access points joining problem

[khaled masri]

dear all,

kindly note, cisco access points not joined, I received the following logs from the WLC 2504 

#DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:2963 Failed to complete DTLS handshake with peer 192.168.198.101

the access points getting IP correctly from the Core Switch, also note tries this command without any luck :

config ap lifetime-check mic enable

any solution for that problem ???

[Mark Elsen]

        - What are the access point models ? What is the controller software version ?

 M.

[khaled masri]

access points: AIR-CAP1702I-E-K9 software version 15.3(3)JA5

WLC software Version 8.0.121.0

[Mark Elsen]

 - You need at least 8.3.x on the controller, then you can use these commands :
                   config ap cert-expiry-ignore  mic enable
                   config ap cert-expiry-ignore   ssc enable
 M.
                          

[Leo Laohoo]

Adjust the date of the WLC back to two years and then reboot the AP.

[Sandeep Choudhary]

Can you paste the complete bootup logs from AP console:

also paste the output of the command from WLC: show sysinfo

[khorram1998]

This error message is indicating that the DTLS (Datagram Transport Layer Security) handshake between the access point and the wireless controller is failing. This can be caused by a number of different factors, including incorrect time synchronization, certificate issues, or issues with the network configuration.

Here are a few steps you can try to troubleshoot and resolve the problem:

1. Verify that the time on the access point and the wireless controller is synced correctly. The DTLS handshake is time-sensitive, and if the clocks are not in sync, it can cause the handshake to fail.

2. Check the certificate configuration on both the access point and the wireless controller. Ensure that the correct certificate is installed and that it is not expired or otherwise invalid.

3. Confirm that the network settings, such as IP addresses and subnet masks, are configured correctly on both the access point and the wireless controller.

4. Check the security settings of the network, verify that the same security settings are being used on both the access point and the wireless controller.

5. Try restarting both the access point and the wireless controller, and see if this resolves the issue.

6. Run the command show ap debug dtls, this will show the DTLS packet exchange between the AP and the WLC to see where the failure is happening.

7. Double check the AP's firmware, if the AP is running different version than the WLC, upgrade the AP to the same version as the WLC.

8. If none of the above steps solve the problem, you may need to contact Cisco Technical Support for further assistance.
   
   Please rate this and mark as solution/answer, if this resolved your issue
   All the best,
   AK

[Rich R]

If you really must run 8.0 then at least update to https://software.cisco.com/download/home/283848165/type/280926587/release/8.0.152.0 which will also support the commands @Mark Elsen mentioned. Follow all the steps in the field notice 63942 linked below carefully.  You need to set the time back as Leo said to allow the APs to join then download the software and config.  After that you can turn NTP on again.