topic 2 new 1602i AP won't connect to vWLC in Wireless

2 new 1602i AP won't connect to vWLC

Jacob Simons — Mon, 05 Jul 2021 11:43:10 GMT

I have a virtual WLC running software version 7.6.130.0. I have a variety of APs on it from 1141 all the way to 2702's. I have 104 APs current connected with 7 licenses remaining.

I just purchased 2 refurbished 1602i's and am trying to get them to connect to the WLC.

This is what they keep giving me over and over again:

*Mar 3 20:16:43.071: AP has SHA2 MIC certificate - Using SHA1 MIC certificate for DTLS.

*Mar 3 20:16:43.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.20.3.10 peer_port: 5246
*Mar 3 20:17:12.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0x7631114!

*Mar 3 20:17:42.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.20.3.10:52

I did a lot of searching on the forums and I find references to some of these errors but they are all for people that upgraded the WLC to version 8.0.

Any help would be greatly appreciated.

What happens if you try

Philip D'Ath — Thu, 03 Mar 2016 21:20:08 GMT

What happens if you try getting it to join manually from the CLI?

I have never had to do that

Jacob Simons — Thu, 03 Mar 2016 21:23:02 GMT

I have never had to do that before.

Can you point me at some documentation or let me know what the commands would be to do it?

lwapp ap controller ip

Philip D'Ath — Thu, 03 Mar 2016 21:34:52 GMT

You need to use the command:

lwapp ap controller ip address <IP-address>

If that is not allowed, you may need to execute this command first:

"debug lwapp console cli"
or
"debug capwap console cli"

I was able to run the first

Jacob Simons — Fri, 04 Mar 2016 14:01:36 GMT

I was able to run the first command. It didn't return any errors but it didn't seem to make any changes either. The same errors I mentioned in my initial post continue to repeat.

The current version of

Freerk Terpstra — Sat, 05 Mar 2016 17:06:01 GMT

The current version of software on the access-point might be to low and not including the needed certificates. Because of this I recommend you to download one of the latest ap1g2-k9w8 images from the Cisco website and install it manually. Please post the whole console output of the access-point and the recent logging of the WLC if the access-point still can't join the WLC after upgrading the software of the access-point.

Please rate useful posts... 🙂

I think we should try what

Philip D'Ath — Sun, 06 Mar 2016 19:35:49 GMT

I think we should try what Freerk has suggested, and put a newer recovery image on the APs.

I checked out the software

Jacob Simons — Mon, 07 Mar 2016 16:04:00 GMT

I checked out the software version on the AP and it is pretty new. ap1g2-k9w8-mx.153-3.JBB6. Here are all the boot up logs off of the AP and the relevent message logs of the WLC.

AP

flashfs[0]: 74 files, 15 directories

flashfs[0]: 0 orphaned files, 0 orphaned directories

flashfs[0]: Total bytes: 31936000

flashfs[0]: Bytes used: 30277120

flashfs[0]: Bytes available: 1658880

flashfs[0]: flashfs fsck took 19 seconds.

flashfs[1]: 0 files, 1 directories

flashfs[1]: 0 orphaned files, 0 orphaned directories

flashfs[1]: Total bytes: 16386048

flashfs[1]: Bytes used: 1024

flashfs[1]: Bytes available: 16385024

flashfs[1]: flashfs fsck took 0 seconds.

Reading cookie from SEEPROM

Base Ethernet MAC address: d0:72:dc:36:ea:56

************* loopback_mode = 0

Marvell Phy Revision = 0xdd1 - Production Phy, Rev. A0

Marvell Phy Rev. A0 initialization...

Turn off CLK125

1000BaseT Status reg. = 0x7800

1000BaseT Copper Status 1 reg. = 0xbc08

1000BaseT Copper Status 2 reg. = 0x1c40

Receive Error Counter reg. = 0x0

Loading "flash:/ap1g2-k9w8-mx.153-3.JBB6/ap1g2-k9w8-mx.153-3.JBB6"...##############

File "flash:/ap1g2-k9w8-mx.153-3.JBB6/ap1g2-k9w8-mx.153-3.JBB6" uncompressed and installed, entry point: 0x2004000

executing...

Secondary Bootloader - Starting system.

FLASH CHIP: Micronix MX25L256_35F

Xmodem file system is available.

flashfs[0]: 74 files, 15 directories

flashfs[0]: 0 orphaned files, 0 orphaned directories

flashfs[0]: Total bytes: 31936000

flashfs[0]: Bytes used: 30277120

flashfs[0]: Bytes available: 1658880

flashfs[0]: flashfs fsck took 20 seconds.

Reading cookie from SEEPROM

Base Ethernet MAC address: d0:72:dc:36:ea:56

Secondary bootloader Ethernet not enabled, skip ether_init

Boot CMD: 'boot flash:/ap1g2-k9w8-mx.153-3.JBB6/ap1g2-k9w8-xx.153-3.JBB6;flash:/ap1g2-k9w8-mx.153-3.JBB6/ap1g2-k9w8-xx.153-3.JBB6'

Loading "flash:/ap1g2-k9w8-mx.153-3.JBB6/ap1g2-k9w8-xx.153-3.JBB6"...##########################################

File "flash:/ap1g2-k9w8-mx.153-3.JBB6/ap1g2-k9w8-xx.153-3.JBB6" uncompressed and installed, entry point: 0x100000

executing...

Restricted Rights Legend

Use, duplication, or disclosure by the Government is

subject to restrictions as set forth in subparagraph

Rights clause at FAR sec. 52.227-19 and subparagraph

Software clause at DFARS sec. 252.227-7013.

cisco Systems, Inc.

170 West Tasman Drive

San Jose, California 95134-1706

Cisco IOS Software, C1600 Software (AP1G2-K9W8-M), Version 15.3(3)JBB6, RELEASE SOFTWARE (fc2)

Technical Support: http://www.cisco.com/techsupport

Compiled Sun 01-Nov-15 20:15 by prod_rel_team

Initializing flashfs...

FLASH CHIP: Micronix MX25L256_35F

flashfs[2]: WARNING - Unable to allocate backup blocks.

Please free some space on the flash file system.

flashfs[2]: 74 files, 15 directories

flashfs[2]: 0 orphaned files, 0 orphaned directories

flashfs[2]: Total bytes: 31936000

flashfs[2]: Bytes used: 30277120

flashfs[2]: Bytes available: 1658880

flashfs[2]: flashfs fsck took 18 seconds.

flashfs[2]: Initialization complete.

flashfs[4]: 0 files, 1 directories

flashfs[4]: 0 orphaned files, 0 orphaned directories

flashfs[4]: Total bytes: 11999232

flashfs[4]: Bytes used: 1024

flashfs[4]: Bytes available: 11998208

flashfs[4]: flashfs fsck took 0 seconds.

flashfs[4]: Initialization complete....done Initializing flashfs.

Radio0 present 8764B 8000 0 A8000000 A8010000 0

Rate table has 586 entries (20 legacy/160 11n/406 11ac)

POWER TABLE FILENAME = flash:/ap1g2-k9w8-mx.153-3.JBB6/K2.bin

Radio1 present 8764B 8000 0 88000000 88010000 4

POWER TABLE FILENAME = flash:/ap1g2-k9w8-mx.153-3.JBB6/K5.bin

This product contains cryptographic features and is subject to United

States and local country laws governing import, export, transfer and

use. Delivery of Cisco cryptographic products does not imply

third-party authority to import, export, distribute or use encryption.

Importers, exporters, distributors and users are responsible for

compliance with U.S. and local country laws. By using this product you

agree to comply with applicable laws and regulations. If you are unable

to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:

http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to

export@cisco.com.

cisco AIR-CAP1602I-A-K9 (PowerPC) processor (revision B0) with 187382K/74672K bytes of memory.

Processor board ID FGL1815W78N

PowerPC CPU at 533Mhz, revision number 0x2151

Last reset from power-on

LWAPP image version 8.1.131.0

1 Gigabit Ethernet interface

2 802.11 Radios

32K bytes of flash-simulated non-volatile configuration memory.

Base ethernet MAC Address: D0:72:DC:36:EA:56

Part Number : 73-14671-04

PCA Assembly Number : 000-00000-00

PCA Revision Number :

PCB Serial Number : FOC181246WP

Top Assembly Part Number : 800-38552-01

Top Assembly Serial Number : FGL1815W78N

Top Revision Number : A0

Product/Model Number : AIR-CAP1602I-A-K9

% Please define a domain-name first.

Press RETURN to get started!

*Mar 1 00:00:20.947: %SOAP_FIPS-2-SELF_TEST_IOS_SUCCESS: IOS crypto FIPS self test passed (15)

*Mar 1 00:00:21.943: %SOAP_FIPS-2-SELF_TEST_HW_SUCCESS: HW crypto FIPS self test passed (1-8)

*Mar 1 00:00:21.943: Registering HW DTLS

*Mar 1 00:00:21.951: APAVC: Initial WLAN Buffers Given to System is 500

*Mar 1 00:00:21.967: APAVC: WlanPAKs 9355 RadioPaks 8747

*Mar 1 00:00:23.991: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state to up

*Mar 1 00:00:25.699: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up

*Mar 1 00:00:28.855: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 0 (4)

*Mar 1 00:00:28.999: Loading Power Tables from flash:/ap1g2-k9w8-mx.153-3.JBB6/K2.bin. Class = A

*Mar 1 00:00:28.999: record size of 3ss: 1168 read_ptr: 34F2BFE

*Mar 1 00:00:35.323: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 1 (4)

*Mar 1 00:00:35.399: Loading Power Tables from flash:/ap1g2-k9w8-mx.153-3.JBB6/K5.bin. Class = A

*Mar 1 00:00:35.399: record size of 3ss: 1168 read_ptr: 34F2BFE

*Mar 1 00:00:35.575: Wait until the stile protocol list is initialized.

*Mar 1 00:00:37.747: Start STILE Activation

*Mar 3 17:12:42.051: %SYS-5-RESTART: System restarted --

Cisco IOS Software, C1600 Software (AP1G2-K9W8-M), Version 15.3(3)JBB6, RELEASE SOFTWARE (fc2)

Technical Support: http://www.cisco.com/techsupport

Compiled Sun 01-Nov-15 20:15 by prod_rel_team

*Mar 3 17:12:42.051: %SNMP-5-COLDSTART: SNMP agent on host APd072.dc36.ea56 is undergoing a cold start

*Mar 3 17:12:43.391: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up

*Mar 3 17:12:44.639: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up

*Mar 3 17:12:44.871: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up

*Mar 3 17:12:49.331: %SSH-5-DISABLED: SSH 2.0 has been disabled

*Mar 3 17:12:49.403: %SSH-5-ENABLED: SSH 2.0 has been enabledlwapp_crypto_init: MIC Present and Parsed Successfully

*Mar 3 17:12:59.603: Currently running a Release Image

*Mar 3 17:12:59.699: Using SHA-2 signed certificate for image signing validation.

*Mar 3 17:13:31.483: APAVC: Succeeded to activate all the STILE protocols.

*Mar 3 17:13:31.483: APAVC: Registering with CFT

*Mar 3 17:13:31.483: APAVC: CFT registration of delete callback succeeded

*Mar 3 17:13:31.483: APAVC: Reattaching Original Buffer pool for system use

*Mar 3 17:13:31.483: Pool-ReAtach: paks 9355 radio8747

%Default route without gateway, if not a point-to-point interface, may impact performance

*Mar 3 17:13:35.863: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 10.20.20.3, mask 255.255.0.0, hostname APd072.dc36.ea56

*Mar 3 17:13:37.191: AP image integrity check PASSED

*Mar 3 17:13:37.375: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset

*Mar 3 17:13:37.375: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset

*Mar 3 17:13:37.795: Cert ISSUER (39): cn=Cisco Manufacturing CA SHA2,o=Cisco

*Mar 3 17:13:47.835: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 255.255.255.255 port 0 CLI Request Triggered

Translating "CISCO-CAPWAP-CONTROLLER.walworth1.mpc.com"...domain server (10.25.1.30) [OK]

*Mar 3 17:13:58.843: %CAPWAP-5-DHCP_OPTION_43: Controller address 10.20.3.10 obtained through DHCP

*Mar 3 17:14:09.911: AP has SHA2 MIC certificate - Using SHA1 MIC certificate for DTLS.

*Mar 7 15:50:52.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.20.3.10 peer_port: 5246Get AP Certificate: failed to get local certificate

*Mar 7 15:50:52.055: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_handshake.c:1439 Error fetching certificate.

*Mar 7 15:50:52.055: %DTLS-5-SEND_ALERT: Send FATAL : Internal error Alert to 10.20.3.10:5246

*Mar 7 15:50:52.055: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_client.c:426 Error sending Certificate.

*Mar 7 15:50:52.055: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.20.3.10:5246

*Mar 7 15:51:01.067: %CDP_PD-4-POWER_OK: Full power - INJECTOR_CONFIGURED_ON_SOURCE inline power source

*Mar 7 15:51:02.335: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up

*Mar 7 15:51:03.335: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up

*Mar 7 15:51:03.607: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up

*Mar 7 15:51:04.607: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up

*Mar 7 15:51:57.071: AP has SHA2 MIC certificate - Using SHA1 MIC certificate for DTLS.

User Access Verification

Username:

*Mar 7 15:51:57.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.20.3.10 peer_port: 5246

% Username: timeout expired!

APd072.dc36.ea56 con0 is now available

Press RETURN to get started.

*Mar 7 15:52:26.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0x58A8C88!

WLC

*apfMsConnTask_3: Mar 07 09:53:09.051: #APF-3-AID_UPDATE_FAILED: apf_80211.c:6571 Error updating Association ID for REAP AP Client10:bd:18:1a:54:b0 - AID 9

*apfMsConnTask_3: Mar 07 09:53:09.051: #LWAPP-3-INVALID_AID2: spam_api.c:1465 Association identifier 9 for client 00:23:68:d7:b0:3f is already in use by 80:00:0b:b7:56:3d

*SISF BT Process: Mar 07 09:52:58.639: #SISF-3-INTERNAL: sisf_shim_utils.c:442 Internal error, check handle invalid entry

*apfMsConnTask_3: Mar 07 09:52:52.671: #APF-3-AID_UPDATE_FAILED: apf_80211.c:6571 Error updating Association ID for REAP AP Client10:bd:18:1a:54:b0 - AID 9

*apfMsConnTask_3: Mar 07 09:52:52.671: #LWAPP-3-INVALID_AID2: spam_api.c:1465 Association identifier 9 for client 34:4d:f7:7d:1c:42 is already in use by 80:00:0b:b7:56:3d

This is the issue:

Philip D'Ath — Mon, 07 Mar 2016 18:55:38 GMT

This is the issue:

Get AP Certificate: failed to get local certificate

The AP is missing its burned in certificate. If it was me, I think I would return the access points. I'm wondering if they are genuine Cisco AP's.

Failing that, you may be able to put a locally significant certificate on it if you like a lot of pain.

http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/110141-loc-sig-cert.html

They are refurbished access

Jacob Simons — Mon, 07 Mar 2016 21:38:33 GMT

They are refurbished access points. They have a sticker on the back that says Cisco Wholesale Refurbished. It does have the rest of the standard stickers on the back with the model and serial numbers and such.

Refer the link : https:/

mohanak — Tue, 08 Mar 2016 01:50:35 GMT

Refer the link : https://supportforums.cisco.com/discussion/12341441/unable-join-cisco-ap-2602i-ap-wlc-2504-version-801000

https://supportforums.cisco.com/discussion/12562396/ap-fetal-error

Thank you for your response.

Jacob Simons — Tue, 08 Mar 2016 14:17:18 GMT

Thank you for your response.

Both links look to be problems caused by the software level on the controller being version 8. As I said in my first post I am running version 7.6.

Have you already tried to

Freerk Terpstra — Tue, 08 Mar 2016 19:25:05 GMT

Have you already tried to download one of the latest ap1g2-k9w8 images from the Cisco website and install it manually?

Yes, I did try with 15.3

Jacob Simons — Tue, 08 Mar 2016 20:26:13 GMT

Yes, I did try with 15.3.jbb6. That was the newest I could download. I got the same result as with the stock IOS. I also put on the same IOS that I had used in the previous 1600's that we have purchased. That is version 15.3.JA. That also did the same thing.

I also contacted the company that I purchased the AP's from. There tech department is going to look into the issue and possibly send me a couple new access points.

I found out why they are

Jacob Simons — Wed, 09 Mar 2016 20:44:09 GMT

I found out why they are behaving like they are. The company that I bought them from gets them and then hooks them up to a WLC to make sure they work and such. Their WLC is running software version 8. Once it connects up to that the certificate gets updated and it won't connect to a controller running anything older.

I even when so far as to delete everything out of the flash directory and reload from the rommon prompt but the cert is still there.

I have them looking into whether they have any access points that haven't been hooked up to their controller yet that I can just reset myself.