topic Re: AP not joining 9800WLC in Wireless

AP not joining 9800WLC

someone_003 — Fri, 21 Jun 2024 11:12:35 GMT

Hi,

I m really struggling to get 9164 access points to join a 9800 controller.

I get this error on the console of the Access point dtls_log_replay: dtls_log_replay: DTLS Replay Attack detected for Source.

I don't know if this is the reason for the APs not to join, but I have set an ntp for the controller and the APs as per some previous posts.

Any help would be appreciated

Re: AP not joining 9800WLC

Mark Elsen — Fri, 21 Jun 2024 11:19:33 GMT

- Make sure that the country code for the APs is configured on the controller (allowed)
- Have a checkup of the 9800 controller's configuration using the CLI command show tech wireless
and feed the output from that into Wireless Config Analyzer

- Get further insights from https://logadvisor.cisco.com/logadvisor/wireless/9800/9800APJoin

Re: AP not joining 9800WLC

someone_003 — Fri, 21 Jun 2024 11:35:45 GMT

Hi,

I have these in the config:

wireless country BE

ap profile default-ap-profile
country BE

However in the radioactive trace i get these errors:

Failed to get valid slot count. country code DE is not configured on WLC

Not sure how to change that?

Re: AP not joining 9800WLC

Mark Elsen — Fri, 21 Jun 2024 12:54:21 GMT

>...Failed to get valid slot count. country code DE is not configured on WLC
- For which country did you buy the AP ?

Re: AP not joining 9800WLC

someone_003 — Fri, 21 Jun 2024 13:52:09 GMT

HI,

PID: CW9164I-E so it should be right? Its strange because I haven't set DE on it all.

Re: AP not joining 9800WLC

Mark Elsen — Fri, 21 Jun 2024 13:59:06 GMT

- Yeah , that should be right : could you check the output of :
show running-config | inc country

- Also have an overall checkup of the 9800 controller configuration with the CLI command show tech wireless
and feed the output from that into Wireless Config Analyzer

Re: AP not joining 9800WLC

someone_003 — Fri, 21 Jun 2024 16:32:44 GMT

Hi,

I just checked the ntp status on the AP it shows this:

#sho ntp
%Error: NTP service is not running

I have set the NTP in the profile in the controller, is there any other way for the AP to pick up the NTP server?

Re: AP not joining 9800WLC

someone_003 — Fri, 21 Jun 2024 19:51:48 GMT

I've fixed the ntp issue and set the country to DE (not correct) but still get the same error.

Re: AP not joining 9800WLC

Leo Laohoo — Sat, 22 Jun 2024 06:02:34 GMT

What firmware is the controller on?

Re: AP not joining 9800WLC

Mark Elsen — Sat, 22 Jun 2024 06:33:19 GMT

>...and set the country to DE (not correct) but still get the same error = ???
- Strange reply ; could you set the correct country code and see if the AP can join according to your initial post.

Re: AP not joining 9800WLC

someone_003 — Sat, 22 Jun 2024 06:37:47 GMT

Hi,

Sorry I should have said that when it's set to BE it's still the same error, it thinks its set to DE. But when the controller is DE that error goes away but it still has the dtls replay attack message.

Re: AP not joining 9800WLC

someone_003 — Sat, 22 Jun 2024 06:41:44 GMT

It's on 17.12.3

Re: AP not joining 9800WLC

Mark Elsen — Sat, 22 Jun 2024 07:21:41 GMT

>...Sorry I should have said that when it's set to BE it's still the same error, it thinks its set to DE.
- Ok ,let's stick with that for the moment , the correct NTP parameters will be provided if or when the AP can join.
As asked before : Have a checkup of the 9800 controller's configuration using the CLI command show tech wireless
and feed the output from that into Wireless Config Analyzer
(set the correct country code BE first!)

- On a switch where this particular AP model is connected ; issue the command show cdp neighbors detail
and post the output for an AP connection ,

Re: AP not joining 9800WLC

someone_003 — Sat, 22 Jun 2024 09:42:09 GMT

Hi,

I have run the wireless config analyser there were a few minor issues regarding management access, but it didn't give any glaring issues?

Show cdp neighbors output:

Device ID Local Intrfce Holdtme Capability Platform Port ID
APC4D6.6636.F1B0 Two 1/0/4 169 R T CW9164I-E Gig 0
APC4D6.6637.0830 Two 1/0/3 163 R T CW9164I-E Gig 0

Re: AP not joining 9800WLC

Leo Laohoo — Sat, 22 Jun 2024 09:55:05 GMT

Console into the AP and reboot.

Post, in a text file and attached to the thread, the entire bootup process.

Re: AP not joining 9800WLC

Mark Elsen — Sat, 22 Jun 2024 10:23:21 GMT

>....Show cdp neighbors output:
- Also include one output from show cdp neighbors detail (tx)
And as @Leo Laohoo mentioned , post the entire bootup process. from one of these APs

Re: AP not joining 9800WLC

Rich R — Mon, 24 Jun 2024 07:53:40 GMT

The AP does not require NTP. It gets the current time from the WLC over CAPWAP when it joins. AP NTP is only required for location services, not joining. The AP gets the NTP configuration (if required) from the WLC after joining.

We definitely need to see those complete AP logs. (attach in a text file rather than pasting thousands of lines into your reply)

Have you done a factory default reset on the AP in case it has a previous DE config on the AP?