topic Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508 in Wireless

1542 fails to attach to 9800 (AP auth fail) after moving from 5508

David Ritter — Wed, 21 Feb 2024 15:44:39 GMT

I have 2 1542i's that I reassigned from a 5508 to my 9800.

while I do have MAC auth for the ap's in the 5508, I did not enter such on the 9800 and don't rightly know where I would do that.

so why did only 1 ap fail instead of 2

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

Mark Elsen — Wed, 21 Feb 2024 16:06:53 GMT

- Start without MAC based authentication for the APs on the 9800 controller ; can they join then ?

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

Leo Laohoo — Wed, 21 Feb 2024 21:59:53 GMT

What firmware is the 5508 on?

Maybe the 1540 is not joining because of expired certificate that would prevent the AP from finish downloading the firmware from the 9800.

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

David Ritter — Wed, 21 Feb 2024 23:13:57 GMT

the outdoor class 1542's required mac auth on airos, were on 8.5.182.7 (answers Leo's question) aok.

moved to the 9800 on 17.9.4a and only 1 attached. the failed unit was reported as auth failure and was moved back to the 5508, no issue.

I'm, pushing the problem child the the 5520 on 8.10.185.0. At this point I don't suspect a cert issue.

I know how to do AP mac auth in airos.. but not clear on the sequence for the 9800.

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

David Ritter — Thu, 22 Feb 2024 04:39:38 GMT

The saga continues. Leo, I would expect an expired cert to also block the association to the 5520.

That being said, I am logged on to the AP and changing the primary-base target between 5520 and the 9800. as the primary object was to get the ap off the 5508, mission is accomplished. I did find a location to enter the AP mac ; Configuration, wireless, Access Points, AP Certificate Policy: Authorize Aps joining with MIC and add the mac.. but still no joy.

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

Leo Laohoo — Thu, 22 Feb 2024 10:01:15 GMT

Console into the AP and reboot it.
Post the entire boot-up process and attempts to join the 9800. IF there are expired certificates, it will show up in the AP log.

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

Mark Elsen — Thu, 22 Feb 2024 10:33:06 GMT

>...I know how to do AP mac auth in airos.. but not clear on the sequence for the 9800.
Check this documentation : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213916-catalyst-9800-wireless-controllers-ap-au.html

After the 9800 controller has been configured accordingly , have a checkup of it's configuration using the CLI command
show tech wireless and feed the output into Wireless Config Analyzer

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

Rich R — Thu, 22 Feb 2024 14:49:26 GMT

Maybe you already have "config ap cert-expiry-ignore mic enable" configured on the 5508 and 5520 but you're missing the equivalent config on the 9800?

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

David Ritter — Thu, 22 Feb 2024 16:46:21 GMT

um, well yes. Had a bunch of x700's on them. I have a 3rd 1542 that has yet to be deployed. testing now.

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

aaronbrown — Wed, 29 May 2024 18:14:45 GMT

Hey David,

We are having the exact same problem migrating a 2702 from our 5508 to a 9800. We've successfully migrated about 10 other AP's (various models including 2702's) without a problem. Were you able to find a fix?

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

David Ritter — Wed, 29 May 2024 18:37:06 GMT

Wave 1 AP's were supported in 16.x and 17.3 code but remove above that. However due to popular demand, they were returned in 17.9.3 and above.

That being said, the x702 series did experience cert expiration back in 22 and require temporary date reset.

My Wave1 aps work fine on 17.9.4a

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

David Ritter — Wed, 29 May 2024 18:41:23 GMT

some where along the way I missed a tidbit.

the working 1542 was in Local mode while the failing units were in mesh mode. Upon switching to local all was well. However, it seems that the unit at the landfill was really failing because there be no DHCP on the local segment. As the network is being extended to another building, at which time DHCP will be established the AP remains in limbo.

Thank you all

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

Rich R — Thu, 30 May 2024 16:28:56 GMT

Hi @aaronbrown it depends what version of code is installed on the APs.
There are some major changes to the CAPWAP protocol in recent 9800 code which are not compatible with older AireOS code. You either need to migrate the APs to an intermediate version which supports the CAPWAP changes or pre-install the correct image on the APs.
What version is the 5508 running?
What version is the 9800 which you are migrating to running?
Have you checked the complete console logs of a failing 2702 from power on? Attach here as a .txt file. That should help diagnose the issue.

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

aaronbrown — Thu, 30 May 2024 17:03:14 GMT

Thank you for the reply on this. It looks like the Bridge\Mesh mode on the AP is the culprit. After moving it local mode, and performing a factory reset (we had tried factory resets previously) seemed to clear the issue.

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

Rich R — Thu, 30 May 2024 17:14:43 GMT

Ah well that's the same issue David had already mentioned so assumed you had checked that.

If an AP is in bridge mode then you must configure AP authorisation of the AP MAC address on the WLC for it to be able to join. No doubt you had already done this on the 5508 but not on 9800. The quick and easy fix (as you mentioned) is to change the AP to local mode if mesh is not required.

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

JamesSbt — Thu, 10 Jul 2025 12:26:01 GMT

Mesh issues are a bug - two hours of my life i'm not getting back.

you enter the mac on the AAA-Advanced AAA-Device Auth

www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215100-join-mesh-aps-to-catalyst-9800-wireless.html

... if any mac address delimiters like '.', ':' or '-' are added, the AP is not able to join...

Cisco bug ID CSCvv43870 and Cisco bug ID CSCvr07920.

Re: 1542 fails to attach to 9800 (AP auth fail) after moving from 5508

Rich R — Thu, 10 Jul 2025 14:22:18 GMT

Correct - MAC address must be lower case only, no punctuation/spaces/separators.
That is the only way you will get it to match.
This has already been covered on this forum a number of times before.