This is a "normal" message if you use more than one WLC and have the APs split to those WLCs. If a user is now roaming from AP1 (connected to WLC1) to AP2 (connected to WLC2) and back to AP1, then this message appears. I suggest you connect the APs of a building all to the same WLC, to get rid of this message. ... View more

Don't do it. The AP anyway can't reach speeds > 1 Gbps on wireless on normal circumstances, so you will not win anything by using load-balancing. Unless you can really use 2x a 160 MHz channel and you have 4 stream clients that are 160 MHz capable. Then it might be theoretically possible for it to reach > 1 Gbps peaks. You will actually loose a switch port and have a way more complicated configuration.   ... View more

You want to use WIRED phones and not WIRELESS ones, correct? If WIRED, then it all depends on the switches. Next question is, do you want to use a dedicated VLAN for the phones (and do they support a voice vlan?) or not. Depending on that you have to make a configuration on the switches or not. If not, then just plug them in and they should work (assuming they are SIP based and the SIP server is in the same VLAN). ... View more

Does the AP now still reboot from time to time while connected to the switch? Do you get any error message on the AP if you have a console cable attached and run a serial program? ... View more

You already tested a different Switch port and you received the same result? Did you replace that cable between the AP and Switch already? ... View more

8.8.120.0 is still very new and that's the reason why it's not yet TAC approved. I guess in 1-2 weeks, unless some serious bugs are found, it will be TAC approved and 8.8.110.0 removed. ... View more

I also back Leos suggestion for going to 8.5.140.0. Running very stable and is the last train (8.5) that supports the 3500 series. ... View more

You are mixing different light technologies, that will not work: 1000BASE-SX short wavelength; with DOM GLC-SX-MMD 1000BASE-LX/LH long-wavelength; with DOM GLC-LH-SMD You have to use twice SX or LH, but not mix it. ... View more

Basically all wireless sets will work, as long as they adhere to Wi-Fi standards. The question is, what specific features do you want to use for improved voice features. Like CAC, data rates, QoS, separate SSID, coverage … Please note, that phone only supports 802.11a/b/g. That means I would put it onto the 2.4 GHz band and would move all computer clients to the 5 GHz band, because the phones will vastly decrease your wireless performance while calls are active. ... View more

Although it probably doesn't fix your chromebook issue, also consider upgrading to 8.5.140.0, which fixes various other bugs with the 3800 series. Sadly a possible reboot bug in the 3504 is still open in 8.5.140.0 :( Will be fixed in the next release (there is an open beta for production networks for 8.5MR5 here in the forum). Release notes 8.5.140.0: https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn85mr4.html ... View more

Now that I read that again, it remains me of an issue I had with a single 2802i in ME configuration running 8.8.111.0. I had a Netgear Bridge with several wired clients attached to the bridge. As soon as a second client on the bridge came online, my whole wireless was offline, for around a minute. For whatever reason, the ARP entries were wrong of my wired clients once that happened. After around 1 minute it recovered. I then replaced it with an Ubiquiti AC Wave2 model (the Cisco was just temporary) and guess what, with the Ubiquiti I had the exactly same issue, only that the Ubi never recovered until I rebooted it. Then I installed the latest beta firmware on it and it started to work correctly. Anyway, did you also try 8.8.120.0? Maybe that fixes the issue. ... View more

Looks correct.  Then I'm out of ideas sorry.    Honestly, I haven't yet seen people complaining about broken images on their AP here on the forum. Thus my suggestion is: Upgrade to the latest WLC version, 8.3.150.0 was released today, it includes the flash corruption fix. Same as 8.8.120.0 and 8.5.140.0. Then, before rebooting the WLC, pre-load the new image to all APs. If that shows as successful, the chances are very good that they will come up as soon as you reboot the WLC correctly. ... View more

I was curious and just tested this on my WLC running 8.8.120.0 with Cipher-Option-High enabled and rebooted. The result of the sslscan tool from: https://github.com/rbsec/sslscan is this (compiled it without SSLv2 support): ./sslscan --no-failed 172.16.102.12 Version: 1.11.13-rbsec-static OpenSSL 1.0.2-chacha (1.0.2g-dev) Connected to 172.16.102.12 Testing SSL server 172.16.102.12 on port 443 using SNI name 172.16.102.12 TLS Fallback SCSV: Server supports TLS Fallback SCSV TLS renegotiation: Secure session renegotiation supported TLS Compression: Compression disabled Heartbleed: TLS 1.2 not vulnerable to heartbleed TLS 1.1 not vulnerable to heartbleed TLS 1.0 not vulnerable to heartbleed Supported Server Cipher(s): Preferred TLSv1.2 256 bits AES256-GCM-SHA384 Accepted TLSv1.2 256 bits AES256-SHA256 Accepted TLSv1.2 256 bits AES256-SHA Accepted TLSv1.2 256 bits CAMELLIA256-SHA Accepted TLSv1.2 128 bits AES128-GCM-SHA256 Accepted TLSv1.2 128 bits AES128-SHA256 Accepted TLSv1.2 128 bits AES128-SHA Accepted TLSv1.2 128 bits SEED-SHA Accepted TLSv1.2 128 bits CAMELLIA128-SHA Accepted TLSv1.2 128 bits IDEA-CBC-SHA Preferred TLSv1.1 256 bits AES256-SHA Accepted TLSv1.1 256 bits CAMELLIA256-SHA Accepted TLSv1.1 128 bits AES128-SHA Accepted TLSv1.1 128 bits SEED-SHA Accepted TLSv1.1 128 bits CAMELLIA128-SHA Accepted TLSv1.1 128 bits IDEA-CBC-SHA Preferred TLSv1.0 256 bits AES256-SHA Accepted TLSv1.0 256 bits CAMELLIA256-SHA Accepted TLSv1.0 128 bits AES128-SHA Accepted TLSv1.0 128 bits SEED-SHA Accepted TLSv1.0 128 bits CAMELLIA128-SHA Accepted TLSv1.0 128 bits IDEA-CBC-SHA SSL Certificate: Signature Algorithm: sha256WithRSAEncryption RSA Key Strength: 2048 Subject: 169.254.1.1 Altnames: IP Address:169.254.1.1, URI:https://169.254.1.1 Issuer: 169.254.1.1 Not valid before: Jul 18 00:00:01 2018 GMT Not valid after: Jul 18 00:00:01 2028 GMT ... View more

I'm not sure you can directly see that on the WLC. You can probably test this by using Nessus:  https://www.owasp.org/index.php/Testing_for_SSL-TLS_(OWASP-CM-001)   ... View more

Sorry I don't know, maybe somebody else can help. ... View more