CCNA 200-301 v1.1 reference — Network Access

Wireless client troubleshooting

Diagnose client connectivity failures from controller and client configuration evidence: security, VLAN, band and RF causes.

Objective 2.9Objective 1.11v1.1 exam target

Failure stages

Observation	Points to
SSID not visible in scan list	WLAN disabled, AP not broadcasting, band mismatch (client lacks the band)
Association/auth fails immediately	Security mismatch — wrong PSK, 802.1X vs PSK confusion, PMF requirement unmet
Associated, but no IP / APIPA	VLAN/DHCP path broken — wrong WLAN-interface map, missing helper, exhausted scope
Associated + IP but no gateway	Wrong VLAN delivered, or the SVI is down
Connects but constant drops/slowness	RF: interference, weak RSSI, channel overlap, power/band issues

Client capability	WLAN requirement	Result
WPA2-only client	WPA3-required WLAN	Cannot authenticate
Client missing PMF	WLAN requires 802.11w PMF	Association fails
2.4 GHz-only client	5/6 GHz-only SSID	SSID invisible to that client
Legacy client	WPA3 transition/mixed mode	Usually works — transition mode allows WPA2

Read a client symptom correctly

169.254.x.x means the client associated and authenticated — radio and security are fine.
DHCP broadcast never got an offer on this WLAN — but peers on the same AP work.
Different result on the same AP → suspect a different SSID/VLAN mapping or a client-side DHCP quirk, not the RF.

Trace the DHCP path for that specific WLAN→VLAN mapping; the AP itself is healthy.

Gather evidence on the wired side

Correlate client reports with device state — Privileged EXEC

Cisco IOS / IOS XE (infrastructure side)

Verify

show cdp neighbors
show vlan brief
show interfaces trunk
show ip dhcp snooping binding
show mac address-table address <client-mac>

CDP shows which switch port the AP sits on; trunk output confirms the AP and WLC VLAN paths are carried; the client MAC on the WLC-facing link proves L2 delivery through the controller.
Snooping binding exists in the intended VLAN (or check the actual DHCP server's lease table) — proves the DHCP path works.

Controller-side evidence (client status, RSSI, auth logs) lives in the WLC GUI/CLI — combine both views.

Read-only verification commands.

Blaming RF first — most 'wireless problems' turn out to be VLAN/DHCP mapping or security mismatches.
Treating 'associated' as 'connected' — authentication and DHCP still have to succeed.
Ignoring band support — a 2.4 GHz client cannot see a 5 GHz-only SSID.
Assuming one failed client means a WLAN outage — check whether peers on the same AP succeed.

New employee cannot join the corp SSID

Observation: Client sees the SSID, enters the right PSK, and fails authentication repeatedly.

Hypotheses

Check	Indicates
WLAN security settings (PMF policy, WPA2 vs WPA3)	Required PMF or WPA3-only rejects incapable clients.
Client's saved profile — forget and re-add	Stale cached credentials produce repeated auth failure.
WLC client auth-failure logs	Names the reject reason (bad key vs policy rejection).

Correction: Align the security policy with supported clients (e.g., WPA2+WPA3 transition) or update the client.

Client completes association, authentication and gets a lease.

On this page

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.