Recently we acquired two new 1572EAC APs intended to be used as Lightweight APs in our network. We also recently installed several 3850s to supply full POE to these devices. However, I kept running into a bug where they refused to join our Wireless Controller running 8.0.120.0. All other APs join with and can be configured out of box, but not the 1572's. After spending considerable amount of time trying to see what the issue might be on the AP, and modifying config and interfaces via Console; I almost gave up and opened a TAC case.
Then I decided to look at the logs of my 3850 to see if it was delivering lower than expected voltage, or anything else, really.
Aug 22 23:11:20.770: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/26, changed state to up
Aug 22 23:11:20.930: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/23, changed state to up
Aug 22 23:12:59.556: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address xxxx.xxxx.xxxx on port GigabitEthernet1/0/23.
Aug 22 23:13:47.745: %DHCP_SNOOPING-4-AGENT_OPERATION_FAILED_N: DHCP snooping binding transfer failed(31). Unable to access URL.
Aug 22 23:14:07.853: %ILPOWER-5-PWRGOOD_SPARE_PAIR: Interface Gi1/0/26: spare pair power good
Aug 22 23:14:16.927: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address xxxx.xxxx.xxxx on port GigabitEthernet1/0/23.
Aug 22 23:15:02.131: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/26, changed state to down
Aug 22 23:15:02.149: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/23, changed state to down
Aug 22 23:15:03.139: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/26, changed state to down
Aug 22 23:15:03.149: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/23, changed state to down
Aug 22 23:44:47.752: %DHCP_SNOOPING-4-AGENT_OPERATION_FAILED_N: DHCP snooping binding transfer failed(31). Unable to access URL.
As you can see, the issue turned out to be a switchport port-security max violation. This typically does not affect the booting up and configuring of other APs on our bench, because they only have a single ethernet interface. The 1572 APs have numerous ethernet interfaces that apparently must register as interfaces on the access layer, thus triggering the multiple violations and eventual port lock.
I hope that my mistake and struggles helps anyone else with setting up their 1572 and getting it to successfully join the CAPWAP.
