WLC(Wireless LAN Controller)의 디버그 클라이언트 이해
소개
이 문서에서는 debug client WLC(무선 LAN 컨트롤러)의 명령 출력입니다.
사전 요구 사항
요구 사항
이 문서에서는 다음 항목에 대해 설명합니다.
- 무선 클라이언트 처리 방법
- 기본 연결 및 인증 문제를 해결하는 방법
분석할 출력은 WPA 사전 공유 키(WPA-PSK) 네트워크에 대한 시나리오를 다룹니다.
다음 주제에 대한 지식을 보유하고 있으면 유용합니다.
- 기본 작동을 위해 WLC 및 LAP(Lightweight Access Point)를 구성하는 방법
- LWAPP(Lightweight Access Point Protocol) 및 무선 보안 방법
- 802.11 인증 및 연결 프로세스의 작동 방식
사용되는 구성 요소
이 문서의 정보는 다음 소프트웨어 및 하드웨어 버전을 기반으로 합니다.
- 펌웨어 8.5 또는 8.10을 실행하는 Cisco AireOS WLC(8540, 5520, vWLC).
- CAPWAP 기반 액세스 포인트
이 문서의 정보는 특정 랩 환경의 디바이스를 토대로 작성되었습니다. 이 문서에 사용된 모든 디바이스는 초기화된(기본) 컨피그레이션으로 시작되었습니다. 현재 네트워크가 작동 중인 경우 모든 명령의 잠재적인 영향을 미리 숙지하시기 바랍니다.
표기 규칙
문서 규칙에 대한 자세한 내용은 Cisco 기술 팁 표기 규칙을 참고하십시오.
디버그 클라이언트
명령 debug client
8개의 debug 명령과 함께 제공된 MAC 주소의 필터를 활성화하는 매크로이므로 지정된 MAC 주소가 포함된 메시지만 표시됩니다. 8개의 debug 명령은 클라이언트 연결 및 인증에 대한 가장 중요한 세부 정보를 표시합니다. 이 필터는 여러 무선 클라이언트가 있는 경우에 유용합니다. 너무 많은 출력이 생성되거나 필터 없이 디버그가 활성화된 경우 컨트롤러가 오버로드되는 등의 상황이 발생합니다.
수집된 정보에는 클라이언트 연결 및 인증에 대한 중요한 세부 정보가 포함됩니다(이 문서의 뒷부분에 언급된 두 가지 예외 사항 포함).
활성화된 명령은 다음 출력에 표시됩니다.
(Cisco Controller) >show debug MAC address ................................ 00:00:00:00:00:00 Debug Flags Enabled: dhcp packet enabled. dot11 mobile enabled. dot11 state enabled. dot1x events enabled. dot1x states enabled. pem events enabled. pem state enabled.
이 명령은 주소 협상, 802.11 클라이언트 상태 머신, 802.1x 인증, PEM(Policy Enforcement Module) 및 DHCP(Address Negotiation)를 다룹니다.
디버그 클라이언트 변형
대부분의 경우 debug client
명령은 필요한 정보를 얻는 데 충분합니다. 그러나 추가 디버그가 필요한 두 가지 중요한 상황이 있습니다.
- 모빌리티(컨트롤러 간 클라이언트 로밍)
- EAP 인증 문제 해결
모빌리티
이러한 상황에서는 다음 이후에 모빌리티 디버그를 활성화해야 합니다. debug client
컨트롤러 간의 모빌리티 프로토콜 상호 작용에 대한 추가 정보를 얻기 위해 명령이 도입되었습니다.
모빌리티 디버그를 활성화하려면 debug client 명령을 사용하여 debug mobility handoff enable 명령을 사용합니다:
(Cisco Controller) >debug client 00:00:00:00:00:00 (Cisco Controller) >debug mobility handoff enable (Cisco Controller) >show debug MAC address ................................ 00:00:00:00:00:00 Debug Flags Enabled: dhcp packet enabled. dot11 mobile enabled. dot11 state enabled dot1x events enabled. dot1x states enabled. mobility handoff enabled. pem events enabled. pem state enabled.
EAP 인증 문제 해결
WLC와 인증 서버(외부 RADIUS 또는 내부 EAP 서버) 간의 상호 작용을 트러블슈팅하려면 debug AAA all enable 명령 - 필요한 세부 정보를 표시합니다. 이 명령은 다음 이후에 사용됩니다. debug client 및 은(는) 필요에 따라 다른 debug 명령과 결합할 수 있습니다(예: handoff 명령).
(Cisco Controller) >debug client 00:00:00:00:00:00 (Cisco Controller) >debug aaa all enable (Cisco Controller) >show debug MAC address ................................ 00:00:00:00:00:00 Debug Flags Enabled: aaa detail enabled. aaa events enabled. aaa packet enabled. aaa packet enabled. aaa ldap enabled. aaa local-auth db enabled. aaa local-auth eap framework errors enabled. aaa local-auth eap framework events enabled. aaa local-auth eap framework packets enabled. aaa local-auth eap framework state machine enabled. aaa local-auth eap method errors enabled. aaa local-auth eap method events enabled. aaa local-auth eap method packets enabled. aaa local-auth eap method state machine enabled. aaa local-auth shim enabled. aaa tacacs enabled. dhcp packet enabled. dot11 mobile enabled. dot11 state enabled dot1x events enabled dot1x states enabled. mobility handoff enabled. pem events enabled. pem state enabled.
클라이언트 연결
이 문서에서 클라이언트 연결은 무선 클라이언트가 다음 단계를 통과하는 프로세스입니다.
802.11 섹션
- Probe - 연결할 유효한 AP를 찾습니다.
- 인증: Open(Null) 또는 Shared일 수 있습니다. 일반적으로 Open(열기)이 선택됩니다.
- 연결: AP에 데이터 서비스를 요청합니다.
L2 정책 섹션
- 없음. PSK 또는 EAP 인증은 컨피그레이션을 기반으로 수행됩니다.
- 키 협상(암호화 방법이 선택된 경우)
L3 정책 섹션
- 주소 학습.
- 웹 인증(선택한 경우).
컨트롤러 프로세스
각 구간에서 컨트롤러는 매 순간 클라이언트의 상태를 추적하기 위해 분리된 과정을 이용한다. 이 프로세스는 클라이언트 간에 상호 작용하여 클라이언트가 연결 테이블에 추가되도록 합니다(구성된 보안 정책에 따라). 컨트롤러에 대한 클라이언트 연결 단계를 이해하기 위해 가장 관련성이 높은 프로세스를 간략하게 요약하면 다음과 같습니다.
- PEM(Policy Enforcement Module) — 클라이언트 상태를 제어하고 WLAN 컨피그레이션의 각 보안 정책을 통해 강제로 클라이언트 상태를 제어합니다.
- APF(Access Point Functions) — 기본적으로 802.11 상태 시스템입니다.
- Dot1x — 802.1x, PSK 인증 및 무선 클라이언트의 키 처리를 위한 상태 시스템을 구현합니다.
- 모빌리티 — 동일한 모빌리티 그룹에 있는 다른 컨트롤러와의 상호 작용을 추적합니다.
- DTL(Data Transformation Layer) — 소프트웨어 구성 요소와 NPU(Network Hardware Acceleration) 사이에 위치하며 ARP 정보를 제어합니다.
PEM(Policy Enforcement Module)
WLAN 컨피그레이션에 따라 클라이언트는 일련의 단계를 거칩니다. PEM은 필요한 L2 및 L3 보안 정책을 준수하기 위해 이 작업을 수행합니다.
다음은 클라이언트 디버그 분석과 관련된 PEM 상태의 하위 집합입니다.
- 시작 — 새 클라이언트 항목의 초기 상태입니다.
- AUTHCHECK — WLAN에 적용할 L2 인증 정책이 있습니다.
- 8021X_REQD — 클라이언트가 802.1x 인증을 완료해야 합니다.
- L2AUTHCOMPLETE — 클라이언트가 L2 정책을 성공적으로 완료했습니다. 이제 프로세스는 L3 정책(주소 학습, 웹 인증 등)으로 진행할 수 있습니다. 컨트롤러가 동일한 모빌리티 그룹에 있는 클라이언트 로밍인 경우 다른 컨트롤러에서 L3 정보를 확인하기 위해 모빌리티 알림을 여기에 보냅니다.
- WEP_REQD — 클라이언트가 WEP 인증을 완료해야 합니다.
- DHCP_REQD — 컨트롤러는 ARP 요청, DHCP 요청 또는 갱신을 통해 수행되거나 모빌리티 그룹의 다른 컨트롤러에서 학습된 정보를 통해 클라이언트에서 L3 주소를 학습해야 합니다. DHCP Required(DHCP 필요)가 WLAN에 표시된 경우 DHCP 또는 모빌리티 정보만 사용됩니다.
- WEBAUTH_REQD — 클라이언트가 웹 인증을 완료해야 합니다. (L3 정책)
- RUN — 클라이언트가 필요한 L2 및 L3 정책을 성공적으로 완료했으며 이제 네트워크로 트래픽을 전송할 수 있습니다.
이 그림에서는 RUN 상태에 도달할 때까지 클라이언트가 전환되는 간소화된 PEM 상태 머신을 보여 줍니다. 이제 클라이언트가 네트워크로 트래픽을 전송할 수 있습니다.
클라이언트 트래픽 포워딩
START 상태와 최종 RUN 상태 사이에 클라이언트 트래픽은 네트워크로 전달되지 않고 분석을 위해 컨트롤러의 기본 CPU로 전달됩니다. 전달되는 정보는 상태 및 적용된 정책에 따라 달라집니다. 예를 들어 802.1x가 활성화된 경우 EAPOL 트래픽이 CPU로 전달됩니다. 또 다른 예는 웹 인증을 사용하는 경우 HTTP 및 DNS가 허용되고 CPU에 의해 가로채기되어 웹 리디렉션을 수행하고 클라이언트 인증 자격 증명을 얻는 것입니다.
클라이언트가 RUN 상태에 도달하면 클라이언트 정보를 NPU로 전송하여 사용자 트래픽을 클라이언트 VLAN에 케이블 속도로 전달하고 사용자 데이터 포워딩 작업의 중앙 CPU를 해제하는 FastPath 스위칭을 활성화합니다.
전달되는 트래픽은 NPU에 적용되는 클라이언트 유형에 따라 달라집니다. 이 표에서는 가장 관련성이 높은 유형에 대해 설명합니다.
| 유형 | 설명 |
|---|---|
| 1 | 일반적인 클라이언트 트래픽 포워딩. |
| 9 | IP 학습 상태입니다. 사용된 IP 주소를 파악하기 위해 이 클라이언트에서 하나의 패킷이 CPU로 전송됩니다. |
| 2 | ACL 통과. WLAN이 NPU에 알리도록 구성된 ACL인 경우 사용됩니다. |
APF(액세스 포인트 기능)
이 프로세스는 802.11 시스템 상태를 통해 클라이언트의 상태를 처리하고 모빌리티 코드와 상호 작용하여 다른 로밍 시나리오를 검증합니다. 이 문서에서는 모빌리티 세부 정보나 해당 상태를 다루지 않습니다.
다음 표는 클라이언트가 컨트롤러에 연결될 때 발생할 수 있는 보다 관련성 있는 클라이언트 상태를 보여줍니다.
| 이름 | 설명 |
|---|---|
| 유휴 | 일부 상황에서는 새 클라이언트 또는 임시 상태입니다. |
| AAA 펜던트 | 클라이언트가 MAC 주소 인증을 기다립니다. |
| 인증됨 | 일부 상황에서는 개방 인증에 성공했거나 중간 상태입니다. |
| 관련 | 클라이언트가 MAC 인증을 통과했으며 인증 프로세스를 열었습니다. |
| 연결 해제됨 | 클라이언트가 연결 해제/인증 해제를 보냈거나 연결 타이머가 만료되었습니다. |
| 삭제 | 클라이언트가 삭제되도록 표시되었습니다(일반적으로 제외 타이머가 만료된 후). |
| 프로브 | 새 클라이언트에 대한 프로브 요청을 받았습니다. |
| 제외됨/차단 목록 | 클라이언트가 제외됨으로 표시되었습니다. 일반적으로 WPS 정책과 관련됩니다. |
| Invalid | 클라이언트 상태에 오류가 있습니다. |
이 이미지는 상태 시스템 전환을 나타내며 가장 관련성이 높은 상태 및 전환만 표시합니다.
802.1x 인증(Dot1x)
Dot1x 프로세스는 클라이언트에 대한 802.1x 인증 및 키 관리를 담당합니다. 즉, 802.1x가 필요한 EAP 정책이 없는 WLAN에서도 dot1x는 클라이언트와 키 생성 및 협상을 처리하고 캐시된 키 처리(PMK 또는 CCKM)에 참여합니다.
이 상태 시스템은 전체 802.1x 전환을 보여줍니다.
디버그 클라이언트 분석
이 섹션에서는 클라이언트가 WLAN에 연결할 때 로그의 전체 프로세스를 보여줍니다.
APF Process
Wed Oct 31 10:46:13 2007: 00:1b:77:42:07:69 Adding mobile on LWAPP AP
00:1c:0j:ca:5f:c0(0)
!--- A new station is received. After validating type, it is added to the
!--- AP that received it. This can happen both on processing association
!--- request or probe requests
Wed Oct 31 10:46:13 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 23) in 5 seconds
!--- Sets an expiration timer for this entry in case it does not progress
!--- beyond probe status. 5 Seconds corresponds to Probe Timeout. This message
!--- might appear with other time values since, during client processing,
!--- other functions might set different timeouts that depend on state.
Wed Oct 31 10:46:13 2007: 00:1b:77:42:07:69 apfProcessProbeReq
(apf_80211.c:4057) Changing state for mobile 00:1b:77:42:07:69 on AP
00:1c:0j:ca:5f:c0 from Idle to Probe
!--- APF state machine is updated.
Wed Oct 31 10:46:13 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
!--- New Probe request update sent AP about client. IMPORTANT:
!--- Access points do not forward all probe requests to the controller; they
!--- summarize per time interval (by default 500 msec). This information is
!--- used later by location and load balancing processes.
Wed Oct 31 10:46:14 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
!--- New Probe request update sent AP about client.
Wed Oct 31 10:46:14 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
!--- New Probe request update sent AP about client.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
!--- New Probe request update sent AP about client.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Association received from
mobile on AP 00:1c:0j:ca:5f:c0
!--- Access point reports an association request from the client.
!--- When the process reaches this point, the client is not excluded and not
!--- in mobility intermediate state
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 STA - rates (8): 140 18 152
36 176 72 96 108 0 0 0 0 0 0 0 0
!--- Controller saves the client supported rates into its connection table.
!--- Units are values of 500 kbps, basic (mandatory) rates have the Most Significant bit (MSb) set.
!--- The above would be 6mbps basic, 9, 12 basic, 18, 24 basic, 36, 48, 54
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Processing WPA IE type 221,
length 24 for mobile 00:1b:77:42:07:69
!--- Controller validates the 802.11i security information element.
PEM Process
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 START (0) Deleted mobile
LWAPP rule on AP [00:1c:0j:ca:5f:c0]
!--- As the client requests new association, APF requests to PEM to delete the
!--- client state and remove any traffic forwarding rules that it could have.
APF Process
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Updated location for station old
AP 00:00:00:00:00:00-0, new AP 00:1c:0j:ca:5f:c0-1
!--- APF updates where this client is located. For example, this client is
!--- a new addition; therefore, no value exists for the old location.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 START (0) Initializing
policy
!--- PEM notifies that this is a new user. Security policies are checked
!--- for enforcement.
PEM Process
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 START (0) Change state
to AUTHCHECK (2) last state AUTHCHECK (2)
!--- PEM marks as authentication check needed.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 AUTHCHECK (2) Change
state to 8021X_REQD (3) last state 8021X_REQD
!--- After the WLAN configuration is checked, the client will need either
!--- 802.1x or PSK authentication
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 8021X_REQD (3) Plumbed
mobile LWAPP rule on AP 00:1c:0j:ca:5f:c0
!--- PEM notifies the LWAPP component to add the new client on the AP with
!--- a list of negotiated capabilities, rates, Qos, etc.
APF Process
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 apfPemAddUser2 (apf_policy.c:209)
Changing state for mobile 00:1b:77:42:07:69 on AP 00:1c:0j:ca:5f:c0 from
Probe to Associated
!--- APF notifies that client has been moved successfully into associated
!--- state.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Stopping deletion of Mobile
Station: (callerId: 48)
!--- The expiration timer for client is removed, as now the session timeout
!--- is taking place. This is also part of the above notification
!--- (internal code callerId: 48).
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Sending Assoc Response to
station on BSSID 00:1c:0j:ca:5f:c0 (status 0)
!--- APF builds and sends the association response to client.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 apfProcessAssocReq
(apf_80211.c:3838) Changing state for mobile 00:1b:77:42:07:69 on AP
00:1c:0j:ca:5f:c0 from Associated to Associated
!--- The association response was sent successfully; now APF keeps the
!--- client in associated state and sets the association timestamp on this point.
Dot1x Process
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Creating a new PMK Cache Entry
for station 00:1b:77:42:07:69 (RSN 0)
!--- APF calls Dot1x to allocate a new PMK cached entry for the client.
!--- RSN is disabled (zero value).
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Initiating WPA PSK to mobile
00:1b:77:42:07:69
!--- Dot1x signals a new WPA or WPA2 PSK exchange with mobile.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 dot1x - moving mobile
00:1b:77:42:07:69 into
Force Auth state
!--- As no EAPOL authentication takes place, the client port is marked as
!--- forced Auth. Dot1x performs key negotiation with PSK clients only.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Skipping EAP-Success to mobile
00:1b:77:42:07:69
!--- For PSK, CCKM or RSN, the EAP success is not sent to client, as there
!--- was no EAPOL authentication taking place.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Sending EAPOL-Key Message to
mobile
00:1b:77:42:07:69
state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00
!--- Dot1x starts the exchange to arrive into PTK. PMK is known, as this
!--- is PSK auth. First message is ANonce.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Received EAPOL-Key from mobile
00:1b:77:42:07:69
!--- Message received from client.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Received EAPOL-key in PKT_START
state (message 2) from mobile 00:1b:77:42:07:69
!--- This signals the start of the validation of the second message
!--- from client (SNonce+MIC). No errors are shown, so process continues.
!--- Potential errors at this point could be: deflection attack (ACK bit
!--- not set on key), MIC errors, invalid key type, invalid key length, etc.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Stopping retransmission timer
for mobile 00:1b:77:42:07:69
!--- Dot1x got an answer for message 1, so retransmission timeout is stopped.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Sending EAPOL-Key Message to
mobile 00:1b:77:42:07:69
state PTKINITNEGOTIATING (message 3), replay counter
00.00.00.00.00.00.00.01
!--- Derive PTK; send GTK + MIC.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Received EAPOL-Key from mobile
00:1b:77:42:07:69
!--- Message received from client.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 Received EAPOL-key in
PTKINITNEGOTIATING state (message 4) from mobile 00:1b:77:42:07:69
!--- This signals the start of validation of message 4 (MIC), which
!--- means client installed the keys. Potential errors after this message
!--- are MIC validation errors, invalid key types, etc.
PEM Process
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 8021X_REQD (3) Change
state to L2AUTHCOMPLETE (4) last state L2AUTHCOMPLETE (4)
!--- PEM receives notification and signals the state machine to change to L2
!--- authentication completed.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 L2AUTHCOMPLETE (4)
Plumbed mobile LWAPP rule on AP 00:1c:0j:ca:5f:c0
!--- PEM pushes client status and keys to AP through LWAPP component.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 L2AUTHCOMPLETE (4)
Change state to DHCP_REQD (7) last state DHCP_REQD (7)
>!--- PEM sets the client on address learning status.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 DHCP_REQD (7)
pemAdvanceState2 4238, Adding TMP rule
!--- PEM signals NPU to allow DHCP/ARP traffic to be inspected by controller
!--- for the address learning.
Wed Oct 31 10:46:15 2007: 00:1b:77:42:07:69 0.0.0.0 DHCP_REQD (7)
Adding Fast Path rule
type = Airespace AP - Learn IP address
on AP 00:1c:0j:ca:5f:c0, slot 1, interface = 1, QOS = 0
ACL Id = 255, Jumbo Frames = NO, 802.1P = 0, DSCP = 0, TokenID = 5006
!--- Entry is built for client and prepared to be forwarded to NPU.
!--- Type is 9 (see the table in the Client Traffic Forwarding section of
!--- this document) to allow controller to learn the IP address.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 0.0.0.0 DHCP_REQD (7)
Successfully plumbed mobile rule (ACL ID 255)
!--- A new rule is successfully sent to internal queue to add the client
!--- to the NPU.
Dot1x Process
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 Stopping retransmission timer
for mobile 00:1b:77:42:07:69
!--- Dot1x received message from client.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 Sending EAPOL-Key Message to
mobile 00:1b:77:42:07:69
state PTKINITDONE (message 5 - group), replay counter
00.00.00.00.00.00.00.02
!--- Group key update prepared for client.
PEM Process
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 0.0.0.0 Added NPU entry of type 9
!--- NPU reports that entry of type 9 is added (learning address state).
!--- See the table in the Client Traffic Forwarding section of this document.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 Sent an XID frame
!--- No address known yet, so the controller sends only XID frame
!--- (destination broadcast, source client address, control 0xAF).
Dot1x Process
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 Sent EAPOL-Key M5 for mobile
00:1b:77:42:07:69
!--- Key update sent.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 Received EAPOL-Key from mobile
00:1b:77:42:07:69
!--- Key received.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 Received EAPOL-key in
REKEYNEGOTIATING state (message 6) from mobile 00:1b:77:42:07:69
!--- Successfully received group key update.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 Stopping retransmission timer
for mobile 00:1b:77:42:07:69
!--- Group key timeout is removed.
DHCP Process
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 DHCP received op BOOTREQUEST
(1) (len 308, port 1, encap 0xec03)
!--- First DHCP message received from client.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 DHCP dropping packet due to
ongoing mobility handshake exchange, (siaddr 0.0.0.0, mobility
state = 'apfMsMmQueryRequested'
PEM Process
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 0.0.0.0 DHCP_REQD (7) mobility
role update request from Unassociated to Local
Peer = 0.0.0.0, Old Anchor = 0.0.0.0, New Anchor = 192.168.100.11
!--- NPU is notified that this controller is the local anchor, so to
!--- terminate any previous mobility tunnel. As this is a new client,
!--- old address is empty.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 0.0.0.0 DHCP_REQD (7) State
Update from Mobility-Incomplete to Mobility-Complete, mobility
role=Local
!--- Role change was successful.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 0.0.0.0 DHCP_REQD (7)
pemAdvanceState2 3934, Adding TMP rule
!--- Adding temporary rule to NPU for address learning now with new mobility
!--- role as local controller.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 0.0.0.0 DHCP_REQD (7)
Replacing Fast Path rule
type = Airespace AP - Learn IP address
on AP 00:1c:0j:ca:5f:c0, slot 1, interface = 1, QOS = 0
ACL Id = 255, Jumbo Frames = NO, 802.1P = 0, DSCP = 0, TokenID = 5006
!--- Entry is built.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 0.0.0.0 DHCP_REQD (7)
Successfully plumbed mobile rule (ACL ID 255)
!--- A new rule is successfully sent to internal queue to add the
!--- client to the NPU.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 0.0.0.0 Added NPU entry of type 9
!--- Client is on address learning state; see the table in the
!--- Client Traffic Forwarding section of this document. Now mobility
!--- has finished.
Wed Oct 31 10:46:19 2007: 00:1b:77:42:07:69 Sent an XID frame
!--- No address known yet, so controller sends only XID frame (destination
!--- broadcast, source client address, control 0xAF).
DHCP Process
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP received op BOOTREQUEST
(1) (len 308, port 1, encap 0xec03)
!--- DHCP request from client.
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP selecting relay 1 -
control block settings:
dhcpServer: 0.0.0.0, dhcpNetmask: 0.0.0.0,
dhcpGateway: 0.0.0.0, dhcpRelay: 0.0.0.0 VLAN: 0
!--- Based on the WLAN configuration, the controller selects the identity to
!--- use to relay the DHCP messages.
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP selected relay 1 -
192.168.100.254 (local address 192.168.100.11, gateway 192.168.100.254,
VLAN 100, port 1)
!--- Interface selected.
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
transmitting DHCP DISCOVER (1)
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 1
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
xid: 0xd3d3b6e9 (3553867497), secs: 1024, flags: 0
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
chaddr: 00:1b:77:42:07:69
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
ciaddr: 0.0.0.0, yiaddr: 0.0.0.0
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
siaddr: 0.0.0.0, giaddr: 192.168.100.11
!--- Debug parsing of the frame sent. The most important fields are included.
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP sending REQUEST to
192.168.100.254 (len 350, port 1, vlan 100)
!--- DHCP request forwarded.
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP selecting relay 2 -
control block settings:
dhcpServer: 0.0.0.0, dhcpNetmask: 0.0.0.0,
dhcpGateway: 0.0.0.0, dhcpRelay: 192.168.100.11 VLAN: 100
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP selected relay 2 ? NONE
!--- No secondary server configured, so no additional DHCP request are
!--- prepared (configuration dependant).
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP received op BOOTREPLY (2)
(len 308, port 1, encap 0xec00)
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP setting server from OFFER
(server 192.168.100.254, yiaddr 192.168.100.105)
!--- DHCP received for a known server. Controller discards any offer not on
!--- the DHCP server list for the WLAN/Interface.
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP sending REPLY to STA
(len 416, port 1, vlan 100)
!--- After building the DHCP reply for client, it is sent to AP for forwarding.
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP transmitting DHCP OFFER (2)
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
xid: 0xd3d3b6e9 (3553867497), secs: 0, flags: 0
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
chaddr: 00:1b:77:42:07:69
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
ciaddr: 0.0.0.0, yiaddr: 192.168.100.105
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
siaddr: 0.0.0.0, giaddr: 0.0.0.0
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP
server id: x.x.x.x rcvd server id: 192.168.100.254
!--- Debug parsing of the frame sent. The most important fields are included.
Wed Oct 31 10:46:21 2007: 00:1b:77:42:07:69 DHCP received op BOOTREQUEST (1)
(len 316, port 1, encap 0xec03)
!--- Client answers
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP selecting relay 1 -
control block settings:
dhcpServer: 192.168.100.254, dhcpNetmask: 0.0.0.0,
dhcpGateway: 0.0.0.0, dhcpRelay: 192.168.100.11 VLAN: 100
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP selected relay 1 -
192.168.100.254 (local address 192.168.100.11, gateway 192.168.100.254,
VLAN 100, port 1)
!--- DHCP relay selected per WLAN config
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP transmitting DHCP REQUEST (3)
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 1
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
xid: 0xd3d3b6e9 (3553867497), secs: 1024, flags: 0
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
chaddr: 00:1b:77:42:07:69
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
ciaddr: 0.0.0.0, yiaddr: 0.0.0.0
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
siaddr: 0.0.0.0, giaddr: 192.168.100.11
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
requested ip: 192.168.100.105
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
server id: 192.168.100.254 rcvd server id: x.x.x.x
!--- Debug parsing of the frame sent. The most important fields are included.
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP sending REQUEST to
192.168.100.254 (len 358, port 1, vlan 100)
!--- Request sent to server.
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP selecting relay 2 -
control block settings:
dhcpServer: 192.168.100.254, dhcpNetmask: 0.0.0.0,
dhcpGateway: 0.0.0.0, dhcpRelay: 192.168.100.11 VLAN: 100
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP selected relay 2 ? NONE
!--- No other DHCP server configured.
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP received op BOOTREPLY
(2) (len 308, port 1, encap 0xec00)
!--- Server sends a DHCP reply, most probably an ACK (see below).
PEM Process
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 192.168.100.105 DHCP_REQD
(7) Change state to RUN (20) last state RUN (20)
!--- DHCP negotiation successful, address is now known, and client
!--- is moved to RUN status.
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 192.168.100.105 RUN (20)
Reached PLUMBFASTPATH: from line 4699
!--- No L3 security; client entry is sent to NPU.
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 192.168.100.105 RUN (20)
Replacing Fast Path rule
type = Airespace AP Client
on AP 00:1c:0j:ca:5f:c0, slot 1, interface = 1, QOS = 0
ACL Id = 255, Jumbo Frames = NO, 802.1P = 0, DSCP = 0, TokenID = 5006
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 192.168.100.105 RUN (20)
Successfully plumbed mobile rule (ACL ID 255)
DHCP Process
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 Assigning Address
192.168.100.105 to mobile
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP sending REPLY to STA
(len 416, port 1, vlan 100)
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP transmitting DHCP ACK (5)
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
xid: 0xd3d3b6e9 (3553867497), secs: 0, flags: 0
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
chaddr: 00:1b:77:42:07:69
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
ciaddr: 0.0.0.0, yiaddr: 192.168.100.105
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
siaddr: 0.0.0.0, giaddr: 0.0.0.0
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 DHCP
server id: x.x.x.x rcvd server id: 192.168.100.254
PEM Process
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 192.168.100.105 Added NPU
entry of type 1
!--- Client is now successfully associated to controller.
!--- Type is 1; see the table in the Client Traffic Forwarding
!--- section of this document.
Wed Oct 31 10:46:25 2007: 00:1b:77:42:07:69 Sending a gratuitous ARP for
192.168.100.105, VLAN Id 100
!--- As address is known, gratuitous ARP is sent to notify.
문제 해결 예
잘못된 클라이언트 암호 컨피그레이션
이 예에서는 AP에 대해 서로 다른 기능을 가진 클라이언트를 보여줍니다. 클라이언트는 SSID에 대해 프로브하지만, 프로브 요청에 지원되지 않는 일부 매개변수가 표시되므로 클라이언트는 인증/연결 단계로 진행하지 않습니다.
특히 WPA를 사용하는 클라이언트와 WPA2만 지원하는 AP가 일치하지 않는 문제가 발생했습니다.
Wed Oct 31 10:51:37 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 23) in 5 seconds
Wed Oct 31 10:51:37 2007: 00:1b:77:42:07:69 apfProcessProbeReq
(apf_80211.c:4057) Changing state for mobile 00:1b:77:42:07:69 on AP
00:1c:b0:ea:5f:c0 from Idle to Probe
!--- Controller adds the new client, moving into probing status
Wed Oct 31 10:51:37 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:38 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:38 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
!--- AP is reporting probe activity every 500 ms as configured
Wed Oct 31 10:51:41 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:41 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:41 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:41 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:44 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:44 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:44 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:44 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:51:49 2007: 00:1b:77:42:07:69 apfMsExpireCallback (apf_ms.c:433)
Expiring Mobile!
Wed Oct 31 10:51:49 2007: 00:1b:77:42:07:69 0.0.0.0 START (0) Deleted mobile
LWAPP rule on AP [00:1c:b0:ea:5f:c0]
Wed Oct 31 10:51:49 2007: 00:1b:77:42:07:69 Deleting mobile on AP
00:1c:b0:ea:5f:c0(0)
!--- After 5 seconds of inactivity, client is deleted, never moved into
!--- authentication or association phases.
잘못된 사전 공유 키
이는 클라이언트가 인프라에 대해 WPA-PSK를 통해 인증을 시도하지만 클라이언트와 컨트롤러 간의 사전 공유 키가 일치하지 않아 실패하고 결국 제외(차단) 목록에 클라이언트가 추가됨을 나타냅니다.
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Adding mobile on LWAPP AP
00:1c:b0:ea:5f:c0(0)
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 23) in 5 seconds
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 apfProcessProbeReq (apf_80211.c:
4057) Changing state for mobile 00:1b:77:42:07:69 on AP 00:1c:b0:ea:5f:c0
from Idle to Probe
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 24) in 5 seconds
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Association received from mobile
on AP 00:1c:b0:ea:5f:c0
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 STA - rates (8): 130 132 139 150
12 18 24 36 0 0 0 0 0 0 0 0
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 STA - rates (12): 130 132 139 150
12 18 24 36 48 72 96 108 0 0 0 0
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Processing WPA IE type 221,
length 24 for mobile 00:1b:77:42:07:69
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 0.0.0.0 START (0)
Initializing policy
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 0.0.0.0 START (0) Change state to
AUTHCHECK (2) last state AUTHCHECK (2)
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 0.0.0.0 AUTHCHECK (2) Change
state to 8021X_REQD (3) last state 8021X_REQD (3)
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 0.0.0.0 8021X_REQD (3) Plumbed
mobile LWAPP rule on AP 00:1c:b0:ea:5f:c0
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 apfPemAddUser2 (apf_policy.c:209)
Changing state for mobile 00:1b:77:42:07:69 on AP 00:1c:b0:ea:5f:c0 from
Probe to Associated
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Stopping deletion of Mobile
Station: (callerId: 48)
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Sending Assoc Response to station
on BSSID 00:1c:b0:ea:5f:c0 (status 0)
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 apfProcessAssocReq (apf_80211.c:
3838) Changing state for mobile 00:1b:77:42:07:69 on AP 00:1c:b0:ea:5f:c0
from Associated to Associated
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Creating a new PMK Cache Entry
for station 00:1b:77:42:07:69 (RSN 0)
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Initiating WPA PSK to mobile
00:1b:77:42:07:69
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 dot1x - moving mobile
00:1b:77:42:07:69 into Force Auth state
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Skipping EAP-Success to mobile
00:1b:77:42:07:69
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Sending EAPOL-Key Message to
mobile 00:1b:77:42:07:69
state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Received EAPOL-Key from mobile
00:1b:77:42:07:69
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Received EAPOL-key in PKT_START
state (message 2) from mobile 00:1b:77:42:07:69
Wed Oct 31 10:55:55 2007: 00:1b:77:42:07:69 Received EAPOL-key M2 with
invalid MIC from mobile 00:1b:77:42:07:69
Wed Oct 31 10:55:56 2007: 00:1b:77:42:07:69 802.1x 'timeoutEvt' Timer expired
for station 00:1b:77:42:07:69
Wed Oct 31 10:55:56 2007: 00:1b:77:42:07:69 Retransmit 1 of EAPOL-Key M1
(length 99) for mobile 00:1b:77:42:07:69
Wed Oct 31 10:55:56 2007: 00:1b:77:42:07:69 Received EAPOL-Key from mobile
00:1b:77:42:07:69
Wed Oct 31 10:55:56 2007: 00:1b:77:42:07:69 Received EAPOL-key in PKT_START
state (message 2) from mobile 00:1b:77:42:07:69
Wed Oct 31 10:55:56 2007: 00:1b:77:42:07:69 Received EAPOL-key M2 with invalid
MIC from mobile 00:1b:77:42:07:69
!--- MIC error due to wrong preshared key
Wed Oct 31 10:55:57 2007: 00:1b:77:42:07:69 802.1x 'timeoutEvt' Timer expired
for station 00:1b:77:42:07:69
Wed Oct 31 10:55:57 2007: 00:1b:77:42:07:69 Retransmit 2 of EAPOL-Key M1
(length 99) for mobile 00:1b:77:42:07:69
Wed Oct 31 10:55:57 2007: 00:1b:77:42:07:69 Received EAPOL-Key from mobile
00:1b:77:42:07:69
Wed Oct 31 10:55:57 2007: 00:1b:77:42:07:69 Received EAPOL-key in PKT_START
state (message 2) from mobile 00:1b:77:42:07:69
Wed Oct 31 10:55:57 2007: 00:1b:77:42:07:69 Received EAPOL-key M2 with invalid
MIC from mobile 00:1b:77:42:07:69
Wed Oct 31 10:55:58 2007: 00:1b:77:42:07:69 802.1x 'timeoutEvt' Timer expired
for station 00:1b:77:42:07:69
Wed Oct 31 10:55:58 2007: 00:1b:77:42:07:69 Retransmit failure for EAPOL-Key
M1 to mobile 00:1b:77:42:07:69, retransmit count 3, mscb deauth count 0
Wed Oct 31 10:55:58 2007: 00:1b:77:42:07:69 Sent Deauthenticate to mobile on
BSSID 00:1c:b0:ea:5f:c0 slot 0(caller 1x_ptsm.c:462)
!--- Client is deauthenticated, after three retries
!--- The process is repeated three times, until client is block listed
Wed Oct 31 10:56:10 2007: 00:1b:77:42:07:69 Block listing (if enabled) mobile
00:1b:77:42:07:69
Wed Oct 31 10:56:10 2007: 00:1b:77:42:07:69 apfBlacklistMobileStationEntry2
(apf_ms.c:3560) Changing state for mobile 00:1b:77:42:07:69 on AP
00:1c:b0:ea:5f:c0 from Associated to Exclusion-list (1)
Wed Oct 31 10:56:10 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 44) in 10 seconds
Wed Oct 31 10:56:10 2007: 00:1b:77:42:07:69 0.0.0.0 8021X_REQD (3) Change
state to START (0) last state 8021X_REQD (3)
Wed Oct 31 10:56:10 2007: 00:1b:77:42:07:69 0.0.0.0 START (0) Reached FAILURE:
from line 3522
Wed Oct 31 10:56:10 2007: 00:1b:77:42:07:69 Scheduling deletion of Mobile
Station: (callerId: 9) in 10 seconds
관련 정보
개정 이력
| 개정 | 게시 날짜 | 의견 |
|---|---|---|
1.0 |
28-Nov-2007 |
최초 릴리스 |
피드백