Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About PJR_CDF
09-11-2019
Stats
Member since
06-20-2018
16
Posts
0
Helpful
2
Solutions
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-17-2018
06:22 AM
08-17-2018
06:22 AM
This root cause for this issue has now been established.
It would appear the controller in question had previously been setup to use LSC certs and configured to talk to a (now offline) CA.
Previous OS updates of the WLC didnt cause an issue but the jump from 8.0 to 8.3 caused this issue.
It wasnt possible to disable LSC from the GUI (it errored) but once disabled via the CLI, APs were able to connect.
Thanks to all those who provided input into this thread.
... View more
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-17-2018
06:22 AM
08-17-2018
06:22 AM
This root cause for this issue has now been established.
It would appear the controller in question had previously been setup to use LSC certs and configured to talk to a (now offline) CA.
Previous OS updates of the WLC didnt cause an issue but the jump from 8.0 to 8.3 caused this issue.
It wasnt possible to disable LSC from the GUI (it errored) but once disabled via the CLI, APs were able to connect.
Thanks to all those who provided input into this thread.
... View more
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-17-2018
02:53 AM
08-17-2018
02:53 AM
Thanks for that - I had checked it previously.
The serials of our APs were not listed as affected.
Plus the same APs are able to connect to another 5508 that was purchased at the exact same time.
The issues also affects our new box fresh 2802 APs which have a much more recent manufacture date than the 2602's.
The cert expiry dates on both WLCs are identical. Which cert specifically on the WLC is critical as there are some that have expired (listed below)
Airespace Root CA cert
Old Airespace CA cert
Airespace Id cert
Old Airespace Id cert
The Cisco SHA1 device cert on both devices is valid until 2023
... View more
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-17-2018
02:37 AM
08-17-2018
02:37 AM
thanks for this but 8.3.143.0 isnt listed as an affected release?
... View more
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-17-2018
01:40 AM
08-17-2018
01:40 AM
Topology
2 x WLC 5508 with 13 x 2602 APs and 4 x 2802 APs
No WLC SSO HA in place - just primary and secondary controllers specified in the AP's config
I have previously posted about this issue in this thread
https://community.cisco.com/t5/wireless-and-mobility/2602-ap-s-wont-connect-to-5508wlc-after-update-to-8-3-143-pki/m-p/3681836#M102238
Previously I had been upgrading our secondary controller only to 8.3.143.0. Last night I upgraded our primary WLC to 8.3.143.0 and all the AP's upgraded and connected without issue. This is the exact step that failed when I upgraded our secondary as per the previous post.
When I shut down our primary WLC to allow the (now upgraded) APs to failover to our secondary, the APs were still unable to negotiate a DTLS connection to the secondary controller.
The issue is now no longer an AP/WLC software incompatibility. It appears the issue is specific to our secondary WLC and only, when it runs 8.3.143.0 (as all APs are able to connect to it when it runs 8.0.152.0).
We have also now been able to rule out issues relating to the age of the 2602 APs, as since the update to 8.3.143.0 was successful on our primary WLC, we introduced 4 new box fresh 2802 APs which connected immediately without issue. When failed over to our secondary WLC, these exhibited the same issue as the 2602s (see below logs from secondary WLC with IPs obfuscated)
*spamApTask4: Aug 16 17:47:20.847: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask5: Aug 16 17:47:20.349: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 b0:fa:eb:56:5d:78: Failed to create DTLS connection for AP xx.xx.0.22 (26072). *spamApTask5: Aug 16 17:47:20.348: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask4: Aug 16 17:47:20.005: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 00:06:f6:ec:e3:85: Failed to create DTLS connection for AP xx.xx.0.21 (52793). *spamApTask4: Aug 16 17:47:20.004: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask6: Aug 16 17:47:19.992: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 00:06:f6:ec:d7:9f: Failed to create DTLS connection for AP xx.xx.0.23 (52602). *spamApTask6: Aug 16 17:47:19.992: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask7: Aug 16 17:47:19.720: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 4c:4e:35:03:4b:f9: Failed to create DTLS connection for AP xx.xx.0.20 (13505). *spamApTask7: Aug 16 17:47:19.720: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask5: Aug 16 17:47:19.372: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 b0:fa:eb:56:5c:b8: Failed to create DTLS connection for AP xx.xx.0.19 (26061). *spamApTask5: Aug 16 17:47:19.372: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask3: Aug 16 17:47:18.999: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 4c:4e:35:03:4b:fb: Failed to create DTLS connection for AP xx.xx.0.17 (13504). *spamApTask3: Aug 16 17:47:18.999: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask2: Aug 16 17:47:18.858: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 00:06:f6:a5:51:dc: Failed to create DTLS connection for AP xx.xx.7.49 (13657). *spamApTask2: Aug 16 17:47:18.857: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask5: Aug 16 17:47:16.349: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 b0:fa:eb:56:5d:78: Failed to create DTLS connection for AP xx.xx.0.22 (26072). *spamApTask5: Aug 16 17:47:16.348: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask6: Aug 16 17:47:15.992: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 00:06:f6:ec:d7:9f: Failed to create DTLS connection for AP xx.xx.0.23 (52602). *spamApTask6: Aug 16 17:47:15.991: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask7: Aug 16 17:47:15.720: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 4c:4e:35:03:4b:f9: Failed to create DTLS connection for AP xx.xx.0.20 (13505). *spamApTask7: Aug 16 17:47:15.720: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed *spamApTask3: Aug 16 17:47:14.748: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 b0:fa:eb:56:5d:53: Failed to create DTLS connection for AP xx.xx.0.14 (26070). *spamApTask3: Aug 16 17:47:14.748: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed
A comparison of show certificate all from both WLCs looks good to my eyes
Any ideas on what the issue could be?
... View more
Labels:
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-09-2018
03:43 AM
08-09-2018
03:43 AM
Hi,
I am planning an update to our WLC and AP's (2602s) and wanted to clarify the behaviour around the pre download function.
We are going from 8.0.152.0 to 8.3.143.0
I know from both the GUI and CLI you can issue a command to pre download software from the WLCs primary or backup image.
I believe this command relates to the version of software (either primary or backup) on the WLC. So when I upload 8.3.143.0 code to the WLC it will make that the primary code. If I then choose to predownload primary to my APs they get the 8.3.143.0 code pushed to them.
When I do a show ap image all from the CLI of the controller, where should I expect to see that 8.3.143.0 code listed?
Will I see that under primary image or backup image in the output?
I am trying to understand the AP behaviour from that point - if it puts it in primary, does it automatically put the previous code (8.0.152.0) as the backup image? Or does it put 8.3.143.0 code as the backup image?
If it puts it as the backup image, how do I get he AP to boot into 8.3.143.0?
Basically I am trying to establish what my rollback position is.
If I push 8.3.143.0 to all APs but have to roll the controller back to 8.0.152.00 for any reason, am I OK from an AP perspective as they will have both software version images and they will automatically boot into the correct one once they contact the controller or do the APs have to be connected to the WLC in order for the command to be issue to them to tell them which software image to use as primary?
Thanks in advance
Paul
... View more
- Tags:
- predownload
Labels:
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-06-2018
03:01 AM
08-06-2018
03:01 AM
option 43 isnt used
I believe the AP knows where the WLC is from it's current configuration and is able to locate the WLC and attempt connection which the logs I posted earlier show (unless I am misinterpreting something?)
I appreciate my original post showed a load of info but in terms of connectivity the WLC logs show attempted connection from the AP
WLC Log
*spamApTask2: Aug 05 15:14:43.021: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 4c:4e:35:03:4b:fb: Failed to create DTLS connection for AP 10.100.0.17 (13505). *spamApTask2: Aug 05 15:14:43.020: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed
AP logs showing attempted connection to WLC
*Aug 5 13:55:10.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.100.0.9 peer_port: 5246
*Aug 5 13:55:39.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0x6B7919C!
I dont think the AP is unable to locate the WLC - It appears to me that the 2 devices are unable to negotiate a secure channel on which to communicate?
Thanks for your continued help by the way
... View more
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-06-2018
02:21 AM
08-06-2018
02:21 AM
I'm not allowed to make changes outside of maintenance windows I'm afraid. Doesn't entering this command just set the CAPWAP controller IP address for the AP? Just trying to understand what adding this command will show us? Thanks for your assistance as always though :)
... View more
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-06-2018
02:07 AM
08-06-2018
02:07 AM
>show sysinfo
Manufacturer's Name.............................. Cisco Systems Inc. Product Name..................................... Cisco Controller Product Version.................................. 8.0.152.0 Bootloader Version............................... 1.0.20 Field Recovery Image Version..................... 7.6.101.1 Firmware Version................................. FPGA 1.7, Env 1.8, USB console 2.2 Build Type....................................... DATA + WPS
System Name...................................... XXXXXXXXXXXX System Location.................................. System Contact................................... System ObjectID.................................. 1.3.6.1.4.1.9.1.1069 Redundancy Mode.................................. Disabled IP Address....................................... 10.100.0.9 IPv6 Address..................................... :: Last Reset....................................... Power on reset System Up Time................................... 0 days 17 hrs 5 mins 23 secs System Timezone Location......................... System Stats Realtime Interval................... 5 System Stats Normal Interval..................... 180
Configured Country............................... GB - United Kingdom Operating Environment............................ Commercial (0 to 40 C) Internal Temp Alarm Limits....................... 0 to 65 C Internal Temperature............................. +35 C External Temperature............................. +23 C Fan Status....................................... OK
State of 802.11b Network......................... Enabled State of 802.11a Network......................... Enabled Number of WLANs.................................. 4 Number of Active Clients......................... 225
Burned-in MAC Address............................ 00:06:F6:62:0B:40 Power Supply 1................................... Present, OK Power Supply 2................................... Absent Maximum number of APs supported.................. 500 System Nas-Id.................................... WLC MIC Certificate Types........................ SHA1
>show time
Time............................................. Mon Aug 6 09:01:37 2018
Timezone delta................................... 0:0 Timezone location................................
NTP Servers NTP Polling Interval......................... 3600
Index NTP Key Index NTP Server NTP Msg Auth Status ------- ---------------------------------------------------------------------------------- 1 0 10.100.0.XX AUTH DISABLED
---------
#sh version Cisco IOS Software, C2600 Software (AP3G2-K9W8-M), Version 15.3(3)JA12, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2017 by Cisco Systems, Inc. Compiled Fri 20-Oct-17 20:51 by prod_rel_team
ROM: Bootstrap program is C2600 boot loader BOOTLDR: C2600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JAY, RELEASE SOFTWARE (fc1)
GC01-F00-AP06 uptime is 17 hours, 9 minutes System returned to ROM by power-on System image file is "flash:/ap3g2-k9w8-mx.153-3.JA12/ap3g2-k9w8-xx.153-3.JA12" Last reload reason:
This product contains cryptographic features and is subject to United States and local country laws governing import, export, transfer and use. Delivery of Cisco cryptographic products does not imply third-party authority to import, export, distribute or use encryption. Importers, exporters, distributors and users are responsible for compliance with U.S. and local country laws. By using this product you agree to comply with applicable laws and regulations. If you are unable to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at: http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to export@cisco.com.
cisco AIR-CAP2602I-E-K9 (PowerPC) processor (revision A0) with 188398K/60928K bytes of memory. Processor board ID FGL1708Z7XA PowerPC CPU at 800Mhz, revision number 0x2151 Last reset from power-on LWAPP image version 8.0.152.0 1 Gigabit Ethernet interface 2 802.11 Radios
32K bytes of flash-simulated non-volatile configuration memory. Base ethernet MAC Address: 4C:4E:35:03:4B:FB Part Number : 73-14588-02 PCA Assembly Number : 800-37899-01 PCA Revision Number : A0 PCB Serial Number : FOC17055MWR Top Assembly Part Number : 800-38356-01 Top Assembly Serial Number : FGL1708Z7XA Top Revision Number : A0 Product/Model Number : AIR-CAP2602I-E-K9
Configuration register is 0xF #sh ip interface brief Interface IP-Address OK? Method Status Protocol BVI1 10.100.0.X YES TFTP up up Dot11Radio0 unassigned NO unset up up Dot11Radio1 unassigned NO unset up up GigabitEthernet0 unassigned NO unset up up Virtual-WLAN0 unassigned NO unset up up Virtual-WLAN0.1 unassigned NO unset up up Virtual-WLAN0.2 unassigned NO unset up up Virtual-WLAN0.3 unassigned NO unset up up Virtual-WLAN0.4 unassigned NO unset up up Virtual-WLAN0.5 unassigned NO unset up up Virtual-WLAN0.6 unassigned NO unset up up Virtual-WLAN0.7 unassigned NO unset up up Virtual-WLAN0.8 unassigned NO unset up up Virtual-WLAN0.9 unassigned NO unset up up Virtual-WLAN0.10 unassigned NO unset up up Virtual-WLAN0.11 unassigned NO unset up up Virtual-WLAN0.12 unassigned NO unset up up Virtual-WLAN0.13 unassigned NO unset up up Virtual-WLAN0.14 unassigned NO unset up up Virtual-WLAN0.15 unassigned NO unset up up Virtual-WLAN0.16 unassigned NO unset up up
-------
WLC commands show details of 8.0.152.0 as we had to roll back I'm afraid
... View more
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
08-06-2018
12:57 AM
08-06-2018
12:57 AM
Updated 5508 WLC from 8.0.152.0 to 8.3.143.0
WLC updated fine but our APs running 8.0.152.0 would not join the WLC (couldn’t even join it to download its updated software)
WLC logs below
*spamApTask3: Aug 05 13:41:25.730: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed
*spamApTask3: Aug 05 13:40:39.729: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 4c:4e:35:03:4b:fb: Failed to create DTLS connection for AP 10.100.0.17 (13504).
*spamApTask3: Aug 05 13:40:39.728: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed
*spamApTask3: Aug 05 13:40:31.729: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 4c:4e:35:03:4b:fb: Failed to create DTLS connection for AP 10.100.0.17 (13504).
*spamApTask3: Aug 05 13:40:31.728: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed
*spamApTask3: Aug 05 13:40:27.729: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 4c:4e:35:03:4b:fb: Failed to create DTLS connection for AP 10.100.0.17 (13504).
*spamApTask3: Aug 05 13:40:27.728: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed
*spamApTask3: Aug 05 13:40:25.729: %CAPWAP-3-DTLS_DB_ERR: capwap_ac_sm.c:9507 4c:4e:35:03:4b:fb: Failed to create DTLS connection for AP 10.100.0.17 (13504).
*spamApTask3: Aug 05 13:40:25.728: %DTLS-3-PKI_ERROR: openssl_dtls.c:562 PKI initialization error : Certificate initialization failed
--------
AP logs below
Feb 4 13:20:14.795: %SSH-5-ENABLED: SSH 2.0 has been enabled
*Feb 4 13:20:14.795: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Feb 4 13:20:15.427: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to down
*Feb 4 13:20:15.643: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Feb 4 13:20:15.843: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down
*Feb 4 13:20:16.843: %SOAP_FIPS-2-SELF_TEST_HW_SUCCESS: HW crypto FIPS self test passed (2-16)
*Feb 4 13:20:16.843: DPAA Initialization Complete
*Feb 4 13:20:16.843: %SYS-3-HARIKARI: Process DPAA INIT top-level routine exited
*Feb 4 13:20:17.847: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
*Feb 4 13:20:18.863: %LINK-6-UPDOWN: Interface BVI1, changed state to up
*Feb 4 13:20:19.863: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Feb 4 13:20:20.315: Currently running a Release Image
validate_sha2_block: Failed to get certificate chain
*Feb 4 13:20:20.731: Using SHA-1 signed certificate for image signing validation.
*Feb 4 13:20:27.075: APAVC: Succeeded to activate all the STILE protocols.
*Feb 4 13:20:27.075: APAVC: Registering with CFT
*Feb 4 13:20:27.075: APAVC: CFT registration of delete callback succeeded
*Feb 4 13:20:27.075: APAVC: Reattaching Original Buffer pool for system use
*Feb 4 13:20:27.075: Pool-ReAtach: paks 18174 radio17566
*Feb 4 13:20:34.275: AP image integrity check PASSED
*Feb 4 13:20:34.387: validate_sha2_block:No SHA2 Block present on this AP.
*Feb 4 13:20:34.403: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Feb 4 13:20:34.403: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset
*Feb 4 13:20:44.411: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 255.255.255.255 port 0 CLI Request Triggered
*Feb 4 13:20:55.691: %CDP_PD-4-POWER_OK: Full power - NEGOTIATED inline power source
*Feb 4 13:20:56.791: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up
*Feb 4 13:20:57.791: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up
Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)
*Feb 4 13:20:57.887: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up
*Feb 4 13:20:58.887: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up
*Aug 5 13:55:10.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.100.0.9 peer_port: 5246
*Aug 5 13:55:39.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0x6B7919C!
*Aug 5 13:56:09.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.100.0.9:5246
----------
I'm guessing the Cert issue relates to the lack of SHA2 block message on our APs?
---------
The result of show crypto ca certificates as as below
CA Certificate
Status: Available
Certificate Serial Number (hex): 01
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA M2
o=Cisco
Subject:
cn=Cisco Root CA M2
o=Cisco
Validity Date:
start date: 13:00:18 UTC Nov 12 2012
end date: 13:00:18 UTC Nov 12 2037
Associated Trustpoints: Trustpool cisco-m2-root-cert
Storage:
CA Certificate
Status: Available
Certificate Serial Number (hex): 02
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA M2
o=Cisco
Subject:
cn=Cisco Manufacturing CA SHA2
o=Cisco
CRL Distribution Points:
http://www.cisco.com/security/pki/crl/crcam2.crl
Validity Date:
start date: 13:50:58 UTC Nov 12 2012
end date: 13:00:17 UTC Nov 12 2037
Associated Trustpoints: Trustpool Cisco_IOS_M2_MIC_cert
Storage:
CA Certificate
Status: Available
Certificate Serial Number (hex): 00
Certificate Usage: General Purpose
Issuer:
e=support@airespace.com
cn=ca
ou=none
o=airespace Inc
l=San Jose
st=California
c=US
Subject:
e=support@airespace.com
cn=ca
ou=none
o=airespace Inc
l=San Jose
st=California
c=US
Validity Date:
start date: 23:38:55 UTC Feb 12 2003
end date: 23:38:55 UTC Nov 11 2012
Associated Trustpoints: airespace-old-root-cert
Storage:
CA Certificate
Status: Available
Certificate Serial Number (hex): 00
Certificate Usage: Signature
Issuer:
e=support@airespace.com
cn=Airespace Root CA
ou=Engineering
o=Airespace Inc.
l=San Jose
st=California
c=US
Subject:
e=support@airespace.com
cn=Airespace Root CA
ou=Engineering
o=Airespace Inc.
l=San Jose
st=California
c=US
Validity Date:
start date: 13:41:22 UTC Jul 31 2003
end date: 13:41:22 UTC Apr 29 2013
Associated Trustpoints: airespace-new-root-cert
Storage:
CA Certificate
Status: Available
Certificate Serial Number (hex): 03
Certificate Usage: General Purpose
Issuer:
e=support@airespace.com
cn=Airespace Root CA
ou=Engineering
o=Airespace Inc.
l=San Jose
st=California
c=US
Subject:
e=support@airespace.com
cn=Airespace Device CA
ou=Engineering
o=Airespace Inc.
l=San Jose
st=California
c=US
Validity Date:
start date: 22:37:13 UTC Apr 28 2005
end date: 22:37:13 UTC Jan 26 2015
Associated Trustpoints: airespace-device-root-cert
Storage:
CA Certificate
Status: Available
Certificate Serial Number (hex): 5FF87B282B54DC8D42A315B568C9ADFF
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA 2048
o=Cisco Systems
Subject:
cn=Cisco Root CA 2048
o=Cisco Systems
Validity Date:
start date: 20:17:12 UTC May 14 2004
end date: 20:25:42 UTC May 14 2029
Associated Trustpoints: Trustpool cisco-root-cert
Storage:
Certificate
Status: Available
Certificate Serial Number (hex): 7EAD12810000002375BE
Certificate Usage: General Purpose
Issuer:
cn=Cisco Manufacturing CA
o=Cisco Systems
Subject:
Name: AP3G2-4c4e35034bfb
e=support@cisco.com
cn=AP3G2-4c4e35034bfb
o=Cisco Systems
l=San Jose
st=California
c=US
CRL Distribution Points:
http://www.cisco.com/security/pki/crl/cmca.crl
Validity Date:
start date: 20:53:56 UTC Feb 4 2013
end date: 21:03:56 UTC Feb 4 2023
Associated Trustpoints: Cisco_IOS_MIC_cert
Storage:
CA Certificate
Status: Available
Certificate Serial Number (hex): 6A6967B3000000000003
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA 2048
o=Cisco Systems
Subject:
cn=Cisco Manufacturing CA
o=Cisco Systems
CRL Distribution Points:
http://www.cisco.com/security/pki/crl/crca2048.crl
Validity Date:
start date: 22:16:01 UTC Jun 10 2005
end date: 20:25:42 UTC May 14 2029
Associated Trustpoints: Trustpool Cisco_IOS_MIC_cert
Storage:
------------
I have found multiple Cisco Bugs that refer to similar symptoms but our situation doesn’t quite meet all the criteria
This one looks most similar - https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63916.html but our AP serial number doesn’t show as being affected?
These others show similar symptoms but not exact error matches
https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuq19142/?rfs=iqvred
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCur43050/?referring_site=bugqvinvisibleredir
Anyone able to assist?
Thanks
Paul
... View more
Labels:
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
07-25-2018
01:43 AM
07-25-2018
01:43 AM
Thanks for your response - I resolved the issue by using the Mode button to reset the AP's (which presumably boots the AP into the RCV image?)
Now I know the cause of the issue is related to a reboot of the AP mid update rather than an upgrade path bug/incompatibility, I can schedule another window and ensure the APs are not rebooted during their upgrade.
Out of interest if an AP updates to 8.0.152 and for some unforeseen reason I need to rollback the WLC to 7.4.145.0, will the AP downgrade its software gracefully automatically in the same way they upgrade?
... View more
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
07-24-2018
03:14 AM
07-24-2018
03:14 AM
Flash Dir below - this is post recovery of the AP
Directory of flash:/
2 -rwx 77777 Jul 22 2018 18:13:27 +00:00 event.log 3 -rwx 64 Mar 1 1993 00:01:05 +00:00 sensord_CSPRNG1 4 -rwx 7192 Jul 24 2018 10:12:31 +00:00 private-multiple-fs 5 -rwx 64 Mar 1 1993 00:01:03 +00:00 sensord_CSPRNG0 45 drwx 0 Mar 1 1993 00:00:25 +00:00 configs 46 -rwx 0 Jan 30 2018 09:58:40 +00:00 ce 7 drwx 960 Jul 22 2018 18:13:17 +00:00 ap3g2-k9w8-mx.152-2.JB6 51 -rwx 380 Jul 23 2018 07:30:18 +00:00 env_vars 13 drwx 192 Feb 4 2013 13:18:02 +00:00 ap3g2-rcvk9w8-mx
31739904 bytes total (13079552 bytes free)
... View more
Created by
PJR_CDF
in Wireless and Mobility
in Wireless and Mobility
07-24-2018
02:44 AM
07-24-2018
02:44 AM
I recently attempted to upgrade our WLC environment (5508 and 15+ 2602 APs) and hit a few issues and was wondering if anyone else has encountered anything similar?
My starting point was 7.3.112.0 on our WLC with a planned upgrade path of:
7.3.112.0 > 7.4.150 > 8.0.152.0 > 8.3.143.0 > 8.5.131.0
In case of issues and to allow a swift rollback, I powered off all APs except 2 during each upgrade hop
I updated FUS to 1.9.0.0 first and then WLC to 7.4.145.0 which was fine.
I then updated the WLC to 8.0.152.0.
When the 2 test APs attempted to update, they bricked with a red flashing LED.
Console access to the devices showed the following output:
--------------------------------------------
IOS Bootloader - Starting system.
flash is writable
FLASH CHIP: Numonyx Mirrorbit (0089)
Xmodem file system is available.
flashfs[0]: 13 files, 5 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 31997952
flashfs[0]: Bytes used: 12638208
flashfs[0]: Bytes available: 19359744
flashfs[0]: flashfs fsck took 16 seconds.
Reading cookie from SEEPROM
Base Ethernet MAC address: 4c:4e:35:03:4b:fb
Ethernet speed is 1000 Mb - FULL Duplex
Loading "flash:/ap3g2-k9w8-mx.152-2.JB6/ap3g2-k9w8-mx.152-2.JB6"...flash:/ap3g2- k9w8-mx.152-2.JB6/ap3g2-k9w8-mx.152-2.JB6: no such file or directory
Error loading "flash:/ap3g2-k9w8-mx.152-2.JB6/ap3g2-k9w8-mx.152-2.JB6"
Interrupt within 5 seconds to abort boot process.
Loading "flash:/update/ap3g2-k9w8-mx.153-3.JA12/ap3g2-k9w8-mx.153-3.JA12"...#### #####################
File "flash:/update/ap3g2-k9w8-mx.153-3.JA12/ap3g2-k9w8-mx.153-3.JA12" uncompressed and installed, entry point: 0x2003000
executing...
Secondary Bootloader - Starting system.
Tide MB - 32MB of flash
Xmodem file system is available.
flashfs[0]: 13 files, 5 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 31997952
flashfs[0]: Bytes used: 12638208
flashfs[0]: Bytes available: 19359744
flashfs[0]: flashfs fsck took 9 seconds.
flashfs[1]: 0 files, 1 directories
flashfs[1]: 0 orphaned files, 0 orphaned directories
flashfs[1]: Total bytes: 12257280
flashfs[1]: Bytes used: 1024
flashfs[1]: Bytes available: 12256256
flashfs[1]: flashfs fsck took 0 seconds.
Base Ethernet MAC address: 4c:4e:35:03:4b:fb
2600/3600 AP, PID: 'AIR-CAP2602I-E-K9 '. Checking for BL upgrade...
BL: C2600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JA1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Compiled Wed 30-May-12 03:34 by binugopa
BL Build year: 12
De-compress 'flash:/ap3g2-k9w8-mx.152-2.JB6/ap3g2-bl-2600' to 'ram:/ap3g2-bl'...
File not found: flash:/ap3g2-k9w8-mx.152-2.JB6/ap3g2-bl-2600
Boot CMD: 'boot flash:/ap3g2-k9w8-mx.152-2.JB6/ap3g2-k9w8-xx.152-2.JB6;flash:/update/ap3g2-k9w8-mx.153-3.JA12/ap3g2-k9w8-xx.153-3.JA12'
Loading "flash:/ap3g2-k9w8-mx.152-2.JB6/ap3g2-k9w8-xx.152-2.JB6"...flash:/ap3g2-k9w8-mx.152-2.JB6/ap3g2-k9w8-xx.152-2.JB6: no such file or directory
Error loading "flash:/ap3g2-k9w8-mx.152-2.JB6/ap3g2-k9w8-xx.152-2.JB6"
Interrupt within 5 seconds to abort boot process.
Unable to locate IOS image with name **xx**.
Boot CMD: 'flash:/update/ap3g2-k9w8-mx.153-3.JA12/ap3g2-k9w8-xx.153-3.JA12'
Loading "flash:/update/ap3g2-k9w8-mx.153-3.JA12/ap3g2-k9w8-xx.153-3.JA12"...###################
Error loading "flash:/update/ap3g2-k9w8-mx.153-3.JA12/ap3g2-k9w8-xx.153-3.JA12"
Interrupt within 5 seconds to abort boot process.
Boot process failed...
The system is unable to boot automatically. The BOOT
environment variable needs to be set to a bootable
image.
C2600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JA1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Compiled Wed 30-May-12 03:34 by binugopa
-------------------------------
This appears to be IOS corruption. I was eventually able to recover the AP’s by dismounting them, and factory resetting them via the mode button but, as my maintenance window had then expired, I rolled back the WLC and AP’s to 7.4.150.
Has anyone else encountered issues with 2602’s when going from 7.4.150.0 > 8.0.152.0?
I have looked into maybe pre downloading the AP image to the APs instead to see if this helps, but this isn’t supported for this upgrade hop (7.4.150 > 8.0.152.0) as per this document:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-3/config-guide/b_cg83/b_cg83_chapter_0101.html#ID1266
If you upgrade from a release that is prior to Release 7.5 directly to Release 7.6.X or a later release, the predownload process on Cisco AP2600 and AP3600 fails. After the Cisco WLC is upgraded to Release 7.6.X or a later release, the new image is loaded on Cisco AP2600 and AP3600. After the upgrade to a Release 7.6.X image, the predownload functionality works as expected. The predownload failure is only a one-time failure.
... View more
Labels:
Found this info here https://rscciew.wordpress.com/2014/01/04/understand-access-point-ios-images/
Platform : The access point hardware model or family supported by the image
Example:
ap1g1 – 700 series ap1g2 – 1600 series ap1g3 – 1530 series ap3g2 – 3700/3600/2600 series (3700 supported beginning with 15.2(4)JB) ap3g1 – 3500/1260 series ap802 – AP embedded in 819, 812, 886VA-W/887VA-W, C88x and C88x routers ap801 – AP embedded in 861W, most 88xW, and 1911W routers c1520 – 1550 and 1520 series mesh APs c1410 – BR1410 c1310 – BR1310 c1250 – 1250 series APs c1240 – 1240 series APs c1200 – 1200 series (1200/1210/1220/1230) c1140 – 1140 and 1040 series APs c1130 – 1130 series APs c1100 – 1100 series APs (i.e. the AP1121) c520 – 521 AP c350 – 350 series APs
... View more
08-13-2019
This is now resolved - I needed to add the "sAMAccountName" value to the
UI Access Attribute Mapping...
08-13-2019
I've followed this guide to setup our Active Directory as a source of
external authentication for ac...
08-17-2018
This root cause for this issue has now been established. It would appear
the controller in question ...
08-17-2018
This root cause for this issue has now been established. It would appear
the controller in question ...
08-17-2018
Thanks for that - I had checked it previously. The serials of our APs
were not listed as affected. P...
Created by
PJR_CDF
in Wireless and Mobility
08-17-2018
08-17-2018
Topology 2 x WLC 5508 with 13 x 2602 APs and 4 x 2802 APs No WLC SSO HA
in place - just primary and ...
Created by
PJR_CDF
in Wireless and Mobility
08-09-2018
08-09-2018
Hi, I am planning an update to our WLC and AP's (2602s) and wanted to
clarify the behaviour around t...
08-06-2018
option 43 isnt used I believe the AP knows where the WLC is from it's
current configuration and is a...
08-06-2018
I'm not allowed to make changes outside of maintenance windows I'm
afraid.Doesn't entering this comm...
08-06-2018
>show sysinfo Manufacturer's Name.............................. Cisco
Systems Inc.Product Name.........
08-06-2018
Updated 5508 WLC from 8.0.152.0 to 8.3.143.0 WLC updated fine but our
APs running 8.0.152.0 would no...
Created by
PJR_CDF
in Wireless and Mobility
07-25-2018
07-25-2018
Thanks for your response - I resolved the issue by using the Mode button
to reset the AP's (which pr...
Created by
PJR_CDF
in Wireless and Mobility
07-24-2018
07-24-2018
Flash Dir below - this is post recovery of the AP Directory of flash:/ 2
-rwx 77777 Jul 22 2018 18:1...
Created by
PJR_CDF
in Wireless and Mobility
07-24-2018
07-24-2018
I recently attempted to upgrade our WLC environment (5508 and 15+ 2602
APs) and hit a few issues and...
Public Statistics
| Date Registered | 06-20-2018 03:28 AM |
| Date Last Visited | 09-11-2019 02:13 AM |
| Total Messages Posted | 16 |
.jpg "Hall of Fame Community Legend"){kind=icon}
.jpg "VIP Engager"){kind=icon}
