Solved: Cisco 3702i not joining ME Controller

jonssonm1 · ‎04-09-2019

Hi, I just got a 3802 AP that I'm testing ME on at home. The 3802 is running version 8.5.140.0 ME code and works as it should currently.

I'm trying to get a 3702i that I recently converted from Automous to LW running 15.2(4)JB with image ap3g2-k9w8-xx.153-3.JI4.

The AP is attempting to join the WLC but never successfully does and is currently in a loop. Some of the lines from debug capwap errors log on the WLC are:

(Cisco Controller) >*spamApTask0: Apr 09 10:47:59.361: 00:d7:8f:28:1f:80 Failed to parse CAPWAP packet from 10.0.1.127:60215

*spamApTask0: Apr 09 10:48:53.806: 00:00:00:00:00:00 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 10.0.1.127:60215)since DTLS session is not established

*spamApTask0: Apr 09 10:49:03.806: 00:d7:8f:28:1f:80 ApModel: AIR-CAP3702I-B-K9

*spamApTask0: Apr 09 10:49:03.806: 00:d7:8f:28:1f:80 we already missed the echo from this AP. Echo time 37 time value 1554824943, last echo 1554824784
*spamApTask0: Apr 09 10:49:03.806: 00:d7:8f:28:1f:80 Echo Timer Expiry: Missing Echo from AP00:d7:8f:28:1f:80, Closing dtls Connection.
*spamApTask0: Apr 09 10:49:03.808: 00:d7:8f:28:1f:80 ApModel: AIR-CAP3702I-B-K9

*spamApTask0: Apr 09 10:49:14.058: 00:d7:8f:28:1f:80 Unable to get Ap mode in Join request

*spamApTask0: Apr 09 10:49:14.079: 00:d7:8f:28:1f:80 Missing ap-image TFTP params, need to configure file path and server IP

*spamApTask0: Apr 09 10:49:14.080: 00:d7:8f:28:1f:80 State machine handler: Failed to process msg type = 15 state = 5 from 10.0.1.127:60215

*spamApTask0: Apr 09 10:49:14.080: 00:d7:8f:28:1f:80 Failed to parse CAPWAP packet from 10.0.1.127:60215

spamApTask0: Apr 09 10:50:34.200: 00:d7:8f:28:1f:80 ApModel: AIR-CAP3702I-B-K9

*spamApTask0: Apr 09 10:50:34.202: 00:d7:8f:28:1f:80 ApModel: AIR-CAP3702I-B-K9

and from debug capwap events enable are:

(Cisco Controller) >*osapiBsnTimer: Apr 09 10:51:43.796: 00:00:00:00:00:00 Wait join timer expired for connection 10.0.1.127:60214
*spamApTask0: Apr 09 10:51:43.797: 00:00:00:00:00:00 Disconnecting due to a wait join timer expiry event for (10.0.1.127:60214) server details (10.0.1.200:5246)

*spamApTask0: Apr 09 10:51:43.797: 00:00:00:00:00:00 Found DTLS connection 0x7fca4a8, disconnecting it
*spamApTask0: Apr 09 10:51:43.797: 00:00:00:00:00:00 Deleting AP entry 10.0.1.127:60214 from temporary database.
*spamApTask0: Apr 09 10:51:43.797: 00:00:00:00:00:00 DTLS connection closed event receivedserver (10.0.1.200/5246) client (10.0.1.127/60214)
*spamApTask0: Apr 09 10:51:43.797: 00:00:00:00:00:00 No entry exists for AP (10.0.1.127/60214)
*spamApTask0: Apr 09 10:51:43.797: 00:00:00:00:00:00 No AP entry exist in temporary database for 10.0.1.127:60214
*spamApTask0: Apr 09 10:51:43.803: 00:00:00:00:00:00 DTLS connection not found, creating new connection for 10.0.1.127 (60214) 10.0.1.200 (5246)

*spamApTask0: Apr 09 10:51:44.053: 00:00:00:00:00:00 DTLS Session established server (10.0.1.200:5246), client (10.0.1.127:60214)
*spamApTask0: Apr 09 10:51:44.053: 00:00:00:00:00:00 Starting wait join timer for AP: 10.0.1.127:60214

*spamApTask0: Apr 09 10:51:52.037: 00:ea:bd:6d:88:20 Echo Request from 10.0.1.126:5248

*spamApTask0: Apr 09 10:51:52.037: 00:ea:bd:6d:88:20 Echo Response sent to 10.0.1.126:5248

ANY help here would be appreciated. Thanks

Rich R · ‎04-10-2019

From your debugs:
*spamApTask0: Apr 09 10:49:14.079: 00:d7:8f:28:1f:80 Missing ap-image TFTP params, need to configure file path and server IP

Did you install the "Cisco 3800 Series Mobility Express Release 8.5 Software. Access Point image bundle, to be used for software update and/or supported access points images." ?https://software.cisco.com/download/home/286304981/type/286289839/release/8.5.140.0

https://www.cisco.com/c/en/us/td/docs/wireless/access_point/mob_exp/85/user_guide/b_ME_User_Guide_85/manage.html#concept_F9DFFCFBB1D94289838733DF8871AF33

Regards

Rich

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.190.0, latest 9800 releases, 8.5.182.11 (8.5 mainline) and 8.5.182.108 (8.5 IRCM)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs

View solution in original post

Rich R · ‎04-10-2019

From your debugs:
*spamApTask0: Apr 09 10:49:14.079: 00:d7:8f:28:1f:80 Missing ap-image TFTP params, need to configure file path and server IP

Did you install the "Cisco 3800 Series Mobility Express Release 8.5 Software. Access Point image bundle, to be used for software update and/or supported access points images." ?https://software.cisco.com/download/home/286304981/type/286289839/release/8.5.140.0

https://www.cisco.com/c/en/us/td/docs/wireless/access_point/mob_exp/85/user_guide/b_ME_User_Guide_85/manage.html#concept_F9DFFCFBB1D94289838733DF8871AF33

Regards

Rich

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.190.0, latest 9800 releases, 8.5.182.11 (8.5 mainline) and 8.5.182.108 (8.5 IRCM)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs

jonssonm1 · ‎04-11-2019

Thanks for pointing me in the right direction. I went through my TFTP logs and found that the transfer was failing after transferring the version.info file. I pulled that file then ran TFTP update on the ME and all was well after that.

Thanks again!

ZawHtet45843 · ‎02-02-2021

.

ZawHtet45843 · ‎02-02-2021

Hi Rich,

I have also this problem

AP model-3802i
software ver-8.5.140

please help!

(Cisco Controller) >*spamApTask0: Jan 30 18:28:11.715: c8:84:a1:bc:e5:20 Unable to get Ap mode in Join request

*spamApTask0: Jan 30 18:28:11.829: c8:84:a1:bc:e5:20 Recieved Invalid Fragmentation Threshold From AP = 0

*spamApTask0: Jan 30 18:28:11.830: c8:84:a1:bc:e5:20 Channel 36 is invalid in the domain
*spamApTask0: Jan 30 18:28:11.830: c8:84:a1:bc:e5:20 Regulatory Domain Mismatch: AP c8:84:a1:bc:e5:20 not allowed to join. Allowed domains: 802.11bg:-A 802.
*spamApTask0: Jan 30 18:28:11.831: c8:84:a1:bc:e5:20 Failed post decode processing of config status from 192.168.40.1:5272

*spamApTask0: Jan 30 18:28:11.831: c8:84:a1:bc:e5:20 State machine handler: Failed to process msg type = 5 state = 5 from 192.168.40.1:5272

*spamApTask0: Jan 30 18:28:11.831: c8:84:a1:bc:e5:20 Failed to parse CAPWAP packet from 192.168.40.1:5272

*spamApTask0: Jan 30 18:28:11.835: 00:00:00:00:00:00 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 192.168.40.1:5272)since DTLS session is not established

*spamApTask0: Jan 30 18:28:14.564: 00:00:00:00:00:00 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 192.168.40.1:5272)since DTLS session is not established

*spamApTask0: Jan 30 18:28:17.415: 00:00:00:00:00:00 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 192.168.40.1:5272)since DTLS session is not established

*spamApTask0: Jan 30 18:28:20.266: 00:00:00:00:00:00 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 192.168.40.1:5272)since DTLS session is not established

*spamApTask0: Jan 30 18:28:23.116: 00:00:00:00:00:00 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 192.168.40.1:5272)since DTLS session is not established

*spamApTask0: Jan 30 18:28:23.117: 00:00:00:00:00:00 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 192.168.40.1:5272)since DTLS session is not established

*spamApTask0: Jan 30 18:28:25.967: 00:00:00:00:00:00 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 192.168.40.1:5272)since DTLS session is not established

debug capwap errors disable *spamApTask0: Jan 30 18:28:28.819: 00:00:00:00:00:00 Discarding non-ClientHello Handshake OR DTLS encrypted packet from 192.168.40.1:5272)since DTLS session is not established

(Cisco Controller) >

patoberli · ‎02-02-2021

Which exact AP model is it? It's printed on the label. And which country is enabled on the controller?

Rich R · ‎02-03-2021

Just to be clear @ZawHtet45843 this is not the same problem!

Your problem is: "Regulatory Domain Mismatch: AP c8:84:a1:bc:e5:20 not allowed to join" clearly stated in the logs.

Hence @patoberli question about the exact AP model and what country is enabled on your WLC?

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.190.0, latest 9800 releases, 8.5.182.11 (8.5 mainline) and 8.5.182.108 (8.5 IRCM)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs

ZawHtet45843 · ‎02-03-2021

Thanks, reply to me Mr,rrudling

I mean, the same is the cisco ap is not joining the ME controller and unknow itself because I wrong my country code in ME controller.

Special Thanks.

ZawHtet45843 · ‎02-03-2021

Thanks, reply to me Mr.patoberli.

Now I got it, I change the country code in the controller. and then everything is work and no error message.

patoberli · ‎02-04-2021

Perfect

patoberli · ‎04-11-2019

For ME, you require a TFTP server, where you have the needed software updates for the different AP types saved. That TFTP server you have to configure on the Master AP. While the new AP boots, it checks if it requires an update. If yes, it connects to that TFTP server and downloads the file it requires.
Alternatively you can manually, through console, update the AP image of the 3702i from another TFTP server and then connect it again to the ME network.