topic Re: Locked out - no http, no https, no ssh, no telnet in Wireless

Locked out - no http, no https, no ssh, no telnet

Googleris — Sat, 03 Jul 2021 04:37:39 GMT

We have six Cisco APs – 5 1832i and 1 1815i – in FlexConnect mode and everything was ok until for some reason we were locked out from the controller either by GUI or ssh…

So now we do see the APs, we can connect to them with ssh or management console but we cannot connect to the controller from the GUI or CLI…

How can we unlock the controller either ssh or GUI?

Re: Locked out - no http, no https, no ssh, no telnet

balaji.bandi — Wed, 30 Jun 2021 13:29:51 GMT

Is the AP working ? or disassociated with WCL ?

you need to physically reboot (connecting console see what is wrong ?)

Re: Locked out - no http, no https, no ssh, no telnet

Googleris — Wed, 30 Jun 2021 13:33:13 GMT

Hi... the APs are working fine... the controller's IP is shown and the controller seems to work fine as well... but I cannot connect to its IP either through web browser (GUI) http or https neither through ssh.

I can ssh to every single AP to their IPs... not the controller's one.

Re: Locked out - no http, no https, no ssh, no telnet

Googleris — Wed, 30 Jun 2021 13:39:46 GMT

On all APs when I connect with ssh and do a show version command I get - among other things -

AP Image type : MOBILITY EXPRESS IMAGE
AP Configuration : MOBILITY EXPRESS CAPABLE

and on show run

Admin State : Enabled
AP Mode : FlexConnect
AP Submode : Not Configured

AP join priority : 1
IP Prefer-mode : IPv4
CAPWAP UDP-Lite : Unconfigured
DTLS Encryption State : Disabled
Discovery Timer : 10
Heartbeat Timer : 30
CDP State : Enabled
Watchdog monitoring : Enabled
IOX : Disabled
RRM State : Enabled
LSC State : Disabled
SSH State : Enabled
AP Username : ict
Session Timeout : 300

Re: Locked out - no http, no https, no ssh, no telnet

Scott Fella — Wed, 30 Jun 2021 15:18:07 GMT

Just to clarify, the controller ip would be different than the ap ip address. Did that happen to change? Maybe scan your subnet and see if the controller not the ap has a different ip. That is all I can think that happened. You might want to reboot the master ap if you know which one that is just to see.

Re: Locked out - no http, no https, no ssh, no telnet

patoberli — Wed, 30 Jun 2021 15:20:02 GMT

You might have a CPU ACL configured on the controller. Can you still access it via console port and check this?

Maybe you have also hit some software bug and your controller need a reload.