topic Re: WLC 9800-CL HA Configuration in Wireless

WLC 9800-CL HA Configuration

Debabrata Majhi — Fri, 29 Nov 2024 23:20:04 GMT

Hi All,

We are configuring new WLC 9800-CL version 17.2.3 in VMware environment. HÀ is configured and running as expected, RMI and WMI in subnet and VLAN of wireless management interface However we are getting the below error may you please advise

RMI IP must be in the same subnet as Wireless Management Interface (WMI). For more information -Screen shot attached for reference.

Please advise if we are missing anything to configure the HA

Here is the below interface configuration

Gig1-AS OOB

GIg2-VGT-TRUNK

Gig-RP port HA

Thanks

Debabrata

Re: WLC 9800-CL HA Configuration

Flavio Miranda — Sat, 30 Nov 2024 00:36:21 GMT

@Debabrata Majhi

Information About Redundancy Management Interface

The Redundancy Management Interface (RMI) is used as a secondary link between the active and standby Cisco Catalyst 9800 Series Wireless Controllers. This interface is the same as the wireless management interface, and the IP address on this interface is configured in the same subnet as the Wireless Management Interface. The RMI is used for the following purposes:"

This is a requeriment.

Re: WLC 9800-CL HA Configuration

MHM Cisco World — Sat, 30 Nov 2024 05:50:04 GMT

in simple words

WMI RMI must be in same subent

RPI must be in different subnet than (WMI/RMI)

MHM

Re: WLC 9800-CL HA Configuration

Rich R — Sat, 30 Nov 2024 13:08:56 GMT

Have you followed https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-cl-dg.html#Deployingthe9800CLusingVMwareESXi and https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/9800-cloud/installation/b-c9800-cl-install-guide/installing_the_controller.html and checked each step carefully (easy to miss some minor details)?

Also see https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/220277-configure-high-availability-sso-on-catal.html#toc-hId-112823875 and https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#C9800CLconsiderations

ps: Screen shot attached for reference.
I don't see any screenshot attached.

Re: WLC 9800-CL HA Configuration

Debabrata Majhi — Sun, 01 Dec 2024 20:54:51 GMT

Hi All,

Thanks for helping me out from this issue

As per ACI deployment guide I have applied the following still the issue same

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_vewlc_high_availability.html

Device(config)# no redun-management fast-switchover

devce(config)# redun-management garp-retransmit burst 0 interval 0

Device(config)# no redun-management garp-retransmit initial

Regards

Debabrata

Re: WLC 9800-CL HA Configuration

Debabrata Majhi — Sun, 01 Dec 2024 20:13:56 GMT

Hi All,

seems issue not fixed ,Its showing again ,very strange

WMI and RMI in same subnet

RPI interface is auto populated based on the RMI

Gig3 -RP port is different EPG (ACI) not is same EPG (WMI)

Please advise if any further advice

Thanks

Re: WLC 9800-CL HA Configuration

Mark Elsen — Sun, 01 Dec 2024 20:20:07 GMT

- To get a detailed report on your 9800 configuration and what is wrong use this procedure :
issue the CLI command on the primary controller show tech wireless (not show tech) and feed the output
from that into Wireless Config Analyzer

Re: WLC 9800-CL HA Configuration

Debabrata Majhi — Sun, 01 Dec 2024 20:41:20 GMT

Hi All,

Here is the config below

device#show romvar
ROMMON variables:
SWITCH_NUMBER = 1
LICENSE_SUITE =
SWITCH_PRIORITY = 2
CHASSIS_HA_IFNAME = GigabitEthernet3
CHASSIS_HA_IFMAC = 00:00:00:00:00:00
RMI_INTERFACE_NAME = Vlan24
RMI_CHASSIS_LOCAL_IP = 10.24.24.12
RMI_CHASSIS_REMOTE_IP = 10.24.24.13
CHASSIS_HA_LOCAL_IP = 169.254.24.12
CHASSIS_HA_REMOTE_IP = 169.254.24.13
CHASSIS_HA_LOCAL_MASK = 255.255.255.0
RET_2_RTS =
CSDL_MODE_DISABLE = 1
BSI = 0
RET_2_RCALTS =
RANDOM_NUM = 1243252048
LICENSE_BOOT_LEVEL =
CHASSIS_HA_PEER_TIMEOUT = 500
CHASSIS_HA_PEER_TIMEOUT_RETRY = 10
device#show chas
device#show chassis rmi
Chassis/Stack Mac Address : 0000.0000.0000 - Local Mac Address
Mac persistency wait time: Indefinite
H/W Current
Chassis# Role Mac Address Priority Version State IP RMI-IP
--------------------------------------------------------------------------------------------------------
*1 Active 000x.1111.1115 2 V02 Ready 169.254.24.12 10.24.24.12
2 Standby 000x.1111.1102 1 V02 Ready 169.254.24.13 10.24.24.13

device#show wireless interface summary

Wireless Interface Summary

Interface Name Interface Type VLAN ID IP Address IP Netmask NAT-IP Address MAC Address
--------------------------------------------------------------------------------------------------
Vlan24 Management 24 10.24.24.10 255.255.255.0 0.0.0.0 001e.bd86.60ff

Note:MAC are chnage due to security

Thanks

Debabrata

Re: WLC 9800-CL HA Configuration

Rich R — Sun, 01 Dec 2024 21:42:31 GMT

@Debabrata Majhi I didn't see any answer to my previous reply so I'll ask again...
Have you checked those guides carefully to make sure you have not missed any minor details?

Have you done a complete check of your config with Config Analyzer as advised by @Mark Elsen ?

I presume 17.2.3 is just a typo and you meant 17.12.3?

Re: WLC 9800-CL HA Configuration

Debabrata Majhi — Sun, 01 Dec 2024 23:32:28 GMT

Hi marce1000 , Rich R

Here is the report

Error	Best Practices	Management	Management: HTTP server does not have an IPv4 access class set. To improve security, it is advisable to set ACL explicitly allowing address that can configure the controller
Warning	Config Error	Version	Version: IOS-XE Controller with not recommended code:17.12.3, please check software download page for the current version for your hardware
Warning	Best Practices	High Availability	High Availability: Redundancy mac address is not set. This is mandatory configuration value if using redundancy feature
Warning	Config Error	Management	Management: To prevent WebUI issues while using some large GUI options (VLANs for example), it is advisable to increase the VTY count to 50
Warning	Best Practices	Management	Management: Service tcp-keepalive in/out, should be enabled to reduce lingering inactive connections to management points
Warning	Config Error	Security	Security: Current configuration is vulnerable to CVE-2023-48795/CSCwi59338, Chacha20 should be removed from SSH encryption options
Warning	Best Practices	Security	Security: Management user has not been set. For security reasons, it is best practice to configure username/password for AP access on the join profile. AP Profiles: default-ap-profile
Warning	Best Practices	Syslog	Syslog: Syslog host is not set (using default broadcast value). For best practices, it is recommended to use a syslog server. AP Profiles: default-ap-profile
Info	Best Practices	11b	11b: Legacy rate enabled in Global Config . Disabling low data rates/11b can help to optimise the channel utilisation on the 2.4 band. Depending on RF coverage, or if using legacy clients, this may cause problems. Please validate before enforcing the changes, as this may have important RF dependencies.
Info	Best Practices	Client Profiling	Client Profiling: Device Classification (client profiling) is not globally enabled, it is recommended to use it
Info	Best Practices	RRM	RRM: ED-RRM is not in use. It is recommended to enable for enterprise environments. Band(s): 2.4 GHz 5 GHz
Info	Best Practices	Security	Security: Password Encryption is not enabled. This is optional feature to protect keys/passwords in configuration
Info	Best Practices	Tags	Tags: For versions 17.6 and higher, it is advisable to use AP tag persistency command, to ensure tags are preserved if AP is temporarily moved to another controller
Info	Information	AAA	AAA: The max-user-login feature is set. This restricts how many clients can share the same username during authentication. Ensure this is intended, as this can impact some deployment scenarios
Info	Best Practices	Rogues	Rogues: Rogue AP policies and rules should be defined, specially around managed SSIDs
Info	Information	Policy Profile	Policy Profile: Disabled profile, no configuration checks run. Policy Profile(s): default-policy-profile
Info	Best Practices	Monitoring	Monitoring: AP system monitoring statistics are not enabled. To improve AP status visibility it would be recommended to use it. AP Profiles: default-ap-profile

230034 -It is fixed now ,Howver Please advice the version I should take upgrade -To fix the other issue ?

Thanks

Debabrata

Re: WLC 9800-CL HA Configuration

Mark Elsen — Mon, 02 Dec 2024 07:35:32 GMT

@Debabrata Majhi wrote : Here is the report
>...
If you have the HTML or Excell version then all errors red flagged from the WLC results must always be corrected ,

Re: WLC 9800-CL HA Configuration

Mark Elsen — Mon, 02 Dec 2024 09:59:30 GMT

- Could you also provide the current ip address of the WMI ?

Re: WLC 9800-CL HA Configuration

Flavio Miranda — Mon, 02 Dec 2024 09:59:34 GMT

@Debabrata Majhi

If you intent to connect the WLC to ACI to perform High availability, you need to be on version Cisco IOS XE Cupertino 17.9.1

This information is on the doc you shared above.

Re: WLC 9800-CL HA Configuration

Debabrata Majhi — Mon, 02 Dec 2024 15:30:21 GMT

It is upgraded to 17.9.6 version now ,Howver still it is showing same

Thanks

Re: WLC 9800-CL HA Configuration

Debabrata Majhi — Mon, 02 Dec 2024 15:32:20 GMT

It is 10.24.24.10 ,No error msg now in WLC analyser as well ,Alert is still showing .

Thanks

Re: WLC 9800-CL HA Configuration

Flavio Miranda — Mon, 02 Dec 2024 15:42:40 GMT

Are you sure everything is fine from the ACI side?

Re: WLC 9800-CL HA Configuration

MHM Cisco World — Mon, 02 Dec 2024 15:47:11 GMT

9800-LC in vmware

Did you check depoly guide?

You need to connect RPI to different vNIC

MHM

Re: WLC 9800-CL HA Configuration

Rich R — Mon, 02 Dec 2024 15:56:28 GMT

Which is why I asked twice if the guides have been followed @MHM Cisco World - there are a whole lot of very specific instructions which must be followed otherwise it will not work correctly......

Re: WLC 9800-CL HA Configuration

Debabrata Majhi — Sat, 18 Jan 2025 19:55:33 GMT

Hi All,

Thanks every one for helping and advsing to fix the issue.

Aplogies for late response .I was engage in different activity ,I had a call with Cisco TAC ,They confirm that "warning is set to to be aware that both IP sould be same VLAN.

All configurtion is Ok

HA is working as expected.

Thanks

Debabrata