The issue is to do with the AP version. The new AP shipped with a version 14.something, all the other APs and the one you tested with are 15.2. Manually upgrading the AP to 15.2 then allowed it to try the external IP, fail and try the internal IP as expected. I then tested turning off the NAT on the controller, bringing the AP up with its original 14. version, letting the controller upgrade the AP then turning NAT back on. This worked and was much easier than manual upgrade, so I'll be using this process for future new APs that come with a old version. I didn't notice any loss of the OEAPs when I turned NAT off temporarily on the controller. Is that setting only used during discovery? Thanks for your assistance.
... View more
I'm running 7.4.100.60 on the WLC5508. Output of the new AP booting and not joining is.. *Sep 25 13:51:16.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: x.x.x.x peer_port: 5246 *Sep 25 13:51:30.000: DTLS_CLIENT_ERROR: ../dtls/dtls_connection_db.c:1924 Max retransmission count reached! *Sep 25 13:51:30.000: %DTLS-3-HANDSHAKE_RETRANSMIT: Max retransmit count for x.x.x.x is reached. Which just keeps looping every few mins. I'll have to wait until I can get downtime on a working AP to post that output. I should mention that all the other local APs were configured before the OEAP ones were added and the NAT options configured.
... View more
I have the same problem except the new Local AP I'm trying to add is in the same subnet as the WLC management interface. I can't remove the NAT config because there are still OEAPs in use. "AP Discovery - NAT IP only" is already disabled on the controller and from what I've read this means the discovery is given both IP's of the WLC (internal and NAT'd), but th e new Local AP (1142) only ever tries to connect to the NAT'd address which of course it cannot reach. Even using " lwapp ap controller ip address x.x.x.x" to point it to the local address of the WLC does not work.
... View more
Thank you for your advice. I have done some playing around and have found the solution to my problem, hopefully it will help the others as well. The issue seems to be the format of the final PEM file being uploaded. The controller seems to be expecting a file in the following format.. -----BEGIN CERTIFICATE----- Device cert -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- Intermediate cert -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- Root Cert -----END CERTIFICATE----- -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC, -----END RSA PRIVATE KEY----- But the version of OpenSSL I was using ended up in this format.... Bag Attributes -----BEGIN CERTIFICATE----- Device Cert -----END CERTIFICATE----- Bag Attributes: -----BEGIN CERTIFICATE----- Intermediate Cert -----END CERTIFICATE----- Bag Attributes: -----BEGIN CERTIFICATE----- Root Cert -----END CERTIFICATE----- Bag Attributes -----BEGIN ENCRYPTED PRIVATE KEY----- Private key -----END ENCRYPTED PRIVATE KEY----- So using the command OpenSSL>rsa -in mykey.pem -des3 -out keyout.pem I encrypted the private key using Triple DES, it prompted for a passphrase. I did not then run the pkcs12 commands, but combined the certs and key myself. Creating a new file in notepad I pasted the X509 certs from Thawte, followed by the contents of keyout.pem in the format.. -----BEGIN CERTIFICATE----- Device cert -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- Intermediate cert -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- Root Cert -----END CERTIFICATE----- -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC, -----END RSA PRIVATE KEY----- I saved the file as final.pem Setting the certpassword parameter as the pass phrase used in the DES3 encryption. The upload then worked as expected. I'm guessing the issue is down to a different version of OpenSSL being used. Hopefully this will work for others as well.
... View more
I am also having exactly the same issue with a certificate from Thawte. I followed the unchained guide and have tried both with and without a password in the initial step key generation step, requesting a new cert each time. As with Jeensernchew's issue there are no errors in OpenSSL but when uploading the cert to the WLC get the following error. *Jun 04 10:51:07.789: sshpmAddWebauthCert: extractingprivate key from webauth cert; pwd: . *Jun 04 10:51:07.793: sshpmDecodePrivateKey: private keydecode failed... *Jun 04 10:51:07.793: sshpmAddWebauthCert: key extractionfailed. The WLC is running version 6.0.196.0. I am using OpenSSL 1.0.0 29 Mar 2010. When I requested the cert from Thawte I was asked to specify the device type, I chose Cisco, but as all the work and conversion is being done by OpenSSL, should I have chosen differently?
... View more
