topic 9800 Anchor Mobility will 5508 but Control Path Down in Wireless

9800 Anchor Mobility will 5508 but Control Path Down

Tom Cheung — Mon, 05 Jul 2021 20:06:31 GMT

Dear All,

I would like to test a anchor mobility with 5508 and 9800.

Both controller can ping and reach other.

But status keep show "Control Path Down".

For 9800 is using 17.3.2a version and 5508 is 8.5.164.216.

I tried to reboot those controller but still same issue.

Did I need to upgrade/downgrade 9800 controller firmware or related to other issue?

Please help.

Re: 9800 Anchor Mobility will 5508 but Control Path Down

Sandeep Choudhary — Thu, 28 Jan 2021 08:07:10 GMT

did you try eping and mping ?

https://rscciew.wordpress.com/tag/mobility/

try to use this image: https://software.cisco.com/download/home/282600534/type/280926587/release/8.5IRCM

Regards

Dont forget to rate helpful posts

Re: 9800 Anchor Mobility will 5508 but Control Path Down

Tom Cheung — Thu, 28 Jan 2021 08:56:54 GMT

Dear Sandeep Choudhary,

5508 is using this version.
And 5508 controller IP is 10.32.192.1 and 9800 is 192.168.56.53.

I found that 5508 can ping 9800 but mping and eping are fail.
I want to try at 9800 ping to 5508. But 9800 not support this ping command.
Did 9800 support mping and eping?

Reagsrd,
Tom

Re: 9800 Anchor Mobility will 5508 but Control Path Down

Sandeep Choudhary — Thu, 28 Jan 2021 09:04:32 GMT

Hi,

As per my knowledge ....mobility will works as long as the code is supported and that the ports are open (udp 16667 and udp 16667).

Also make sure that you add the proper MAC address and verify if DTLS is defined on AireOS or not because that makes a difference on the 9800 peer configuration.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213913-building-mobility-tunnels-on-catalyst-98.html#anc12

Regards

Dont forget to arte helpful posts

Re: 9800 Anchor Mobility will 5508 but Control Path Down

jegan_rajappa — Fri, 29 Jan 2021 23:03:44 GMT

Did you enabled secure mobility while adding mobility peer in 5508? This is required for IOSXE and AireOS interoperability solution

Re: 9800 Anchor Mobility will 5508 but Control Path Down

mchirico01 — Sat, 06 Feb 2021 03:28:27 GMT

I had the same problem tonight, I upgraded from 17.1 to 17.03.02a this evening and the existing, configured mobility tunnel would not come. The only way I got the tunnel to come up was to enable data-encryption. I couldn't find this documented anywhere at Cisco, so may be a new unpublished requirement.

As other users have stated, you also have to have Secure Mobility enabled, but since yours was also an existing deployment, I assume you already had that configured.

Enjoy!

Marty

Re: 9800 Anchor Mobility will 5508 but Control Path Down

Ric Beeching — Sun, 07 Feb 2021 02:24:25 GMT

In case others see this post - the IRCM deployment guide helps with understanding the different architectures you can use for interoperability between AireOS and 9800s including the Secure Mobility options and configs:

Cisco Catalyst 9800 Wireless Controller-Aireos IRCM
Deployment Guide

Cheers

Ric

Re: 9800 Anchor Mobility will 5508 but Control Path Down

Netzwerkbetrieb DFG — Fri, 05 Aug 2022 08:42:19 GMT

https://community.cisco.com/t5/wireless/inter-release-controller-mobility-ircm-with-5508-fail-control/td-p/4273720

That might be solution.

9800-1#conf t
9800-1(config)#crypto pki certificate map map1 1
9800-1(ca-certificate-map)#issuer-name co Cisco Manufacturing CA
9800-1(ca-certificate-map)#exit
9800-1(config)#crypto pki trustpool policy
9800-1(ca-trustpool)#match certificate map1 allow expired-certificate
9800-1(ca-trustpool)#end

Re: 9800 Anchor Mobility will 5508 but Control Path Down

hans-rodriguez — Wed, 13 Mar 2024 20:12:26 GMT

Works for me, thank you