DX NetOps

Expand all | Collapse all

Cisco WLC Access Point DisAssociate alarm issue

Jump to Best Answer
  • 1.  Cisco WLC Access Point DisAssociate alarm issue

    Posted 10-04-2017 10:47 AM

    I have come across a problem with alarming on Cisco Wireless Lan Controllers (WLC) when an Access Point (AP) goes down and wondering if anyone can help.


    Out of the box Spectrum will alarm when an AP is Disassociated (bsnAPDisassociated trap, event 0x4b60007), however the corresponding clear event (trap bsnAPAssociated, event 0x4b60006) is deprecated so will never be seen. Put simply, Spectrum creates an alarm when an AP is disassociated, but doesn’t clear it when it’s back on again.

    The problem is the AP disassociate and associate traps are from different mibs. The Disassociate is from the Airespace mib, bsnAPDisassociated, and the Associate from the Cisco Lwapp AP mib, ciscoLwappApAssociated (event 0x210e0c). Don’t ask me why 


    I have captured the traps from the WLC when the AP goes down and back up and can confirm that bsnAPDisassociated is sent for the disassociate and ciscoLwappApAssociated is sent for the subsequent associate.


    Both traps send the mac address and AP name in the trap variables and I have tried to use both of these to discriminate the alarm and the clear, but without success .


    Has anyone come across this already? And more importantly, has anyone got a solution, or even suggest a solution?


    Thanks, John


    For info the trap definitions are as follows.


    bsnAPDisassociated NOTIFICATION-TYPE
    STATUS current
    "When Airespace AP disassociates from Airespace Switch, AP
    disassociated notification will be sent with dot3 MAC address
    of Airespace AP management system to remove Airespace AP from
    this Airespace Switch"
    ::= { bsnTraps 8 }

    ciscoLwappApAssociated NOTIFICATION-TYPE
    STATUS current
    "This notification is generated whenever an AP joins the
    controller successfully. This notification contains
    information about the last reboot reason and Data
    Encryption status of the AP."
    ::= { ciscoLwappApMIBNotifs 4 }

  • 2.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 10-04-2017 12:07 PM

    Hi John,

                    Spectrum’s WLC code does account for this, so please open a case as it sounds like it’s not working.



  • 3.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 10-04-2017 12:20 PM

    Hi Jason

    Are you saying that the ciscoLwappApAssociated event should clear the alarm created by the bsnAPDisassociated event? If so I will create a support call.


    I should have added that a complication in our environment is that Spectrum cannot communicate directly with the APs, hence we are relying on the traps.


    For info we are on



  • 4.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 10-04-2017 01:47 PM


    I have raised case number 00858990 for this.


    Regards, John

  • 5.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 10-04-2017 01:50 PM

    Cool, I’ll put some notes in it…If you have any debug (events, sniffer etc) that you can add, that would be appreciated.



  • 6.  Re: Cisco WLC Access Point DisAssociate alarm issue
    Best Answer

    Posted 10-05-2017 04:52 AM



    The reason it doesn't clear is pretty simple if you ask me. When you use discriminators in Spectrum Events, they should be exactly the same. I see variables are not in the same order in both traps, so I think the right way to make them clear each other is to do a custom event handler for both, and the AlertMap for both traps should create an event with the variables in the same order (let's say 1. APName, 2. MAC, 3. and 4. for the rest) so you can then use events to clear each other. Having that into a case should help us to get this OOTB for next release!  In the meantime, I think this can be fixed in the field!

  • 7.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 10-05-2017 07:06 AM

    Hi Christophe

    I hadn't realised the discriminators needed to be in the same order. A bit weak if you ask me  ... mind you this was on my list of things to try but hadn't got there just yet 


    So I tried what you said and have now got it working, so thank you for that . I had to change the discriminator for both the Disassociate and Associate to the APName to get it working however. The mac address is available for both but seems to be in a different format and doesn't work. Not really sure why that is.


    Anyway onwards and upwards from here.


    Regards, John

  • 8.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 10-05-2017 07:53 AM

    Nice catch Christophe. I jumped right to the code to make sure we should generate the clear without even looking at the event config   Sounds like we can create a defect to get it fixed out of the box.



  • 9.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 06-22-2018 08:14 PM

    Has this been fixed.  I am being sweated about disassociation's from corp controller, and I dont even see the bsn event listed in the event list.

  • 10.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 06-26-2018 08:32 AM

    What are you getting for an event stream?  Are you getting 0x04b60007 and 0x04b60006 events?


    # bsnAPAssociated                                # bsnAPMacAddrTrapVariable 0x04b60006,0)\
    # bsnAPPortNumberTrapVariable,0)\
    # bsnAPName,0)



    # bsnAPDisassociated                            # bsnAPMacAddrTrapVariable 0x04b60007,0)\
    # bsnAPName,0)


    The event rule is triggering off of value 1 (the MAC):

    # bsnAPDisassociated
    0x4b60007 E 50 A 1,0x04b60007,U,1 R CA.EventCounter, "0x4b60006 -:-", 10, "0x6760002 -:-", "0x6760003 -:-"
    0x04b60006 E 50 C 0x04b60007, 1


    If you're still seeing the 0x04b60007 and 0x00210e0c then you'll need to copy the SS/CsVendor/AlertMap and EventDisp to /custom/Events/Cisco_Router.  Update the AlertMap to match the bsnAPName of 0x4b60007.  


    # ciscoLwappApAssociated              cLApLastRebootReason 0x00210e0c,0)\
    # cLApDataEncryptionStatus,0)


    You'll need to add 0x4b60007 to use the varbind 2 as a discriminator and generate the alarm:


    0x4b60007 E 50 A 1,0x04b60007,U,2


    0x210e0c generates a minor alarm, so if you don't want the minor alarm when the APAssociated happens, you'll probably want to change that to clear the 0x4b60007:


    0x00210e0c E 20 C 0x4b60007,2


    In Event configuration editor, edit 0x00210e0c so it has this in the event variables:


    cLApLastRebootReason = {T cLApLastRebootReason 1}

    cLApName = {S 2}
    cLApName.cLApSysMacAddress = {o 3}
    cLApDataEncryptionStatus = {T cLApDataEncryptionStatus 4}


    Be sure to press the Update Event Configuration on the VNM after.


    I think that looks right. Someone please spot check me as I get another coffee   



  • 11.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 06-22-2018 08:17 PM

    were you able to get this to work? I need this solution like yesterday. I dont really understand creating custom events yet, so if you have a screenshot or 2 on how you did this....


  • 12.  Re: Cisco WLC Access Point DisAssociate alarm issue

    Posted 06-26-2018 08:45 AM

    Hi Dick,


    For time sensitive issues its probably best to log a support issue.  I just checked on my Spectrum 10.2.3 lab server and I can see that it is not fixed.


    If you look at the traps in how they are defined in the AlertMap, you can find the alertmap location from a grep


    > grep -r "" .
    ./Cisco_Router/AlertMap: 0x00210e0c
    > grep -r "bsnAPDisassociated" .
    ./Airespace/AlertMap:# bsnAPDisassociated #
    ./Airespace/EventDisp:# bsnAPDisassociated


    So Spectrum/SS/CsVendor/Cisco_Router for Cisco Alertmap and Spectrum/SS/CsVendor/Airespace for the bsnAPDissociated Alertmap.

    # ciscoLwappApAssociatedNotify cLApName 0x00210e34,2)\
    # cLApSysMacAddress,0)\
    # cLApLastRebootReason,0)\
    # cLApDataEncryptionStatus,0)



    # bsnAPDisassociated # bsnAPMacAddrTrapVariable 0x04b60007,0)\
    # bsnAPName,0)


    If we check the Mac Address in both traps they have different discriminators  3 for Cisco and 1 for bsnAPDissociated.  So the suggestion by Christophe Sperandio was to make them match so that Cisco uses Discriminator of 1 instead of 3.


    So the fixed Cisco Alertmap should look like this:


    # ciscoLwappApAssociatedNotify cLApName 0x00210e34,2)\
    # cLApSysMacAddress,0)\
    # cLApLastRebootReason,0)\
    # cLApDataEncryptionStatus,0)


    You will then need to fix the EventFormat File for the Cisco Event  0x00210e34



    Then save and reload the events from the VNM model in Spectrum and from the OneClick admin page for OneClick because we changed the event format files.


    Any doubts please open a support issue as we probably should have fixed this out of the box but it looks like it hasn´t been corrected yet.


    Best regards,