9120 AP not able to join 9800 WLC

[mgollob]

My access point (9120) cannot join the WLC (virtual 9800). In the log from the AP I see the following:

[*03/16/2023 07:05:40.0000] CAPWAP State: DTLS Setup
[*03/16/2023 07:05:40.7090] First connect to vWLC, accept vWLC by default
[*03/16/2023 07:05:40.7090]
[*03/16/2023 07:05:40.7270]
[*03/16/2023 07:05:40.7270] CAPWAP State: Join
[*03/16/2023 07:05:40.7300] Sending Join request to X.X.X.X through port 5260
[*03/16/2023 07:05:45.3340] Sending Join request to X.X.X.X through port 5260
[*03/16/2023 07:05:50.0750] Sending Join request to X.X.X.X through port 5260
[*03/16/2023 07:06:37.0280]
[*03/16/2023 07:06:37.0280] CAPWAP State: DTLS Teardown
[*03/16/2023 07:06:37.1010] upgrade.sh: Script called with args:[ABORT]
[*03/16/2023 07:06:37.1410] do ABORT, part2 is active part
[*03/16/2023 07:06:37.1570] upgrade.sh: Cleanup tmp files ...
[*03/16/2023 07:06:37.1790] Discarding msg CAPWAP_WTP_EVENT_REQUEST(type 9) in CAPWAP state: DTLS Teardown(4).
[*03/16/2023 07:06:37.1790] Discarding msg CAPWAP_WTP_EVENT_REQUEST(type 9) in CAPWAP state: DTLS Teardown(4).
[*03/16/2023 07:06:51.7800]
[*03/16/2023 07:06:51.7800] CAPWAP State: Discovery
[*03/16/2023 07:06:51.7820] Discovery Request sent to X.X.X.X, discovery type STATIC_CONFIG(1)
[*03/16/2023 07:06:51.7890] Discovery Request sent to X.X.X.X, discovery type STATIC_CONFIG(1)
[*03/16/2023 07:06:51.7900] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0)
[*03/16/2023 07:06:51.7960] Discovery Response from X.X.X.X
[*03/16/2023 07:06:51.7960] Discovery Response from X.X.X.X

Version from WLC is 17.3.6 and from AP 17.3.6.202

There is another WLC in the same network with the software 17.3.6 and here the AP can join normally

I despair slowly

[Gaurav Kansal]

Dear Mgollob,

Have checked that your access point is able to get echo reply from its gateway and controller..?

have you edited the port number mentioned or it is actually using that port number 5260..?
GoodLuck..

[balaji.bandi]

First you need to post complete boot logs - with the below message not sure what is the cause of the issue :

 CAPWAP State: DTLS Teardown

There is another WLC in the same network with the software 17.3.6 and here the AP can join normally  - This confuses is more - so clarify is this Same WLC model and controllers - one working and one not working ?

you should able to compare them and see what is wrong ? with complete boot logs ?

[marce1000]

 - It is advised to not have two controllers on the same subnet, also review the 9800 configuration with https://cway.cisco.com/wireless-config-analyzer , it needs the output of (CLI)  show tech wireless

 M.

[LC.IT]

Did you try to set primary controller on High Availability tab?

[Prince.O]

For virtual controllers, it's required to have a wireless management interface specified as well as a SSC applied to the interface in order for any Aps to join. I would say verify you have this applied and then compare the working scenario with the non-working scenario if you still see issues

Refer to this guide below (step 4 in the process): 
https://networkphil.com/2018/12/27/deploying-and-configuring-the-cisco-9800-virtual-wireless-controller-for-the-first-time/

[Scott Fella]

@Prince.O is right, plus depending on what hyper visor you use, there are some settings you need to make sure is enabled.  All this is in the 9800-CL guide(s), just pull the guide for the version you have and go through it set by step.  Most likely you missed one or two things that is required.

[Rich R]

@Gaurav Kansal 5260 is the UDP source port used by the AP not the CAPWAP destination port.
@marce1000 there's no inherent problem with having multiple WLCs on the same subnet although that could get confusing if you start putting APs on the same subnet - all the broadcasts could cause chaos.  But you must never put an ME or EWC on the same subnet as a WLC.
I think it's more likely one of the problems highlighted by Scott and Prince.

ps: you can always try doing a factory reset on the AP - that can sometimes clear weird join problems.

[mgollob · Accepted solution]

The problem was solved. There were certificate errors. The WLC was reinstalled and the certificates reimported and now it works again.

AP reset I have tried about 100 times

[117222400]

Hi 

I have the similar issue, when I first plug in the AP 9120, it can join and get the default tags, but after I modified the tags( policy tag, site tag, RF tag), it won't join any more.

Should I reset the AP and try again?

I saw that 

■To reset the AP to the default factory-shipped configuration, keep the mode button pressed for less than 20 seconds. The AP configuration files are cleared.

This resets all configuration settings to factory defaults, including passwords, WEP keys, the IP address, and the SSID.

■To clear the AP internal storage, including all configuration files, keep the mode button pressed for more than 20 seconds, but less than 60 seconds.

Which one should I use?

Thanks very much 

[Rich R]

Yes reset to factory default should be fine.

But if there's a mistake in your config the AP is just going to get stranded again after it joins so make sure you fix your config first!

Check your WLC config with the Config Analyzer (link below) and go through the Best Practices guide (link below).

For example an incorrect country setting in the join profile could prevent the AP from joining.

Also make sure your software is up to date as per the TAC recommended link below.

[117222400]

Thanks Rich for your instant reply.

Today I got a chance to be onsite.  I just deleted the unjoined record on the primary WLC, and plugged again the AP.

The amazing is the AP joined to the secondary WLC automatically with default tags, I then changed the name and modified the 3x self-defined tags and it rebooted and becomes all working.

I am still a little confused that, there is an entry for Tags -AP-Static table added automatically, is this configured somewhere? why the static entry was added automatically? How it will impact the AP join process ?

Thanks again.

Best regards

George

[Rich R]

Hi George

Not sure what you mean by " I just deleted the unjoined record on the primary WLC" - the join statistics are just statistics, deleting them won't affect APs joining.  Maybe you deleted a static AP join profile (which is linked to the MAC of the AP)?

> is this configured somewhere? why the static entry was added automatically?
I think you probably are talking about a static AP join profile.  These are not created automatically.  When you manually set the AP tags is when you are probably creating the static join profile.  This means you end up with a config full of static profile - 1 for every AP MAC address!  I highly recommend you look at using regex filter - see the AP Filter section of the config guide https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_config_model.html and refer to the Best Practices guide (link below).  And remember the regex filter will not work until you also set the filter priority (common mistake to forget to set priority and then the filter is not active till the priority is set).
Then you only need to set the AP name (easiest from CLI: ap name APXXXX.XXXX.XXXX name NEW-AP-NAME) and it automatically picks up the correct tags from the filter.

Also make sure your software is up to date as per the TAC recommended link below and that you have tag persistence enabled (also in the Best Practices guide).  Tag persistence was not possible in older software which caused all sorts of problems.

Normally APs will do a CAPWAP restart automatically when the filter has been added/updated but sometimes you should force a restart to get them updated "ap name NEW-AP-NAME reset capwap" then the AP will disjoin and re-join and pick up any changes (much quicker than reboot).  Remember by default a static profile will override the filter so delete static filters before doing that.  Normally as soon as you delete the static profile the AP will do a capwap restart.  You can see static profiles in the config - they look like:
ap abcd.ef12.3456
 policy-tag <tag-name>
 site-tag <site-tag-name>