WLC 5520 not join AP - ap disassociated previously due to Link Failure

[Roberto Casagrande]

Hi and thanks for support,

I have a wlc 5520 and 5 ap registered. The model that I'm using is AIR-CAP2702I-E. Now I have 3 ap with the same model that work fine.

This AP is only in the site , but I try to connect in other site and work fine. The configuration of switch is same of the site when I tested.

The messagges of the error that I see in wlc are:

0	Mon Feb 4 10:46:45 2019	AP Disassociated. Base Radio MAC:58:97:bd:fa:19:a0 ApName - AP-XXXX-1
1	Mon Feb 4 10:46:45 2019	AP's Interface:1(802.11a) Operation State Down: Base Radio MAC:58:97:bd:fa:19:a0 Cause=Heartbeat Timeout Status:NA
2	Mon Feb 4 10:46:45 2019	AP's Interface:0(802.11b) Operation State Down: Base Radio MAC:58:97:bd:fa:19:a0 Cause=Heartbeat Timeout Status:NA
3	Mon Feb 4 10:45:53 2019	AP 'AP-XXXXX-1', MAC: 58:97:bd:fa:19:a0 disassociated previously due to Link Failure. Uptime: 0 days, 01 h 46 m 47 s . Reason: Capwap configuration status.

The version of WLC is 8.3.143.0.

The version of the switch and the model is the same of the site where functioned.

Thanks for support.

Roberto

[marce1000]

 - Perhaps the capwap-latency is beyond spec (200ms) if I remember correctly.

M.

[Roberto Casagrande]

Hi Marce1000 and thanks,
If I test with ping from switch to controller I have 38 ms of the roud-trip.
I think is not this the problem.
this site is connected to the central with a vpn ipsec

[Scott Fella]

You need to set the TCP MSS value to 1300. You can do this from the WLC GUI.

https://mrncciew.com/2013/04/07/configuring-tcp-mss/

[Roberto Casagrande]

I have already set up this to 1363 mss into controller.
Now I have set to 1300 and I have testin with 1280.
We have the same problem.

(Cisco Controller) >show ap tcp-mss-adjust all

AP Name TCP State MSS Size
------------------ -------- -------
AP-xxxxx-1 enabled 1280

[Rich R]

TCP MSS will make no difference to CAPWAP traffic which is UDP, that only affects client TCP traffic (by intercepting and altering the TCP SYN packet from client).

Without more detail hard to say what might be causing it - run debugs on WLC and check the logs on the AP itself.

Obviously check switch and router logs at site and check for congestion or packet loss between the AP and WLC.

[Scott Fella]

Just making sure as that is needed when there is a vpn tunnel between the ap and WLC.

[Roberto Casagrande]

yes the mss is was setting in the interface tunnel. If I do not insert that the connection does not work (example: email with attached file and other problems with applications that can not explained the reason why is not work)
Now I try with poe injector. I hope who will resoled.
Roberto