AIR-LAP1242G-E-K9 does not register with Cisco 4402 WLAN Controller

[Ozan Oguz]

Hi everyone,

We are using multiple AIR-LAP1242G-E-K9 access points with single 4402 WLAN controller with one of our customers. Here is the detailed info :

- WLAN management (192.168.1.51) and ap-manager IP's (192.168.1.50) are on same subnet & VLAN 12

- AP management network is on different VLAN. (VLAN 75) and has different subnet (10.0.91.0/25)

- We are using Cisco DHCP with option 43 on 6509 backbone switch, so here is the config :

ip dhcp pool AP
   network 10.0.91.0 255.255.255.128   ---------> VLAN75 network which belongs to APs
   default-router 10.0.91.126                  -------->  6509 backbone switch HSRP virtual IP
   option 60 ascii "Cisco AP c1240"        ------> we are using 1242 models
   option 43 hex f104.c0a8.0132            --------->  we have 1 controller (f104) with IP address of 192.168.1.50 (c0a80132 in hex)
   domain-name xxx.xx                      ---------> local domain name of our customer

- Here is the switchport configuration which is connected to AP on local switch :

switchport trunk native vlan 75
switchport mode trunk
spanning-tree portfast

- After we connected the AP, the console output is atached and access point is continuously registering itself to controller and falling.

*Mar  9 14:46:42.510: %CAPWAP-3-ERRORLOG: Dropping dtls packet since session is not established.

I can send any debugging logs if needed.

Any idea on what could be wrong is highly appreciated.

Thank you.

Ozan Oguz

CCIE#22559

[Scott Fella]

That LAP should not be connected to a trunk port unless that LAP is configured as an H-REAP AP and utilizing more than one vlan.  Try to stage the LAP in the same subnet as the WLC management vlan.... easies way.  The LAP should join and then just move it to the vlan you want it to be on.

[weterry]

Well I was going to tell you to correct your option 43, as it is supposed to go to the Mangement IP address. So it should be f104.c0a8.0133.

However, according to your log, the AP is sending DTLS (sucessfully) to the .50 AP-Manager, so I'd like to think it properly sent discovery to the .51 Management IP address.

Are all APs doing this?

I suppose it might not hurt to find out what the WLC is doing in all this mix. Perhaps "debug capwap events enable" "debug capwap error enable"....

But I too would suggest you go to an access switchport, just to see if it helps.

any chance the country code just isn't set correctly on the WLC for the -E AP?

[Leo Laohoo]

Been there, done that ... The port for the AP to the switch should be an access port and not a trunk port.