topic Re: WLC 2504 with AP 1700 in Wireless

WLC 2504 with AP 1700

flokki123 — Mon, 05 Jul 2021 17:08:57 GMT

Hi all,

I have the problem that my APs wont join my WLC for some reason.

On the DHCP server I can tell that all 4 APs get an IP address and I also can ping them but dont see them on my WLC.

When I look at the WLC log I can see the following messages:

*fp_main_task: Mar 27 15:33:36.004: %SSHPM-4-AES_AP_ONLY: sshpmcert.c:4919 Cisco APs will not be able to join this controller
*fp_main_task: Mar 27 15:33:36.004: %LOG-6-Q_IND: sshpmcert.c:4561 Found Manufacturing-installed device certificates
*fp_main_task: Mar 27 15:33:36.001: %SSHPM-6-MANUF_CERT_INFO: sshpmcert.c:4561 Found Manufacturing-installed device certificates

Unfortunately, I couldnt find anything about the first message online.

I configured Option 43 on the DHCP server and used the MGMT IP of the WLC in hex.

Any ideas? The first log message is somehow suspucious!?

Thanks!

Re: WLC 2504 with AP 1700

Mark Elsen — Wed, 27 Mar 2019 19:23:06 GMT

- Which software version is the controller running ?. Make sure it is compatible with the AP-type.

Re: WLC 2504 with AP 1700

Haydn Andrews — Wed, 27 Mar 2019 21:49:02 GMT

Which software version are you running on the WLC.

The 1700 is only compatible with 8.0.x and above.

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

Do you have any other 1700 series APs on the WLC?

Is the time on the WLC correct?

Try adding the AP Ethernet mac address to the AP Policies and see how you go as well

Can you console the AP and provide the logs from it when it tries to join.

Re: WLC 2504 with AP 1700

Sandeep Choudhary — Thu, 28 Mar 2019 05:59:19 GMT

paste the output of these commands:

From WLC: sh sysinfo

FRom AP: sh version

Also boot the AP and paste the complete bootup process here .

Reagards

Dont forget to rate helpful posts

Re: WLC 2504 with AP 1700

flokki123 — Thu, 28 Mar 2019 12:30:14 GMT

Hi all,

thanks for all your replies!

FW running on the WLC is 8.1.x, which should be compatible to the APs.

Time is correct on the WLC.

I can ping all the AP IPs from the WLC.

When I turn on debugging for CAPWAP I dont see any related packets on the WLC?

There is another backup WLC in my mobility group to which I cannot connect yet. Might this be the problem? It says "Control and Data Path Down" for the connection to the other WLC. But I would think that this has nothing to do with the APs not joing the controller, right!?

At the moment I dont have any access to the APs.

Re: WLC 2504 with AP 1700

Scott Fella — Thu, 28 Mar 2019 13:20:44 GMT

You have two issue which you need to address separately. As far as the mobility if the WLC’s are not in the same subnet, most likely you have an acl or fw rule blocking the mobility ports.

Now with your AP, can you place the AP on the same management subnet as the wlc is on? I’m assuming the aps are local to where the controllers are at? Can you post the show cdp neighbor detail from the switch?

Re: WLC 2504 with AP 1700

flokki123 — Thu, 28 Mar 2019 15:53:48 GMT

Hi Scott,

thanks for your reply!

Here the "cdp neig detail" output from the switch the APs are connected to:

Device ID: XXX-AP001
Entry address(es):
IP address: 172.29.x.x
IPv6 address: FE80::7A72:x:x:x:x (link-local)
Platform: cisco AIR-CAP1702I-E-K9, Capabilities: Trans-Bridge Source-Route-Bridge IGMP
Interface: GigabitEthernet0/1, Port ID (outgoing port): GigabitEthernet0
Holdtime : 158 sec

Version :
Cisco IOS Software, C1700 Software (AP3G2-K9W8-M), Version 15.3(3)JD14, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2018 by Cisco Systems, Inc.
Compiled Fri 23-Mar-18 09:21 by prod_rel_team

advertisement version: 2
Duplex: full
Power drawn: 15.400 Watts
Power request id: 51247, Power management id: 2
Power request levels are:15400 13000 0 0 0
Management address(es):
IP address: 172.29.x.x

From the switch the WLC is connected to:

Device ID: XXX

Interface address(es):
IPv4 Address: 172.29.X.X
IPv6 Address: fe80::ba38:x:x:x:x
Platform: AIR-CT2504-K9, Capabilities: Host
Interface: Ethernet1/18, Port ID (outgoing port): GigabitEthernet0/0/1
Holdtime: 160 sec

Version:
Manufacturer's Name: Cisco Systems Inc. Product Name: Cisco Controller Product Version: 8.1.131.0 RTOS Version: Erro Bootloader Version: 1.0.20 Build Type: DATA + WPS

Advertisement Version: 2
Duplex: full

The WLC is connected via a trunk and the APs are connected as access ports to VLAN 100. The trunk to the WLC is allowed to carry VLAN 100.

Unfortunately, I cannot connect them together directly.

Just as info for you, I also included now the string "Cisco AP c1700" as option 60 with my DHCP server.

According to the "setup guide" its necessary.

Re: WLC 2504 with AP 1700

Scott Fella — Thu, 28 Mar 2019 16:32:33 GMT

Well the AP is lightweight which is good but might not be 100% if it was converted. Place the AP on the same subnet as the WLC and see if it joins. Do one first, once it joins, then you can move it back to the other vlan. If that is the issue, then you know your option is not working.

Re: WLC 2504 with AP 1700

flokki123 — Fri, 29 Mar 2019 14:08:35 GMT

Hi Scott,

thanks for your help.

I will do this and see what happens.

One last question, what FW version is getting pushed down to the APs from the WLC?

When I look at the WLCs flash there are only the active and backup FW versions.

But that are not the FW versions used for the APs, right? How can I tell the WLC which FW version to use for the APs?

Thanks!

Re: WLC 2504 with AP 1700

Scott Fella — Fri, 29 Mar 2019 15:58:33 GMT

The wlc will push the image to the AP. If you look at the config boot, you will see “active”, which is what the controller booted from and “default” which is the image the wlc will boot from on the next reload. So whatever the image the controller is currently on, that’s the image that will get pushed down to the AP. So even if you boot the controller on a different code, the controller will push the other image to the AP.