topic Re: Some APs no longer showing on WLC but can still ping the devices in Wireless

Some APs no longer showing on WLC but can still ping the devices

g.ghir — Sun, 01 May 2022 15:38:33 GMT

Dear Community,

I have been running a network over a number of years (remotely) which has a Cisco 2504 WLC with LAP1042N-E Access Points (x5) and one AP (CAP1602I-E). The users have reported a problem of poor connectivity, once we have investigated the issue we are not seeing 3 of the 6 APs on the WLC. Strange thing is that we can ping all 6 APs???

Not sure what is going on. Happy to provide logs/dumps etc but I am working remotely however I have had one of thWLC, AP1042N,e (faulty) APs shipped to my house.

Re: Some APs no longer showing on WLC but can still ping the devices

Flavio Miranda — Sun, 01 May 2022 16:25:29 GMT

You may see AP on the network but not on the WLC. And you may see AP on the WLC but not propagating wireless signal.

Make sure the AP is properly configured on the switch. Check vlan and port mode.

Access the AP remotely and try to Ping the wlc

Re: Some APs no longer showing on WLC but can still ping the devices

MHM Cisco World — Sun, 01 May 2022 16:33:32 GMT

check if AP join WLC,
check AP Certificate may be it expire.

Re: Some APs no longer showing on WLC but can still ping the devices

Leo Laohoo — Sun, 01 May 2022 23:04:52 GMT

Read this: FN - 63942 - Wireless Lightweight Access Points and WLAN Controllers Fail to Create CAPWAP Connections Due to Certificate Expiration

I suspect the WLC is running a fairly old firmware, probably early 8.0, and the APs have rebooted or crashed.

Re: Some APs no longer showing on WLC but can still ping the devices

Haydn Andrews — Sun, 01 May 2022 23:19:55 GMT

agree with @Leo Laohoo more than likely APs hitting MIC certificate expiry

Re: Some APs no longer showing on WLC but can still ping the devices

g.ghir — Mon, 02 May 2022 19:12:20 GMT

Thanks, but it used to work and nothing has changed on the switch, the other 3 APs are continuing to work.

Re: Some APs no longer showing on WLC but can still ping the devices

g.ghir — Mon, 02 May 2022 19:41:39 GMT

Hi Leo, yes the Software Version is 7.6.100.0. What version would be recommended to fix this issue please?

Re: Some APs no longer showing on WLC but can still ping the devices

g.ghir — Mon, 02 May 2022 19:44:53 GMT

Thanks Haydn,

I looked at the article but I have not worked on controllers so I need to do a bit more study. When I look at the logs I notice this error:

*spamApTask2: May 02 18:03:29.307: #DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:698 Failed to complete DTLS handshake with peer

Does this have something to do with the issue?

Re: Some APs no longer showing on WLC but can still ping the devices

g.ghir — Mon, 02 May 2022 20:14:23 GMT

In doing some more digging you seem to be correct (although I have not fixed this yet). Once I set the clock back in time on my Wireless Controller the APs started to come back. I am working remotely so I am not sure if I need to console into the APs to apply a permanent fix. Exploring further...

Re: Some APs no longer showing on WLC but can still ping the devices

MHM Cisco World — Mon, 02 May 2022 20:26:27 GMT

As I mention in first my comment, the issue is certificate
other workaround is using

ap cert-expiry-ignore mic enable

Re: Some APs no longer showing on WLC but can still ping the devices

Leo Laohoo — Mon, 02 May 2022 22:56:42 GMT

@g.ghir wrote:

Hi Leo, yes the Software Version is 7.6.100.0. What version would be recommended to fix this issue please?

What APs are there?

1042 and 1600. Any other models?

Re: Some APs no longer showing on WLC but can still ping the devices

Haydn Andrews — Tue, 03 May 2022 00:19:34 GMT

If just the 1042 and 1600 then the highest version you can run is

8.3.150.0

As per the wireless compatibility matrix

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

Then:

You will need to follow these steps:

Solution for Expired WLC Certificates

Situation: The WLC does not run a fixed software version and some APs cannot join.

Upgrade to a fixed version of the software.
Enter the config ap cert-expiry-ignore {mic|ssc} enable command.
If any of the APs that cannot join have not downloaded the fixed software:
1. Disable NTP.
2. Set the clock back to a time before the WLC certificate expired (might keep newer APs from joining).
3. Have all APs join the WLC, download new software, and rejoin.
4. Set the clock to the correct time and re-enable NTP.

Situation: The WLC runs fixed software, but some APs cannot join.

Enter the config ap cert-expiry-ignore mic enable command.
If any of the APs that cannot join have not downloaded the fixed software:
1. Disable NTP.
2. Set the clock back to a time before the WLC certificate expired (might keep newer APs from joining).
3. Have all APs join the WLC, download new software, and rejoin.
4. Set the clock to the correct time and re-enable NTP.

Alternatively as a work around before the upgrade you can roll the WLC clock manually back to before the certificate expired

Further details here: https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

Re: Some APs no longer showing on WLC but can still ping the devices

g.ghir — Tue, 03 May 2022 09:37:22 GMT

1x AIR-CAP1602I-E-K9
5x AIR-LAP1042N-E-K9

Kind thx

Re: Some APs no longer showing on WLC but can still ping the devices

Rich R — Sat, 07 May 2022 12:21:24 GMT

Yes - the field notice tells you exactly what to do and @Haydn Andrews has even summarised that for you above.

You need to upgrade the WLC to a version with the fix/workaround (8.3.150.0 as Hayden suggested) and then apply the correct config as per the instructions.