FortiWLC – Troubleshooting

Serviceability

In addition to the existing diagnostic tools to troubleshoot stations connectivity issues, you can use the station-log issues command to get more definitive reasons on stations connectivity. Two additional columns (Issue Observed and Reason) in the station-log issues command provide specific details of an issue and plausible cause.

default(15)# station‐log issues

Time stamp              | Client MAC address | AP MAC address   | Issue observed         | Reason

2014‐03‐14 07:15:13.342 | 00:00:00:00:00:00 | 00:0c:e6:0e:00:21 | AP radio reset         | Reset of radio interface 0

2014‐03‐14 07:17:58.851 | a8:86:dd:db:6a:c9 | 00:0c:e6:0e:00:21 | Handoff retry failure  | Handoff retry failed for BSSID 00:0c:e6:02:4c:45 The following are pre-defined list of issues:

TABLE 33: Connectivity Issues

Issues Description
Frequent change in associated AP This will be observed by comparing the current AP to previously associated APs (3 associations to different APs in 3 minutes.)
AP radio reset This will be observed in the APs whenever an AP radio is reset
Long queuing delay This will be observed in the AP queue manager, when the packets to the sent to clients remain in the queue was more than the expected time (5s)
Connected to distant AP Observed when the client doesn’t connect to the closest AP with a higher RSSI value but to an AP further away with a lower RSSI value
Good RSSI value but low data rate Observed when the RSSI value of the associated AP is considered good (above -70), but the wireless data rate is below the expected performance
High AP throughput but high retry count Observed when the AP throughput is high, but the retry percentage is also high
Frequent associations and dissociations Observed when the client associates and dissociates continuously to the same AP. (3 associations to the same AP in 3 minutes)
Back-and-forth handoff Observed when 3 handoff acknowledgement messages are received with 12s between 2 APs. Eg. AP1 to AP2 back to

AP1

Handoff retry failure Observed when an initiated handoff fails repeatedly for 5 times
Station Log Issues Filter

By default the station-log issues command will display all issues on the screen. The following filter options are available to view specific issues:

  • By Mac address:

Use the -mac filter to view issues specific to a particular mac address. default(15)# station‐log issues ‐mac a8:86:dd:db:6a:c9 By AP Mac address:

Use the -apmac filter to view issues related to a specific AP. default(15)# station‐log issues ‐apmac 00:0c:e6:0e:00:21 By Issue ID:

Use -is <IssueID1>,<IssueID2> to view specific issues from the list of issues printed on the screen. The following example, will list issues that match issues IDs 2 and 9 . default(15)# station‐log issues ‐is 2,9

  • Last Entries:

To view the last set of issues, use -last <x> filter, where x is an integer.

default(15)# station‐log issues ‐last 2

  • Using Search Pattern

To view issues that match a text pattern, use the -search “text” option. station‐log issues ‐search “Reset of radio”

  • Help

To view all available options, use the help keyword.

default(15)# station‐log issues help

Usage: station‐log issues <Arguments>

<Arguments>

help Display this help and exit all  Display all logs

-is <Issue ID>[,<Issue ID>]  Display issues matching issue ID (Example) -is 2,3 : filtering for AP radio reset and Long queuing delay

-mac <MAC> Display issues for this client MAC address

(Example) -mac 00:90:0b:23:2e:b7 : filtering ’00:90:0b:23:2e:b7′

-apmac <MAC> Display issues for this AP MAC address

(Example) -apmac 00:90:0b:23:2e:b7  : filtering ’00:90:0b:23:2e:b7′

-search “<PATTERN>” Display issues matching this pattern. PATTERN is case-sensitive

(Example) -search “Reset of radio” : filtering matching string ‘Reset of radio’

-last <NUM> Display the last <NUM> issues. NUM should be greater than

0

(Example) -last 5: print the last 5 issues List of Issue IDs

TABLE 34: List of Station Log Issues ID

Issue ID Description
     1 Frequent change in associated AP
     2 AP radio reset
     3 Long queuing delay
     4 Connected to distant AP
     5 Good RSSI value but low data rate
     6 High AP throughput but high retry count
     7 Frequent associations and dissociations
     8 Back-and-forth hand-off
     9 Hand-off retries failure

What Else Can I learn From A Diagnostic Event?

To see Controller Diagnostic Inferences with the CLI, turn on controller diagnostic inferences with the diag-log command admin controller on.

Meru01# configure terminal

Meru01(config)# diag‐log

Meru01(config‐diag‐log)# admin controller on

Turn on station diagnostic inferences with the diag-log command admin station on.

Meru01# configure terminal

Meru01(config)# diag‐log

Meru01(config‐diag‐log)# admin station on

Examine the details of a particular event by copying a MAC address from a Web UI screen such as Figure 82, pasting it into the Station Diagnostics window (Monitor > Diagnostics > Station) and then clicking Start Diagnostics.

 

Figure 84: Results of pasting a MAC address into the Station Diagnostics window

Scroll down to the bottom of the screen and click Show Buffered Diagnostics.

Capturing Packets

With the packet-capture-profile commands, you can capture packets from either a controller’s local interface or capture over the air from access points. Once packets are captured, you have three options for using them. You can see packet captures in real time, save them to a file for future offline analysis, or send them to an IDS program or device.

The CLI command packet-capture-profile supports a capture of a file up to 10Mb. Make sure that the directory captive is empty before using the command packet-capture-profile. With the packet-capture-profile commands, you can forward packet captures from APs directly to external devices without storing packets locally on the controller. This eliminates the restriction on the file size of the packet capture (you are not limited by controller memory) and also allows the captured information to be stored and archived externally. Use these CLI commands to

Capturing Packets

send captured packets from APs to a hardware device or program. This command is required to use Location Manager.

To Do this: Using this command:
Enter pcap mode and create a packet capture profile. packet-capture-profile either updates an existing profile or creates a new profile and then enters pcap mode where the rest of these commands are used.
Determine which APs will send packets. ap-list determines which APs will send packets. You must type each AP name one by one, separated by commas. At this time there is no all option or range ability. This list is limited by buffer space; you can enter 1, 2, 3,…90 without exceeding the limit. We recommend that you create the list in an application such as Notepad and then paste it into the command because if you exceed the buffer size, the command fails and you have to retype the entire list of APs again. If your list of APs exceeds the buffer size, you can create another profile that covers the rest of the APs.
Indicate packet destination.

Indicate which port to use.

mode sets the transmit mode to layer2 or layer3, names the destination IP and names the port that should be used. Port 9177 is used for Location Manager and 17777 (PPI encapsulation) can be used for debugging.

*PPI = Per-Packet Information

Determine the biggest packet size that you want an AP to send. packet-truncation-length sets packet capture truncation length. Default is 0 for troubleshooting and operation with WIPS. 82 is used for Location Manager.
Decide if you want to limit the rate at which packets are sent. rate-limiting sets the packet capture rate limit to per-station or cumulative.

! Note: Currently, if rate limiting is on, packets are limited only for perstation.

Determine whether you want to capture packets going to the AP, coming from the AP, or both. rxtx sets traffic intrusion detection to received traffic, sent traffic, or both. .
Limit bandwidth used. token-bucket-rate sets the token bucket rate.
Limit bandwidth used. token-bucket-size sets the token bucket size.
Download the configuration to the APs and start capturing packets. enable-profile turns on a packet capture profile.
This entry was posted in Administration Guides, FortiWLC on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

One thought on “FortiWLC – Troubleshooting

  1. Johnny

    “station-log issues” command works but will not accept any of the arguments. 4200 controller running 8.4.1 software.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.