topic Re: Controller Keyhash matches with the MSE in Wireless

Controller Keyhash matches with the MSE

santana_a — Mon, 05 Jul 2021 15:11:19 GMT

Hello guys. I need your help. I have the following machines: WLC 8.2.166.0 vMSE 8.0.150.0 CPI 3.1.0 I can see reachable the MSE from CPI, but the NMSP status is inactive. all machines has the same time zone and clock. Thank you for your help

Re: Controller Keyhash matches with the MSE

Richard Wakefield — Thu, 03 May 2018 18:22:37 GMT

Same exact revisions, same exact problems. I've tried manually adding the hash:

config auth-list add sha256-lbs-ssc <mac> <hash>

With no luck.

Re: Controller Keyhash matches with the MSE

d.friday — Thu, 03 May 2018 20:11:25 GMT

I had this same issue a few months ago. I tired everything from manually adding the key on the WLC and rebuilding the MSE. I finally removed the MSE from Prime, added the MSE back into Prime and resynced the MSE to Prime which fixed my issue.

I hope this fixed your issues too.

David

Re: Controller Keyhash matches with the MSE

Richard Wakefield — Thu, 03 May 2018 21:16:09 GMT

Tried all of the above a few times... No luck. Thanks for the response, though.

Re: Controller Keyhash matches with the MSE

Richard Wakefield — Thu, 03 May 2018 22:43:04 GMT

...although I'm in awe that this is a Sev 6 Enhancement.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvh68000/?reffering_site=dumpcr

WLC8540 8.2MR6 rejects NMSP SSL Handshake after server hello from MSE8.0MR5

CSCvh68000

Description

Symptom:
WLC is sending TCP FIN as soon as it received server hello from MSE to establish NMSP handshake. Confirmed by packet capture.
WLC nmsp statistics shows SSL Handshake error.

Conditions:
MSE3365 running 8.0.150.0
WLC8540 running 8.2.166.0
PI3.1
AP3800 joined
Trigger: MSE upgrade. (8.0.140.0 -> 8.0.150.0)

Workaround:
None at this time

Last Modified:

May 3,2018

Status:

Other

Severity:

6 Enhancement

Re: Controller Keyhash matches with the MSE

Richard Wakefield — Thu, 03 May 2018 23:04:29 GMT

From TAC:

Accordingly to our internal research, the workaround in this case will be to enable TLSv1.0 for NMSP:

Invoke the setup script in the MSE:

/opt/mse/setup/setup.sh

Select option 23
Save the settings by selecting the option#25

This did actually work for me...

Re: Controller Keyhash matches with the MSE

JohnCaston — Wed, 04 Jul 2018 04:33:24 GMT

Brilliant - that work around worked for me too

Many thanks for the post

Re: Controller Keyhash matches with the MSE

chris.decker — Mon, 05 Aug 2019 16:23:23 GMT

Saved me a headache, couldn't figure this out. Thank you for sharing this info!!

Re: Controller Keyhash matches with the MSE

Patrick_Warren — Thu, 19 Sep 2019 20:36:13 GMT

Enabling TLS 1.0 worked for us too.

WLC 5520 8.2.151

Upgraded MSE from 8.0.130 to 8.0.150 and NMSP connection to WLCs broke.