. This will cause the dot11 radio interface to reset, after which the MAC address filter will be enabled: Cisco-WAP(config)#dot11 association mac-list 700 *Mar 1 01:51:19.543: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset *Mar 1 01:51:19.555: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up Chapter 29: Wireless Troubleshooting Here are some useful commands for troubleshooting a WAP. For me, the problems usually revolve around association. The command show dot11 associations is a great tool. If you have Cisco devices associated, it will even show you what they are: Cisco-WAP#sho dot11 associations 802.11 Client Stations on Dot11Radioo: SSID [Coolness] : MAC Address IP address Device Parent State 0014.a524.5b7a 192.168.1.129 ccx-client hp-laptop Assoc 001d.a231.6568 192.168.1.135 CP-7921 SEP001DA2316568 Assoc 001e.a98b.0018 192.168.1.120 unknown Assoc 7c6d.62a4.6aad 192.168.1.110 unknown Assoc Keeping the monitor session active with the terminal monitor command is a must when troubleshooting association problems. This will ensure that console message are sent to your terminal session when you're using Telnet or SSH to connect to the WAP. Here is the console output that resulted from a wireless client losing power: *Mar 1 00:56:54.671: %DOT11-6-DISASSOC: Interface Dot11Radio0, Deauthenticating Station 0025.0046.3f26 Reason: Sending station has left the BSS Here is the resulting console message after power was restored: *Mar 1 00:58:25.607: %DOT11-6-ASSOC: Interface Dot11Radioo, Station 0025.0046.3f26 Associated KEY_MGMT[NONE] These debug commands can be very helpful when you are troubleshooting wireless authentication: debug dot11 aaa authenticator process debug dot11 aaa authenticator state-machine If WPA or WPA2 Enterprise is enabled and RADIUS is involved, debugging RADIUS can be handy as well: debug radius authentication The output of these debug commands can be pretty verbose. Cisco document ID#50843 (http://www.cisco.com/en/US/products/hw/wireless/ps430/products_tech _note09186a00802