Troubleshooting and Verification
Methodical troubleshooting
Adopt a layered approach: physical/link, AP registration, client association, authentication, then forwarding. Use show commands (AP database, client table, station details), packet captures, and logs to isolate faults. Understand the difference between association, authentication, and DHCP/IP failures - each points to a different layer.
Common failure signatures
APs stuck in registration often indicate discovery or firewall issues (PAPI/UDP 8211, GRE). Clients stuck at 802.1X suggest certificate or RADIUS problems. Clients with an IP but no connectivity suggest VLAN, gateway, or role/ACL issues. High retries or low SNR point to RF problems.
Traps
Questions often present a symptom and expect you to identify the first verification step, not the fix. Avoid jumping to configuration changes before confirming the fault layer. Another trap: misreading client states - a client in a deny role is authenticated but unauthorized.
Worked example
Users on one SSID intermittently fail to get IPs. Check: AP registration stable? Client associates? 802.1X succeeds? DHCP relay reachable and VLAN trunked? If all pass but no IP, verify DHCP scope exhaustion and relay configuration on the user VLAN.
Verification tools
Use controller dashboards, client event logs, and RF heatmaps to correlate symptoms.