topic Re: Relocate the existing Controller or setup a new controller in Wireless

Relocate the existing Controller or setup a new controller

gamane — Mon, 15 May 2023 02:33:05 GMT

Hi Everyone,

We have an existing Wireless Controller(AIR-CT5508-K9) in one of our Data center and this controller services 60 AP spreadout accross six different sites/ offices.

Note that the existing data center where the controller is located will be decomisionned so we are planning to relocate the existing controller or setup a new controller..

Question number 1: If we are to set up a another controller fron a new data center then copy the config from the existing controller then migrate the APs one by one to new controller, would this be feasible?

Question number 2: How long APs can function controller less?

Thanks,

gamane

Re: Relocate the existing Controller or setup a new controller

Mark Elsen — Mon, 15 May 2023 07:03:15 GMT

Q1 : Is feasible , but if possible don't migrate the existing controller , the 5508 platform is old , look at the 9800 based platform(s) and or solutions
Q2 : If they are in CAPWAP (client) mode , then they can not work without a controller,

Re: Relocate the existing Controller or setup a new controller

Rich R — Mon, 15 May 2023 14:22:18 GMT

I'll add to that - there's really not enough information to answer Q2 properly.

For example if the APs are in flexconnect mode and using local switching and local authentication then they can probably keep working in standalone mode. If they're not then the degree of impact really depends on the exact design and configuration. If everything gets tunnelled back to the WLC over CAPWAP then you'll lose it all as soon as they lose connection to the WLC.

This doc is old but will give you some idea what I'm talking about:
https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/112042-technote-wlc-00.html#toc-hId-961437047

Re: Relocate the existing Controller or setup a new controller

gamane — Wed, 24 May 2023 07:51:21 GMT

Hi @Mark Elsen @Rich R I really appreciate all your time in answering my questions. I do have some follow up inquiries and I hope you can provide some feedback as well.

1. How do I check if the APs are in flex connect mode or CAPWAP mdoe?
2. We are bringing up a second controller on a different ip address? Is it possible to migrate the APs one by one? 3. Any issues anyone can think of other than connectivity.

Regards,

gamane

Re: Relocate the existing Controller or setup a new controller

Mark Elsen — Wed, 24 May 2023 08:24:52 GMT

>...1. How do I check if the APs are in flex connect mode or CAPWAP mode?
That is defined in the AP settings in the controller configuration pages

>...Is it possible to migrate the APs one by one?
If DHCP option 43 is used to point to the designate controller for the AP then you can change that per access point (e.g.)

>...(bringing up second controller) Any issues anyone can think of other than connectivity.
It is for instance strongly advised to run a configuration check on the new controller , before production release , with this procedure : https://community.cisco.com/t5/networking-knowledge-base/show-the-complete-configuration-without-breaks-pauses-on-cisco/ta-p/3115114#toc-hId-1039672820 , have the output analyzed with https://cway.cisco.com/wireless-config-analyzer/ , if the new controller is a 9800 based model then use the command show tech wireless instead as input for WirelessAnalyzer ,

Re: Relocate the existing Controller or setup a new controller

Rich R — Wed, 24 May 2023 09:07:04 GMT

1. "show ap mode local" and "show ap mode flexconnect"

2. Option 43 if you have them on different subnets - easily achieved by simply moving the AP switch port to a new VLAN, or manually edit the primary/secondary controllers on the AP HA tab (that will override anything it learns from option 43) - can also be done from CLI with "config ap primary-base <wlc-name> <ap-name> <wlc-IP>" and "config ap secondary-base <wlc-name> <ap-name> <wlc-IP>" When changing the AP HA setting it should take effect sometime within the ap-primary-discovery-timeout time (default value is 120 seconds/2 minutes) which is how often the AP should check for the configured primary.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/ap_connectivity_to_cisco_wlc.html?bookSearch=true#ID2960

Re: Relocate the existing Controller or setup a new controller

JPavonM — Wed, 24 May 2023 09:12:23 GMT

The quick way to check if AP mode is Flexconnect or not is to use this command on the CLI, if it returns "FlexConnect" then you are there:
grep include "AP Mode " "show ap config general <your_ap_name_here>"
Regarding issues when moving from legacy AireOS WLCs to new IOS-XE WLCs, there could be a lot, but always related to config traslation. One way would be to use the embedded conversion tool for an untrained admin on the new code, but this introduces a lot of weird configd, my recommendaton, do it manually, but then you would need to do lot of tests until having something that would be working.

Re: Relocate the existing Controller or setup a new controller

gamane — Wed, 31 May 2023 00:49:34 GMT

Hi @JPavonM @Mark Elsen @Rich R . Thanks again for the feedback.
I am also trying to introduce another radius server for this existing controller, currently the radius server that is being used is for authenticating wireless users, but this radius server will be decommissioned soon, but we plan to replace that with a new one but it will be in a different location. Would you be able to share the instructions on how we introduce a new radius server to the controller and how to test it with the existing wlan ?

Re: Relocate the existing Controller or setup a new controller

JPavonM — Wed, 31 May 2023 05:30:16 GMT

The best way to test this is to create a new WLAN profile with the same specs than the production one but different ID, assign this to an AP group where your test AP would be, and try to connect.

If that works, then you ar ready to swap the AAA server in the production WLAN.

Re: Relocate the existing Controller or setup a new controller

gamane — Mon, 05 Jun 2023 10:32:43 GMT

Hi @JPavonM ,

I tried to use the new radius server but users were unable to connect and is giving them an error "can't connect to the network". I did ran a debug from the controller and it seems the request from the user was picked up by the controller. Controller then relayed the packet to Radius server for authentication but radius server sent an "Authentication failed" reply.

Below is a screenshot of the debug aaa all enable. I would appreciate if you could provide some thoughts or workarounds on this.

Re: Relocate the existing Controller or setup a new controller

JPavonM — Mon, 05 Jun 2023 12:31:32 GMT

To debug the authentication you need to look into RADIUS server logs, maybe wrong certificate selected, or wrong AD group, or wront EAP type.

Re: Relocate the existing Controller or setup a new controller

gamane — Tue, 06 Jun 2023 06:28:16 GMT

Thanks @JPavonM , I'll look into this.

Re: Relocate the existing Controller or setup a new controller

gamane — Tue, 06 Jun 2023 06:30:26 GMT

@JPavonM @Rich R @Mark Elsen . I've read an article where in to enable HA, both controllers redundancy port and redundancy management interfaces must be configured in the same subnet.

My question is, is it possible to have different subnets for redundancy port and redundancy management interfaces? This is because the secondary controller is located in another location..

Re: Relocate the existing Controller or setup a new controller

Rich R — Tue, 06 Jun 2023 10:32:08 GMT

What you've read is correct. It's not recommended to have them in separate locations but if you do (at your own risk, latency will be important) then you'll need layer 2 connectivity between them.
If you have them in separate locations then you should rather consider N+1 HA instead of HA SSO.

Re: Relocate the existing Controller or setup a new controller

gamane — Mon, 12 Jun 2023 06:11:04 GMT

@Rich R What if I will just set up another Controller hosted in a different location. Copy paste the configuration from the existing controller except it's IP address. Please note that the new controller will have the same connectivity to existing APs controlled by the existing controller. My question is;

1. Will it create an issue if the new Controller is powered up which has the same config(except the IP address) of the existing controller like for example, Access Points will start register to the new Controller?

2. How can I manually de-register the APs from the existing controller and re-register them to the new controller?

Thanks,

gamane

Re: Relocate the existing Controller or setup a new controller

Rich R — Mon, 12 Jun 2023 10:13:24 GMT

Basically, yes you can do that. That's really what N+1 HA is.

I've already answered your question about configuring the AP pri/sec above:
https://community.cisco.com/t5/wireless/relocate-the-existing-controller-or-setup-a-new-controller/m-p/4841752/highlight/true#M256250
If you want to move them you change the primary and secondary WLC setting on the AP then wait for it to move or reset it to force it straight away. If you want users to be able to roam properly between APs on both WLCs then you need mobility configured between the WLCs.

You probably need to read more about N+1 AP config:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85/ap_connectivity_to_cisco_wlc.html#backup-controllers

Re: Relocate the existing Controller or setup a new controller

gamane — Tue, 20 Jun 2023 13:50:41 GMT

@JPavonM @marce1000 @Rich R , Appreciate all your feedback from all my previous inquiries. Just a quick question though about this commands;

1. AP#capwap ap controller ip address x.x.x.x and
2. AP#capwap ap primary-base WLC x.x.x.x

Do both of this commands force an AP to join a controller? and whats the difference between the two commands?

Thanks,

gamane