Understand SNMP Traps for Access Point (AP) Association/Disassociation on AireOS Wireless LAN Controller (WLC)

Introduction

This document describes the SNMP (Simple Network Manager Protocol) traps that an AireOS WLC sends for AP association/disassociation.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics: 

• Wireless LAN Controller (WLC)
• Access Points (AP)
• SNMP (Simple Network Manager Protocol)

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any step.

Background Information

For each AP dissociation/association event, the WLC must send a SNMP trap with the following Object Identifiers (OIDs):

Dissociation trap (variable bindings)

1.3.6.1.2.1.1.3.0 (sysUpTime)                                                   <---- included in traps as the first variable binding

1.3.6.1.6.3.1.1.4.1 (snmpTrapOID)                                           <---- second variable binding (the value of this is another OID, indicating the AP dissociation event)

    1.3.6.1.4.1.14179.2.6.3.8 (bsnAPDisassociated)                 <---- OID indicating the event

1.3.6.1.4.1.14179.2.6.2.20 (bsnAPMacAddrTrapVariable)       <---- trap component, base radio MAC (Media Access Control) address of the AP

1.3.6.1.4.1.14179.2.2.1.1.3 (bsnAPName)                               <---- trap component

Management Information Base (MIB): AIRESPACE-WIRELESS-MIB (all OIDs except sysUpTime and snmpTrapOID):

Association trap (variable bindings)

1.3.6.1.2.1.1.3.0 (sysUpTime)                                                   <---- included in traps as the first variable binding

1.3.6.1.6.3.1.1.4.1 (snmpTrapOID)                                           <---- second variable binding (the value of this is another OID, indicating the AP association event)

    1.3.6.1.4.1.9.9.513.0.4 (ciscoLwappApAssociated)              <---- OID indicating the event 

1.3.6.1.4.1.9.9.513.1.1.1.1.5 (cLApName)                                <---- trap component, AP name

1.3.6.1.4.1.9.9.513.1.1.1.1.16 (cLApLastRebootReason)         <---- trap component (essentially the reason why the AP disconnected previously)

1.3.6.1.4.1.9.9.513.1.1.1.1.36 (cLApDataEncryptionStatus)     <---- trap component

MIB: CISCO-LWAPP-AP-MIB (all OIDs except sysUpTime and snmpTrapOID).

SNMP Traps for AP Association/Disassociation on AirOS WLC

Configuration

The trap control configuration can be set on the WLC GUI with the AP Register control (Management > SNMP > Trap Controls > AP > AP Register). This is enabled by default. Also, the WLC needs a trap receiver configured (Management > SNMP > Trap Receivers) on the GUI as well.

Verify Association and dissociation of the AP:

1. Traplog

The output of show traplog on the WLC shows counters for both associated and dissociated traps, in addition to messages for each event as shown below:

(Cisco Controller) >show trap log


AP Traps Statistics

AP Associated Traps ............... 1         
AP Disassociated Traps ............ 1       


23 Fri Jun 14 23:32:22 2019 AP 'torres-3802', MAC: 40:01:7a:73:fd:c0 disassoc     
iated previously due to AP Reset. Uptime: 0 days,
00 h 02 m 05 s . Reason: controller reboot comman
d. 
24 Fri Jun 14 23:29:32 2019 AP Disassociated. Base Radio MAC:40:01:7a:73:fd:c 
0 ApName - torres-3802

2. Packet Capture

Disassociation will appear in the packet captures as shown in the image:

1.3.6.1.4.1.14179.2.6.3.8 is the OID to indicate that the AP disconnected, followed by instance of bsnAPMacAddrTrapVariable with the base radio MAC of the AP (40:01:7a:73:fd:c0) and instance of bsnAPName with the AP name (torres-3802 is translated from the hexadecimal value).

Association will appear in the packet captures as shown in the image:

1.3.6.1.4.1.9.9.513.0.4 is the OID to indicate that the AP connected back to the WLC, followed by instance of cLApName with the AP name (torres-3802 is translated from the hexadecimal value) and instance of cLApLastRebootReason (in this case it is number 4 to indicate a manual reboot from the WLC).

Below Wireshark filters can be used for the SNMP packets:

1. snmp.value.oid == 1.3.6.1.4.1.14179.2.6.3.8
2. snmp.value.oid == 1.3.6.1.4.1.9.9.513.0.4
3. (snmp.value.oid == 1.3.6.1.4.1.14179.2.6.3.8 or snmp.value.oid == 1.3.6.1.4.1.9.9.513.0.4) and snmp.value.octets == "<AP name>"