topic Re: AP does not connect to the controller in Wireless

AP does not connect to the controller

burich96 — Tue, 11 Jan 2022 12:54:14 GMT

Hello, colleagues! I deployed the WLC 9800 on ESXi, transferred the access point 9105AXI to a lightweight one with the command "ap-type capwap".
But then a problem arose: the access point receives its IP from DHCP (15 VLAN), the controller sees it, but they do not want to work, the point does not connect (not join). In the controller:

"Reason for last AP connection failure: DTLS cert-chain not available"
On AP the following:

What should I do?

Re: AP does not connect to the controller

Flavio Miranda — Tue, 11 Jan 2022 13:27:34 GMT

Most probably they are in diferrent time. Make sure both are on the same time.

Re: AP does not connect to the controller

Sandeep Choudhary — Tue, 11 Jan 2022 14:07:44 GMT

Hi,

Looks like a trust point issue to me.

check this post:

https://gblogs.cisco.com/ch-tech/setup-your-lab-with-catalyst-9800-cl/

you can also manually create a trust point ....example:

WLC#wireless config vwlc-ssc key-size 2048 signature-algo sha256 password 0 ...

Regards

Dont forget to rate helpful posts

Re: AP does not connect to the controller

Rich R — Tue, 11 Jan 2022 15:26:38 GMT

Very common question - have you read previous posts on the subject?

Example: https://community.cisco.com/t5/wireless/9800-cl-wlc-no-valid-ap-manager-found-for-controller/td-p/3985577

Re: AP does not connect to the controller

burich96 — Wed, 12 Jan 2022 04:31:08 GMT

Hi! At the moment, different time zones. What command can I use to change the time zone on the access point at the moment?

Re: AP does not connect to the controller

Martin Pritchard — Thu, 21 Mar 2024 10:21:44 GMT

I had a similar issue last night when upgrading a 9800-80 from 17.9.4a to 17.9.5. 1600 APs all refusing to connect with a "DTLS cert-chain not available" error.
There's nothing in the release notes to say that the config needs to be changed, but there's a clue as to what the certificate ought to be.

The command wireless management trustpoint CISCO_IDEVID_CMCA3_SUDI fixed it; all APs started pouring in, realised they needed to switch firmware, cleared off and came back.

9800WLC#sh ap image
Total number of APs : 0

Number of APs
Initiated : 0
Downloading : 0
Predownloading : 0
Completed downloading : 0
Completed predownloading : 0
Not Supported : 0
Failed to Predownload : 0
Predownload in progress : No

9800WLC#wireless config validate
wireless management trustpoint is not set

9800WLC#show wireless management trustpoint
Trustpoint Name :
Certificate Info : Not Available
Private key Info : Not Available
FIPS suitability : Not Applicable

9800WLC#conf t
Enter configuration commands, one per line. End with CNTL/Z.
9800WLC(config)#wireless management trustpoint CISCO_IDEVID_CMCA3_SUDI
9800WLC(config)#^Z
9800WLC#show wireless management trustpoint
Trustpoint Name : CISCO_IDEVID_CMCA3_SUDI
Certificate Info : Available
Certificate Type : MIC
Certificate Hash : ****HIDDEN****
Private key Info : Available
FIPS suitability : Not Applicable