CWT Troubleshooting & Maintenance Procedures 3 — Questions and Answers
Question 1: A WLAN controller shows an AP in 'discovery' state and it never transitions to 'joined.' What should you verify first?
- That the AP has the correct SSID configured
- That the AP can reach the WLC IP address and UDP port 5246/5247 are open (Correct answer)
- That the AP's transmit power is set to auto
- That the AP's MAC address is in the DHCP exclusion list
Correct answer: That the AP can reach the WLC IP address and UDP port 5246/5247 are open
CAPWAP control traffic uses UDP 5246/5247, and if these ports are blocked the AP cannot join the WLC.
Question 2: A client can connect to the WLAN but cannot reach the internet. Other clients on the same SSID work fine. What is the most likely cause?
- The AP's antenna is misaligned
- The client has an incorrect IP address or DNS configuration (Correct answer)
- The WLAN controller needs a reboot
- The client's wireless radio is failing
Correct answer: The client has an incorrect IP address or DNS configuration
If other clients on the same SSID work, the issue is client-specific—most likely an incorrect IP, subnet mask, gateway, or DNS setting.
Question 3: During a post-installation walkthrough, you notice dead spots in areas predicted to have coverage. What is the most common cause?
- Incorrect channel width settings on the APs
- Obstructions not accounted for in the predictive site survey (Correct answer)
- Clients using outdated wireless drivers
- The DHCP pool is too small for the number of clients
Correct answer: Obstructions not accounted for in the predictive site survey
Predictive surveys use building blueprints that may not reflect actual RF-attenuating materials like dense walls, metal shelving, or HVAC ducts.
Question 4: Which log entry on a wireless controller most directly indicates a rogue AP has been detected?
- Client association timeout
- Rogue AP containment initiated for BSSID XX:XX:XX:XX:XX:XX (Correct answer)
- DHCP offer sent to client
- Channel change detected on managed AP
Correct answer: Rogue AP containment initiated for BSSID XX:XX:XX:XX:XX:XX
A rogue AP containment log entry directly confirms the controller's WIDS/WIPS has identified and is responding to an unauthorized AP.
Question 5: A technician performs a packet capture and sees many 802.11 Probe Request frames but few Probe Responses. This suggests:
- The SSID is hidden and not responding to directed probes
- Clients are passively scanning only
- The AP is overloaded and dropping management frames (Correct answer)
- Normal Wi-Fi behavior with no issues
Correct answer: The AP is overloaded and dropping management frames
If an AP is heavily loaded or experiencing resource exhaustion, it may fail to respond to client probe requests in a timely manner.
Question 6: What is the purpose of running 'clear arp' on a wireless controller during troubleshooting?
- To reset all client associations
- To remove stale ARP cache entries that may cause connectivity issues (Correct answer)
- To flush the AP firmware image cache
- To restart the DHCP service
Correct answer: To remove stale ARP cache entries that may cause connectivity issues
Stale ARP entries can cause the controller to forward traffic to an incorrect MAC address, and clearing the ARP table forces re-resolution.
Question 7: When troubleshooting 802.1X authentication failures, which server log should you review first?
- DHCP server lease log
- RADIUS server authentication log (Correct answer)
- DNS server query log
- Wireless controller CAPWAP log
Correct answer: RADIUS server authentication log
802.1X authentication relies on RADIUS, so the RADIUS server log will contain detailed accept/reject records and failure reasons.
CWT Troubleshooting & Maintenance Procedures 3
A WLAN controller shows an AP in 'discovery' state and it never transitions to 'joined.' What should you verify first?