topic Re: AP cannot join vwlc 8.10 in Wireless

AP cannot join vwlc 8.10

eigrpy — Mon, 05 Jul 2021 20:05:30 GMT

Hello, AP3602 can join vwlc8.0 but cannot join vwlc8.10-, Is this wlc version too high? If so , what is the latest version of vwlc the AP can join? The below is the AP message. Thank you!

*Apr 3 22:55:45.000: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:508 Certificate verified failed!
*Apr 3 22:55:45.003: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 10.0.10.6:5246
*Apr 3 22:55:45.003: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.0.10.6:5246
*Apr 3 22:56:53.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.0.10.6 peer_port: 5246
*Apr 3 22:56:53.000: %CAPWAP-1-SSC_CERT_AUTH_FAILED: Failed to authorize controller, SSC certificate validation failed.Peer certificate verification failed FFFFFFFF

Re: AP cannot join vwlc 8.10

Scott Fella — Sat, 03 Apr 2021 23:19:32 GMT

Yes it is. Take a look at the compatibility matrix. This will come in handy.

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

Re: AP cannot join vwlc 8.10

eigrpy — Sun, 04 Apr 2021 00:17:43 GMT

Thanks for your reply. The link does not list vWLC

Can you tell what is the latest version of vwlc the AP can join?

Re: AP cannot join vwlc 8.10

Scott Fella — Sun, 04 Apr 2021 00:30:32 GMT

You look at the code.

Re: AP cannot join vwlc 8.10

Scott Fella — Sun, 04 Apr 2021 00:30:34 GMT

Look at the ap model and see what image it first was supported, what is the last supported image, or if it’s still supported.

Re: AP cannot join vwlc 8.10

eigrpy — Sun, 04 Apr 2021 00:46:58 GMT

Thank you very much for your reply.

What that mean with " - " in the table? I also have ap 3700, how about this 3700?

Re: AP cannot join vwlc 8.10

Leo Laohoo — Sun, 04 Apr 2021 00:53:12 GMT

The "final" AP support for a 3600 is 8.5.X.X.

Re: AP cannot join vwlc 8.10

eigrpy — Sun, 04 Apr 2021 01:04:05 GMT

" - " means it has not have final. if this is case, based on the table, the ap 3700 could be compatible with wlc up to latest one, which is 8.10-

Re: AP cannot join vwlc 8.10

Scott Fella — Sun, 04 Apr 2021 01:57:32 GMT

That is correct.

Re: AP cannot join vwlc 8.10

eigrpy — Sun, 04 Apr 2021 02:49:40 GMT

the ios of vwlc changed to 8.5(AIR_CTVM-K9_8_5_161_0.ova) from 8.10 based the table, but it still cannot work. The below is the AP message:

909c.b654#sh version
Cisco IOS Software, C3700 Software (AP3G2-K9W8-M), Version 15.3(3)JA12, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2017 by Cisco Systems, Inc.
Compiled Fri 20-Oct-17 20:51 by prod_rel_team

ROM: Bootstrap program is C3700 boot loader
BOOTLDR: C3700 Boot Loader (AP3G2-BOOT-M) LoaderVersion 15.2(4)JB, RELEASE SOFTWARE (fc1)

APd8b1.909c.b654 uptime is 58 minutes
System returned to ROM by power-on
System image file is "flash:/ap3g2-k9w8-mx.153-3.JA12/ap3g2-k9w8-xx.153-3.JA12"
Last reload reason:

/////////////

*Apr 4 02:43:04.003: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:508 Certificate verified failed!
*Apr 4 02:43:04.003: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 10.0.10.5:5246
*Apr 4 02:43:04.003: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.0.10.5:5246
*Apr 4 02:44:08.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Apr 4 02:44:09.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.0.10.5 peer_port: 5246
*Apr 4 02:44:14.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_handshake.c:929 Unexpected message received while expecting HelloVerifyRequest
*Apr 4 02:44:14.999: %DTLS-5-SEND_ALERT: Send FATAL : Unexpected message Alert to 10.0.10.5:5246
*Apr 4 02:44:14.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.0.10.5:5246
*Apr 4 02:45:35.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Apr 4 02:45:24.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.0.10.5 peer_port: 5246
*Apr 4 02:45:37.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_handshake.c:929 Unexpected message received while expecting HelloVerifyRequest
*Apr 4 02:45:37.999: %DTLS-5-SEND_ALERT: Send FATAL : Unexpected message Alert to 10.0.10.5:5246
*Apr 4 02:45:37.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.0.10.5:5246
*Apr 4 02:46:28.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

Re: AP cannot join vwlc 8.10

Scott Fella — Sun, 04 Apr 2021 03:23:32 GMT

You can just search the internet for some pieces of your output. Here is one thing I found searching.
https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63916.html

Re: AP cannot join vwlc 8.10

Leo Laohoo — Sun, 04 Apr 2021 03:52:08 GMT

@eigrpy wrote:

System image file is "flash:/ap3g2-k9w8-mx.153-3.JA12/ap3g2-k9w8-xx.153-3.JA12"

This means the AP has joined a controller and downloaded the full CAPWAP firmware. In enable mode, do the following:

debug capwap console cli
clear capwap private

Reboot the AP by pulling the power (do not use the "reload" command).

Re: AP cannot join vwlc 8.10

eigrpy — Sun, 04 Apr 2021 04:26:27 GMT

No, it cannot work after entering that command

we cannot say ap joined. the ap keeps sending message: "sending Join Request to 10.0.10.5" (wlc) and we cannot see it in wlc

Re: AP cannot join vwlc 8.10

Scott Fella — Sun, 04 Apr 2021 06:08:32 GMT

Try to just factory reset the ap. Hold the mode button down and power on the ap while still holding the mode button. Wait for the led to flash red which takes around 20 seconds. Also make sure the ap is on the same subnet as the wlc management for an easier join.
Console into the ap and look at the messages. If the ap still does not join, copy some of the messages and just do a search. You will find other post that might provide you with your answers.

Re: AP cannot join vwlc 8.10

eigrpy — Sat, 10 Apr 2021 01:37:18 GMT

Tried all your suggestions, but none of them can work. I list the below vwlc and i cannot try all of them. I appreciate if some one can tell which one can work for ap 3700 or 3600. I cannot believe cisco compatibility matrix. I know one version can work, but it is too old. That's why i am trying to get new one. Thank you all for your time and suggestions

MFG_CTVM_LARGE_8.6.101.0.iso 319.62 MB

Re: AP cannot join vwlc 8.10

Scott Fella — Mon, 05 Apr 2021 02:46:48 GMT

The matrix explains exactly what image is supported for each ap. The 3602 last support is 8.5.x so you can’t run a controller image higher than that. So make a decision if you still want the 3602 or else get rid of it.

Re: AP cannot join vwlc 8.10

eigrpy — Mon, 05 Apr 2021 03:44:31 GMT

Yes that is why I tried wlc 8.5 for 3602 and wlc 8.5 8.7 and 8.10 for 3702. all of them cannot work.

I know ap 3802 has ios 8.10-. we upgrade ap3800 then join the wlc 8.10. Not sure if ap 3700 has ios 8.10 and do the same thing

Re: AP cannot join vwlc 8.10

Scott Fella — Mon, 05 Apr 2021 04:58:48 GMT

The controller provides the image to the access point. So you need to review the troubleshooting guide. If you have 8.10 and the 3802’s have joined, then the 3702’s should be able to join. If not, the look at the console output and search the internet and see what others have done to fix it. The 3602 will not join the controller on this code, so don’t worry about those aps anymore.