Manuals / Cisco Systems / Computer Equipment / Network Router

Cisco Systems OL-6415-04 manual Recommended Action

Models: OL-6415-04

1 188

Download 188 pages 52.52 Kb

Page 167

Appendix D Error and Event Messages

802.11 Subsystem Messages

Error Message DOT11-4-TKIP_MIC_FAILURE_REPORT: Received TKIP Michael MIC failure report from the station [mac-address] on the packet (TSC=0x0) encrypted and protected by [key] key

Explanation The access point received an EAPOL-key from the indicated station notifying the access point that TKIP Michael MIC failed on a packet transmitted by this access point.

Recommended Action None.

Error Message DOT11-3-TKIP_MIC_FAILURE_REPEATED: Two TKIP Michael MIC failures were detected within [number] seconds on [interface] interface. The interface will be put on MIC failure hold state for next [number] seconds

Explanation Two TKIP Michael MIC failures were detected within the indicated time on the indicated interface. Because this usually indicates an active attack on your network, the interface will be put on hold for the indicated time. During this hold time, stations using TKIP ciphers are disassociated and cannot reassociate until the hold time ends. At the end of the hold time, the interface operates normally.

Recommended Action MIC failures usually indicate an active attack on your network. Search for and remove potential rogue devices from your wireless LAN. If this is a false alarm and the interface should not be on hold this long, use the countermeasure tkip hold-timecommand to adjust the hold time.

Error Message SOAP-3-WGB_CLIENT_VLAN: Workgroup Bridge Ethernet client VLAN not configured

Explanation No VLAN is configured for client devices attached to the workgroup bridge.

Recommended Action Configure a VLAN to accommodate client devices attached to the workgroup bridge.

Error Message SOAP-3-ERROR: Reported on line [number] in file [characters].[characters]

Explanation An internal error occurred on the indicated line number in the indicated filename in the controller ASIC.

Recommended Action None

Error Message IF-4-MISPLACED_VLAN_TAG: Detected a misplaced VLAN tag on source [interface]. Dropping packet

Explanation Received an 802.1Q VLAN tag which could not be parsed correctly. The received packet was encapsulated or de encapsulated incorrectly.

Recommended Action

Cisco Wireless ISR and HWIC Access Point Configuration Guide

	OL-6415-04	D-11

Image 167

Cisco Systems OL-6415-04 manual Recommended Action

Contents

Text Part Number 0L-6415-04 Corporate HeadquartersPage N T E N T S Ssid Configuration Methods Supported by Cisco IOS Releases Creating Cipher Suites Protocol Filters Local Authenticator Messages Contents Cisco Wireless Router and Hwic Configuration Guide Preface provides information on the following topics PrefaceAudience PurposeConventions OrganizationPreface Conventions Cisco Product Document Title Related PublicationsCisco.com Obtaining DocumentationOrdering Documentation Documentation FeedbackProduct Documentation DVD Cisco Product Security Overview Reporting Security Problems in Cisco ProductsCisco Technical Support & Documentation Website Submitting a Service RequestObtaining Technical Assistance Obtaining Additional Publications and Information Definitions of Service Request SeverityPreface Obtaining Additional Publications and Information Overview Wireless Device ManagementRoot Unit on a Wired LAN Network Configuration ExampleFeatures Overview Features Overview Overview Cisco Wireless Router and Hwic Configuration Guide Configuring Radio Settings Cisco Role in Radio Network Eries ISRs Command PurposeEnabling the Radio Interface Roles in Radio NetworkConfiguring Network or Fallback Role Following is a sample of a Root Bridge Configuration Bridge Features Not SupportedSample Bridging Configuration Following is a sample of Non-Root Bridge Configuration Interface Dot11Radio0/1/0 no ip address Configuring Universal Client Mode Universal Client ModeVirtual interface to aid NAT translation Following configuration is supported on NATNAT Network Address Translation No service password-encryption Hostname C1803WUC Configuring Radio Settings Configuring Radio Data Rates Configuring Radio Data Rates2.0 5.5 6.0 9.0 Throughput ofdm defaultSpeed 11.0 2.0 5.5 basic-1.0100 125 150 200 250 Configuring Radio Transmit PowerEnd Return to privileged Exec mode DBmMaximum Limiting the Power Level for Associated Client DevicesPower local 5 6 7 10 13 15 1710 20 30 50 Maximum Configuring Radio Channel SettingsPower client 20 30 50 100 maximumRegulatory Domains 2412 2417 2422 2427 2432 2437 2442 2447 2452 2457 2462 2467 CenterChannel Identifier MHz2472 2484 Channel GHz Channels on Which DFS is Automatically Enabled DFS Automatically Enabled on Some 5-GHz Radio ChannelsBlocking Channels from DFS Selection Enabling and Disabling World ModeConfirming that DFS is Enabled This example shows how to unblock all frequencies for DFSEnabling and Disabling Short Radio Preambles Antenna transmit Configuring Transmit and Receive AntennasAntenna receive Diversity left rightNo dot11 extension aironet Disabling and Enabling Access Point ExtensionsDisable Access Point extensions Snap dot1h Snap or 802.1h dot1h, the default settingPayload-encapsulation Set the encapsulation transformation method to RFC1042Bridge-group group port-protected Configure terminal Enter global configuration modeEnable Pspf Configuring Protected Ports Configuring Beacon Period and DtimRts retries value Configuring RTS Threshold and RetriesConfiguring Maximum Data Retries Rts threshold valueFragment-threshold value Configuring Fragmentation ThresholdBytes for the 2.4-GHz radio. Enter a setting from 256 to Enabling Short Slot Time for 802.11g RadiosPerforming a Carrier Busy Test OL-6415-04 Configuring Multiple SSIDs Vlan Ssid Configuration Methods Supported by Cisco IOS ReleasesUnderstanding Multiple SSIDs Creating an Ssid Globally Configuring Multiple SSIDsCommand Purpose Using Spaces in SSIDs Using a Radius Server to Restrict SSIDsViewing SSIDs Configured Globally Guidelines for Using Multiple BSSIDs Configuring Multiple Basic SSIDsRequirements for Configuring Multiple BSSIDs Information-element ssidl CLI Configuration ExampleDisplaying Configured BSSIDs Enabling Mbssid and Ssidl at the same timeBelow is a sample configuration for enabling Ssidl Sample Configuration for Enabling Mbssid and SsidlUse the no form of the command to disable Ssidl IEs Below is a sample configuration for enabling MbssidInterface Dot11Radio0/0/0 no ip address OL-6415-04 Configuring an Access Point as a Local Authenticator Configure a Local Authenticator Understand Local AuthenticationAaa new-model Enable AAA Guidelines for Local AuthenticatorsConfiguration Overview Configuring the Local Authenticator Access PointSsid ssid Reauthentication time secondsRadius-server local Vlan vlanMac-auth-only Password nthash passwordThis example shows how to set up EAP-FAST authentication End Routerconfig# aaa new-model Configuring PAC Settings Configuring EAP-FAST SettingsPossible PAC Failures Caused by Access Point Clock Configuring an Authority IDConfiguring Server Keys Unblocking Locked Usernames Limiting the Local Authenticator to One Authentication TypeViewing Local Authenticator Statistics This example shows local authenticator statisticsUsing Debug Messages Understand Encryption Types, Configure Encryption Types, Configuring Encryption TypesUnderstand Encryption Types Creating WEP Keys Configure Encryption TypesKey Security Configuration WEP Key RestrictionWEP Key Restrictions EncryptionCreating Cipher Suites Example WEP Key SetupAccess Point Associated Device Slot Transmit? Key Contents Cipher Suites Compatible with WPA WPA Enabling and Disabling Broadcast Key RotationCompatible Cipher Suites Security Security Type in Universal Client ModeWEP 40-bit WEP 128-bit Universal client configurationTkip AES TKIP+AES Caveats DebuggingWEP OL-6415-04 Configuring Authentication Types Open Authentication to Access Point Understand Authentication TypesTraffic from client Shared Key Authentication to Access PointSequence for EAP Authentication EAP Authentication to NetworkMAC Address Authentication to the Network Using WPA Key Management Combining MAC-Based, EAP, and Open Authentication5shows the WPA key management process Protocol Required? Systems WPA-PSK Mode Windows XP YesSoftware and Firmware Requirements for WPA and WPA-TKIP Third Party Host SupplicantAssigning Authentication Types to an Ssid Configure Authentication TypesOptional eap list-name Authentication openOptional Set the authentication type to open for this Ssid Mac-address list-name alternateMac-address list-name Authentication sharedAuthentication network-eap Authentication key-managementConfiguring WPA Migration Mode Wpa-psk hex ascii 0 Configuring Additional WPA SettingsConfiguring MAC Authentication Caching Server Dot1x client-timeout secondsDot11 holdoff-time seconds Dot1x reauth-period secondsTkip clients on that interface for the holdtime period Security Feature Client Setting Access Point SettingDetects two MIC failures within 60 seconds, it blocks all WPA-PSK Security Feature Client Setting Access Point Setting Configuring Radius Servers Understanding Radius Configuring and Enabling RadiusRadius Operation Default Radius Configuration Configuring RadiusIdentifying the Radius Server Host Radius-server host hostname Acct-port port-number timeoutPort for authentication requests.Optional For acct-port Radius-server timeout command is usedShow running-config Verify your entries Configuring Radius Login AuthenticationInclude-in-access-req format %h Aaa authentication login defaultLogin authentication default Authentication login commandDefining AAA Server Groups Define the AAA server-group with a group name Port for authentication requestsPort for accounting requests Aaa group server radius group-nameRadius Starting Radius Accounting Option MAC Address Example Configuring Settings for All Radius ServersSelecting the Csid Format Show running-config Verify your settings Radius-server host hostname ip-address non-standard AuthenticationRadius-server vsa send accounting Radius-server key string Configuring WISPr Radius AttributesSnmp-server location location Displaying the Radius ConfigurationAttribute ID Description Radius Attributes Sent by the Access PointVLAN-ID VSA attribute NAS-Location Disc-Cause-Ext Acct-Terminate-CauseConfiguring VLANs Understanding VLANs Related Documents LAN and Vlan Segmentation with Wireless DevicesIncorporating Wireless Devices into VLANs Configuring VLANsInterface dot11radio 0.x Configuring a VlanEncapsulation dot1q vlan-id Creating a Vlan Name Using a Radius Server to Assign Users to VLANsGuidelines for Using Vlan Names Assigning Names to VLANsViewing VLANs Configured on the Access Point Ssid Vlan ID Vlan Configuration ExampleVlan 1 Interfaces Vlan 2 Interfaces Vlan 3 Interfaces Configuring VlanConfiguring VLANs Vlan Configuration Example OL-6415-04 Understanding QoS for Wireless LANs, Configuring QoS, Configuring QoSImpact of QoS on a Wireless LAN Understanding QoS for Wireless LANsQoS for Wireless LANs Versus QoS on Wired LANs Upstream and Downstream Traffic Flow Precedence of QoS SettingsUsing Wi-Fi Multimedia Mode Fixed Slot Time Configuring QoSConfiguration Guidelines Adjusting Radio Access CategoriesDisabling Igmp Snooping Helper Sample Configuration Using the CLIJapan Channel SettingsIeee 802.11b 2.4-GHz Band Center Frequency AmericasAmericas -A Emea -E Japan -J Frequency Ieee 802.11g 2.4-GHz BandIeee 802.11a 5-GHz Band Center Regulatory DomainsFrequency North America OL-6415-04 Protocol Filters Protocol EGP PUP Chaos IcmpIgmp TCPISO Designator IMAP2 TsapPOP2 POP3CVS RIPRPC UucpIEEE802dot11-MIB Supported MIBsMIB List RFC1213-MIB RFC1398-MIB SNMPv2-MIB SNMPv2-SMI SNMPv2-TC Using FTP to Access the MIB FilesLevel Description Error and Event MessagesHow to Read System Messages This appendix lists the CLI error and event messagesAssociation Management Messages Explanation a station associated to an access pointExplanation a station disassociated from an access point Message Traceback ReportsSubsystem Messages Recommended Action None Explanation The device has begun its DFS scanning process Recommended Action None Error Message DOT11-4-RMINCAPABLE Interface interface Recommended Action Reload the system Error Message DOT11-4-CANTASSOC Cannot associate characters Recommended Action None Recommended Action Local Authenticator Messages Operating in the 2.4-GHz band Network with wireless stationsWireless network composed of stations without Access Points Access PointGL-2 Hoc modeCorresponding IP addresses LAN 802.11 specificationsWired Ethernet network An antenna that radiates its signal in a spherical patternTransmission at 2 Mbps Transmission at 6, 9, 12, 18, 24, 36, 48, and 54 MbpsThat of a cable While maintaining an unbroken connection to the LAN802.1X for authenticated key management Wireless MultiMediaComputing device with an installed client adapter AES-CCMP EAPIN-2 EAP-FAST 1Leap FTPQbss Names, Vlan Network-EAPOfdm Radius RFC Guest mode Multiple SSIDs Support Using spacesLocal authentication Names Ssid 4 Vlan command 4 Regulatory DomainsWPA migration mode Wpa-psk command World-mode commandIN-7 IN-8 IN-9 IN-10 IN-11 IN-12 IN-13 IN-14