topic Re: DTLS connection not found in Wireless

DTLS connection not found

kingstdz — Mon, 13 Feb 2023 07:59:41 GMT

i have cisco WLC 4400 linked to sw 4500, WLC is up and SW, AP cant join the WLC, debug on WLC give

how i can fix that, WLC is set to net server of WS linked to.

*spamReceiveTask: Feb 12 08:48:41.017: 00:3a:98:77:fb:70 No entry exists for AP
*spamReceiveTask: Feb 12 08:48:41.017: 00:3a:98:77:fb:70 No AP entry exist in temporary database for
*spamReceiveTask: Feb 12 08:48:50.195: 00:3a:98:7c:ee:c0 DTLS connection not found, creating new connection for

*spamReceiveTask: Feb 12 08:48:50.313: 00:3a:98:7c:ee:c0 DTLS connection closed event receivedserver
*spamReceiveTask: Feb 12 08:48:50.313: 00:3a:98:7c:ee:c0 No entry exists for AP
*spamReceiveTask: Feb 12 08:48:50.313: 00:3a:98:7c:ee:c0 No AP entry exist in temporary database for
*spamReceiveTask: Feb 12 08:48:52.700: 00:3a:98:72:69:00 DTLS connection not found, creating new connection for

Re: DTLS connection not found

balaji.bandi — Sun, 12 Feb 2023 09:46:47 GMT

Need to provide more information here :

1. what model of AP ?

2. what Code running on WLC ?

3. is there any AP working, none of the AP works ?

4. can you connect the console to AP and check what logs you getting (pos the logs here)

5. provide below information and enable debug:

>show license in-use

>show sysinfo

>debug capwap events enable

>debug capwap packet enable

>debug capwap errors enable

>debug capwap detail enable

Re: DTLS connection not found

Leo Laohoo — Sun, 12 Feb 2023 09:57:00 GMT

FN - 63942 - Wireless Lightweight Access Points and WLAN Controllers Fail to Create CAPWAP Connections Due to Certificate Expiration

Re: DTLS connection not found

Rich R — Sun, 12 Feb 2023 14:28:25 GMT

As @balaji.bandi says need more info but very likely the problem is expired certificate as per the FN link which @Leo Laohoo shared. You must follow all the steps in the field notice, in the correct order, to permanently resolve the issue. My summary from numerous previous posts:

Read this field notice through very carefully (twice if necessary) then follow all the instructions carefully in the right order:
https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html
I'll summarise it for the umpteenth time:
1. Upgrade to the latest version which supports your APs and WLC - probably 8.5.182.7
https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc10
2. Apply the config workaround on the WLC
3. Disable WLC NTP and set time manually to before your certs expired
4. Allow all the APs to join, download new code, pick up the config workaround
5 Re-enable NTP
Note that it could be AP and/or WLC certs which have expired.

You should also make yourself aware of the other field notices and alerts mentioned in my signature below:

Re: DTLS connection not found

kingstdz — Sun, 12 Feb 2023 14:55:33 GMT

thanks for reply

how i can fix that cert, cert is localy wlc, i enabled web mode but i cant access web interface to generate other cert please show me how to.

ap 1100, 1242,1300, and 2600 LAP

thanks

Re: DTLS connection not found

kingstdz — Sun, 12 Feb 2023 14:59:47 GMT

1. what model of AP ? AP1100, 1300,1242 and 2600

3. is there any AP working, none of the AP works ? no

i give other as soon as

Re: DTLS connection not found

Scott Fella — Sun, 12 Feb 2023 15:18:54 GMT

The WLC 4400 is very very old and also the last code release is 7.4.x. I really would look at migrating to another model that can support your ap's or maybe its time for a full uplift. It's amazing that you controller and some of your ap's are still functioning.

Re: DTLS connection not found

kingstdz — Sun, 12 Feb 2023 15:46:23 GMT

in certifcate

Name:
bsnSslWebadminCert
Type:
Locally Generated
Serial Number:
1332271936
Valid:
From 2020 Mar 25th, 00:00:01 GMT Until 2030 Mar 25th, 00:00:01 GMT
Subject Name:
C=US, O=Cisco Systems Inc., OU=DeviceSSL (WebAdmin), CN=
Issuer Name:
C=US, O=Cisco Systems Inc., OU=DeviceSSL (WebAdmin), CN=
MD5 Fingerprint:
4f:f1:4a:9b:06:44:31:1b:e2:08:83:ca:54:85:b9:99
SHA1 Fingerprint:
3b:ba:82:7f:f3:32:c6:00:9f:dd:aa:16:45:73:bd:a2:1f:fe:d9:80
Download SSL Certificate *
* Controller must be rebooted for the new certificate to take effect.

Re: DTLS connection not found

kingstdz — Sun, 12 Feb 2023 16:13:48 GMT

log from AP

*Feb 12 15:09:18.115: %DTLS-3-BAD_RECORD: Erroneous record received from X.X.X.X: Malformed Certificate
*Feb 12 15:09:18.115: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to X.X.X.X:5246
*Feb 12 15:09:18.116: %CAPWAP-3-ERRORLOG: Invalid event 38 & state 3 combination.
*Feb 12 15:10:22.084: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
*Feb 12 15:10:22.084: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY
*Feb 12 15:10:22.134: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to administratively down
*Feb 12 15:10:22.134: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to administratively down
*Feb 12 15:10:22.135: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Feb 12 15:10:22.165: status of voice_diag_test from WLC is false
*Feb 12 15:10:22.166: %LINK-3-UPDOWN: Interface Dot11Radio1, changed state to up
*Feb 12 15:10:22.167: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to down
*Feb 12 15:10:22.173: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Feb 12 15:10:22.199: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Feb 12 15:10:32.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: X.X.X.X peer_port: 5246
*Feb 12 15:10:32.001: %CAPWAP-5-CHANGED: CAPWAP changed state to
*Feb 12 15:10:32.116: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed. The certificate (SN: 70D0C3120000001E93A6) has expired. Validity period ended on 01:12:55 UTC Feb 6 2020
*Feb 12 15:10:32.118: %LWAPP-3-CLIENTERRORLOG: Peer certificate verification failed
*Feb 12 15:10:32.118: %CAPWAP-3-ERRORLOG: Certificate verification failed!
*Feb 12 15:10:32.118: DTLS_CLIENT_ERROR: ../capwap/capwap_wtp_dtls.c:352 Certificate verified failed!
*Feb 12 15:10:32.118: %DTLS-4-BAD_CERT: Certificate verification failed. Peer IP: X.X.X.X
*Feb 12 15:10:32.118: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to X.X.X.X:5246
*Feb 12 15:10:32.119: %DTLS-3-BAD_RECORD: Erroneous record received from X.X.X.X: Malformed Certificate
*Feb 12 15:10:32.119: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to X.X.X.X:5246

Re: DTLS connection not found

kingstdz — Sun, 12 Feb 2023 16:55:26 GMT

Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 7.0.240.0
RTOS Version..................................... 7.0.240.0
Bootloader Version............................... 4.2.205.0
Emergency Image Version.......................... N/A
Build Type....................................... DATA + WPS

System Name...................................... WLCpruebas
System Location..................................
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.14179.1.1.4.3

Re: DTLS connection not found

kingstdz — Sun, 12 Feb 2023 17:47:35 GMT

on ap

sh crypto pki certificates
CA Certificate
Status: Available
Certificate Serial Number: 00
Certificate Usage: General Purpose
Issuer:
ea=support@airespace.com
cn=ca
ou=none
o=airespace Inc
l=San Jose
st=California
c=US
Subject:
ea=support@airespace.com
cn=ca
ou=none
o=airespace Inc
l=San Jose
st=California
c=US
Validity Date:
start date: 23:38:55 UTC Feb 12 2003
end date: 23:38:55 UTC Nov 11 2012

Re: DTLS connection not found

balaji.bandi — Sun, 12 Feb 2023 17:50:57 GMT

PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed. The certificate (SN: 70D0C3120000001E93A6) has expired. Validity period ended on 01:12:55 UTC Feb 6 2020

then make sense to use the Field notice URL suggested :

https://www.cisco.com/c/en/us/support/docs/field-notices/725/fn72524.html

https://www.cisco.com/c/en/us/support/docs/wireless/aironet-700-series-access-points/218447-ios-ap-image-download-fails-due-to-expir.html

On the WLC check

> show certificate all

For testing :

> config time ntp delete 1
> config time manual  mm/dd/yy HH:mm:sec   ( see if that fix the issue - not recomended in production)

EDIT :

your version of code too old try to uplift to latest supported version.

Re: DTLS connection not found

balaji.bandi — Sun, 12 Feb 2023 17:52:25 GMT

Validity Date:
start date: 23:38:55 UTC Feb 12 2003
end date: 23:38:55 UTC Nov 11 2012

update as suggested URL.

Re: DTLS connection not found

Mark Elsen — Sun, 12 Feb 2023 17:53:26 GMT

>...end date: 23:38:55 UTC Nov 11 2012
- As mentioned by Leo : https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html , the controller version is very old too, counter measures as described in FN are available from 8.3

Re: DTLS connection not found

kingstdz — Sun, 12 Feb 2023 18:30:00 GMT

thanks

any way to bypass certification WLC ---AP Policy??

Re: DTLS connection not found

balaji.bandi — Sun, 12 Feb 2023 18:36:44 GMT

Read through the post, there are several suggestions provided.

Re: DTLS connection not found

kingstdz — Sun, 12 Feb 2023 18:56:35 GMT

hi please can i bypass certificate (AP policy add mac AP???) thanks

Re: DTLS connection not found

Rich R — Sun, 12 Feb 2023 19:22:54 GMT

READ the replies already provided!

Re: DTLS connection not found

kingstdz — Sun, 12 Feb 2023 19:50:55 GMT

hi i have set ap polici accept lsc and authorized lsc

and set time to before 2020 (example 2019)

AP join the WLC but disconnect and reconnect how to fix that?

Re: DTLS connection not found

Rich R — Sun, 12 Feb 2023 20:13:42 GMT

Unfortunately you're running very old and unsupported WLC, APs and software - so you could be encountering any one of thousands of bugs that got fixed years ago.
Also remember some AP certificates expired even before 2020.
If you provide specific details of the symptoms you're seeing (meaning actual console logs from the AP and logs from WLC) we *might* be able to help.

This should serve as a reminder that you need to replace all that equipment with modern equipment which can be supported.