topic Re: 9166 Not Leaveing CAPWAP Discovery in Wireless

9166 Not Leaveing CAPWAP Discovery

jbulloch — Thu, 10 Apr 2025 17:09:42 GMT

Hi cisco community,

We have recently deployed a 9800 WLC and are attempting to join several 9166. I have confiqured DHCP 43, and DNS A record which appear to be working. Routing between WLC and AP is functional and DNS entry is resolving correctly. I can ping between AP and WLC. I have run captures on the AP port and can see the DNS/DHCP/PNP/CAPWAP Broadcast, but when i do capture on the WLC i do not see any capwap traffic. I have the CAPWAP ports 5246 and 5247 forwarded with forward protocol. WLC is not on the same subnet but the AP from log is discovering the 43/DNS correctly.

I haven't been able to get my capture software (wireshark) to show inside the capwap packets even with the cisco capwap protocol enabled, but i can see the port in the details so it does appear that at least the AP is attempting to contact the WLC.

The AP logs as below. It will repeat several times and reboot. License number for APs is confirmed. Is there possibly a setup step on the WLC we are missing?

Thank you very much for your assistance.

[*04/10/2025 17:04:46.3130] CAPWAP State: Discovery
[*04/10/2025 17:04:46.3138] Got WLC address x.x.6.28 from DHCP.
[*04/10/2025 17:04:46.3138] IP DNS query for CISCO-CAPWAP-CONTROLLER.domain
[*04/10/2025 17:04:46.3157] DNS resolved CISCO-CAPWAP-CONTROLLER.domain
[*04/10/2025 17:04:46.3158] DNS discover IP addr: x.x.6.28
[*04/10/2025 17:04:46.3176] Discovery Request sent to x.x.6.28, discovery type DHCP(2)
[*04/10/2025 17:04:46.3192] Discovery Request sent to x.x.6.28, discovery type DNS(3)
[*04/10/2025 17:04:46.3312] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0)

Re: 9166 Not Leaveing CAPWAP Discovery

Saikat Nandy — Thu, 10 Apr 2025 17:32:01 GMT

Based on the above logs, I can see AP is sending Discovery Req but further logs are not present to understand what is happening after that. please share the term output or console output of the AP for a better understanding.

Re: 9166 Not Leaveing CAPWAP Discovery

Mark Elsen — Thu, 10 Apr 2025 17:40:22 GMT

- Could you also have a checkup of the 9800 WLC's configuration using the CLI command :
show tech wireless and feed the output from that into Wireless Config Analyzer

What software version are you using ?

Re: 9166 Not Leaveing CAPWAP Discovery

jbulloch — Thu, 10 Apr 2025 18:12:03 GMT

Hi sandy,

I had to hide the octet information and domain due to company requirements, but the first two are in the correct subnet. I have attached log up until the capwap process appears to restart below.

Re: 9166 Not Leaveing CAPWAP Discovery

jbulloch — Thu, 10 Apr 2025 18:24:08 GMT

Hi marce,

I am running C9800-L-universalk9_wlc.17.09.04a.SPA.

Re: 9166 Not Leaveing CAPWAP Discovery

Mark Elsen — Thu, 10 Apr 2025 18:39:00 GMT

- @jbulloch We see multiple
OOBImageDnld: OOBImageDownloadTimer expired for image download
from apconsole.txt

There can be several reasons for it ; basically the controller 'can't handle an image for the AP':
- Make sure AP country code is supported on controller
- Controller has compatible software version : https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html
- Controller uses NTP
++ Pay attention to WirelessAnalyzer procedure from my initial reply

Re: 9166 Not Leaveing CAPWAP Discovery

Mark Elsen — Thu, 10 Apr 2025 18:41:27 GMT

- @jbulloch >....I am running C9800-L-universalk9_wlc.17.09.04a.SPA.
Should be good go for a checkup of the 9800 WLC's configuration using the CLI command :
show tech wireless and feed the output from that into Wireless Config Analyzer

Re: 9166 Not Leaveing CAPWAP Discovery

jbulloch — Thu, 10 Apr 2025 19:01:09 GMT

Hi marce, i have run a show tech (wireless) though it and identifed several problems but have not discovered one related to the capwap. Thank you.

Re: 9166 Not Leaveing CAPWAP Discovery

Mark Elsen — Thu, 10 Apr 2025 19:24:08 GMT

@jbulloch - Please note that from WirelessAnalyzer all errors red flagged in the resulting excell from the
wlc_results tab must be corrected , if any!

+ Further more check controller logs when the AP tries to join
+ Proceed with info's from https://logadvisor.cisco.com/logadvisor/wireless/9800/9800APJoin
to further analyze and troubleshoot the issue.

Re: 9166 Not Leaveing CAPWAP Discovery

jbulloch — Thu, 10 Apr 2025 19:55:35 GMT

Hi marce, Yes the two flagged were an ACL issue and a missing SSID. These are good issues to fix, but i do doubt they are related to capwap issue. I am debating if possibly we have a issue with management/WMI, since are using a single interface with L3 IP. I noted there's a default route back to the svi (o.o.o.o o.o.o.o and the svi's gateway). I have a trunk allowing the vlans from the AP subnet and the subnet the controller sits in. Is there a SVI needed for the WMI in some manner i am missing?

Re: 9166 Not Leaveing CAPWAP Discovery

Leo Laohoo — Thu, 10 Apr 2025 22:19:31 GMT

ip route 0.0.0.0 0.0.0.0 <GATEWAY>

Re: 9166 Not Leaveing CAPWAP Discovery

Saikat Nandy — Fri, 11 Apr 2025 00:30:00 GMT

The log says that AP is getting WLC details from DHCP/DNS and sending the Discovery Req but not getting the response back. The most obvious reason should be some config on WLC (assuming routing, CAPWAP ports between WLC/AP is open). Can you share the following outputs from the controller please -

#show wireless interface summary
#show ip int br
#show run | in route

Re: 9166 Not Leaveing CAPWAP Discovery

Mark Elsen — Fri, 11 Apr 2025 06:54:31 GMT

- @jbulloch https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#Wirelessmanagementinterface

In your initial post you wrote : I have the CAPWAP ports 5246 and 5247 forwarded with forward protocol
What do you mean by that ?

Re: 9166 Not Leaveing CAPWAP Discovery

jbulloch — Fri, 11 Apr 2025 11:22:05 GMT

Hi sanandy, yes my feeling is some wlc config/routing config. I worked through the basics, checking ospf, pings and trunks.

I have attached log below.

Re: 9166 Not Leaveing CAPWAP Discovery

jbulloch — Fri, 11 Apr 2025 11:26:46 GMT

Hi marce,

I set

ip forward-protocol udp 5246
ip forward-protocol udp 5247

Globally on the core device handling the SVIs

Re: 9166 Not Leaveing CAPWAP Discovery

jbulloch — Fri, 11 Apr 2025 11:28:01 GMT

Hi leo, yes i have this set per WMI instructions. It does seem a bit odd to me to route from the device back to the gateway. This exists for clients return traffic 'back into network'? Otherwise internal routing would point traffic to the WLC i would think.

Thank you.

Re: 9166 Not Leaveing CAPWAP Discovery

Mark Elsen — Fri, 11 Apr 2025 13:37:36 GMT

- @jbulloch >.....Globally on the core device handling the SVIs
What is the core device model ?

Re: 9166 Not Leaveing CAPWAP Discovery

jbulloch — Fri, 11 Apr 2025 13:51:25 GMT

I run two 9500's in stackwise at my core.

Re: 9166 Not Leaveing CAPWAP Discovery

Mark Elsen — Fri, 11 Apr 2025 13:57:17 GMT

- Check and analyze if you could get hit by this one :
https://bst.cisco.com/bugsearch/bug/CSCuw17864?rfs=qvred

Re: 9166 Not Leaveing CAPWAP Discovery

Mark Elsen — Fri, 11 Apr 2025 15:53:57 GMT

- @jbulloch Referring to : ip forward-protocol udp 5246
ip forward-protocol udp 5247

Note that when using these you also need
ip helper-address <WLC-Management-Address>
on the core,