1542 fails to attach to 9800 (AP auth fail) after moving from 5508

[David Ritter]

I have 2 1542i's that I reassigned from a 5508 to my 9800.

while I do have MAC auth for the ap's in the 5508, I did not enter such on the 9800 and don't rightly know where I would do that.

so why did only 1 ap fail instead of 2

[marce1000]

  - Start without  MAC  based authentication for the APs on the 9800 controller ; can they join then  ?

 M.

[David Ritter]

the outdoor class 1542's required mac auth on airos,  were on 8.5.182.7  (answers Leo's question) aok.

moved to the 9800 on 17.9.4a and only 1 attached.  the failed unit was reported as auth failure and was moved back to the 5508, no issue.  

I'm, pushing the problem child the the 5520 on 8.10.185.0.  At this point I don't suspect a cert issue.

I know how to do AP mac auth in airos..  but not clear on the sequence for the 9800.  

[marce1000]

             >...I know how to do AP mac auth in airos..  but not clear on the sequence for the 9800.
  Check this documentation : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213916-catalyst-9800-wireless-controllers-ap-au.html

   After the 9800 controller has been configured accordingly  , have a checkup of it's configuration using the CLI command 
                                             show tech wireless and feed the output into Wireless Config Analyzer

 M.

[Leo Laohoo]

What firmware is the 5508 on?

Maybe the 1540 is not joining because of expired certificate that would prevent the AP from finish downloading the firmware from the 9800.

[David Ritter]

The saga continues.   Leo, I would expect an expired cert to also block the association to the 5520.

That being said, I am logged on to the AP and changing the primary-base target between 5520 and the 9800.  as the primary object was to get the ap off the 5508, mission is accomplished. I did find a location to enter the AP mac ; Configuration, wireless, Access Points, AP Certificate Policy: Authorize Aps joining with MIC and add the mac..  but still no joy.

[Leo Laohoo]

Console into the AP and reboot it.  
Post the entire boot-up process and attempts to join the 9800.  IF there are expired certificates, it will show up in the AP log.

[Rich R]

Maybe you already have "config ap cert-expiry-ignore mic enable" configured on the 5508 and 5520 but you're missing the equivalent config on the 9800?

[David Ritter]

um, well yes.  Had a bunch of x700's on them.  I have a 3rd 1542 that has yet to be deployed.  testing now.

[David Ritter · Accepted solution]

some where along the way I missed a tidbit.

the working 1542 was in Local mode while the failing units were in mesh mode.   Upon switching to local all was well.  However, it seems that the unit at the landfill was really failing because there be no DHCP on the local segment.  As the network is being extended to another building, at which time DHCP will be established the AP remains in limbo.

Thank you all

[aaronbrown]

Hey David, 

We are having the exact same problem migrating a 2702 from our 5508 to a 9800. We've successfully migrated about 10 other AP's (various models including 2702's) without a problem. Were you able to find a fix?

[David Ritter]

Wave 1 AP's were supported in 16.x and 17.3 code but remove above that.  However due to popular demand, they were returned in 17.9.3 and above.

That being said, the x702 series did experience cert expiration back in 22 and require temporary date reset.

My Wave1 aps work fine on 17.9.4a

[Rich R]

Hi @aaronbrown it depends what version of code is installed on the APs.
There are some major changes to the CAPWAP protocol in recent 9800 code which are not compatible with older AireOS code.  You either need to migrate the APs to an intermediate version which supports the CAPWAP changes or pre-install the correct image on the APs.
What version is the 5508 running?
What version is the 9800 which you are migrating to running?
Have you checked the complete console logs of a failing 2702 from power on? Attach here as a .txt file.  That should help diagnose the issue.

[aaronbrown]

Thank you for the reply on this. It looks like the Bridge\Mesh mode on the AP is the culprit. After moving it local mode, and performing a factory reset (we had tried factory resets previously) seemed to clear the issue.

[Rich R]

Ah well that's the same issue David had already mentioned so assumed you had checked that.

If an AP is in bridge mode then you must configure AP authorisation of the AP MAC address on the WLC for it to be able to join.  No doubt you had already done this on the 5508 but not on 9800.  The quick and easy fix (as you mentioned) is to change the AP to local mode if mesh is not required.