IO state READING -> WRITING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53007/195 IO state WRITING -> READING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53007/195 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]GET rcvd when in LOGIN state
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]HTTP GET request
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Parse GET, src [10.105.60.226] dst [192.0.2.1] url [https://192.0.2.1:443/favicon.ico]
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Read complete: parse_request return 6
{wncd_x_R0-0}{1}: [webauth-error] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Parse logo GET, File /favicon.ico not found
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53007/195 IO state READING -> END
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53007/195 Remove IO ctx and close socket, id [1D000064]
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53008/195 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53009/195 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53009/195 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]GET rcvd when in LOGIN state
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]HTTP GET request
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Parse GET, src [10.105.60.226] dst [192.0.2.1] url [https://192.0.2.1:443/favicon.ico]
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Read complete: parse_request return 6
{wncd_x_R0-0}{1}: [webauth-error] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Parse logo GET, File /favicon.ico not found
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53009/195 IO state READING -> END
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53009/195 Remove IO ctx and close socket, id [D1000066]
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53011/195 IO state NEW -> READING
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53011/195 Remove IO ctx and close socket, id [77000069]
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53020/195 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53022/235 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53023/195 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53023/195 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]POST rcvd when in LOGIN state
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]get url: /login.html
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Read complete: parse_request return 4
{wncd_x_R0-0}{1}: [sadb-attr] [24229]: (info): Removing ipv6 addresses from the attr list -1526718499,sm_ctx = 0x80806a1f10, num_ipv6 = 1
{wncd_x_R0-0}{1}: [caaa-authen] [24229]: (info): [CAAA:AUTHEN:4000544] NULL ATTR LIST 
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]State LOGIN -> AUTHENTICATING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53023/195 IO state READING -> AUTHENTICATING
{wncd_x_R0-0}{1}: [sadb-attr] [24229]: (info): Removing ipv6 addresses from the attr list 1761615853,sm_ctx = 0x80806a1f10, num_ipv6 = 1
{wncd_x_R0-0}{1}: [caaa-author] [24229]: (info): [CAAA:AUTHOR:4000544] NULL ATTR LIST 
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]State AUTHENTICATING -> AUTHC_SUCCESS
{wncd_x_R0-0}{1}: [webauth-acl] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Unapply IPv4 intecept ACL via SVM, name IP-Adm-V4-Int-ACL-global, pri 50, IIF 0 
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Raising ext evt Template Deactivated (11) on this session, client (unknown) (0)
{wncd_x_R0-0}{1}: [webauth-acl] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Unapply IPv6 intecept ACL via SVM, name IP-Adm-V6-Int-ACL-global, pri 52, IIF 0
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Raising ext evt Template Deactivated (11) on this session, client (unknown) (0)
{wncd_x_R0-0}{1}: [llbridge-main] [24229]: (debug): MAC: Client_MAC Link-local bridging not enabled for this client, not checking VLAN validity
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Authc success from WebAuth, Auth event success
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Raised event APPLY_USER_PROFILE (14)
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Raised event RX_METHOD_AUTHC_SUCCESS (3)

{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_WEBAUTH_PENDING -> S_AUTHIF_WEBAUTH_PENDING
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : username 0 Guest1
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : aaa-author-type 0 1 (0x1)
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : aaa-author-service 0 16 (0x10)
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : clid-MAC-addr 0 Client_MAC 
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : addr 0 0xa693ce2
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : method 0 1 [webauth]
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : clid-MAC-addr 0 Client_MAC 
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : intf-id 0 2684354561 (0xa0000001)
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] auth mgr attr add/change notification is received for attr username(450)
{wncd_x_R0-0}{1}: [auth-mgr-feat_acct] [24229]: (info): [Client_MAC:mobility_a0000001] SM Notified attribute Add/Update username Guest1
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Received User-Name Guest1 for client Client_MAC
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] auth mgr attr add/change notification is received for attr auth-domain(954)
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Method webauth changing state from 'Running' to 'Authc Success'
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Context changing state from 'Running' to 'Authc Success'
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] auth mgr attr add/change notification is received for attr method(757)
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Raised event AUTHZ_SUCCESS (11)
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Context changing state from 'Authc Success' to 'Authz Success'
{wncd_x_R0-0}{1}: [webauth-acl] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Applying IPv4 logout ACL via SVM, name: IP-Adm-V4-LOGOUT-ACL, priority: 51, IIF-ID: 0
{wncd_x_R0-0}{1}: [svm] [24229]: (info): SVM_INFO: Applying Svc Templ IP-Adm-V4-LOGOUT-ACL (ML:NONE)
{wncd_x_R0-0}{1}: [epm] [24229]: (info): [Client_MAC:mobility_a0000001] Feature (EPM URL PLUG-IN) has been started (status Success)
{wncd_x_R0-0}{1}: [svm] [24229]: (info): SVM_INFO: Response of epm is SYNC with return code Success
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Raising ext evt Template Activated (9) on this session, client (unknown) (0)
{wncd_x_R0-0}{1}: [sanet-shim-miscellaneous] [24229]: (ERR): authc policy update from SANet vlan 31
{wncd_x_R0-0}{1}: [llbridge-main] [24229]: (debug): MAC: Client_MAC Link-local bridging not enabled for this client, not checking VLAN validity
{wncd_x_R0-0}{1}: [webauth-sess] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]State AUTHC_SUCCESS -> AUTHZ
{wncd_x_R0-0}{1}: [webauth-page] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]Sending Webauth success page
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53023/195 IO state AUTHENTICATING -> WRITING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53023/195 IO state WRITING -> END
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.226]53023/195 Remove IO ctx and close socket, id [EC00006C]
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] SM will not send event Template Activated to PRE for 0x4000544
{wncd_x_R0-0}{1}: [client-auth] [24229]: (note): MAC: Client_MAC L3 Authentication Successful. ACL:[]
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_WEBAUTH_PENDING -> S_AUTHIF_WEBAUTH_DONE
{wncd_x_R0-0}{1}: [rog-proxy-capwap] [24229]: (debug): Managed client RUN state notification: Client_MAC
{wncd_x_R0-0}{1}: [avc-afc] [24229]: (info): ReAnchor [client MAC: Client_MAC] Client has Anchor role
{wncd_x_R0-0}{1}: [avc-afc] [24229]: (info): ReAnchor [client MAC: Client_MAC] Guest client detected. Skip it
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_L3_AUTH_IN_PROGRESS -> S_CO_RUN >> !! Client went to RUN State !!

Capture de paquets

Après le transfert de mobilité, le contrôleur d'ancrage reçoit le trafic DHCP du contrôleur étranger via le tunnel de mobilité. 

Trafic DHCP client sur le contrôleur d'ancrage reçu du contrôleur étranger

Le contrôleur d’ancrage reçoit les vérifications de connectivité, les demandes d’accès aux pages Web et les détails d’authentification pour poursuivre le traitement.

Vérification de l'état de la connectivité réseau sur le contrôleur d'ancrage

Rediriger l'URL envoyée au client

Page Client Access to Local Webauth pour fournir les détails d'authentification

Une fois l'authentification Web locale réussie, le client passe à l'état EXÉCUTÉ avec un rôle d'ancrage d'exportation. À partir de ce point, le contrôleur d’ancrage sert de point de sortie pour le trafic de données client.

État du client sur le contrôleur étranger et le contrôleur d'ancrage

État du client sur étrangerÉtat du client au point d'ancrage

Propriétés du client sur les  Propriétés du client sur l'ancre

Authentification Web centralisée

Flux pour le SSID Webauth central dans la configuration d'ancrage étranger

1. Le client envoie une demande d’association pour le SSID diffusé par le contrôleur de réseau local sans fil étranger (WLC).
2. Le WLC étranger effectue le filtrage MAC en envoyant une requête d’accès au serveur RADIUS. Le serveur RADIUS répond avec un Access-Accept, qui inclut l'URL de redirection et la liste de contrôle d'accès (ACL) nécessaires.
3. Le WLC étranger envoie la réponse d’association au client.
4. Le client est ancré au WLC d'ancrage. Le client passe à l'état d'exécution sur le WLC étranger, avec le rôle de mobilité défini sur Exporter étranger.
5. Le client obtient une adresse IP. À ce stade, le WLC d'ancrage gère le trafic de redirection, dirigeant le client vers le portail d'authentification.
6. Une fois redirigé, le client communique directement avec le serveur RADIUS. Ce trafic est tunnellisé via le WLC d'ancrage vers le serveur RADIUS.
7. Le client saisit les informations d'authentification sur le serveur RADIUS. Une fois l'authentification réussie, le serveur RADIUS envoie une demande de modification d'autorisation (CoA) au WLC étranger.
8. Le WLC étranger envoie une réponse CoA au serveur RADIUS. Le client passe à l'état EXÉCUTÉ sur le WLC d'ancrage, avec le rôle défini sur Exporter l'ancrage.
9. Tout le trafic client suivant est tunnellisé du WLC étranger au WLC d’ancrage, où il sort du réseau.

Diagramme de flux de connectivité client pour le SSID Webauth central dans la configuration d'ancrage étranger

Analyse du flux SSID Webauth central dans la configuration d'ancrage étranger via les journaux

Cette section explique le flux de connectivité client pour le SSID d'authentification Web centrale à l'aide de la trace radioactive (RA Trace), des captures de paquets intégrées (EPC) et de l'état du client sur les contrôleurs Foreign et Anchor.

Journaux du contrôleur étranger

Traces radioactives

!! Client Association Phase !!
{wncd_x_R0-0}{1}: [client-orch-sm] [17047]: (note): MAC: Client_MAC Association received. BSSID BSSID_MAC, WLAN DMZ_CWA, Slot 1 AP AP_MAC, AP_NAME, Site tag default-site-tag, Policy tag default-policy-tag, Policy profile DMZ_CWA_PP, Switching Central, Socket delay 0ms
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_INIT -> S_CO_ASSOCIATING

!! MAC Authentication !!
{wncd_x_R0-0}{1}: [dot11] [17047]: (info): MAC: Client_MAC DOT11 state transition: S_DOT11_INIT -> S_DOT11_MAB_PENDING
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_ASSOCIATING -> S_CO_MACAUTH_IN_PROGRESS
{wncd_x_R0-0}{1}: [client-auth] [17047]: (note): MAC: Client_MAC MAB Authentication initiated. Policy VLAN 31, AAA override = 1, NAC = 1
{wncd_x_R0-0}{1}: [auth-mgr-feat_wireless] [17047]: (info): [Client_MAC:capwap_90000003] - authc_list: DMZ_CWA_Authorization
{wncd_x_R0-0}{1}: [auth-mgr-feat_wireless] [17047]: (info): [Client_MAC:capwap_90000003] - authz_list: Not present under wlan configuration
{wncd_x_R0-0}{1}: [client-auth] [17047]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_INIT -> S_AUTHIF_AWAIT_MAB_AUTH_START_RESP
{wncd_x_R0-0}{1}: [client-auth] [17047]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_AWAIT_MAB_AUTH_START_RESP -> S_AUTHIF_MAB_AUTH_PENDING
{wncd_x_R0-0}{1}: [client-auth] [17047]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_MAB_AUTH_PENDING -> S_AUTHIF_MAB_AUTH_PENDING
{wncd_x_R0-0}{1}: [mab] [17047]: (info): [Client_MAC:capwap_90000003] Received event 'MAB_CONTINUE' on (Client_MAC)
{wncd_x_R0-0}{1}: [caaa-author] [17047]: (info): [CAAA:AUTHOR:a30003a6] NULL ATTR LIST

{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Send Access-Request to 10.106.32.130:1812 id 0/245, len 370
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: authenticator 
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: User-Name [1] 14 user-MAC
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: User-Password [2] 18 *
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Service-Type [6] 6 Call Check [10]
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Cisco [26] 31
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Cisco AVpair [1] 25 service-type=Call Check
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Framed-MTU [12] 6 1485 
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Message-Authenticator[80] 18 ...
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: EAP-Key-Name [102] 2 *
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Cisco [26] 49
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Cisco AVpair [1] 43 audit-session-id=1E4F6B0A000003D247203276
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Cisco [26] 18
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Cisco AVpair [1] 12 method=mab
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Cisco [26] 32
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Cisco AVpair [1] 26 client-iif-id=3556776730
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: NAS-IP-Address [4] 6 10.107.79.30 
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: NAS-Port-Type [61] 6 802.11 wireless [19]
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: NAS-Port [5] 6 141522 
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Cisco [26] 31
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Cisco AVpair [1] 25 cisco-wlan-ssid=DMZ_CWA
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Cisco [26] 33
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Cisco AVpair [1] 27 wlan-profile-name=DMZ_CWA
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Called-Station-Id [30] 27 called-station-id
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Calling-Station-Id [31] 19 client-MAC
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Airespace [26] 12
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Airespace-WLAN-ID [1] 6 12 
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Nas-Identifier [32] 16 ForeignSiteWLC
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Started 5 sec timeout
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Received from id 1812/245 10.106.32.130:0, Access-Accept, len 383
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: authenticator 
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: User-Name [1] 19 Client_MAC
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Class [25] 56 ...
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Message-Authenticator[80] 18 ...
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Cisco [26] 37
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Cisco AVpair [1] 31 url-redirect-acl=REDIRECT_ACL
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Cisco [26] 191
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Cisco AVpair [1] 185 url-redirect=https://10.106.32.130:8443/portal/gateway?sessionId=1E4F6B0A000003D247203276&portal=d06bc251-f644-4fc3-b09f-dae9bd8a86d5&action=cwa&token=5e47010db56b160c902513244337064a
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Vendor, Cisco [26] 42
{wncd_x_R0-0}{1}: [radius] [17047]: (info): RADIUS: Cisco AVpair [1] 36 profile-name=Windows10-Workstation

{wncd_x_R0-0}{1}: [mab] [17047]: (info): [Client_MAC:capwap_90000003] MAB received an Access-Accept for (Client_MAC)
{wncd_x_R0-0}{1}: [client-auth] [17047]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_MAB_AUTH_PENDING -> S_AUTHIF_MAB_AUTH_DONE
{wncd_x_R0-0}{1}: [client-orch-sm] [17047]: (debug): MAC: Client_MAC Processing MAB authentication result status: 0, CO_AUTH_STATUS_SUCCESS
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_MACAUTH_IN_PROGRESS -> S_CO_ASSOCIATING
{wncd_x_R0-0}{1}: [dot11] [17047]: (info): MAC: Client_MAC dot11 send association response. Sending assoc response of length: 137 with resp_status_code: 0, DOT11_STATUS: DOT11_STATUS_SUCCESS >> Association Successful 
{wncd_x_R0-0}{1}: [dot11] [17047]: (info): MAC: Client_MAC DOT11 state transition: S_DOT11_MAB_PENDING -> S_DOT11_ASSOCIATED
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_ASSOCIATING -> S_CO_L2_AUTH_IN_PROGRESS
{wncd_x_R0-0}{1}: [client-auth] [17047]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_MAB_AUTH_DONE -> S_AUTHIF_WEBAUTH_DONE
{wncd_x_R0-0}{1}: [client-orch-sm] [17047]: (debug): MAC: Client_MAC L2 Authentication of station is successful., L3 Authentication : 0
{wncd_x_R0-0}{1}: [client-orch-sm] [17047]: (note): MAC: Client_MAC Mobility discovery triggered. Client mode: Local
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_L2_AUTH_IN_PROGRESS -> S_CO_MOBILITY_DISCOVERY_IN_PROGRESS

!! Mobility Handoff !!

{mobilityd_R0-0}{1} [mm-dgram-io] [18401] (debug) MAC Client-MAC Sending message mobile_announce to group DMZ
{mobilityd_R0-0}{1} [mm-pmtu] [18401] (debug) Peer IP Anchor-WLC-IP 
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Sending mobile_announce of XID (176280) to (ipv4 Anchor-WLC-IP )
{mobilityd_R0-0}{1} [mm-transition] MMFSM transition S_MC_WAIT_ANNOUNCE_RSP -> S_MC_ANNOUNCE_TIMEDOUT_PROCESSED_TR on E_MC_REQUEST_TIMEDOUT from WNCD[0]

{wncd_x_R0-0}{1} [mm-client] [17047] (debug) MAC Client-MAC Received mobile_announce_nak, sub type 2 of XID (XID) from (MobilityD[0])

{wncd_x_R0-0}{1} [mm-transition] [17047] (info) MAC Client-MAC MMIF FSM transition S_MA_INIT_WAIT_ANNOUNCE_RSP -> S_MA_NAK_PROCESSED_TR on E_MA_NAK_RCVD

{wncd_x_R0-0}{1} [mm-client] [17047] (debug) MAC Client-MAC Sending export_Anchor_req of XID (XID) to (MobilityD[0])
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Received export_Anchor_req, sub type 0 of XID (XID) from (WNCD[0])

{mobilityd_R0-0}{1} [mm-transition] [18401] (info) MAC Client-MAC MMFSM transition S_MC_WAIT_EXP_ANC_REQ -> S_MC_EXP_ANC_REQ_RCVD_TR on E_MC_EXP_ANC_REQ_RCVD from WNCD[0]
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Export Anchor Request successfully processed.
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Sending export_Anchor_req of XID (176282) to (ipv4 Anchor-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Received export_Anchor_rsp, sub type 0 of XID (XID) from (ipv4 Anchor-WLC-IP )

{mobilityd_R0-0}{1} [mm-transition] [18401] (info) MAC Client-MAC MMFSM transition S_MC_WAIT_EXP_ANC_RSP -> S_MC_EXP_ANC_RSP_RCVD_TR on E_MC_EXP_ANC_RSP_RCVD from ipv4 Anchor-WLC-IP 

{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Export Anchor Response successfully processed.

{wncd_x_R0-0}{1} [epm-misc] [17047] (info) Anchor Vlan-id 31 processed
[mm-client] [17047] (info) MAC Client-MAC Mobility role changed - Unassoc -> Export Foreign
[mm-client] Mobility Successful. Roam Type L3 Requested, Sub Roam Type MM_SUB_ROAM_TYPE_NONE, Client IFID 0xa0000004, Client Role Export Foreign >> Client Successfully Anchored
{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS
{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS

{wncd_x_R0-0}{1} [client-orch-sm] [17047] (debug) MAC Client-MAC Received ip learn response. method IPLEARN_METHOD_ROAMING
{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_IP_LEARN_IN_PROGRESS -> S_CO_RUN >> !! Client went to RUN state !!

!! Post Succesful Web authentication, Change of Authorization !!
{wncd_x_R0-0}{1}: [client-auth] [17047]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_WEBAUTH_DONE -> S_AUTHIF_WEBAUTH_DONE
{wncd_x_R0-0}{1}: [caaa-ch] [17047]: (info): [CAAA:COMMAND HANDLER:a30003a6] Processing CoA request under Command Handler ctx.
{wncd_x_R0-0}{1}: [caaa-ch] [17047]: (info): [CAAA:COMMAND HANDLER:a30003a6] Reauthenticate request (0x5d71d3ad10e8) for Client_MAC
{wncd_x_R0-0}{1}: [sadb-attr] [17047]: (info): Removing ipv6 addresses from the attr list -50323943,sm_ctx = 0x80806aad00, num_ipv6 = 1
{wncd_x_R0-0}{1}: [mab] [17047]: (info): [Client_MAC:capwap_90000003] MAB re-authentication started for (Client_MAC)
{wncd_x_R0-0}{1}: [auth-mgr] [17047]: (info): [Client_MAC:capwap_90000003] Context changing state from 'Authz Success' to 'Running'
{wncd_x_R0-0}{1}: [auth-mgr] [17047]: (info): [Client_MAC:capwap_90000003] Method mab changing state from 'Authc Success' to 'Running'
{wncd_x_R0-0}{1}: [aaa-coa] [17047]: (info): radius coa proxy relay coa resp(wncd)
{wncd_x_R0-0}{1}: [aaa-coa] [17047]: (info): CoA Response Details
{wncd_x_R0-0}{1}: [aaa-attr-inf] [17047]: (info): << ssg-command-code 0 32 >>
{wncd_x_R0-0}{1}: [aaa-attr-inf] [17047]: (info): << formatted-clid 0 Client_MAC>>
{wncd_x_R0-0}{1}: [aaa-attr-inf] [17047]: (info): << error-cause 0 1 [Success]>>
{wncd_x_R0-0}{1}: [aaa-coa] [17047]: (info): server:10.107.79.30 cfg_saddr:10.107.79.30 udpport:51304 sport:0, tableid:0iden:2 rad_code:43 msg_auth_rcvd:TRUE coa_resp:ACK
{wncd_x_R0-0}{1}: [caaa-ch] [17047]: (info): [CAAA:COMMAND HANDLER] CoA response sent
{wncd_x_R0-0}{1}: [caaa-ch] [17047]: (info): [CAAA:COMMAND HANDLER:a30003a6] Identity preserved: MAC (Client_MAC), ip (0), audit_sid (1E4F6B0A000003D247203276), aaa_session_id (0)
{wncd_x_R0-0}{1}: [mab] [17047]: (info): [Client_MAC:capwap_90000003] Received event 'MAB_REAUTHENTICATE' on (Client_MAC)
{smd_R0-0}{1}: [aaa-coa] [18867]: (info): ++++++ Received CoA response Attribute List ++++++
{smd_R0-0}{1}: [radius] [18867]: (info): RADIUS(00000000): Send CoA Ack Response to 10.106.32.130:51304 id 2, len 69
{smd_R0-0}{1}: [radius] [18867]: (info): RADIUS: authenticator 
{smd_R0-0}{1}: [radius] [18867]: (info): RADIUS: Vendor, Cisco [26] 9
{smd_R0-0}{1}: [radius] [18867]: (info): RADIUS: ssg-command-code [252] 3 ...
{smd_R0-0}{1}: [radius] [18867]: (info): RADIUS: Calling-Station-Id [31] 16 Client_MAC
{smd_R0-0}{1}: [radius] [18867]: (info): RADIUS: Dynamic-Author-Error-Cause[101] 6 Success [200]
{smd_R0-0}{1}: [radius] [18867]: (info): RADIUS: Message-Authenticator[80] 18 ...
{smd_R0-0}{1}: [aaa-pod] [18867]: (info): CoA response source port = 0, udpport = 51304, 
{wncd_x_R0-0}{1}: [sadb-attr] [17047]: (info): Removing ipv6 addresses from the attr list 1627397682,sm_ctx = 0x80806aad00, num_ipv6 = 1

Capture de paquets

Le client envoie une demande d'association et effectue l'authentification MAC, ce trafic est géré par le contrôleur étranger.

Phase d'association client sur contrôleur étranger avec MAB sans fil

Un transfert de mobilité se déclenche entre les contrôleurs étranger et d'ancrage via le port UDP 16667. Lors d'un événement de mobilité réussi, l'état du client passe à EXÉCUTER avec un rôle Exporter étranger.

Le contrôleur étranger reçoit le trafic DHCP client via le tunnel CAPWAP et le transfère au contrôleur d'ancrage pour un traitement ultérieur.

Le trafic DHCP client reçu sur le contrôleur étranger est transféré au contrôleur d'ancrage à l'aide du tunnel de mobilité

De même, le client envoie l'état de connectivité réseau et le trafic de vérification d'accès à la page Web au WLC étranger via le tunnel CAPWAP ; le WLC étranger transfère ceci au WLC d'ancrage à l'aide du tunnel de mobilité, où le contrôleur d'ancrage intercepte ou traite le trafic.

Vérification de l'état de la connectivité réseau sur le contrôleur étranger

Rediriger l'URL envoyée au client

Page Client Access to Central Webauth pour fournir les détails d'authentification

Le contrôleur étranger traite la demande CoA après une authentification Web centrale réussie.

Changement d'autorisation (COA) avec contrôleur étranger

Journaux du contrôleur d'ancrage

Traces radioactives

!! Mobility Handoff !!
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received mobile_announce, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received mobile_announce, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received export_Anchor_req, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Number of client is BELOW wlan limit
{mobilityd_R0-0}{1} [mm-transition] [26021] (info) MAC Client-MAC MMFSM transition S_MC_INIT -> S_MC_Anchor_EXP_ANC_REQ_RCVD_TR on E_MC_EXP_ANC_REQ_RCVD from ipv4 Foreign-WLC-IP 

{wncd_x_R0-0}{1} [mm-client] [24229] (info) MAC Client-MAC Roam type changed - None -> L3 Requested

!! Session Created for Client !!
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_ASSOCIATING -> S_CO_CREATE_SM_SESSION_IN_PROGRESS
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_AWAIT_PUSH_START_RESP -> S_AUTHIF_SESSION_PUSH_PENDING
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_SESSION_PUSH_PENDING -> S_AUTHIF_L2_WEBAUTH_DONE
{wncd_x_R0-0}{1}: [client-orch-sm] [24229]: (debug): MAC: Client_MAC L2 Authentication of station is successful., L3 Authentication : 1
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_CREATE_SM_SESSION_IN_PROGRESS -> S_CO_MOBILITY_DISCOVERY_IN_PROGRESS
{wncd_x_R0-0}{1}: [mm-transition] [24229]: (info): MAC: Client_MACMMIF FSM transition: S_MA_INIT -> S_MA_ANCHORING_ASSOC_RESP_PROCESSED_TR on E_MA_CO_EXP_ANCHOR_REQ_ASSOC_RCVD
{wncd_x_R0-0}{1}: [mm-client] [24229]: (info): MAC: Client_MACRoam type changed - None -> L3 Requested
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Export Anchor Response successfully processed.
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Forwarding Anchor Response to Foreign.
{mobilityd_R0-0}{1} [mm-client] [26021] (info) MAC Client-MAC Forwarding export_Anchor_rsp, sub type 0 of XID (XID) from (WNCD[0]) to (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Client is AnchorED.
{
wncd_x_R0-0}{1} [mm-client] [24229] (info) MAC Client-MAC Mobility role changed - Unassoc -> Export Anchor
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Client is AnchorED.>> Client is successfully Anchored

!! Central Web Authentication Applied !!

{wncd_x_R0-0}{1}: [webauth-dev] [24229]: (info): Central Webauth URL Redirect, Received a request to create a CWA session for a MAC [d0:37:45:88:25:52]
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): [Client_MAC][ 0.0.0.0]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): [Client_MAC][ 0.0.0.0]State Invalid State -> INIT
{wncd_x_R0-0}{1}: [epm-redirect] [24229]: (info): [0000.0000.0000:unknown] URL-Redirect = https://10.106.32.130:8443/portal/gateway?sessionId=1E4F6B0A000003D247203276&portal=d06bc251-f644-4fc3-b09f-dae9bd8a86d5&action=cwa&token=5e47010db56b160c902513244337064a
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applied User Profile: method 0 2 [mab]
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applied User Profile: clid-MAC-addr 0 Client_MAC
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applied User Profile: intf-id 0 2415919107 (0x90000003)
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applied User Profile: username 0 D0-37-45-88-25-52
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applied User Profile: class 0 43 41 43 53 3a 31 45 34 46 36 42 30 41 30 30 30 30 30 33 44 32 34 37 32 30 33 32 37 36 3a 73 68 63 68 6f 75 62 65 49 53 45 2f 35 32 35 35 35 34 35 32 35 2f 31 38 
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applied User Profile: url-redirect-acl 0 REDIRECT_ACL
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applied User Profile: url-redirect 0 https://10.106.32.130:8443/portal/gateway?sessionId=1E4F6B0A000003D247203276&portal=d06bc251-f644-4fc3-b09f-dae9bd8a86d5&action=cwa&token=5e47010db56b160c902513244337064a

!! Client DHCP Traffic !!
{wncd_x_R0-0}{1} [client-orch-state] [24229] (note) MAC Client-MAC Client state transition S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS 
{wncd_x_R0-0}{1} [client-orch-state] [24229] (note) MAC Client-MAC Client state transition S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS {wncd_x_R0-0}{1} [client-iplearn] [24229] (info) MAC Client-MAC IP-learn state transition S_IPLEARN_INIT -> S_IPLEARN_IN_PROGRESS 

{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, giaddr 0.0.0.0, yiaddr 0.0.0.0, CMAC Client-MAC {wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.249, BOOTPREPLY, SISF_DHCPOFFER, giaddr 0.0.0.0, yiaddr 10.105.60.249, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.249, BOOTPREPLY, SISF_DHCPOFFER, giaddr 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, giaddr 0.0.0.0, yiaddr 0.0.0.0, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.249, BOOTPREPLY, SISF_DHCPACK, giaddr 0.0.0.0, yiaddr 10.105.60.249, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.249, BOOTPREPLY, SISF_DHCPACK, giaddr 0.0.0.0, yiaddr 10.105.60.249, CMAC Client-MAC 
{wncd_x_R0-0}{1} [client-iplearn] [24229] (note) MAC Client-MAC Client IP learn successful. Method DHCP IP 10.105.60.249 {wncd_x_R0-0}{1} [auth-mgr-feat_acct] [24229] (info) [Client-MACmobility_a0000001] SM Notified attribute Add/Update addr 10.105.60.249 
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Sending ipv4_address_update of XID (XID) to (ipv4 Foreign-WLC-IP )
{wncd_x_R0-0}{1} [client-iplearn] [24229] (info) MAC Client-MAC IP-learn state transition S_IPLEARN_IN_PROGRESS -> S_IPLEARN_COMPLETE {wncd_x_R0-0}{1}Received ip learn response. method IPLEARN_METHOD_DHCP >> IP Learn 
Complete
{wncd_x_R0-0}{1}: [client-orch-sm] [24229]: (debug): MAC: Client_MAC Received ip learn response. method: IPLEARN_METHOD_DHCP


!! Central Web Authentication !!

{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): [Client_MAC][ 10.105.60.249]59494/233 IO state NEW -> READING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): [Client_MAC][ 10.105.60.249]59495/235 IO state NEW -> READING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): [Client_MAC][ 10.105.60.249]59494/233 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): Captive bypass: No parameter map associated. Falling on global parameter map
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): [Client_MAC][ 10.105.60.249]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): [Client_MAC][ 10.105.60.249]State GET_REDIRECT -> GET_REDIRECT
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): [Client_MAC][ 10.105.60.249]59494/233 IO state READING -> WRITING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): [Client_MAC][ 10.105.60.249]59494/233 IO state WRITING -> END
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): [Client_MAC][ 10.105.60.249]59494/233 Remove IO ctx and close socket, id [1200007E]
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_WEBAUTH_PENDING -> S_AUTHIF_WEBAUTH_PENDING
{mobilityd_R0-0}{1}: [mm-client] [26021]: (debug): MAC: Client_MAC Sending export_anchor_rsp of XID (182425) to (ipv4: Foreign-WLC-IP )
{wncd_x_R0-0}{1}: [client-auth] [24229]: (note): MAC: Client_MAC L3 Authentication Successful. ACL:[]
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_WEBAUTH_PENDING -> S_AUTHIF_WEBAUTH_DONE
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_L3_AUTH_IN_PROGRESS -> S_CO_RUN

Capture de paquets

Après le transfert de mobilité, le contrôleur d'ancrage reçoit le trafic DHCP du contrôleur étranger via le tunnel de mobilité.

Trafic DHCP client sur le contrôleur d'ancrage reçu du contrôleur étranger

Le contrôleur d’ancrage reçoit les vérifications de connectivité, les demandes d’accès aux pages Web et les détails d’authentification pour poursuivre le traitement.

Vérification de l'état de la connectivité réseau sur le contrôleur d'ancrage

Rediriger l'URL envoyée au client

Page Client Access to Local Webauth pour fournir les détails d'authentification

Lorsque l'authentification Web centrale réussit, un changement d'autorisation (CoA) se déclenche. Après une CoA réussie, le client passe à l'état EXÉCUTÉ avec un rôle Ancre d'exportation.

État du client sur le contrôleur étranger et le contrôleur d'ancrage

État du client sur étranger  État du client au point d'ancrage

Propriétés du client sur les  Propriétés du client sur l'ancre

Authentification Web externe

Flux pour le SSID Webauth externe dans la configuration d'ancrage étranger

1. Le client initie une connexion au SSID diffusé par le WLC étranger.
2. Comme aucune authentification de couche 2 n’est requise, le client est ancré au WLC d’ancrage. Le client passe à l'état EXÉCUTER sur le WLC étranger, avec le rôle de mobilité désigné comme Exporter étranger.
3. Le client acquiert une adresse IP. Le WLC d'ancrage intercepte le trafic et redirige le client vers le portail du serveur Web externe comme défini dans les paramètres d'authentification Web.
4. Le client envoie les informations d'authentification via le portail. Ces informations d'identification sont validées localement sur le WLC ou via un serveur d'authentification externe, selon la stratégie de sécurité configurée.
5. Une fois l'authentification réussie, le client passe à l'état RUN sur le WLC d'ancrage, en assumant le rôle d'ancrage d'exportation.
6. Après une authentification réussie, tout le trafic client suivant est tunnellisé du WLC étranger au WLC d'ancrage, où il sort du réseau.

Diagramme de flux de connectivité client pour SSID Webauth externe dans la configuration d'ancrage étranger

Analyse du flux SSID Webauth externe dans la configuration d'ancrage étranger via les journaux

Cette section explique le flux de connectivité client pour le SSID d'authentification Web externe à l'aide de la trace radioactive (RA Trace), des captures de paquets intégrées (EPC) et de l'état du client sur les contrôleurs Foreign et Anchor.

Journaux du contrôleur étranger

Traces radioactives

!! Client Association Phase !!
{wncd_x_R0-1}{1}: [client-orch-sm] [17162]: (note): MAC: Client_MAC Association received. BSSID BSSID_MAC, WLAN DMZ_EWA, Slot 1 AP AP-MAC, AP-NAME, Site tag default-site-tag, Policy tag default-policy-tag, Policy profile DMZ_EWA_PP, Switching Central, Socket delay 0ms
{wncd_x_R0-1}{1}: [client-orch-state] [17162]: (note): MAC: Client_MAC Client state transition: S_CO_INIT -> S_CO_ASSOCIATING
{wncd_x_R0-1}{1}: [dot11] [17162]: (info): MAC: Client_MAC dot11 send association response. Sending assoc response of length: 137 with resp_status_code: 0, DOT11_STATUS: DOT11_STATUS_SUCCESS
{wncd_x_R0-1}{1}: [dot11] [17162]: (note): MAC: Client_MAC Association success. AID 1, Roaming = False, WGB = False, 11r = False, 11w = False Fast roam = False
{wncd_x_R0-1}{1}: [dot11] [17162]: (info): MAC: Client_MAC DOT11 state transition: S_DOT11_INIT -> S_DOT11_ASSOCIATED

!! Layer 2 Authentication None !!
{wncd_x_R0-1}{1}: [client-orch-state] [17162]: (note): MAC: Client_MAC Client state transition: S_CO_ASSOCIATING -> S_CO_L2_AUTH_IN_PROGRESS
{wncd_x_R0-1}{1}: [client-auth] [17162]: (note): MAC: Client_MAC L2 Authentication initiated. method WEBAUTH, Policy VLAN 31, AAA override = 0
{wncd_x_R0-1}{1}: [client-auth] [17162]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_INIT -> S_AUTHIF_AWAIT_L2_WEBAUTH_START_RESP
{wncd_x_R0-1}{1}: [client-auth] [17162]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_AWAIT_L2_WEBAUTH_START_RESP -> S_AUTHIF_L2_WEBAUTH_PENDING
{wncd_x_R0-1}{1}: [client-auth] [17162]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_L2_WEBAUTH_PENDING -> S_AUTHIF_WEBAUTH_DONE
{wncd_x_R0-1}{1}: [client-orch-sm] [17162]: (debug): MAC: Client_MAC L2 Authentication of station is successful., L3 Authentication : 0
{wncd_x_R0-1}{1}: [client-orch-sm] [17162]: (note): MAC: Client_MAC Mobility discovery triggered. Client mode: Local
{wncd_x_R0-1}{1}: [client-orch-state] [17162]: (note): MAC: Client_MAC Client state transition: S_CO_L2_AUTH_IN_PROGRESS -> S_CO_MOBILITY_DISCOVERY_IN_PROGRESS
{wncd_x_R0-1}{1}: [client-orch-state] [17162]: (note): MAC: Client_MAC Client state transition: S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_MOBILITY_DISCOVERY_IN_PROGRES

!! Mobility Handoff !!
{mobilityd_R0-0}{1} [mm-dgram-io] [18401] (debug) MAC Client-MAC Sending message mobile_announce to group DMZ
{mobilityd_R0-0}{1} [mm-pmtu] [18401] (debug) Peer IP Anchor-WLC-IP 
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Sending mobile_announce of XID (176280) to (ipv4 Anchor-WLC-IP )
{mobilityd_R0-0}{1} [mm-transition] MMFSM transition S_MC_WAIT_ANNOUNCE_RSP -> S_MC_ANNOUNCE_TIMEDOUT_PROCESSED_TR on E_MC_REQUEST_TIMEDOUT from WNCD[0]

{wncd_x_R0-0}{1} [mm-client] [17047] (debug) MAC Client-MAC Received mobile_announce_nak, sub type 2 of XID (XID) from (MobilityD[0])

{wncd_x_R0-0}{1} [mm-transition] [17047] (info) MAC Client-MAC MMIF FSM transition S_MA_INIT_WAIT_ANNOUNCE_RSP -> S_MA_NAK_PROCESSED_TR on E_MA_NAK_RCVD

{wncd_x_R0-0}{1} [mm-client] [17047] (debug) MAC Client-MAC Sending export_Anchor_req of XID (XID) to (MobilityD[0])
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Received export_Anchor_req, sub type 0 of XID (XID) from (WNCD[0])

{mobilityd_R0-0}{1} [mm-transition] [18401] (info) MAC Client-MAC MMFSM transition S_MC_WAIT_EXP_ANC_REQ -> S_MC_EXP_ANC_REQ_RCVD_TR on E_MC_EXP_ANC_REQ_RCVD from WNCD[0]
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Export Anchor Request successfully processed.
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Sending export_Anchor_req of XID (176282) to (ipv4 Anchor-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Received export_Anchor_rsp, sub type 0 of XID (XID) from (ipv4 Anchor-WLC-IP )

{mobilityd_R0-0}{1} [mm-transition] [18401] (info) MAC Client-MAC MMFSM transition S_MC_WAIT_EXP_ANC_RSP -> S_MC_EXP_ANC_RSP_RCVD_TR on E_MC_EXP_ANC_RSP_RCVD from ipv4 Anchor-WLC-IP 

{mobilityd_R0-0}{1} [mm-client] [18401] (debug) MAC Client-MAC Export Anchor Response successfully processed.

{wncd_x_R0-0}{1} [epm-misc] [17047] (info) Anchor Vlan-id 31 processed
[mm-client] [17047] (info) MAC Client-MAC Mobility role changed - Unassoc -> Export Foreign
[mm-client] Mobility Successful. Roam Type L3 Requested, Sub Roam Type MM_SUB_ROAM_TYPE_NONE, Client IFID 0xa0000004, Client Role Export Foreign >> Client Successfully Anchored
{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS
{wncd_x_R0-0}{1} [client-orch-state] Client state transition S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS
{wncd_x_R0-0}{1} [client-orch-sm] [17047] (debug) MAC Client-MAC Received ip learn response. method IPLEARN_METHOD_ROAMING
{wncd_x_R0-0}{1}: [client-orch-state] [17047]: (note): MAC: Client_MAC Client state transition: S_CO_IP_LEARN_IN_PROGRESS -> S_CO_RUN

!! Client AAAA Traffic !!
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC Received aaa_handoff, sub type: 0 of XID (38840) from (ipv4: Anchor-WLC-IP )
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC aaa_handoff base check is VALID 
{mobilityd_R0-0}{1}: [mm-transition] [18401]: (info): MAC: Client_MAC MMFSM transition: S_MC_RUN -> S_MC_AAA_HANDOFF_PROCESSED_TR on E_MC_AAA_HANDOFF_RCVD from ipv4: Anchor-WLC-IP 
{mobilityd_R0-0}{1}: [mm-client] [18401]: (info): MAC: Client_MAC Forwarding aaa_handoff, sub type: 0 of XID (38840) from (ipv4: Anchor-WLC-IP ) to (WNCD[0])
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC Sending aaa_handoff of XID (38840) to (WNCD[0])
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC AAA Handoff successfully forwarded.
{wncd_x_R0-0}{1}: [mm-client] [17047]: (debug): MAC: Client_MAC Received aaa_handoff, sub type: 0 of XID (38840) from (MobilityD[0])
{wncd_x_R0-0}{1}: [mm-transition] [17047]: (info): MAC: Client_MAC MMIF FSM transition: S_MA_FOREIGN -> S_MA_AAA_HANDOFF_PROCESSED_TR on E_MA_AAA_HANDOFF
{wncd_x_R0-0}{1}: [mm-client] [17047]: (debug): MAC: Client_MAC Mobile AAA Handoff update received.
{wncd_x_R0-0}{1}: [sanet-shim-miscellaneous] [17047]: (info): MAC: Client_MAC Received username=Test321 username_len=7
{wncd_x_R0-0}{1}: [sanet-shim-miscellaneous] [17047]: (info): MAC: Client_MAC IPv6 Client payload is received in aaa handoff
{wncd_x_R0-0}{1}: [mm-client] [17047]: (debug): MAC: Client_MAC Sending aaa_handoff_ack of XID (38840) to (MobilityD[0])
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC Received aaa_handoff_ack, sub type: 0 of XID (38840) from (WNCD[0])
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC AAA Handoff Ack successfully handled.
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC aaa_handoff_ack base check is VALID 
{mobilityd_R0-0}{1}: [mm-client] [18401]: (debug): MAC: Client_MAC aaa_handoff_ack is VALID 
{mobilityd_R0-0}{1}: [mm-transition] [18401]: (info): MAC: Client_MAC MMFSM transition: S_MC_RUN -> S_MC_AAA_HANDOFF_ACK_PROCESSED_TR on E_MC_AAA_HANDOFF_ACK_RCVD from WNCD[0]
{mobilityd_R0-0}{1}: [mm-client] [18401]: (info): MAC: Client_MAC Forwarding aaa_handoff_ack, sub type: 0 of XID (38840) from (WNCD[0]) to (ipv4: Anchor-WLC-IP )

Capture de paquets

Le client envoie une demande d'association que le contrôleur étranger traite.

Phase d'association client avec contrôleur étranger

Un transfert de mobilité se déclenche entre les contrôleurs étranger et d'ancrage via le port UDP 16667. Lors d'un événement de mobilité réussi, l'état du client passe à EXÉCUTER avec un rôle Exporter étranger.
Le contrôleur étranger reçoit le trafic DHCP client via le tunnel CAPWAP et le transfère au contrôleur d'ancrage pour un traitement ultérieur.

Le trafic DHCP client reçu sur le contrôleur étranger est transféré au contrôleur d'ancrage à l'aide du tunnel de mobilité

De même, le client envoie l'état de connectivité réseau et le trafic de vérification d'accès à la page Web au WLC étranger via le tunnel CAPWAP ; le WLC étranger transfère ceci au WLC d'ancrage à l'aide du tunnel de mobilité, où le contrôleur d'ancrage intercepte ou traite le trafic.

Vérification de l'état de la connectivité réseau sur le contrôleur étranger

Rediriger l'URL envoyée au client

Accès client à la page WebAuth externe pour fournir les détails d'authentification

Journaux du contrôleur d'ancrage

Traces radioactives

!! Mobility Handoff !!
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received mobile_announce, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received mobile_announce, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Received export_Anchor_req, sub type 0 of XID (XID) from (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Number of client is BELOW wlan limit
{mobilityd_R0-0}{1} [mm-transition] [26021] (info) MAC Client-MAC MMFSM transition S_MC_INIT -> S_MC_Anchor_EXP_ANC_REQ_RCVD_TR on E_MC_EXP_ANC_REQ_RCVD from ipv4 Foreign-WLC-IP

!! Session Created for Client !!
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_ASSOCIATING -> S_CO_CREATE_SM_SESSION_IN_PROGRESS
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_INIT -> S_AUTHIF_AWAIT_L2_WEBAUTH_START_RESP
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): [Client_MAC][ 0.0.0.0]Param-map used: global
{wncd_x_R0-0}{1}: [webauth-acl] [24229]: (info): mobility_a0000001[Client_MAC][ 0.0.0.0]Applying IPv4 intercept ACL via SVM, name: WA-v4-int-10.106.32.130-7, priority: 50, IIF-ID: 0
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_AWAIT_L2_WEBAUTH_START_RESP -> S_AUTHIF_L2_WEBAUTH_PENDING
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_CREATE_SM_SESSION_IN_PROGRESS -> S_CO_MOBILITY_DISCOVERY_IN_PROGRESS
{wncd_x_R0-0}{1}: [mm-transition] [24229]: (info): MAC: Client_MAC MMIF FSM transition: S_MA_INIT -> S_MA_AnchorING_ASSOC_RESP_PROCESSED_TR on E_MA_CO_EXP_Anchor_REQ_ASSOC_RCVD

{wncd_x_R0-0}{1} [mm-client] [24229] (info) MAC Client-MAC Roam type changed - None -> L3 Requested
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Export Anchor Response successfully processed.
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Forwarding Anchor Response to Foreign.
{mobilityd_R0-0}{1} [mm-client] [26021] (info) MAC Client-MAC Forwarding export_Anchor_rsp, sub type 0 of XID (XID) from (WNCD[0]) to (ipv4 Foreign-WLC-IP )
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Client is AnchorED.
{
wncd_x_R0-0}{1} [mm-client] [24229] (info) MAC Client-MAC Mobility role changed - Unassoc -> Export Anchor
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Client is AnchorED.>> Client is successfully Anchored


!! Client DHCP Traffic !!
{wncd_x_R0-0}{1} [client-orch-state] [24229] (note) MAC Client-MAC Client state transition S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS 
{wncd_x_R0-0}{1} [client-orch-state] [24229] (note) MAC Client-MAC Client state transition S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS {wncd_x_R0-0}{1} [client-iplearn] [24229] (info) MAC Client-MAC IP-learn state transition S_IPLEARN_INIT -> S_IPLEARN_IN_PROGRESS 

{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, giaddr 0.0.0.0, yiaddr 0.0.0.0, CMAC Client-MAC {wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.254, BOOTPREPLY, SISF_DHCPOFFER, giaddr 0.0.0.0, yiaddr 10.105.60.254, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.254, BOOTPREPLY, SISF_DHCPOFFER, giaddr 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, giaddr 0.0.0.0, yiaddr 0.0.0.0, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface mobility_a0000001 on vlan 31 Src MAC Client-MAC Dst MAC ffff.ffff.ffff src_ip 0.0.0.0, dst_ip 255.255.255.255, BOOTPREQUEST, SISF_DHCPREQUEST, 
{wncd_x_R0-0}{1} [sisf-packet] RX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.254, BOOTPREPLY, SISF_DHCPACK, giaddr 0.0.0.0, yiaddr 10.105.60.254, CMAC Client-MAC 
{wncd_x_R0-0}{1} [sisf-packet] TX DHCPv4 from interface Tw0/0/1 on vlan 31 Src MAC DHCP-Reply-Source-MAC Dst MAC Client-MAC src_ip 10.105.60.69, dst_ip 10.105.60.254, BOOTPREPLY, SISF_DHCPACK, giaddr 0.0.0.0, yiaddr 10.105.60.254, CMAC Client-MAC 
{wncd_x_R0-0}{1} [client-iplearn] [24229] (note) MAC Client-MAC Client IP learn successful. Method DHCP IP 10.105.60.254 {wncd_x_R0-0}{1} [auth-mgr-feat_acct] [24229] (info) [Client-MACmobility_a0000001] SM Notified attribute Add/Update addr 10.105.60.254 
{mobilityd_R0-0}{1} [mm-client] [26021] (debug) MAC Client-MAC Sending ipv4_address_update of XID (XID) to (ipv4 Foreign-WLC-IP )
{wncd_x_R0-0}{1} [client-iplearn] [24229] (info) MAC Client-MAC IP-learn state transition S_IPLEARN_IN_PROGRESS -> S_IPLEARN_COMPLETE {wncd_x_R0-0}{1}Received ip learn response. method IPLEARN_METHOD_DHCP >> IP Learn 
Complete
{wncd_x_R0-0}{1}: [client-orch-sm] [24229]: (debug): MAC: Client_MAC Received ip learn response. method: IPLEARN_METHOD_DHCP

!! External Web Authentication !!
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_IP_LEARN_IN_PROGRESS -> S_CO_L3_AUTH_IN_PROGRESS
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62440/233 IO state NEW -> READING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62441/235 IO state NEW -> READING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62440/233 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]GET rcvd when in LOGIN state
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]HTTP GET request
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Parse GET, src [10.105.60.254] dst [Resolved-IP] url [http://Connectivity Check URL/redirect]
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Read complete: parse_request return 9
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Param-map used: External_Webauth
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]State LOGIN -> LOGIN
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62440/233 IO state READING -> WRITING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62440/233 IO state WRITING -> READING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62440/233 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]GET rcvd when in LOGIN state
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]HTTP GET request
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Parse GET, src [10.105.60.254] dst [Resolved-IP] url [http://Connectivity Check URL/favicon.ico]
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Read complete: parse_request return 9
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Param-map used: External_Webauth
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]State LOGIN -> LOGIN
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62440/233 IO state READING -> WRITING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62440/233 IO state WRITING -> READING
{wncd_x_R0-0}{1}: [sisf-packet] [24229]: (info): RX: IPv6 DHCP from intf mobility_a0000001 on vlan 31 Src MAC: Client_MAC Dst MAC: 3333.0001.0002 Ipv6 SRC: fe80::877c:b748:ddc:4fc0, Ipv6 DST: ff02::1:2, type: msg type: DHCPV6_MSG_SOLICIT xid: 12241179 
{wncd_x_R0-0}{1}: [sisf-packet] [24229]: (info): TX: IPv6 DHCP from intf mobility_a0000001 on vlan 31 Src MAC: Client_MAC Dst MAC: 3333.0001.0002 Ipv6 SRC: fe80::877c:b748:ddc:4fc0, Ipv6 DST: ff02::1:2, type: msg type: DHCPV6_MSG_SOLICIT xid: 12241179 
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62480/238 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62481/239 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62482/238 IO state NEW -> SSL_HANDSHAKING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62482/238 Read event, Message ready
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]GET rcvd when in LOGIN state
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]HTTP GET request
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Parse GET, src [10.105.60.254] dst [192.0.2.1] url Login URL
{wncd_x_R0-0}{1}: [sadb-attr] [24229]: (info): Removing ipv6 addresses from the attr list -654303708,sm_ctx = 0x80806adfc8, num_ipv6 = 1
{wncd_x_R0-0}{1}: [caaa-authen] [24229]: (info): [CAAA:AUTHEN:910007e3] NULL ATTR LIST 
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Param-map used: External_Webauth
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]State LOGIN -> AUTHENTICATING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62482/238 IO state READING -> AUTHENTICATING
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Send Access-Request to 10.106.32.130:1812 id 0/3, len 418
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: authenticator 
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Calling-Station-Id [31] 19 Client_MAC
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: User-Name [1] 9 Test321
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Vendor, Cisco [26] 49
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Cisco AVpair [1] 43 audit-session-id=723C690A000007ED659D99E5
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Framed-IP-Address [8] 6 10.105.60.254 
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Cisco AVpair [1] 12 vlan-id=31
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: NAS-IP-Address [4] 6 10.105.60.114 
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: NAS-Port-Type [61] 6 Virtual [5]
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: NAS-Port [5] 6 0 
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Vendor, Cisco [26] 31
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Cisco AVpair [1] 25 cisco-wlan-ssid=DMZ_EWA
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Vendor, Cisco [26] 33
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Cisco AVpair [1] 27 wlan-profile-name=DMZ_EWA
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Called-Station-Id [30] 27 Called-Station-ID
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Vendor, Airespace [26] 12
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Airespace-WLAN-ID [1] 6 7 
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Nas-Identifier [32] 12 DMZSiteWLC
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Started 5 sec timeout
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Received from id 1812/3 10.106.32.130:0, Access-Accept, len 145
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: authenticator 
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: User-Name [1] 9 Test321
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Class [25] 56 ...
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Message-Authenticator[80] 18 ...
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Vendor, Cisco [26] 42
{wncd_x_R0-0}{1}: [radius] [24229]: (info): RADIUS: Cisco AVpair [1] 36 profile-name=Windows10-Workstation
{wncd_x_R0-0}{1}: [radius] [24229]: (info): Valid Response Packet, Free the identifier
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Param-map used: External_Webauth
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]State AUTHENTICATING -> AUTHC_SUCCESS
{wncd_x_R0-0}{1}: [webauth-acl] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Unapply IPv4 intecept ACL via SVM, name WA-v4-int-10.106.32.130-7, pri 50, IIF 0 
{wncd_x_R0-0}{1}: [webauth-acl] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Unapply IPv6 intecept ACL via SVM, name IP-Adm-V6-Int-ACL-global, pri 52, IIF 0
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_WEBAUTH_PENDING -> S_AUTHIF_WEBAUTH_PENDING
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : username 0 Test321
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : class 0 43 41 43 53 3a 37 32 33 43 36 39 30 41 30 30 30 30 30 37 45 44 36 35 39 44 39 39 45 35 3a 73 68 63 68 6f 75 62 65 49 53 45 2f 35 32 35 35 35 34 35 32 35 2f 34 34 
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : Message-Authenticator 0 <hidden>
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : method 0 1 [webauth]
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : clid-MAC-addr 0 d0 37 45 88 25 52 
{wncd_x_R0-0}{1}: [aaa-attr-inf] [24229]: (info): Applying Attribute : intf-id 0 2684354561 (0xa0000001)
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] auth mgr attr add/change notification is received for attr username(450)
{wncd_x_R0-0}{1}: [auth-mgr-feat_acct] [24229]: (info): [Client_MAC:mobility_a0000001] SM Notified attribute Add/Update username Test321
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Received User-Name Test321 for client Client_MAC
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] auth mgr attr add/change notification is received for attr auth-domain(954)
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Method webauth changing state from 'Running' to 'Authc Success'
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Context changing state from 'Running' to 'Authc Success'
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] auth mgr attr add/change notification is received for attr method(757)
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Raised event AUTHZ_SUCCESS (11)
{wncd_x_R0-0}{1}: [auth-mgr] [24229]: (info): [Client_MAC:mobility_a0000001] Context changing state from 'Authc Success' to 'Authz Success'
{wncd_x_R0-0}{1}: [webauth-sess] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Param-map used: External_Webauth
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Param-map used: External_Webauth
{wncd_x_R0-0}{1}: [webauth-state] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]State AUTHC_SUCCESS -> AUTHZ
{wncd_x_R0-0}{1}: [webauth-page] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]Sending Webauth success page
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62482/238 IO state AUTHENTICATING -> WRITING
{wncd_x_R0-0}{1}: [webauth-io] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62482/238 IO state WRITING -> END
{wncd_x_R0-0}{1}: [webauth-httpd] [24229]: (info): mobility_a0000001[Client_MAC][ 10.105.60.254]62482/238 Remove IO ctx and close socket, id [4400004C]
{wncd_x_R0-0}{1}: [client-auth] [24229]: (note): MAC: Client_MAC L3 Authentication Successful. ACL:[]
{wncd_x_R0-0}{1}: [client-auth] [24229]: (info): MAC: Client_MAC Client auth-interface state transition: S_AUTHIF_WEBAUTH_PENDING -> S_AUTHIF_WEBAUTH_DONE
{wncd_x_R0-0}{1}: [client-orch-state] [24229]: (note): MAC: Client_MAC Client state transition: S_CO_L3_AUTH_IN_PROGRESS -> S_CO_RUN

{wncd_x_R0-0}{1}: [mm-transition] [24229]: (info): MAC: Client_MAC MMIF FSM transition: S_MA_ANCHOR -> S_MA_ANCHOR_AAA_HANDOFF_PROCESSED_TR on E_MA_CO_AAA_HANDOFF_RCVD
{mobilityd_R0-0}{1}: [mm-client] [26021]: (debug): MAC: Client_MAC Received aaa_handoff, sub type: 0 of XID (0) from (WNCD[0])
{mobilityd_R0-0}{1}: [mm-client] [26021]: (debug): MAC: Client_MAC aaa_handoff base check is VALID 
{mobilityd_R0-0}{1}: [mm-transition] [26021]: (info): MAC: Client_MAC MMFSM transition: S_MC_RUN -> S_MC_ANCHOR_AAA_HANDOFF_PROCESSED_TR on E_MC_AAA_HANDOFF_RCVD from WNCD[0]
{mobilityd_R0-0}{1}: [mm-client] [26021]: (info): MAC: Client_MAC Forwarding aaa_handoff, sub type: 0 of XID (38840) from (WNCD[0]) to (ipv4: Foreign-WLC-IP)
{mobilityd_R0-0}{1}: [mm-client] [26021]: (debug): MAC: Client_MAC Sending aaa_handoff of XID (38840) to (ipv4: Foreign-WLC-IP)
{mobilityd_R0-0}{1}: [mm-client] [26021]: (debug): MAC: Client_MAC AAA Handoff successfully forwarded.
{mobilityd_R0-0}{1}: [mm-client] [26021]: (debug): MAC: Client_MAC Received aaa_handoff_ack, sub type: 0 of XID (38840) from (ipv4: Foreign-WLC-IP)
{mobilityd_R0-0}{1}: [mm-client] [26021]: (debug): MAC: Client_MAC AAA Handoff Ack successfully handled.
{mobilityd_R0-0}{1}: [mm-client] [26021]: (debug): MAC: Client_MAC aaa_handoff_ack base check is VALID 
{mobilityd_R0-0}{1}: [mm-client] [26021]: (debug): MAC: Client_MAC aaa_handoff_ack is VALID 
{mobilityd_R0-0}{1}: [mm-transition] [26021]: (info): MAC: Client_MAC MMFSM transition: S_MC_ANCHOR_WAIT_AAA_HANDOFF_ACK -> S_MC_ANCHOR_AAA_HANDOFF_ACK_PROCESSED_TR on E_MC_AAA_HANDOFF_ACK_RCVD from ipv4: Foreign-WLC-IP

Capture de paquets

Après le transfert de mobilité, le contrôleur d'ancrage reçoit le trafic DHCP du contrôleur étranger via le tunnel de mobilité. 

Trafic DHCP client sur le contrôleur d'ancrage reçu du contrôleur étranger

Le contrôleur d’ancrage reçoit les vérifications de connectivité, les demandes d’accès aux pages Web et les détails d’authentification pour poursuivre le traitement.

Vérification de l'état de la connectivité réseau sur le contrôleur d'ancrage

Rediriger l'URL envoyée au client

Le client envoie les informations d'authentification via le portail. Ces informations d'identification sont validées localement sur le WLC ou via un serveur d'authentification externe, selon la stratégie de sécurité configurée.

Accès client à la page WebAuth externe pour fournir les détails d'authentification

État du client sur le contrôleur étranger et le contrôleur d'ancrage

État du client sur étrangerÉtat du client au point d'ancrage

Propriétés du client sur lesPropriétés du client sur l'ancre

Équilibrage De Charge Entre Contrôleur D'Ancrage Multiple

Lorsque plusieurs contrôleurs d’ancrage sont mappés à un seul WLAN, la distribution du trafic dépend de la priorité. Trois niveaux de priorité peuvent être configurés : Primaire, secondaire et tertiaire. La fonction de priorité d'ancrage invité fournit un mécanisme de distribution de charge active/en veille entre les contrôleurs d'ancrage. Pour ce faire, attribuez une priorité fixe à chaque contrôleur d’ancrage : La charge est distribuée au contrôleur de priorité la plus élevée, et de manière circulaire parmi les contrôleurs qui partagent la même valeur de priorité.

Mappage de priorité d'ancrage

Dépannage de la connectivité client dans un scénario d'ancrage étranger

1. Problèmes d'intégration client
   1. État du tunnel : Vérifiez que le tunnel de mobilité entre les contrôleurs étranger et d'ancrage reste actif.
   2. Non-concordance de configuration : Assurez la parité de configuration entre les deux contrôleurs. Des différences dans les noms de WLAN, les noms de profil de stratégie ou les paramètres avancés (tels que le remplacement AAA, les exigences DHCP IPv4 et NAC) entraînent des erreurs de non-correspondance de profil ou de refus d'ancrage.
   3. Divers : Si le tunnel est activé sans problème de configuration, l'approche de dépannage est similaire à un problème de connectivité client normal en s'assurant de vérifier le contrôleur respectif qui gère le trafic affecté.
      
      
2. Connectivité intermittente
   1. Volets du tunnel : Si les paquets keepalive entre les deux contrôleurs ne parviennent pas, le tunnel s'affole, empêchant le client de maintenir une connexion au SSID.
   2. Bande passante faible : Si la valeur de la MTU de chemin (PMTU) entre homologues de mobilité diminue (576), les clients subissent une dégradation des performances. Cela se produit généralement lorsque des messages de test d'activité mtu de chemin sont manqués entre les deux homologues de mobilité
      
      

      Remarque : Le contrôleur avec l'adresse MAC de mobilité inférieure lance les messages de keepalive standard et de MTU de chemin.

3. Problèmes spécifiques d'accès au site Web
   1. Les en-têtes de trafic de mobilité incluent les identificateurs de groupe de mobilité, les adresses MAC, les adresses IP et les paquets DTLS CAPWAP chiffrés échangés sur les ports UDP 16666 et 16667. Cette surcharge s'ajoute à l'en-tête CAPWAP existant. Pour le trafic TCP, après l'ajustement de TCP MSS configuré pour AP, si la taille du paquet dépasse la PMTU de mobilité (maximum 1385 octets) en raison de cette surcharge supplémentaire, la fragmentation se produit.Bien que la fragmentation soit généralement gérée par le réseau, des problèmes surviennent si les paquets arrivent dans le désordre ou en retard. Ces conditions ont un impact sur le réassemblage des paquets et entraînent des échecs d'accessibilité des données pour des sites Web spécifiques.

Collecte des journaux à partir du contrôleur étranger et d'ancrage

1. Activez term exec prompt timestamp pour avoir une référence temporelle pour toutes les commandes.
2. Utilisez la commande show tech-support wireless !! pour vérifier la configuration.
3. Vous pouvez vérifier l'état du tunnel de mobilité show wireless mobility summary !!
4. Statistiques de Mobility Peer qui incluent l’état de la liaison, les données et les événements client, les statistiques de maintien de la connexion montrent la mobilité sans fil peer ip <IP>
5. Activez le suivi radioactif pour l'adresse IP/MAC de l'homologue de mobilité et l'adresse MAC du client.

   Via CLI :


   debug wireless {MAC | ip} {aaaa.bbb.cccc | x.x.x.x } {monitor-time} {N secondes} !! Le réglage du temps nous permet d'activer les traces pendant 24 jours .

   no debug wireless {MAC | ip} {aaaa.bbb.cccc | x.x.x.x !! Pour désactiver le débogage
   
   WLC génère un fichier de trace de débogage avec Client_info, commande pour vérifier le fichier de trace de débogage généré dir bootflash: | i debug !!

   

   Avertissement : Le débogage conditionnel active la journalisation au niveau du débogage qui à son tour augmente le volume des journaux générés. Laisser cette opération en cours réduit le retard dans le temps à partir duquel vous pouvez afficher les journaux. Il est donc recommandé de toujours désactiver le débogage à la fin de la session de dépannage.

6. Afin de désactiver tous les débogages, exécutez ces commandes :

   # clear platform condition all !!

   # undebug all !!
   Via l'interface utilisateur :



   Étape 1. Accédez à Troubleshooting > Radioactive Trace.

   Étape 2. Cliquez sur Add et entrez une adresse MAC/IP d'homologue de mobilité ou une adresse MAC de client que vous souhaitez dépanner.
   Étape 3. Lorsque vous êtes prêt à démarrer le suivi radioactif, cliquez sur Start. Une fois démarré, la journalisation de débogage est écrite sur le disque à propos de tout traitement du plan de contrôle lié aux adresses MAC suivies.
   Étape 4. Lorsque vous reproduisez le problème que vous souhaitez résoudre, cliquez sur Stop.
   Étape 5. Pour chaque adresse MAC déboguée, vous pouvez générer un fichier journal rassemblant tous les journaux relatifs à cette adresse MAC en cliquant sur Générer.
   Étape 6. Choisissez le délai de retour du fichier journal que vous souhaitez conserver et cliquez sur Apply to Device (Appliquer au périphérique).
   Étape 7. Vous pouvez maintenant télécharger le fichier en cliquant sur la petite icône en regard du nom du fichier. Ce fichier est présent dans le lecteur flash d'amorçage du contrôleur et peut également être copié à partir de la boîte via CLI.

7. Captures intégrées 


Via CLI :
capture de moniteur MYCAP clear !!
capture de moniteur MYCAP interface Po1 les deux !!
Taille de la mémoire tampon MYCAP de capture de moniteur 100 !!
monitor capture MYCAP match access-list name !! (si suivi du trafic du tunnel de mobilité entre WLC)
monitor capture MYCAP match any/ipv4/ipv6.MAC !!
capture de moniteur MYCAP start !!
!!Reproduire
capture de moniteur arrêt MYCAP
capture de moniteur MYCAP export flash:|tftp:|http:.../filename.pcap


Via l'interface utilisateur :


Étape 1. Accédez à Troubleshooting > Packet Capture > +Add.
Étape 2 : définition du nom de la capture de paquets Un maximum de 8 caractères est autorisé.
Étape 3. Définissez les filtres, le cas échéant.
Étape 4. Cochez la case pour surveiller le trafic de contrôle si vous voulez voir le trafic envoyé au processeur du système et réinjecté dans le plan de données.
Étape 5 : définition de la taille de la mémoire tampon Un maximum de 100 Mo est autorisé.
Étape 6. Définissez la limite, soit par la durée qui autorise une plage de 1 à 1000000 secondes, soit par le nombre de paquets qui autorise une plage de 1 à 100000 paquets, selon les besoins.
Étape 7. Choisissez l’interface dans la liste des interfaces de la colonne de gauche et sélectionnez la flèche pour la déplacer vers la colonne de droite.
Étape 8. Cliquez sur Save and Apply to Device.
Étape 9. Pour démarrer la capture, sélectionnez Start.
Étape 10. Vous pouvez laisser la capture s'exécuter jusqu'à la limite définie. Pour arrêter manuellement la capture, sélectionnez Arrêter.
Étape 11. Une fois arrêté, un bouton Export (Exporter) devient disponible et vous permet de cliquer sur l’option permettant de télécharger le fichier de capture (.pcap) sur le bureau local via le serveur HTTP ou TFTP, le serveur FTP ou le disque dur ou la mémoire flash du système local.

Informations connexes

Configuration des topologies de mobilité sur les WLC Catalyst 9800

Configuration de la fonction WLAN Anchor Mobility sur Catalyst 9800

Assistance et documentation techniques - Cisco Systems

Historique de révision

Révision	Date de publication	Commentaires
1.0	22-Jun-2026	Première publication