topic Re: AP NOT Joined in Wireless

AP NOT Joined

antonioxud80 — Mon, 05 Jul 2021 19:50:18 GMT

Good Evening,

I have a problem with a cisco 5508 controller, no ap are unable to connect.

*spamApTask2: Nov 27 18:14:50.099: 00:5f:86:1e:66:e0 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 100, joined Aps =0
*spamApTask2: Nov 27 18:14:50.099: 00:5f:86:1e:66:e0 Primary Discovery Response sent to 10.40.94.199:15203

*spamApTask6: Nov 27 18:14:50.249: c4:0a:cb:5c:7a:90 Primary Discovery Request from 10.40.94.114:48716

*spamApTask6: Nov 27 18:14:50.249: c4:0a:cb:5c:7a:90 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 100, joined Aps =0
*spamApTask6: Nov 27 18:14:50.250: c4:0a:cb:5c:7a:90 Primary Discovery Response sent to 10.40.94.114:48716

*spamApTask6: Nov 27 18:14:50.250: c4:0a:cb:5c:7a:90 Primary Discovery Request from 10.40.94.114:48716

*spamApTask6: Nov 27 18:14:50.250: c4:0a:cb:5c:7a:90 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 100, joined Aps =0
*spamApTask6: Nov 27 18:14:50.250: c4:0a:cb:5c:7a:90 Primary Discovery Response sent to 10.40.94.114:48716

*spamApTask4: Nov 27 18:14:50.251: c4:0a:cb:2d:c3:d0 Primary Discovery Request from 10.40.94.59:1321

Do you have any suggestions?

many thanks

Regards Antonio

Re: AP NOT Joined

balaji.bandi — Fri, 27 Nov 2020 17:53:14 GMT

What is the model of the AP ? - what Code WLC running here ?

is this new Setup or working one broken.

Connect the console to AP, post complete boot log to understand the issue.

Re: AP NOT Joined

ajc — Fri, 27 Nov 2020 17:55:52 GMT

Check this links and run a debug. Post the results/output of the debug.

https://community.cisco.com/t5/wireless/ap-can-t-join-dtls-connection-closed-by-controller/td-p/1871401

https://community.cisco.com/t5/wireless/wlc-and-ap/td-p/1912477

Re: AP NOT Joined

MHM Cisco World — Fri, 27 Nov 2020 18:48:02 GMT

do you use DHCP WLC discovery, i.e. you specify the IP address of WLC in DHCP Server?
do you config AP-mangamer as management IP? are they in same Subnet?
Make sure the AP can connect to both management IP and AP-manger of WLC, i.e. check the routing from AP to WLC.
NOTE:- if this is new AP join then make sure the MASTER mode is enable under WLC.

Re: AP NOT Joined

antonioxud80 — Fri, 27 Nov 2020 19:01:49 GMT

HI MHM Cisco Wold,

I use static Ip address on the controller.

The Aps and the controller are in the same subnet.

Sorry I foget to mention that in my infrastrcuture there are 3 controllers Cisco 5508 with 100 licenses on each.In total I have 230 APS, 200 are working without problems on the first 2 controllers. On the third one i should have abot 30 APs, but i cannot see them.

thanks

Re: AP NOT Joined

MHM Cisco World — Fri, 27 Nov 2020 19:23:02 GMT

master mode disable on the two full and make master enable for third with empty AP join list.
the AP receive discovery from the three WLC and send join to wrong one.
try this method and check the AP join.
after AP join disable Master mode.

Re: AP NOT Joined

antonioxud80 — Fri, 27 Nov 2020 19:22:05 GMT

Cisco Controller) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 7.4.121.0
Bootloader Version............................... 1.0.1
Field Recovery Image Version..................... 6.0.182.0
Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
Build Type....................................... DATA + WPS

System Name...................................... WLC-3
System Location..................................
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.9.1.1069
Redundancy Mode.................................. Disabled
IP Address....................................... 10.40.92.9
Last Reset....................................... Software reset
System Up Time................................... 0 days 21 hrs 22 mins 46 secs
System Timezone Location.........................
System Stats Realtime Interval................... 5
System Stats Normal Interval..................... 180

Configured Country............................... Multiple Countries:IT,US
Operating Environment............................ Commercial (0 to 40 C)

--More-- or (q)uit
Internal Temp Alarm Limits....................... 0 to 65 C
Internal Temperature............................. +40 C
External Temperature............................. +31 C
Fan Status....................................... OK

State of 802.11b Network......................... Enabled
State of 802.11a Network......................... Enabled
Number of WLANs.................................. 6
Number of Active Clients......................... 0

Memory Current Usage............................. Unknown
Memory Average Usage............................. Unknown
CPU Current Usage................................ Unknown
CPU Average Usage................................ Unknown

Burned-in MAC Address............................ 68:EF:BD:94:0C:A0
Power Supply 1................................... Present, OK
Power Supply 2................................... Absent
Maximum number of APs supported.................. 100

AP models: AIR-LAP1142N-E-K9 and AIR-CAP2602I-E-K9

thanks

Re: AP NOT Joined

ajc — Fri, 27 Nov 2020 20:06:17 GMT

after validation, you are running the right country code.

Re: AP NOT Joined

antonioxud80 — Fri, 27 Nov 2020 19:43:34 GMT

I checked all three controllers, none have this option enabled. Now I have enabled this option on the controller number 3 which does not recognize the Ap, for the moment nothing has changed

Re: AP NOT Joined

ajc — Fri, 27 Nov 2020 19:59:50 GMT

I see you have configured IT (Italy) and US (United States) as countries

Re: AP NOT Joined

Scott Fella — Fri, 27 Nov 2020 19:57:28 GMT

You sure you have license activated? If you can’t get one ap to join, it seems like you might have some issue with that controller. Make sure the time, country code is set on that controller.

Re: AP NOT Joined

antonioxud80 — Fri, 27 Nov 2020 19:58:00 GMT

all three controllers are configured with county IT and US
two work without any problems, but on the third controller there are no APs

I know the iOS version is very old, but it has been running smoothly for a few years and then right now I can't change it.

thanks

Re: AP NOT Joined

antonioxud80 — Fri, 27 Nov 2020 20:10:00 GMT

debug capwap errors enable

spamApTask1: Nov 27 21:04:21.019: 00:f2:8b:10:57:1b Deleting AP 10.40.94.207 which has not been plumbed
*spamApTask1: Nov 27 21:04:21.023: 00:f2:8b:10:57:1b DTLS connection was closed
*spamApTask1: Nov 27 21:04:21.023: 00:f2:8b:10:57:1b Discarding non-ClientHello Handshake OR DTLS encrypted packet from 10.40.94.207:1394)since DTLS session is not established

*spamApTask1: Nov 27 21:04:21.023: 00:f2:8b:10:57:1b DTLS connection closed event receivedserver (10:40:92:9/5246) client (10:40:94:207/1394)
*spamApTask1: Nov 27 21:04:21.024: 00:f2:8b:10:57:1b No entry exists for AP (10:40:94:207/1394)
*spamApTask1: Nov 27 21:04:21.024: 00:f2:8b:10:57:1b No AP entry exist in temporary database for 10.40.94.207:1394
*spamApTask5: Nov 27 21:04:21.074: 28:94:0f:05:cd:a6 DTLS connection not found, creating new connection for 10:40:94:137 (23772) 10:40:92:9 (5246)

*spamApTask5: Nov 27 21:04:21.216: 28:94:0f:05:cd:a6 Deleting AP 10.40.94.137 which has not been plumbed
*spamApTask5: Nov 27 21:04:21.220: 28:94:0f:05:cd:a6 DTLS connection was closed
*spamApTask5: Nov 27 21:04:21.220: 28:94:0f:05:cd:a6 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 10.40.94.137:23772)since DTLS session is not established

debug capwap errors enable

*spamApTask2: Nov 27 21:07:33.677: c4:64:13:00:53:c5 Deleting AP 10.40.94.165 which has not been plumbed
*spamApTask2: Nov 27 21:07:33.682: c4:64:13:00:53:c5 DTLS connection was closed
*spamApTask2: Nov 27 21:07:33.682: c4:64:13:00:53:c5 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 10.40.94.165:1341)since DTLS session is not established

*spamApTask1: Nov 27 21:07:34.274: c4:64:13:00:53:95 Deleting AP 10.40.94.38 which has not been plumbed
*spamApTask1: Nov 27 21:07:34.278: c4:64:13:00:53:95 DTLS connection was closed
*spamApTask1: Nov 27 21:07:34.279: c4:64:13:00:53:95 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 10.40.94.38:1339)since DTLS session is not established

*spamApTask3: Nov 27 21:07:36.241: c4:64:13:11:40:25 Deleting AP 10.40.94.47 which has not been plumbed
*spamApTask3: Nov 27 21:07:36.246: c4:64:13:11:40:25 DTLS connection was closed
*spamApTask3: Nov 27 21:07:36.246: c4:64:13:11:40:25 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 10.40.94.47:5124)since DTLS session is not established

*spamApTask1: Nov 27 21:07:36.310: 00:3a:7d:83:af:ff Deleting AP 10.40.94.224 which has not been plumbed
*spamApTask1: Nov 27 21:07:36.315: 00:3a:7d:83:af:ff DTLS connection was closed
*spamApTask1: Nov 27 21:07:36.315: 00:3a:7d:83:af:ff Discarding non-ClientHello Handshake OR DTLS encrypted packet from 10.40.94.224:15105)since DTLS session is not established

*spamApTask2: Nov 27 21:07:36.591: 00:f2:8b:10:58:77 Deleting AP 10.40.94.201 which has not been plumbed
*spamApTask2: Nov 27 21:07:36.595: 00:f2:8b:10:58:77 DTLS connection was closed
*spamApTask2: Nov 27 21:07:36.596: 00:f2:8b:10:58:77 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 10.40.94.201:1417)since DTLS session is not established

Re: AP NOT Joined

MHM Cisco World — Fri, 27 Nov 2020 20:19:32 GMT

first check the time/date in WLC
what type of AP auth, is it MIC with authorize local ?

Re: AP NOT Joined

ajc — Fri, 27 Nov 2020 20:13:30 GMT

CHECK for MIC expiration date on those AP's and ALSO on your WLC's. I have recently ISSUES on BOTH sides regarding certificate expiration. Let me provide you the commands for verification on the WLC and AP's since that you are running OLD WLC's and OLD AP's

Re: AP NOT Joined

ajc — Fri, 27 Nov 2020 20:15:17 GMT

On the AP side, privilege mode, run this

AP_CLI#sh crypto pki certificates

AND look for the section of the certificate,

Certificate
Status: Available
Certificate Serial Number: 728AF4350000001E4C89
Certificate Usage: General Purpose
Issuer:
cn=Cisco Manufacturing CA
o=Cisco Systems
Subject:
Name: C1130-001c58b5b3a4
ea=support@cisco.com
cn=C1130-001c58b5b3a4
o=Cisco Systems
l=San Jose
st=California
c=US
CRL Distribution Points:
http://www.cisco.com/security/crl/cmca.crl
Validity Date:
start date: 04:22:10 UTC Jul 11 2007
end date: 04:32:10 UTC Jul 11 2017
Associated Trustpoints: Cisco_IOS_MIC_cert

AP_CLI >show auth-list
...
AP with Self-Signed Certificate................ yes
...

All AP SSC's have an expiration date of January 1st, 2020.

Re: AP NOT Joined

ajc — Fri, 27 Nov 2020 20:15:55 GMT

On the WLC side:

WLC_CLI: show certificate all

Certificate Name: Cisco SHA1 device cert
Subject Name :
C=US, ST=California, L=San Jose, O=Cisco Systems, CN=AIR-CT2504-K9-d0c282d65a20, MAILTO=support@cisco.com
Issuer Name :
O=Cisco Systems, CN=Cisco Manufacturing CA
Serial Number :
454384735992863371807890
Validity :
Start : 2011 Jul 26th, 20:17:17 GMT
End : 2021 Jul 26th, 20:27:17 GMT
Signature Algorithm :
rsa-pkcs1-sha1
Hash key :
SHA1 Fingerprint : 98:89:eb:12:2a:98:bc:fe:ad:5b:8f:23:63:0f:47:d1:36:ce:f5:be
MD5 Fingerprint : ba:f3:98:9a:cd:f8:01:08:84:b8:66:3c:6a:6c:d3:05

Re: AP NOT Joined

antonioxud80 — Fri, 27 Nov 2020 20:15:58 GMT

Hi Scott,

I checked the licenses, Time, country and everything is the same as the controllers working

thanks

Re: AP NOT Joined

ajc — Fri, 27 Nov 2020 20:18:07 GMT

This link helps

https://community.cisco.com/t5/wireless-mobility-documents/lightweight-ap-fail-to-create-capwap-lwapp-connection-due-to/ta-p/3155111

I had to disable on the WLC side the Certificate Verification of the AP's with expired one. For the WLC the situation is worse because we HAD to migrate the AP's from the 5508 WLC with certificate expired to another 8510 WLC. I have something to do now, I will provide you the command to ignore the AP certificate validation later.

Re: AP NOT Joined

ajc — Fri, 27 Nov 2020 20:48:03 GMT

More information:

http://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn80mr2.html#pgfId-1286693

Cisco Lightweight Access Points that were manufactured over 10 years ago may fail to create a CAPWAP or LWAPP connection due to certificate expiration. You may allow the Access Points with Manufactured Installed Certificates (MICs) or Self-signed Certificates (SSCs) beyond their expiration date to associate with Cisco WLC.

On Cisco WLCs, the AP lifetime-check parameter (MEANS AP CERTIFICATE EXPIRATION DATE VALIDATION) is enabled by default. We recommend that you configure the Cisco WLC to ignore the expiration date on the APs’ MICs and SSCs by entering this command:

(Cisco Controller) >config ap cert-expiry-ignore {mic | ssc} enable

When the config ap cert-expiry-ignore { mic | ssc } enable command is entered, Cisco WLC ignores the expiration date on the APs' MICs or SSCs, allowing APs or Cisco WLCs with certificates that are more than 10 years old to connect with each other. The AP lifetime-check parameter must remain enabled as long as APs with expired MICs or SSCs are managed by this Cisco WLC.

You can see the configuration state by entering this command:

(Cisco Controller) >show certificate summary

Web Administration Certificate................... 3rd Party

Web Authentication Certificate................... Locally Generated

Certificate compatibility mode:.................. off

Lifetime Check for MIC.......................... Enable

Lifetime Check for SSC.......................... Enable