topic Does this change something if in Wireless

AP not joining the WLC controller

Fatim Zahra Berrada Lamine — Mon, 05 Jul 2021 12:14:29 GMT

Hello,

I have 4 AIR-CAP1702I-E-K9 Access point which join the controller for some time (2 hours), then disassociate from the controller randomly.

Please see attached the controller configuration.

This logs keeps appearing on the AP when it is no more associated to the controller

*Jun 16 07:36:01.175: %AAA-3-BADSERVERTYPEERROR: Cannot process authentication server type radius (UNKNOWN)
*Jun 16 07:36:01.175: %DOT11-7-AUTH_FAILED: Station e4b3.1820.d1f9 Authentication failed
*Jun 16 07:36:11.967: %DOT11-7-AUTH_FAILED: Station e4b3.1820.d1f9 Authentication failed
*Jun 16 07:36:12.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 172.26.0.46:5246
*Jun 16 07:36:12.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Jun 16 07:36:13.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.26.0.46 peer_port: 5246
*Jun 16 07:36:42.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0xCEAD6C4!

Do you have any idea about this issue ?

Thank you all for your help!

Multiple Countries:AE,BH,CM

Leo Laohoo — Thu, 16 Jun 2016 11:31:22 GMT

Multiple Countries:AE,BH,CM,DZ,EG,FR,GH,KW,LB,MA,NG,OM,QA,SA,TN,TR,ZA

I think this is the cause. Too many coflicting Regulatory Domains.

Those are not conflicting.

Fatim Zahra Berrada Lamine — Thu, 16 Jun 2016 11:40:24 GMT

Those are not conflicting. They are country codes. I do not see the relation between country codes and DTLS ?

Those are not conflicting.

Leo Laohoo — Thu, 16 Jun 2016 11:45:38 GMT

Those are not conflicting.

Said who? Country codes enabled are mixed ME and European.

If the AP is "-E" then try to enable only European countries and see if the APs join.

Another thing, software running on the 8540 is 8.0.121.0. Cisco has pulled this version due to stability issues.

Product Version..............

Leo Laohoo — Thu, 16 Jun 2016 11:55:00 GMT

Product Version.................................. 8.0.121.0

Ok, there's another culprit. This time it's a bug with this particular software.

Remote into the AP. (Even if Telnet/SSH is not enabled and the APs are not joined to the controller, enable it.)

Post the complete output to the command "sh ip interface brief".

FR229-AP005#show ip int

Fatim Zahra Berrada Lamine — Thu, 16 Jun 2016 11:59:51 GMT

FR229-AP005#show ip int brief
Interface IP-Address OK? Method Status Protocol
BVI1 172.26.210.14 YES DHCP up up
BVI2 unassigned YES unset up up
BVI3 unassigned YES unset up up
Dot11Radio0 unassigned NO unset up up
Dot11Radio0.1 unassigned YES unset up up
Dot11Radio0.18 unassigned YES unset up up
Dot11Radio0.19 unassigned YES unset up up
Dot11Radio1 unassigned NO unset up up
Dot11Radio1.1 unassigned YES unset up up
Dot11Radio1.18 unassigned YES unset up up
Dot11Radio1.19 unassigned YES unset up up
GigabitEthernet0 unassigned NO unset up up
GigabitEthernet1 unassigned NO unset administratively down down
Virtual-WLAN0 unassigned NO unset up up
Virtual-WLAN0.1 unassigned NO unset up up
Virtual-WLAN0.2 unassigned NO unset up up
Virtual-WLAN0.3 unassigned NO unset up up
Virtual-WLAN0.4 unassigned NO unset up up
Virtual-WLAN0.5 unassigned NO unset up up
Virtual-WLAN0.6 unassigned NO unset up up
Virtual-WLAN0.7 unassigned NO unset up up
Virtual-WLAN0.8 unassigned NO unset up up
Virtual-WLAN0.9 unassigned NO unset up up
Virtual-WLAN0.10 unassigned NO unset up up
Virtual-WLAN0.11 unassigned NO unset up up
Virtual-WLAN0.12 unassigned NO unset up up
Virtual-WLAN0.13 unassigned NO unset up up
Virtual-WLAN0.14 unassigned NO unset up up
Virtual-WLAN0.15 unassigned NO unset up up
Virtual-WLAN0.16 unassigned NO unset up up

Looks clean. Radios are not

Leo Laohoo — Thu, 16 Jun 2016 12:08:24 GMT

Looks clean. Radios are not "reset". So I'm still suspecting the conflicting Regulatory Domain.

Does this change something if

Fatim Zahra Berrada Lamine — Thu, 16 Jun 2016 13:19:01 GMT

Does this change something if the country code selected on on of those AP is FR for france (the AP is in France as well). Even with that configured, the AP will suffer a country code conflict ?

This ain't going to work.

Leo Laohoo — Thu, 16 Jun 2016 22:14:00 GMT

This ain't going to work. Whoever is giving these "recommendation" to enable multiple Regulatory Domain needs to stop. This is because the APs come with SPECIFIC Regulatory Domain codes hard-coded in them.

In 2015, Cisco released the 1700/2700/3700 with new "Universal Regulatory Domain" of "-UX". This means the controller can have multiple & conflicting Regulatory Domain enabled and the AP will know which codes to use.

Read this: Cisco Aironet Universal AP Priming and Cisco AirProvision User Guide

I read the guide, and

Fatim Zahra Berrada Lamine — Fri, 17 Jun 2016 09:00:17 GMT

I read the guide, and understand that besides the AP "-UX", the others can have conflicting issue regarding the regulatory domain codes.

I am checking this, trying to see if we can modify it.

However I just want to make sure you have all the information about the situation. The APs having the issue are 4 over 480 ones not having the issue. They join the controller and then disjoin, it is unstable.

On the concerned location, we have 5 APs, 1 is stable, and 4 unstable. When they disconnect from the controller, I have to force the configuration using.

============================

debug capwap console cli

capwap ap controller ip address X.X.X.X

reload

============================

Please see attached the difference I could notice between the AP which is stable and the 4 AP unstable.

> The model, the stable AP is an AIR-CAP1602I-E-K9

> The PoE Status, the stable AP is using a power injector while the others are using PoE

> The Sw version loaded, the stable AP have the primary and backup Sw version, while the others have only the primary

Hmmmm ...

Leo Laohoo — Fri, 17 Jun 2016 09:15:43 GMT

Hmmmm ...

When one of the APs kick itself from the controller, remote into it. Do a "sh log" and see if you see any of the two (or both) log entries:

*Aug 16 03:56:05.075: bsnInitRcbSlot: slot 0 has venus radio(UNSUPPORT)
*Aug 16 03:56:05.075: bsnInitRcbSlot: slot 1 has venus radio(UNSUPPORT)

If any one of the two lines are present, then look into the flash of the AP for one or two files: event.r0 &/or event.r1. Open up the file(s) and see if you see the following messages:

Radio stopped due to external code download failed                                      
Number of supported simultaneous BSSID on Dot11Radio0: 16
Carrier Set:  () (-A)

None of this shows on the AP

Fatim Zahra Berrada Lamine — Fri, 17 Jun 2016 09:55:21 GMT

None of this shows on the AP when it kicks itself from the controller. Please see attached

An other information, when

Fatim Zahra Berrada Lamine — Fri, 17 Jun 2016 10:00:11 GMT

An other information, when the APs join again the wlc, they have the PoE status "Power injector/normal mode" before switch by itself to "PoE/Full Power".

Another thing ... Upgrade the

Leo Laohoo — Fri, 17 Jun 2016 10:29:24 GMT

Another thing ... Upgrade the firmware of the controller. 8.0.121.0 has been pulled by Cisco due to stability reasons.

Hello Leo

Fatim Zahra Berrada Lamine — Thu, 30 Jun 2016 19:22:54 GMT

Hello Leo

The issue was resolved after changing the PoE switch configuration, and adding its mac address to the field AP injector, override checked on the WLC.

Thank you for your help on this