topic Re: C9115 does not join to C9800 controller. in Wireless

C9115 does not join to C9800 controller.

my9774 — Mon, 27 May 2024 09:01:03 GMT

hello.

I am leaving an inquiry because the C9115 does not join the C9800 controller.
AP logs cannot be collected at this time.

It is connected to C9800, but it becomes separated from the controller again.

C9800 version : 17.13.1

Please understand that we only have C9800 logs.

*May 27 15:56:03.104: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac: XXXX Session-IP: 172.17.29.110[5255] 172.17.11.15[5246] Disjoined DTLS close alert from peer
*May 27 15:56:08.539: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac:XXXX Session-IP: 172.17.29.113[5267] 172.17.11.15[5246] Disjoined DTLS handshake failed
*May 27 15:56:15.916: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac:XXXX Session-IP: 172.17.29.118[5255] 172.17.11.15[5246] Disjoined DTLS handshake failed
*May 27 15:56:22.497: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac:XXXX Session-IP: 172.17.29.131[5255] 172.17.11.15[5246] Disjoined DTLS handshake failed
*May 27 15:56:33.627: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac:XXXX Session-IP: 172.17.29.109[5252] 172.17.11.15[5246] Disjoined DTLS handshake failed
*May 27 15:56:38.671: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac:XXXX Session-IP: 172.17.29.127[5270] 172.17.11.15[5246] Disjoined DTLS handshake expired
*May 27 15:56:48.926: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac:XXXX Session-IP: 172.17.29.121[5279] 172.17.11.15[5246] Disjoined DTLS handshake failed
*May 27 15:57:01.810: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac: Session-IP: 172.17.29.102[5253] 172.17.11.15[5246] Disjoined DTLS handshake failed
*May 27 15:57:12.335: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac: Session-IP: 172.17.29.106[5253] 172.17.11.15[5246] Disjoined DTLS handshake failed
*May 27 15:57:14.409: %LINEPROTO-5-UPDOWN: Line protocol on Interface TenGigabitEthernet0/1/1, changed state to down
*May 27 15:57:15.888: %PKI-3-CERTIFICATE_INVALID: Certificate chain validation has failed.
*May 27 15:57:16.121: %PKI-3-CERTIFICATE_INVALID: Certificate chain validation has failed.
*May 27 15:57:15.890: %CERT_MGR_ERRMSG-3-CERT_VALIDATION_ERR: Chassis 1 R0/0: wncd: Certificate Validation Error, Cert validation status:pki_ssl_status@pki_ssl_status:PKI_SSL_VERIFY_FAILURE
*May 27 15:57:15.890: %DTLS_TRACE_MSG-3-WLC_DTLS_ERR: Chassis 1 R0/0: wncd: DTLS Error, session:172.17.29.103[5252] MAC: XXXX, Certificate validation failed
*May 27 15:57:19.664: %CAPWAPAC_SMGR_TRACE_MESSAGE-5-AP_JOIN_DISJOIN: Chassis 1 R0/0: wncd: AP Event: AP Name: APXXXX Mac: Session-IP: 172.17.29.137[5259] 172.17.11.15[5246] Disjoined DTLS handshake failed
*May 27 15:57:24.354: %PKI-3-CERTIFICATE_INVALID: Certificate chain validation has failed.
*May 27 15:57:24.356: %CERT_MGR_ERRMSG-3-CERT_VALIDATION_ERR: Chassis 1 R0/0: wncd: Certificate Validation Error, Cert validation status:pki_ssl_status@pki_ssl_status:PKI_SSL_VERIFY_FAILURE
*May 27 15:57:24.356: %DTLS_TRACE_MSG-3-WLC_DTLS_ERR: Chassis 1 R0/0: wncd: DTLS Error, session:172.17.30.109[5257] MAC: XXXX, Certificate validation failed
*May 27 15:57:28.651: %PKI-3-CERTIFICATE_INVALID: Certificate chain validation has faile
WLC#

Re: C9115 does not join to C9800 controller.

Mark Elsen — Mon, 27 May 2024 09:21:07 GMT

- Have a checkup of the C9800 controller configuration with the CLI command show tech wireless and
feed the output from that into Wireless Config Analyzer

- Check logs on the AP too when that happens

- Check switchport for AP-connection , look at interface error counters
Check interface status and obtained speed and duplex mode

- Debug the AP joining process in detail using https://logadvisor.cisco.com/logadvisor/wireless/9800/9800APJoin

Re: C9115 does not join to C9800 controller.

balaji.bandi — Mon, 27 May 2024 09:24:25 GMT

Is this only AP having issue ? any other AP joined WLC ?

is this working setup or new setup ?

You have DTLS handshake issue.

try re-create a certificate and reload WLC and test again.

Re: C9115 does not join to C9800 controller.

Leo Laohoo — Mon, 27 May 2024 09:28:35 GMT

CSCwh61011

Re: C9115 does not join to C9800 controller.

my9774 — Mon, 27 May 2024 09:31:53 GMT

The overall situation for 48 APs is the same.

This is a new configuration.

How can I generate a new certificate?

Re: C9115 does not join to C9800 controller.

my9774 — Mon, 27 May 2024 09:33:05 GMT

We will collect show tech and find out on our next visit. Thank you for the useful information.

Re: C9115 does not join to C9800 controller.

Mark Elsen — Mon, 27 May 2024 09:39:54 GMT

- Tx ; reminder , for WirelessAnalyzer to work use : show tech wireless
not simple show tech
(feed output from the correct command into Wireless Config Analyzer)

Re: C9115 does not join to C9800 controller.

balaji.bandi — Mon, 27 May 2024 10:08:42 GMT

check below guide :

https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-cl-wireless-controller-cloud/nb-06-cat9800-cl-wirel-cloud-dep-guide-cte-en.html

Re: C9115 does not join to C9800 controller.

Rich R — Mon, 27 May 2024 11:00:23 GMT

@Leo Laohoo CSCwh61011 is supposed to be fixed in 17.13.1 which @my9774 is using.

Re: C9115 does not join to C9800 controller.

Rich R — Mon, 27 May 2024 11:02:11 GMT

1. As @Mark Elsen check why your controller interface is flapping - nothing will work if the port doesn't stay up!

2. Agree with @balaji.bandi that you might have a WLC certificate issue - also refer to the Best Practices link below.

Re: C9115 does not join to C9800 controller.

Mark Elsen — Mon, 27 May 2024 12:16:58 GMT

- I do agree with @Rich R that the whole sequence of DTLS and certificate errors could be misleading here ; it is important to first focus on this part of the output :
>....: %LINEPROTO-5-UPDOWN: Line protocol on Interface TenGigabitEthernet0/1/1, changed state to down

We can see that a TenG interface is being used which is perfectly possible but :
- Check switchport for AP-connection , look at interface error counters
- Check interface status and obtained speed and duplex mode

Which I mentioned earlier ; it will also become imperative to be able to check the AP logs ; and for instance be able to look at
tx-rx counters.