3702s Not Joining a New 5520

jvasilko · ‎12-08-2016

I have installed a new HA pair of 5520s in our lab and need to do some user access testing. The code running on the 5520 is 8.2.130.0. I think I have everything configured, but for some reason, when I attempt to associate a new 3702i, it fails to associate. The AP builds the DTLS connection, then just fails the connection. The AP Join log says that the AP was unsuccessful due to delete database entry. Any thoughts? This device has 1500 AP licenses on it, so that should not be the issue....thanks in advance for any suggestions.

Rasika Nayanajith · ‎12-08-2016

post "show sysinfo" & "show time" from WLC

Also "show version" from AP

HTH

Rasika

jvasilko · ‎12-08-2016

Hey Rasika....thanks for the reply, below you will find what you requested.

Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 8.2.130.0
RTOS Version..................................... 8.2.130.0
Bootloader Version............................... 8.1.102.0
Emergency Image Version.......................... 8.1.102.0

Build Type....................................... DATA + WPS

System Name...................................... US063-W-UA-2050LAB-5520-TEST
System Location..................................
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.9.1.2170
Redundancy Mode.................................. SSO
IP Address....................................... 143.219.211.6
IPv6 Address..................................... ::
System Up Time................................... 3 days 1 hrs 46 mins 35 secs
System Timezone Location......................... (GMT -5:00) Eastern Time (US and Canada)
System Stats Realtime Interval................... 5
System Stats Normal Interval..................... 180

--More-- or (q)uit
Configured Country............................... US - United States
Operating Environment............................ Commercial (10 to 35 C)
Internal Temp Alarm Limits....................... 10 to 38 C
Internal Temperature............................. +30 C
Fan Status....................................... OK

State of 802.11b Network......................... Enabled
State of 802.11a Network......................... Enabled
Number of WLANs.................................. 2
Number of Active Clients......................... 0

Burned-in MAC Address............................ 00:D7:8F:7E:53:A3
Power Supply 1................................... Present, OK
Power Supply 2................................... Present, Off
Maximum number of APs supported.................. 1500
System Nas-Id.................................... Cisco_7e:53:a4
WLC MIC Certificate Types........................ SHA1/SHA2
Licensing Type................................... RTU

Time............................................. Thu Dec 8 11:19:57 2016

Timezone delta................................... 0:0
Timezone location................................ (GMT -5:00) Eastern Time (US and Canada)

NTP Servers
    NTP Polling Interval.........................     3600

     Index     NTP Key Index                  NTP Server                Status          NTP Msg Auth Status
    ------- ----------------------------------------------------------------------------------------------
       1              0                               135.89.92.196     In Sync              AUTH DISABLED
       2              0                               135.89.92.132     Not Tried            AUTH DISABLED

AP0006.f6c8.dcfb>sho vers
Cisco IOS Software, C3500 Software (AP3G1-RCVK9W8-M), Version 15.2(2)JB, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Mon 10-Dec-12 23:48 by prod_rel_team

ROM: Bootstrap program is C3500 boot loader
BOOTLDR: C3500 Boot Loader (AP3G1-BOOT-M), Version 12.4 [mpleso-ap_jmr3_esc_0514 125]

Rasika Nayanajith · ‎12-08-2016

AP0006.f6c8.dcfb>sho vers

Go into enabled mode & run this command.

Is this a 3502 or 3702 ?

If possible attach AP console output during a reboot and trying to register to WLC

HTH

Rasika

jvasilko · ‎12-08-2016

sho vers output is listed above at the end...this is the AP trying to connect to 5520

cisco AIR-CAP3502I-A-K9    (PowerPC460exr) processor (revision A0) with 98294K/32768K bytes of memory.
Processor board ID FGL1710W1YB
PowerPC460exr CPU at 666Mhz, revision number 0x18A8
Last reset from power-on
LWAPP image version 7.4.1.37
1 Gigabit Ethernet interface

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:06:F6:C8:DC:FB
Part Number                          : 73-14857-01
PCA Assembly Number                  : 800-38797-01
PCA Revision Number                  : A0
PCB Serial Number                    : FOC170304XC
Top Assembly Part Number             : 800-32891-02
Top Assembly Serial Number           : FGL1710W1YB
Top Revision Number                  : A0
Product/Model Number                 : AIR-CAP3502I-A-K9
% Please define a domain-name first.
logging facility kern
        ^
% Invalid input detected at '^' marker.

logging trap emergencies
        ^
% Invalid input detected at '^' marker.

Press RETURN to get started!

*Mar 1 00:00:10.122: *** CRASH_LOG = YES
Base Ethernet MAC address: 00:06:F6:C8:DC:FB

*Mar 1 00:00:10.557: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg

*Mar 1 00:00:12.145: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state to up
*Mar 1 00:00:13.271: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
*Mar 1 00:00:13.410: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C3500 Software (AP3G1-RCVK9W8-M), Version 15.2(2)JB, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Mon 10-Dec-12 23:48 by prod_rel_team
*Mar 1 00:00:13.447: %CAPWAP-3-ERRORLOG: Binding Config Initialization failed for binding 1
lwapp_crypto_init: MIC Present and Parsed Successfully

*Mar 1 00:00:14.420: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI
no bridge-group 1 source-learning
                   ^
% Invalid input detected at '^' marker.
%Default route without gateway, if not a point-to-point interface, may impact performance
*Mar 1 00:00:37.110: %CDP_PD-2-POWER_LOW: All radios disabled - NEGOTIATED WS-C3560-24PS (0023.041d.f38a)
*Mar 1 00:00:47.808: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 163.198.110.252, mask 255.255.255.0, hostname AP0006.f6c8.dcfb

Translating "CISCO-CAPWAP-CONTROLLER.dow.com"...domain server (10.0.1.1)

*Mar 1 00:00:57.796: %CAPWAP-3-ERRORLOG: Did not get log server settings from DHCP.
*Mar 1 00:00:57.799: %CAPWAP-3-ERRORLOG: Could Not resolve CISCO-CAPWAP-CONTROLLER.dow.com
*Mar 1 00:01:07.799: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Dec 8 18:27:30.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 143.219.211.6 peer_port: 5246
*Dec 8 18:27:30.217: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 143.219.211.6 peer_port: 5246
*Dec 8 18:27:30.217: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6
*Dec 8 18:27:35.218: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6
*Dec 8 18:27:49.654: %CDP_PD-2-POWER_LOW: All radios disabled - NEGOTIATED WS-C3560-24PS (0023.041d.f38a)
logging facility kern
        ^
% Invalid input detected at '^' marker.

logging trap emergencies
        ^
% Invalid input detected at '^' marker.

*Dec 8 18:28:30.001: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 143.219.211.6:5246
*Dec 8 18:28:30.001: %LWAPP-3-CLIENTERRORLOG: LWAPP LED Init: incorrect led state 255
*Dec 8 18:28:30.014: %CAPWAP-3-ERRORLOG: Binding Config Initialization failed for binding 1

*Dec 8 18:28:40.027: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Dec 8 18:28:40.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 143.219.211.6 peer_port: 5246
*Dec 8 18:28:40.217: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 143.219.211.6 peer_port: 5246
*Dec 8 18:28:40.217: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6
*Dec 8 18:28:45.218: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6
logging facility kern
        ^
% Invalid input detected at '^' marker.

logging trap emergencies
        ^
% Invalid input detected at '^' marker.

*Dec 8 18:29:40.001: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 143.219.211.6:5246
*Dec 8 18:29:40.001: %LWAPP-3-CLIENTERRORLOG: LWAPP LED Init: incorrect led state 255
*Dec 8 18:29:40.014: %CAPWAP-3-ERRORLOG: Binding Config Initialization failed for binding 1

*Dec 8 18:29:50.023: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Dec 8 18:29:49.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 143.219.211.6 peer_port: 5246
*Dec 8 18:29:49.217: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 143.219.211.6 peer_port: 5246
*Dec 8 18:29:49.217: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6
*Dec 8 18:29:54.218: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6
logging facility kern
        ^
% Invalid input detected at '^' marker.

logging trap emergencies
        ^
% Invalid input detected at '^' marker.

*Dec 8 18:30:49.001: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 143.219.211.6:5246
*Dec 8 18:30:49.001: %LWAPP-3-CLIENTERRORLOG: LWAPP LED Init: incorrect led state 255
*Dec 8 18:30:49.014: %CAPWAP-3-ERRORLOG: Binding Config Initialization failed for binding 1

*Dec 8 18:30:49.023: %CAPWAP-3-ERRORLOG: Dropping dtls packet since session is not established. 8FDBD306, 147E, A3C66EFC, 8DD1, 0
*Dec 8 18:30:59.020: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Dec 8 18:30:59.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 143.219.211.6 peer_port: 5246
*Dec 8 18:30:59.217: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 143.219.211.6 peer_port: 5246
*Dec 8 18:30:59.217: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6
*Dec 8 18:31:04.218: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6

Rasika Nayanajith · ‎12-09-2016

Have you enabled any AP policy on this controller ? If so you need to allow this AP MAC address in the list.

"show auth-list" command output can verify that.

Last resort is to take some debug from the controller by filtering to AP ethernet MAC.

HTH

Rasika

jvasilko · ‎12-12-2016

This is a brand new implementation, and nothing has been changed as far as auth-lists are concerned.

Authorize MIC APs against Auth-list or AAA ...... disabled
Authorize LSC APs against Auth-List ............. disabled
APs Allowed to Join
AP with Manufacturing Installed Certificate.... yes
AP with Self-Signed Certificate................ no
AP with Locally Significant Certificate........ no

jvasilko · ‎12-13-2016

This is the output from the AP:

*Dec 13 15:36:26.023: %CAPWAP-3-ERRORLOG: Dropping dtls packet since session is not established. 8FDBD306, 147E, A3C66EFC, 8DD1, 0
*Dec 13 15:36:36.023: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Dec 13 15:36:36.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 143.219.211.6 peer_port: 5246
*Dec 13 15:36:36.217: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 143.219.211.6 peer_port: 5246
*Dec 13 15:36:36.220: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6
*Dec 13 15:36:41.218: %CAPWAP-5-SENDJOIN: sending Join Request to 143.219.211.6
*Dec 13 15:35:17.001: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 143.219.211.6:5246
*Dec 13 15:35:17.001: %LWAPP-3-CLIENTERRORLOG: LWAPP LED Init: incorrect led state 255
*Dec 13 15:35:17.014: %CAPWAP-3-ERRORLOG: Binding Config Initialization failed for binding 1

Just keeps repeating this over and over.

neelesh.gaekwad · ‎03-06-2017

we face same issue with one of our client.

then client them self troubleshooted and found that 3702AP shipped with mesh image.

so we unmount the Aps convert the image from mesh(SWLAP3700-MESH-K9) to recovery image(SWAP3700-RCOVRY-K9 )

the problem get solved.

I still wonder that at a time of ordering we selected SWAP3700-RCOVRY-K9 but cisco shipped the access points with MESH IOS. I don't know why.

Is there anyone who faced the same problem?