9800L swap out with online WAPs

[billydailey]

9800L wireless controller with APs in local mode.  I tried swapping controllers with the exact same configurations and policies, but the waps would not join the new controllers.

I had this labbed up and couldnt get it to work.  So i factory reset the waps and they rejoined the new controller.

Was curious why this didnt work, and aside from going to an HA setup, what if a controller fails and i need to  put in another, do i have to factory reset all the APs and retag?

[Scott Fella]

Swapping controllers that are the same model and firmware should not be an issue unless you had some configuration that needed to be unique between the two like hostname and ip(s).

[balaji.bandi]

When the AP join there is TLS connection and certs are exchanged.

If this in HA, that should work as expected ?

You mentioned controllers - i take this as both ? or one of them in HA ?

[billydailey]

No HA, I have one controller configured as needed.  Configured another controller identical.  Swapped the original with the new, and the APs would not join.

[ammahend]

I don't think its reset that fixed the issue, may be your AP ARP table needed to be cleared because the MAC address of controller changed however the IP was same, did you just trying rebooting the AP instead of factory reset, how much time did you give AP to join before factory reset ?

[billydailey]

Yes, we tried rebooting the APs.  Definitely gave it about 2 hours i would say.

[Rich R]

Agreed with the others - if is a simple as your summary suggests then it should have just worked.
So both were exact same model of WLC running same config and same code version?
What version of code were they running?
What model(s) of AP?
As @ammahend had you tried AP CAPWAP reset or reload?

We move APs around all the time.  There can be some issues moving between majorly different versions of code and sometimes they need some extra nudging but between WLCs on same version of code no problems.  We've replaced WLCs a few times without any impact.

[billydailey]

One was a 9800 L C  and the other was an 9800 L F.  Same config, same code 17.9.4a

The APs are 9166-Bs  

We did not try any resets due to time restraints

[Scott Fella]

Just to add, when you say, "I had this labbed up and couldnt get it to work." you need to continue to work this issue until you come up with a good plan/process.  No one really knows how your environment is setup so it's difficult to say why.  The fact that in the lab you factory reset the ap and it joined the other controller, is interesting, because, how did you get it to join the other controller once your factory reset the ap?

[billydailey]

We reset from the APs with the old controller, shutdown the POE port on the switch attached to the AP to prevent rebooting and joining the original controller.  Once the APS were reset, swapped controller, enabled POE and let them boot and join the new controller.

[Scott Fella]

So you were able to get all the ap's up an running with the reset?

[billydailey]

Yes, we factory reset 2 controllers today, configured identical, swapped them out and the APs joined the new controller.  Gonna go through the configs line by line, my guess there was something lingering causing them not to join in that old setup.  Thanks for all the help.

[billydailey]

So my next task is, we are using the custom web authorization banner.  Is there a way to have different logins and passwords for each SSID?  Right now we are adding accounts in the global policy.  We noticed we can go to any SSID and login with any of the accounts regardless of what SSID we are on.  Would like to segregate by SSID.