Customer service Visit the Avaya Web site to access the complete range of services and support that Avaya provides. Go to www.avaya.com or go to one of the pages listed in the following sections. Navigation • “Getting technical documentation” on page 5 •...
Avaya gear correctly. This depends on being able to reproduce the problem of course. If possible, you should also load Ethereal onto the client and/or servers involved in the problem area (i.e. the DHCP server if client’s aren’t getting IP addresses).
Page 8
copy configuration tftp://10.1.1.107/config.txt Transfers CLI configuration from WSS to tftp server. copy tftp://10.1.1.107/config.txt config.txt Transfers WSS CLI config from tftp server to WSS. load configuration config.txt You can restrict the number of entries displayed in the system and trace logs with some additional arguments: show log buffer -10 (show last 10 entries from system log, newest entry first) show log trace -10...
Set trace dot1x level 8 mac-addr <mac-addr> Web Portal Show crypto certificate web Set trace sm level 7 mac-addr <mac-addr> Set trace web level 10 Set trace dns level 10 Set trace httpd level 10 Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 10
RADIUS Show aaa Ping <ip> Traceroute <ip> Set trace radius level 5 Check RADIUS server’s logs Authorization Set log buffer severity warning Failures (Identity based Networking) Set trace authorization level 10 Client Connectivity Intermittent Check Client driver version and settings and Issues Disconnects supplicant version.
Page 11
Ethernet sniff as close to the DAP as possible problems Verify spanning tree disabled on port DAP is connected to Verify DAP has DHCP reservation Check DHCP server logs TAPA Tunnel Set trace tapa Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 12
Auto-RF Set trace autorf level 10 Show auto-tune neighbors Show auto-tune attributes Set log buffer severity notice RF-Detect Set trace rf_master level 10 Set trace rf_slave level 10 Set trace rf_client level 10 Show rfdetect counters Active-Scan Upgrade to REL 4.0.20 or newer. Over-the-air tracing Disable Active-scan to see if the problem follows the state.
Page 13
Capture serial console output during crash if possible. This is vital if the corefile turns out to be unreadable. Contact Avaya ATS and provide information. Excessive CPU Show load Load Show fsm statistics Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
WSS software debug command descriptions Command Description Set log buffer severity warning Sets the WSSs internal syslog buffer severity to “WARNING” which is slightly more verbose than the default of “ERROR”. This allows you to see more messages which can help diagnose issues. Set trace authorization level 10 Sends information to the trace log on the mapping of RADIUS attributes to appropriate WSS functions.
Page 15
Displays radio statistics on the daps for everything from noise-floor to per-packet data rates. Show dap etherstats Displays packet statistics for the DAPs Ethernet ports. show dap qos-stats Displays transmit packet counts for each queue on the Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 16
Show dap status Shows current operating parameters for DAPs as well as serial#, IP, state, SSIDs, BSSIDs, current channel/power and other useful information. Show dap status terse Abbreviated version of “show dap status” which is very useful for “at-a-glance” status on DAPs and APs. Show dap unconfigured Shows DAPs which are contacting the mobility domain but are not configured on any of the WSSs.
Page 17
Show vlan Displays the VLANs/ports/tags currently active on the WSS, including tunneled VLANs. Traceroute <ip> Same as Unix traceroute command, will initiate it from the system IP address of the WSS. Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
WMS troubleshooting areas URL or Local File Description https://<ip addr> Accesses the WMS services log. Note: By default you will only be able to access the log from the WMS server itself. You will need to “Allow Remote Access” in Tools->WMS Services Setup in order to access this URL across the network (not recommended for security reasons).
Page 19
Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Troubleshooting scenarios Client unable to connect to wireless network Typical symptoms: complete inability of the client to connect to the wireless network No user session in “show sessions” command output, or only user’s mac-address listed with no VLAN, IP, and username.
Switch stability Typical symptoms: All DAPs on a switch rebooting simultaneously “Core” files other than command_audit.cur” showing in the output of “dir” Sluggish CLI and occasional missed ping responses. Troubleshooting Steps: Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
“show mem summary proc netsys” (replace netsys with whichever process is named in the corefile) to get a sample of memory usage on the switch over time, and send the logs to Avaya ATS. If the cores are happening at a regular interval, increase the frequency you run the command on the day when the core would be expected.
Messages will appear in the logs similar to: Tue Jan 31 20:02:06 2006: <133>Jan 31 20:01:26 172.17.11.1 AUTORF_NOTICE: Changing channel on radio dap 14/1, 11->6: Too many neighboring APs on channel(32098/36000) Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Each of these messages will indicate the reason for the change, and you can try to correlate the DAP and timedate stamp with user complaints. Collect the entire log (unfiltered) for analysis. If the system is continually changing channels it has not converged for some reason, and the logs will assist in determining this.
The show ap counters command lists the number of times a client attempts to connect with a disabled data rate. For example, Syntax wss# sh ap counters AP: 2 radio: 2 LastPktXferRate PktTxCount 42847 NumCntInPwrSave MultiPktDrop LastPktRxSigStrength MultiBytDrop LastPktSigNoiseRatio User Sessions Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 26
TKIP Pkt Transfer Ct MIC Error Ct TKIP Pkt Replays TKIP Decrypt Err CCMP Pkt Decrypt Err CCMP Pkt Replays CCMP Pkt Transfer Ct RadioResets Radio Recv Phy Err Ct Transmit Retries 30469 Radio Adjusted Tx Pwr Noise Floor 802.3 Packet Tx Ct 802.3 Packet Rx Ct No Receive Descriptor Invalid Rates...
To collect the ZIP file go to WMS menu and then to Help-> Report Problem and enter the stated information and save it. Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
The path information of the zip file is provided at the bottom of the WMS screen. Now, you can open a trouble ticket with the above compiled information. Voice Monitoring If the QOS level is not being incremented properly under the statistics then verify that all QOS settings and markings are set throughout the network between the AP and WSS.
WSS# show session network The command output shows a flag (L), indicating that the session is on a local switched VLAN, under VLAN Name. Check whether a VLAN is local switched Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Syntax WSS# show ap vlan <ap number> The command output shows the mode of the VLAN as either local or tunnel Check the FDB entry of a specific AP Syntax WSS# show ap fdb <ap number> The command output shows the fdb entries of the AP. Local switching enabled and the AP cannot boot After enabling local switching if AP cannot boot up, then check for the following: Check the boot configuration of one AP...
You always start connectivity with the IP address, hence verify that the WLE2340 has the IP address that is being used to access it. You can do this through the Administrative UI or the Command Line Interface (CLI). Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 32
Verify system availability To verify the system availability, perform the following: In the Web browser, check if the Web UI shows port 443. Check the Administrative Web UI through SSL on port 8003. Check if the command line for the WLE2340 is available, if none of the Web UI is available.
Page 33
In this case, return the system to the initial state (having no users), so that the first access of the Web UI gives you the form to create the first admin user and declare the password for that user. Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Password lost for the WLE2340 Admin User To verify the lost password for the WLE2340 Admin user, perform the following: Reset the Admin Password to the Factory Default This requires physical access to the WLE2340. Connect through the serial cable connection. There is a 5- second delay before the prompt is shown.
If the IP addresses of the sensors have changed, then proceed to the next sub-section on changed IP addresses. Auto Discovered TZSP Sensors APs from Trapeze, Avaya, and 3Com are capable of sending information to the WLE2340 and declaring themselves sensors. Unlike the Cisco APs, they may be in service providing coverage also, and the WLE2340 is not responsible for their configuration.
Check the Sensor Statistics Firewall Settings Check the Agent Logs Verify the Firmware on the Controller The firmware on the controller must be of at least version 6.0 for official support of the AP as a sensor. One symptom that the firmware is not compliant is that the log for the Agent will fill with Array Index out of Bounds errors, or messages that the AP is reporting an illegal or unknown channel.
If this does not match with the Device List in the Web UI, look for error messages in the lower left hand corner of the Dashboard, and also check the Dashboard logs for errors. Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 38
Check Properties of Layout Palette Elements View the layouts to verify that the Locales where devices are tracked are listed and bound. Do not trust the graphical display that shows the name of the locale. Open the Layout Palette and then use the Select tool to select individual Locales.
Shows the log for the Controller process. Useful for debugging availability issues and Web UI issues. show logs system agent Show the log for the Agent process. Useful for debugging sensor connectivity and tracking issues. Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
show interface eth0 Shows network information for the appliance. show serial-number Displays the appliance serial number. The Dashboard Logs There are logs for the Dashboard available on the client machine. In a Windows install, these files can be found in the following path: C:\Documents and Settings\<username>\.dashboard\dashboard\var\log NN47250-700 (Version 04.01)
This message is completely normal for WPA clients. WPA2 clients should (but don’t have to) send a PMK ID when they associate. DOT1X Apr 11 20:45:37.685475 DEBUG DOT1X-PACKET: setting id to networkid=slipshod- tkip,nasid=nos-3.0,portid=16 in request Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 42
After a client associates we always send an EAP Identity request if 802.1X is configured for that SSID. This message indicates what the contents of the ID request will be. DOT1X Apr 11 20:45:37.685503 DEBUG DOT1X-PACKET: EAPoL EAP packet of 57 bytes w/id 1 (with retransmit set) sent to 00:0d:54:98:99:6d This packet indicates that we sent the ID request with an EAP id value of 1.
Page 43
DOT1X Apr 11 20:45:37.746285 DEBUG DOT1X-PACKET: Cancelling retrans timer for 00:0d:54:98:99:6d DOT1X Apr 11 20:45:37.746360 DEBUG DOT1X-CLIENT: glob '**' matches 'AVAYA\tash', ssid 'slipshod- tkip' matches 'slipshod-tkip': eap_type=25 At this point the WSS knows the outer username of the client, and begins to compare this username to the userwildcards on the “set authentication dot1x…”...
Page 44
DOT1X Apr 11 20:45:37.746820 DEBUG DOT1X-TIMEOUT: set when_retrans timer for 30 seconds DOT1X Apr 11 20:45:37.747105 DEBUG DOT1X-PACKET: EAPoL EAP packet, id 1, len 17, received from 00:0d:54:98:99:6d DOT1X Apr 11 20:45:37.747136 DEBUG DOT1X-PACKET: Cancelling retrans timer for 00:0d:54:98:99:6d Here we see the client sending back a response for id 1 again. This happens frequently with Microsoft clients because both sides are initiating the 802.1X conversation.
Page 45
In other clients they can be different and the outer name is frequently “anonymous” or some variation therein. DOT1X Apr 11 20:45:37.963797 DEBUG DOT1X: asked to change name AVAYA\tash at 00:0d:54:98:99:6d to AVAYAtash DOT1X Apr 11 20:45:37.963865 DEBUG DOT1X-PACKET: EAPoL EAP packet of 105 bytes w/id 7 (with retransmit set) sent to 00:0d:54:98:99:6d DOT1X Apr 11 20:45:37.963895 DEBUG DOT1X-TIMEOUT: set when_retrans timer for 30 seconds...
Page 46
00:0d:54:98:99:6d DOT1X Apr 11 20:45:37.986082 DEBUG DOT1X-TIMEOUT: set when_retrans timer for 5 seconds DOT1X Apr 11 20:45:37.987021 DEBUG DOT1X-STATE: TX RSC is 0 for client AVAYA\tash at 00:0d:54:98:99:6d DOT1X Apr 11 20:45:38.007289 DEBUG DOT1X-PACKET: EAPoL KEY packet received from 00:0d:54:98:99:6d NN47250-700 (Version 04.01)
DOT1X Apr 11 20:33:04.695773 DEBUG DOT1X-CLIENT: new wireless client from 00:05:5d:88:d1:63 on port 2, radio 2 DOT1X Apr 11 20:33:04.699969 DEBUG DOT1X-STATE: 00:05:5d:88:d1:63 transition from NOTHING to CONNECTING DOT1X Apr 11 20:33:04.703742 DEBUG DOT1X-STATS: 00:05:5d:88:d1:63, enters connecting --> 4371 Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 48
Like the previous trace, this is a listing of the network access rules which don’t match (not shown in this example) or match. DOT1X Apr 11 20:33:04.828032 DEBUG DOT1X-CLIENT: EAP-ID resp for AVAYA\jtran at 00:05:5d:88:d1:63 doing PASSTHRU DOT1X Apr 11 20:33:04.833653 DEBUG DOT1X-CLIENT: eapol_aaa_login (sess=0x1ceef94) 00:05:5d:88:d1:63 ->...
Page 49
00:05:5d:88:d1:63 DOT1X Apr 11 20:33:05.050173 DEBUG DOT1X-TIMEOUT: set when_retrans timer for 6 seconds DOT1X Apr 11 20:33:05.059548 DEBUG DOT1X-PACKET: EAPoL EAP packet, id 6, len 95, received from 00:05:5d:88:d1:63 Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 50
DOT1X Apr 11 20:33:05.185751 DEBUG DOT1X-PACKET: EAPoL EAP packet of 8 bytes w/id 10 (without retransmit set) sent to 00:05:5d:88:d1:63 DOT1X Apr 11 20:33:05.189549 DEBUG DOT1X-STATE: 00:05:5d:88:d1:63 transition from AUTHENTICATING to AUTHENTICATED DOT1X Apr 11 20:33:05.193894 DEBUG DOT1X: asked to change name AVAYA\jtran at 00:05:5d:88:d1:63 to AVAYA\jtran NN47250-700 (Version 04.01)
Page 51
DOT1X Apr 11 20:33:05.212506 DEBUG DOT1X-STATE: Putting AVAYA\jtran at 00:05:5d:88:d1:63 in vlan vlan-eng (130) Placing the client on the proper VLAN. DOT1X Apr 11 20:33:05.216127 DEBUG DOT1X-STATE: AVAYA\jtran --> tag 3 for vlan 130, cipher 4, bssid 00:0b:0e:00:d5:83 This is information regarding the WSS to AP connection used for this user.
DOT1X Apr 11 20:33:05.251025 DEBUG DOT1X: Session timeout for 00:05:5d:88:d1:63 set to 3600 DOT1X Apr 11 20:33:05.252763 DEBUG DOT1X-TIMEOUT: set when_reauth timer for 3600 seconds And we set the re-authentication timer for this user (because he’s WEP we need to reauthenticate in order to cycle the key.
Page 53
AAA Jan 31 22:44:46.698752 DEBUG (1872) RADIUS: 31 RAD_CALLING_STATION_ID vlen=17 00-0B-7D-1F-FB-F5 AAA Jan 31 22:44:46.698857 DEBUG (1872) RADIUS: 30 RAD_CALLED_STATION_ID vlen=29 00-0B-0E-14-E9-80:avayawlan AAA Jan 31 22:44:46.698934 DEBUG (1872) RADIUS: 6 RAD_ATTR_SERVICE vlen=4 2 Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 55
Repeat the same process for all packets in the EAP exchange. AAA Jan 31 22:44:46.868037 DEBUG (1872) RADIUS: REPLY <203,1812,192.168.3.4>:20003, ACCESS_ACCEPT, len 268 Receive an “ACCESS ACCEPT” packet from the RADIUS server. This is where it gets interesting. Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 56
VLAN. In this case the VLAN is “vlan-eng”. If you have configured other attributes on the RADIUS server they will appear in this list. All Avaya authorization attributes are of type “string”, so you will be able to read the contents clearly in the trace. This is very useful when troubleshooting “authorization errors”...
“00:10:c6:5d:ae:ae” from DAP 1 (DAP num = port num – 2048 if port num is greater than 2048) SM Jan 4 02:52:41.184020 DEBUG SM-DOT11: 00:10:c6:5d:ae:ae requests association to [slipshod] Client connected to the SSID “slipshod” Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 58
SM Jan 4 02:52:41.184124 DEBUG SM-DOT11: sending associate response 0 to 00:0b:0e:2f:6d:00 for client 00:10:c6:5d:ae:ae Responding to association request… SM Jan 4 02:52:41.184448 DEBUG 20 04 00 01 00 01 00 02 00 2c 00 00 02 01 00 0b SM Jan 4 02:52:41.184532 DEBUG 0e 2f 6d 02 00 10 c6 5d ae ae 00 0b 0e 2f 6d 02 SM Jan 4 02:52:41.184582 DEBUG 00 00 02 01 00 0b 0e 2f 6d 02 00 10 c6 5d ae ae SM Jan 4 02:52:41.184632 DEBUG 00 0b 0e 2f 6d 02 d0 1d 11 00 01 00 00 08 73 6c...
Page 59
The client belongs on VLAN “default”. Insert this into the session entry. SM Jan 4 02:52:43.203781 DEBUG SM: (2) 00:10:c6:5d:ae:ae i_smdb_set_vlan_name=default by set_smdb_from_author_attrs Client session is configured for vlan default. Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 60
SM Jan 4 02:52:43.204003 DEBUG SM-TRACE: (2) added proc hist @484c11ac (3 by do_vlan); 3 total SM Jan 4 02:52:43.204068 DEBUG SM-STATE: (2) do_vlan bumps kill lock vector to 1ah More process hooks and locks. SM Jan 4 02:52:43.204420 DEBUG SM-STATE: (2) mac 00:10:c6:5d:ae:ae, flags 20020ch, to change state AUTH AND ASSOC ->...
Page 61
SM Jan 4 02:52:44.209672 DEBUG SM-TRACE: (2) added proc hist @4855ac2c (3 by AAA new session); 5 total SM Jan 4 02:52:44.209740 DEBUG SM-STATE: (2) AAA new session bumps kill lock vector to eh Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 62
Developer debug messages… Probably receiving confirmation back from the cluster database on the request to update with the client’s identity/location. SM Jan 4 02:52:49.160478 DEBUG SM-DOT11: assoc req from 00:0b:7d:26:9d:d7 on port 2049 Here comes another client… The only comments on this one will be with different messages.
Page 63
AUTH AND ASSOC -> AUTHORIZING, by aaa_dot1x_process_author_data SM Jan 4 02:52:49.472017 DEBUG SM-EVENT: (3) sending net/dot1x/eapol/authorizing to fsm net/dot1x/ eapol SM Jan 4 02:52:49.473685 DEBUG SM-STATE: (3) setting tag to 2 Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 64
Notice how tag 2 is now being used, even though both devices are on the same vlan. This is because the VLAN needs to be tunneled through TAPA separately for each radio. Tunnels are limited to only the radios that require them, preventing extraneous broadcast traffic over the air.
SM Feb 02 01:00:49.206363 DEBUG SM-EVENT: (13) idle timer is tracking (47398 to go) SM Feb 02 01:01:04.206675 DEBUG SM-EVENT: (13) rssi -68, rate 108, idle 148 secs SM Feb 02 01:01:04.206784 DEBUG SM-EVENT: (13) idle timer is tracking (32384 to go) Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 66
SM Feb 02 01:01:19.207044 DEBUG SM-EVENT: (13) rssi -68, rate 108, idle 163 secs SM Feb 02 01:01:19.207122 DEBUG SM-EVENT: (13) idle timer is tracking (17480 to go) SM Feb 02 01:01:34.207524 DEBUG SM-EVENT: (13) rssi -68, rate 108, idle 178 secs SM Feb 02 01:01:34.207601 DEBUG SM-EVENT: (13) idle timer is tracking (2494 to go) SM Feb 02 01:01:36.677033 DEBUG SM-EVENT: (13): wireless idle timer fired;...
Page 67
SM Feb 02 01:01:36.686462 DEBUG 10 05 00 00 00 00 00 00 e5 b0 10 06 00 00 00 00 SM Feb 02 01:01:36.686567 DEBUG SM-EVENT: 13 send FINAL_STATS_READY to AAA Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 68
Built the final session statistics packet, passing to AAA. If RADIUS accounting is enabled, this would be sent out as a RADIUS “Stop” accounting packet. SM Feb 02 01:01:36.687155 DEBUG SM-TRACE: (13) added proc hist @485a662c (4 by AAA do_kill_processing - final stats); 9 total SM Feb 02 01:01:36.687229 DEBUG SM-STATE: (13) AAA do_kill_processing - final stats clearing kill lock, lock vector now =0h Heard back from the last cleanup process, proceeding to kill the session.
Page 69
SM Feb 02 01:01:36.688785 DEBUG sm_sys_free: sys_freeing a ""sm/sm_process_history"" of 112 bytes @485a612c SM Feb 02 01:01:36.688832 DEBUG SM-TRACE: (13) freed proc history @485a612c SM Feb 02 01:01:36.688868 DEBUG sm_sys_free: sys_freeing a ""sm/sm_process_history"" of 112 bytes @484ab32c Avaya WLAN Security Switch 2300 Series Troubleshooting and Debug Guide...
Page 70
SM Feb 02 01:01:36.688950 DEBUG SM-TRACE: (13) freed proc history @484ab32c SM Feb 02 01:01:36.688994 DEBUG sm_sys_free: sys_freeing a ""sm/sm_process_history"" of 112 bytes @485a68ac SM Feb 02 01:01:36.689040 DEBUG SM-TRACE: (13) freed proc history @485a68ac SM Feb 02 01:01:36.689077 DEBUG sm_sys_free: sys_freeing a ""sm/sm_process_history"" of 112 bytes @484ab42c SM Feb 02 01:01:36.689124 DEBUG SM-TRACE: (13) freed proc history @484ab42c Release all processes involved in session.
Need help?
Do you have a question about the WLAN Security Switch 2300 Series and is the answer not in the manual?
Questions and answers