topic Re: WLC2504 Access Point not joining in Wireless

WLC2504 Access Point not joining

Niels van Strien — Tue, 24 Jan 2023 13:17:22 GMT

Hello,

I have a WLC2504 with 10 licenses running 8.5.151.0.

I have several 3602 AP's with AC radio module that previously could join the controller, but now don't join the controller anymore.

As reason for the failed join attempt I read: Missing AP Manager IPV6 interface. However, the configuration has not changed.

Also. I have 3700 series and 3800 series AP's that can join.

I have been reading news about a security certificate that has expired. Could this have something to do with the AP's not joining? Is there an updated software version that addresses this software issue?

Kind regards,

Niels van Strien

Re: WLC2504 Access Point not joining

Mark Elsen — Tue, 24 Jan 2023 13:47:33 GMT

>...: Missing AP Manager IPV6 interface.
- Is this log from the AP or controller ? Meaning post both and or if needed post the (an) AP 3602 boot process (?)

Re: WLC2504 Access Point not joining

Niels van Strien — Tue, 24 Jan 2023 14:03:50 GMT

Hello M,

Just writing to let you know that I am an end-user in a residential setting with some experience configuring the wlc, but without deep knowledge. I attached the message log from the controller to this message. Perhaps it is easy for you to spot what is wrong.

Kind regards,

Niels van Strien

Re: WLC2504 Access Point not joining

Sandeep Choudhary — Tue, 24 Jan 2023 14:25:59 GMT

Hi,

First disable IPV6:

■ From GUI: Controller tab → General → Global IPv6 Config → [Select disable]

■ From CLI : config ipv6 disable

and second: if certificate expired then try this solution as well!

config ap cert-expiry-ignore mic enable

https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

Regards

Dont forget to rate helpful posts

Re: WLC2504 Access Point not joining

Mark Elsen — Tue, 24 Jan 2023 14:38:15 GMT

- As suggested by other reply use (on controller ) : config ap cert-expiry-ignore mic enable

Re: WLC2504 Access Point not joining

Niels van Strien — Tue, 24 Jan 2023 14:55:29 GMT

Ok disabled and rebooted the wlc2504. The message log now says the info below.

The config ap cert-expiry-ignore mic enable command can only be issued when connected directly to the wlc via CLI, correct?

Thanks,

Niels

Message Uploaded at Jan 24 15:52:14.240.

*spamApTask6: Jan 24 15:52:11.973: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:981 Failed to complete DTLS handshake with peer 192.168.1.101

*spamApTask6: Jan 24 15:52:11.973: %SSHPM-3-GENERIC_CERT_ERROR: sshpmPkiApi.c:2237 Certificate validation failed! Reason Cisco user certificate not verified by cisco root., Certificate type : MIC, Certificate issuer :Cisco Certificate
*spamApTask5: Jan 24 15:52:10.235: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:981 Failed to complete DTLS handshake with peer 192.168.1.31

*spamApTask5: Jan 24 15:52:10.235: %SSHPM-3-GENERIC_CERT_ERROR: sshpmPkiApi.c:2237 Certificate validation failed! Reason Cisco user certificate not verified by cisco root., Certificate type : MIC, Certificate issuer :Cisco Certificate
*spamApTask6: Jan 24 15:50:56.981: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:981 Failed to complete DTLS handshake with peer 192.168.1.101

*spamApTask6: Jan 24 15:50:56.980: %SSHPM-3-GENERIC_CERT_ERROR: sshpmPkiApi.c:2237 Certificate validation failed! Reason Cisco user certificate not verified by cisco root., Certificate type : MIC, Certificate issuer :Cisco Certificate
*spamApTask5: Jan 24 15:50:55.264: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:981 Failed to complete DTLS handshake with peer 192.168.1.31

*spamApTask5: Jan 24 15:50:55.263: %SSHPM-3-GENERIC_CERT_ERROR: sshpmPkiApi.c:2237 Certificate validation failed! Reason Cisco user certificate not verified by cisco root., Certificate type : MIC, Certificate issuer :Cisco Certificate
*spamApTask3: Jan 24 15:50:53.026: %LWAPP-3-VENDOR_PLD_VALIDATE_ERR: spam_lrad.c:12016 Validation of SPAM_VENDOR_SPECIFIC_PAYLOAD(185) with length=9 failed - AP 04:62:73:ad:6f:b0
*sntpReceiveTask: Jan 24 15:50:50.413: %SNTP-3-FATAL_ERROR_OCCURED: sntp_main.c:233 Fatal error: : unable to send NTP packet to ::ffff:128.138.141.172.
*sntpReceiveTask: Jan 24 15:50:48.413: %SNTP-3-FATAL_ERROR_OCCURED: sntp_main.c:233 Fatal error: : unable to send NTP packet to ::ffff:128.138.141.172.
*sntpReceiveTask: Jan 24 15:50:46.409: %SNTP-3-FATAL_ERROR_OCCURED: sntp_main.c:233 Fatal error: : unable to send NTP packet to ::ffff:128.138.141.172.
*nim_t: Jan 24 15:50:41.133: %SIM-3-PORT_UP: sim.c:13902 Physical port 1 is up!.
*cpuAclLogTask: Jan 24 15:50:40.954: %ACL-3-CPU_ACL_LOG_UCAPL_DISABLED: acl.c:1361 UCAPL disabled. CPU ACL hits will not be logged.
*bcastDataTask: Jan 24 15:50:35.547: %APF-3-INVALID_MCAST_MODE_ADDR: apf_net.c:5070 Received ipv6 capwap multicast packet source: (fe80::3aed:18ff:fe50:b240) destination: (::) whencapwap multicast mode is multicast with unconfigured ipv6 address.
*fp_main_task: Jan 24 15:50:22.721: %CNFGR-3-INV_COMP_ID: cnfgr.c:4138 Invalid Component Id : Unrecognized (45) in cfgConfiguratorInit.

Re: WLC2504 Access Point not joining

Sandeep Choudhary — Tue, 24 Jan 2023 15:15:22 GMT

yes you can run this command via CLI: config ap cert-expiry-ignore mic enable

Regards

Re: WLC2504 Access Point not joining

Mark Elsen — Tue, 24 Jan 2023 15:21:54 GMT

>....The config ap cert-expiry-ignore mic enable command can only be issued when connected directly to the wlc via CLI, correct
Yes, but the reboot was not needed for testing (then you need to save the configuration too) , but I would like to focus first on a few other items seen in the output provided :
>....SNTP-3-FATAL_ERROR_OCCURED: sntp_main.c:233 Fatal error: : unable to send NTP packet to ::ffff:128.138.141.172
>...APF-3-INVALID_MCAST_MODE_ADDR: apf_net.c:5070 Received ipv6 capwap multicast packet source: (fe80::3aed:18ff:fe50:b240) destination:
It looks like ipv6 is being used or configured , if not ipv6 is not needed could you try : config ipv6 disable , save the configuration , reboot and try again, post the same logs again afterwards too ,

Re: WLC2504 Access Point not joining

Niels van Strien — Tue, 24 Jan 2023 15:46:26 GMT

Hi again - it was a while since I used the CLI over serial but I managed to connect and issue both commands:

config ap cert-expiry-ignore mic enable
config ipv6 disable

and then saved the configuration, performed a reboot. The access points that previously did not join the controller are now joining again. I do see some more ipv6 errors in my message log whereas the controller returned that ipv6 was globally disabled already when I issued the config ipv6 disable command:

*spamApTask4: Jan 24 16:43:08.557: %LWAPP-3-VENDOR_PLD_VALIDATE_ERR: spam_lrad.c:12016 Validation of SPAM_VENDOR_SPECIFIC_PAYLOAD(185) with length=9 failed - AP 04:da:d2:90:6d:e0
*spamApTask0: Jan 24 16:43:06.986: %LWAPP-3-VENDOR_PLD_VALIDATE_ERR: spam_lrad.c:12016 Validation of SPAM_VENDOR_SPECIFIC_PAYLOAD(185) with length=9 failed - AP 04:62:73:ad:6f:b0
*spamApTask7: Jan 24 16:43:06.662: %LWAPP-3-VENDOR_PLD_VALIDATE_ERR: spam_lrad.c:12016 Validation of SPAM_VENDOR_SPECIFIC_PAYLOAD(185) with length=9 failed - AP 1c:e6:c7:0c:66:b0
*sntpReceiveTask: Jan 24 16:43:01.605: %SNTP-3-FATAL_ERROR_OCCURED: sntp_main.c:233 Fatal error: : unable to send NTP packet to ::ffff:86.80.166.233.
*sntpReceiveTask: Jan 24 16:42:59.605: %SNTP-3-FATAL_ERROR_OCCURED: sntp_main.c:233 Fatal error: : unable to send NTP packet to ::ffff:86.80.166.233.
*sntpReceiveTask: Jan 24 16:42:57.605: %SNTP-3-FATAL_ERROR_OCCURED: sntp_main.c:233 Fatal error: : unable to send NTP packet to ::ffff:86.80.166.233.
*nim_t: Jan 24 16:42:52.345: %SIM-3-PORT_UP: sim.c:13902 Physical port 1 is up!.
*cpuAclLogTask: Jan 24 16:42:52.168: %ACL-3-CPU_ACL_LOG_UCAPL_DISABLED: acl.c:1361 UCAPL disabled. CPU ACL hits will not be logged.
*bcastDataTask: Jan 24 16:42:45.571: %APF-3-INVALID_MCAST_MODE_ADDR: apf_net.c:5070 Received ipv6 capwap multicast packet source: (fe80::3aed:18ff:fe50:b240) destination: (::) whencapwap multicast mode is multicast with unconfigured ipv6 address.
*fp_main_task: Jan 24 16:42:33.953: %CNFGR-3-INV_COMP_ID: cnfgr.c:4138 Invalid Component Id : Unrecognized (45) in cfgConfiguratorInit.

Re: WLC2504 Access Point not joining

Mark Elsen — Tue, 24 Jan 2023 16:02:07 GMT

- Probably the config ap cert-expiry-ignore mic enable , is the most important one, in this case the ipv6 messages can be ignored since it was disabled too ,

Re: WLC2504 Access Point not joining

Niels van Strien — Tue, 24 Jan 2023 16:08:38 GMT

Thank you so much for your help. Will there be a software update made available in which these certificates have been renewed?

Kind regards,

Niels van Strien

Re: WLC2504 Access Point not joining

Mark Elsen — Tue, 24 Jan 2023 17:11:46 GMT

- No because that is a built-in certificate on the access point , hence they provided the config ap cert-expiry-ignore mic enable , command as a workaround ,

Re: WLC2504 Access Point not joining

Rich R — Tue, 12 Dec 2023 10:45:21 GMT

Make sure you're familiar with the details of all the field notices mentioned in my signature below. There's another certificate issue which will come into play after 4th December 2022 if you try download software to any APs using that old code - fixed in 8.10.190.0 (and later) or 8.5.182.11. Obviously you can't upgrade to 8.10.190.0 on 2504 or with 3602 APs so you'll have to upgrade to the special escalation image 8.5.182.11 if you have that problem (link below).

Re: WLC2504 Access Point not joining

Niels van Strien — Fri, 27 Jan 2023 11:40:32 GMT

Hello Rich,

Thanks for your helpful addition. I think I should update the software to 8.5.182.7 to be sure all will continue to work. How can I obtain 8.5.182.7 - I don't have an active software license, nor do I see it listed on the downloads.

Kind regards,

Niels

Re: WLC2504 Access Point not joining

Rich R — Fri, 27 Jan 2023 11:59:11 GMT

The field notice https://www.cisco.com/c/en/us/support/docs/field-notices/725/fn72524.html refers to https://www.cisco.com/c/en/us/support/docs/wireless/aironet-700-series-access-points/218447-ios-ap-image-download-fails-due-to-expir.html which in turn has the link to the AireOS software downloads https://software.cisco.com/download/specialrelease/8f166c6d88b9f77aabb63f78affa9749

Not sure whether you'll be able to access that without a contract but give it a try ...

Re: WLC2504 Access Point not joining

Niels van Strien — Fri, 27 Jan 2023 12:36:58 GMT

Thank you for the link. Unfortunately I cannot download the software (I am logged in, but have no active subscription). I wonder if this could qualify as a free update because of a security vulnerability?

Re: WLC2504 Access Point not joining

Mark Elsen — Fri, 27 Jan 2023 12:43:51 GMT

>...I wonder if this could qualify as a free update because of a security vulnerability?
You need to contact TAC , they are usually rather 'forgiving' if you make the security argument(s) ,

Re: WLC2504 Access Point not joining

Rich R — Fri, 27 Jan 2023 14:11:18 GMT

Yes find a recent security advisory that affects 8.5 code and find the section which says "Customers without Contracts" then email TAC (don't phone) quoting the URL of the advisory, the paragraph just mentioned and the version and URL for the software you want to download. You'll have to mention which platform you need it for (2504) because they have all of them there at that URL. Then TAC should publish it to you directly. They might also ask you for WLC serial number.

This one should be suitable: Cisco Wireless LAN Controller AireOS Software FIPS Mode Denial of Service Vulnerability because CSCwa40778 : Bug Search Tool (cisco.com) lists 8.5.182.7 as a fixed release so spot on. (even though the advisory itself says upgrade to 8.10)

"Customers Without Service Contracts

Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade."