Solved: Re: AIR-AP1852I-E-K9 won't connect to Virtual controller 8.2.166.0

Carl_perkins4 · ‎03-01-2018

Hi, i'm trying to get 10 ap's to connect to a Virtual controller:

(Cisco Controller) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 8.2.166.0
RTOS Version..................................... 8.2.166.0
Bootloader Version............................... 8.3.15.96
Emergency Image Version.......................... 8.2.166.0

Build Type....................................... DATA + WPS

System Name...................................... WLC01LSC
System Location..................................
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.9.1.1631
IP Address....................................... 10.164.125.11
IPv6 Address..................................... ::
System Up Time................................... 2 days 1 hrs 1 mins 43 secs
System Timezone Location......................... (GMT) London, Lisbon, Dublin, Edinburgh
System Stats Realtime Interval................... 5
System Stats Normal Interval..................... 180

Configured Country............................... GB - United Kingdom

--More-- or (q)uit

State of 802.11b Network......................... Enabled
State of 802.11a Network......................... Enabled
Number of WLANs.................................. 3
Number of Active Clients......................... 0

Burned-in MAC Address............................ 00:50:56:95:CD:72
Maximum number of APs supported.................. 200
System Nas-Id....................................
WLC MIC Certificate Types........................ SHA1
Licensing Type................................... RTU
vWLC config...................................... Small

(Cisco Controller) >

AP VER:

APA0F8.49E8.2C88>sh ver
Restricted Rights Legend

Use, duplication, or disclosure by the Government is subject to
restrictions as set forth in subparagraph (c) of the Commercial
Computer Software - Restricted Rights clause at FAR sec. 52.227-19 and
subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

Cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

This product contains some software licensed under the
"GNU General Public License, version 2" provided with
ABSOLUTELY NO WARRANTY under the terms of
"GNU General Public License, version 2", available here:
http://www.gnu.org/licenses/old-licenses/gpl-2.0.html

This product contains some software licensed under the
"GNU Library General Public License, version 2" provided
with ABSOLUTELY NO WARRANTY under the terms of "GNU Library
General Public License, version 2", available here:
http://www.gnu.org/licenses/old-licenses/lgpl-2.0.html

This product contains some software licensed under the
"GNU Lesser General Public License, version 2.1" provided
with ABSOLUTELY NO WARRANTY under the terms of "GNU Lesser
General Public License, version 2.1", available here:
http://www.gnu.org/licenses/old-licenses/lgpl-2.1.html

Cisco AP Software, (ap1g4), [wnbu-bld-lnx12:/local/build/JENKINS/workspace/8.2MR--More-- [*03/01/2018 10:27:17.0222] CAPWAP State: DTLS Teardown
[*03/01/2018 10:27:17.0322] Dropping dtls packet since session is not established. aa47d0b, 147e, aa47d4b, 1480, (nil)
5-corsica-CCO]
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Tue Mar 14 13:10:26 PDT 2017

ROM: Bootstrap program is U-Boot boot loader
BOOTLDR: U-Boot boot loader Version 25

APA0F8.49E8.2C88 uptime is 0 days, 2 hours, 07 minutes
Last reload time : Thu Mar 1 08:18:46 UTC 2018
Last reload reason : 1: reload command

cisco AIR-AP1852I-E-K9 ARMv7 Processor rev 0 (v7l) with 966404/745596K bytes of memory.
Processor board ID KWC213505IZ
AP Running Image : 8.2.151.0
Primary Boot Image : 8.2.151.0
Backup Boot Image : 0.0.0.0
2 Gigabit Ethernet interfaces
2 802.11 Radios
Radio FW version : ee27b5094d5b8602d2d973ea084d5cf4
NSS FW version : NSS.AK.1.0.c10-00017-E_custC-1.67978.1

Base ethernet MAC Address : A0:F8:49:E8:2C:88
Part Number : 0-0000-00
PCA Assembly Number : 074-13149-02
PCA Revision Number : 01
PCB Serial Number : KWC213505IZ
Top Assembly Part Number : 074-13149-02
Top Assembly Serial Number : KWC213505IZ
Top Revision Number : A0
Product/Model Number : AIR-AP1852I-E-K9

APA0F8.49E8.2C88>
APA0F8.49E8.2C88>[*03/01/2018 10:27:21.7707] CAPWAP State: Discovery
[*03/01/2018 10:27:21.7807] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:27:21.7807] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:27:21.7807] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:27:21.8107] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:27:21.8107] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:27:21.8107] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:27:21.8207] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0)
[*03/01/2018 10:27:21.8207] Discovery Response from 10.164.125.11
[*03/01/2018 10:27:32.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:27:32.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:27:32.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:27:32.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:27:32.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:27:32.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:27:32.0000] CAPWAP State: DTLS Setup
[*03/01/2018 10:27:32.1299] CAPWAP State: Join
[*03/01/2018 10:27:32.1299] Sending Join request to 10.164.125.11 through port 5248
[*03/01/2018 10:28:29.0322] CAPWAP State: DTLS Teardown
[*03/01/2018 10:28:29.0322] Dropping dtls packet since session is not established. aa47d0b, 147e, aa47d4b, 1480, (nil)
[*03/01/2018 10:28:33.7807] CAPWAP State: Discovery
[*03/01/2018 10:28:33.7807] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:28:33.7907] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:28:33.7907] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:28:33.8207] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:28:33.8207] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:28:33.8207] Discovery Request sent to 10.164.125.11, discovery type STATIC_CONFIG(1)
[*03/01/2018 10:28:33.8307] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0)
[*03/01/2018 10:28:33.8307] Discovery Response from 10.164.125.11
[*03/01/2018 10:28:43.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:28:43.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:28:43.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:28:43.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:28:43.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:28:43.0000] Discovery Response from 10.164.125.11
[*03/01/2018 10:28:43.0000] CAPWAP State: DTLS Setup
[*03/01/2018 10:28:43.1299] CAPWAP State: Join
[*03/01/2018 10:28:43.1299] Sending Join request to 10.164.125.11 through port 5248

DHCP is working ap is on same subnet as the manager

APA0F8.49E8.2C88>SH IP INT BRIEF
Interface IP-Address Method Status Protocol Speed
wired0 10.164.125.75 DHCP up up 1000
wired1 unassigned unset down up n/a
wifi0 unassigned unset administatively down down n/a
wifi1 unassigned unset administatively down down n/a
Controller is synced with time server:

(Cisco Controller) >show time

Time............................................. Thu Mar 1 10:31:33 2018

Timezone delta................................... 0:0
Timezone location................................ (GMT) London, Lisbon, Dublin, Edinburgh

NTP Servers
NTP Polling Interval......................... 3600

Index NTP Key Index NTP Server Status NTP Msg Auth Status
------- ----------------------------------------------------------------------------------------------
1 0 172.19.58.18 In Sync AUTH DISABLED
2 0 172.19.58.19 Not Tried AUTH DISABLED

Jhosbell Verdesca De Aguiar · ‎03-01-2018

Did you add the license or accepted the EULA if using the evaluation license under Management--> Software Activation --> License ??

** Please rate helpful posts **

CCIE #58023

View solution in original post

Leo Laohoo · ‎03-01-2018

On the AP, post the complete output to the command "sh capwap client rcb".

Carl_perkins4 · ‎03-01-2018

Hi Leo

Output as requested

APA0F8.49E8.2C88>sh capwap client rcb
AdminState : ADMIN_ENABLED
OperationState : JOIN
Name : APA0F8.49E8.2C88
SwVer : 8.2.151.0
HwVer : 1.0.0.0
MwarMacAddr : 0a:a4:7d:0b:00:00
MwarApMgrIp : 10.164.125.11
MwarName : WLC01LSC
MwarHwVer : 0.0.0.0
Location : default location
ApMode : Local
ApSubMode : Not Configured
CAPWAP Path MTU : 576
AP Link DTLS Encryption : OFF
AP Tcp MSS Adjust : Disabled
LinkAuditing : disabled
APA0F8.49E8.2C88>

Thanks,

Carl

patoberli · ‎03-01-2018

Have you configured an European country on the WLC, as it is an -E- AP?
This is done under Wireless -> Country.

Carl_perkins4 · ‎03-01-2018

Yeah this is shown in first post on sysinfo:

But also the below in case this is different.

patoberli · ‎03-01-2018

Sorry missed that detail.
I can't see what's wrong here, sorry.
I do find the CAPWAP Path MTU very small, but this is probably normal.
You could try this on the WLC 'debug capwap events' which should show the join process on the controller side. There are a few more variants to that command, that would output more.

Carl_perkins4 · ‎03-01-2018

Thanks i've performed that and the below is the output:

(Cisco Controller) >debug capwap events enable

(Cisco Controller) >*spamApTask4: Mar 01 15:51:12.857: a0:f8:49:e9:0b:00 Join Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:51:12.857: a0:f8:49:e9:0b:00 Allocate database entry for AP 10.164.125.75:5248, already allocated index 65535

*spamApTask4: Mar 01 15:51:12.857: a0:f8:49:e9:0b:00 AP Allocate request at index ffff
*spamApTask4: Mar 01 15:51:12.857: a0:f8:49:e9:0b:00 Join Request failed!

(Cisco Controller) >*spamApTask4: Mar 01 15:52:04.946: a0:f8:49:e9:0b:00 DTLS connection closed event receivedserver (10.164.125.11/5246) client (10.164.125.75/5248)
*spamApTask4: Mar 01 15:52:04.946: a0:f8:49:e9:0b:00 No entry exists for AP (10.164.125.75/5248)
*spamApTask4: Mar 01 15:52:04.946: a0:f8:49:e8:2c:88 Deleting AP entry 10.164.125.75:5248 from temporary database.
*spamApTask4: Mar 01 15:52:09.703: a0:f8:49:e9:0b:00 Discovery Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.703: a0:f8:49:e9:0b:00 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 200, MaxLicense=200 joined Aps =0
*spamApTask4: Mar 01 15:52:09.703: a0:f8:49:e9:0b:00 apType = 48 apModel: AIR-AP1852I-E-K9

*spamApTask4: Mar 01 15:52:09.703: a0:f8:49:e9:0b:00 apType: Ox30 bundleApImageVer: 8.3.140.0
*spamApTask4: Mar 01 15:52:09.703: a0:f8:49:e9:0b:00 version:8 release:3 maint:140 build:0
*spamApTask4: Mar 01 15:52:09.703: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75 port 5248

*spamApTask4: Mar 01 15:52:09.703: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.758: a0:f8:49:e9:0b:00 Discovery Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.758: a0:f8:49:e9:0b:00 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 200, MaxLicense=200 joined Aps =0
*spamApTask4: Mar 01 15:52:09.758: a0:f8:49:e9:0b:00 apType = 48 apModel: AIR-AP1852I-E-K9

*spamApTask4: Mar 01 15:52:09.758: a0:f8:49:e9:0b:00 apType: Ox30 bundleApImageVer: 8.3.140.0
*spamApTask4: Mar 01 15:52:09.758: a0:f8:49:e9:0b:00 version:8 release:3 maint:140 build:0
*spamApTask4: Mar 01 15:52:09.758: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75 port 5248

*spamApTask4: Mar 01 15:52:09.758: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.761: a0:f8:49:e9:0b:00 Discovery Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.761: a0:f8:49:e9:0b:00 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 200, MaxLicense=200 joined Aps =0
*spamApTask4: Mar 01 15:52:09.761: a0:f8:49:e9:0b:00 apType = 48 apModel: AIR-AP1852I-E-K9

*spamApTask4: Mar 01 15:52:09.761: a0:f8:49:e9:0b:00 apType: Ox30 bundleApImageVer: 8.3.140.0
*spamApTask4: Mar 01 15:52:09.761: a0:f8:49:e9:0b:00 version:8 release:3 maint:140 build:0
*spamApTask4: Mar 01 15:52:09.761: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75 port 5248

*spamApTask4: Mar 01 15:52:09.761: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.770: a0:f8:49:e9:0b:00 Discovery Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.770: a0:f8:49:e9:0b:00 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 200, MaxLicense=200 joined Aps =0
*spamApTask4: Mar 01 15:52:09.770: a0:f8:49:e9:0b:00 apType = 48 apModel: AIR-AP1852I-E-K9

*spamApTask4: Mar 01 15:52:09.770: a0:f8:49:e9:0b:00 apType: Ox30 bundleApImageVer: 8.3.140.0
*spamApTask4: Mar 01 15:52:09.770: a0:f8:49:e9:0b:00 version:8 release:3 maint:140 build:0
*spamApTask4: Mar 01 15:52:09.770: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75 port 5248

*spamApTask4: Mar 01 15:52:09.770: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.773: a0:f8:49:e9:0b:00 Discovery Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.773: a0:f8:49:e9:0b:00 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 200, MaxLicense=200 joined Aps =0
*spamApTask4: Mar 01 15:52:09.773: a0:f8:49:e9:0b:00 apType = 48 apModel: AIR-AP1852I-E-K9

*spamApTask4: Mar 01 15:52:09.773: a0:f8:49:e9:0b:00 apType: Ox30 bundleApImageVer: 8.3.140.0
*spamApTask4: Mar 01 15:52:09.773: a0:f8:49:e9:0b:00 version:8 release:3 maint:140 build:0
*spamApTask4: Mar 01 15:52:09.773: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75 port 5248

*spamApTask4: Mar 01 15:52:09.773: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.776: a0:f8:49:e9:0b:00 Discovery Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.776: a0:f8:49:e9:0b:00 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 200, MaxLicense=200 joined Aps =0
*spamApTask4: Mar 01 15:52:09.776: a0:f8:49:e9:0b:00 apType = 48 apModel: AIR-AP1852I-E-K9

*spamApTask4: Mar 01 15:52:09.776: a0:f8:49:e9:0b:00 apType: Ox30 bundleApImageVer: 8.3.140.0
*spamApTask4: Mar 01 15:52:09.776: a0:f8:49:e9:0b:00 version:8 release:3 maint:140 build:0
*spamApTask4: Mar 01 15:52:09.776: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75 port 5248

*spamApTask4: Mar 01 15:52:09.776: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.779: a0:f8:49:e9:0b:00 Discovery Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:09.779: a0:f8:49:e9:0b:00 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 200, MaxLicense=200 joined Aps =0
*spamApTask4: Mar 01 15:52:09.779: a0:f8:49:e9:0b:00 apType = 48 apModel: AIR-AP1852I-E-K9

*spamApTask4: Mar 01 15:52:09.779: a0:f8:49:e9:0b:00 apType: Ox30 bundleApImageVer: 8.3.140.0
*spamApTask4: Mar 01 15:52:09.779: a0:f8:49:e9:0b:00 version:8 release:3 maint:140 build:0
*spamApTask4: Mar 01 15:52:09.779: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75 port 5248

*spamApTask4: Mar 01 15:52:09.779: a0:f8:49:e9:0b:00 Discovery Response sent to 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:19.205: a0:f8:49:e8:2c:88 DTLS connection not found, creating new connection for 10.164.125.75 (5248) 10.164.125.11 (5246)

*spamApTask4: Mar 01 15:52:19.520: a0:f8:49:e8:2c:88 DTLS Session established server (10.164.125.11:5246), client (10.164.125.75:5248)
*spamApTask4: Mar 01 15:52:19.520: a0:f8:49:e8:2c:88 Starting wait join timer for AP: 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:19.572: a0:f8:49:e9:0b:00 Join Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:19.572: a0:f8:49:e9:0b:00 Allocate database entry for AP 10.164.125.75:5248, already allocated index 65535

*spamApTask4: Mar 01 15:52:19.572: a0:f8:49:e9:0b:00 AP Allocate request at index ffff
*spamApTask4: Mar 01 15:52:19.573: a0:f8:49:e9:0b:00 Join Request failed!

*spamApTask4: Mar 01 15:52:24.147: a0:f8:49:e9:0b:00 Join Request from 10.164.125.75:5248

*spamApTask4: Mar 01 15:52:24.148: a0:f8:49:e9:0b:00 Allocate database entry for AP 10.164.125.75:5248, already allocated index 65535

*spamApTask4: Mar 01 15:52:24.148: a0:f8:49:e9:0b:00 AP Allocate request at index ffff

Leo Laohoo · ‎03-01-2018

Is the AP getting a valid IP address?
If it has, enter the command "capwap ap primary-base <WLC name> <WLC IP address>".

Jhosbell Verdesca De Aguiar · ‎03-01-2018

Did you add the license or accepted the EULA if using the evaluation license under Management--> Software Activation --> License ??

** Please rate helpful posts **

CCIE #58023

Carl_perkins4 · ‎03-01-2018

Hi, I'm using the eval lic at the moment. below is the screen shot i've also accepted the eula

Leo Laohoo · ‎03-02-2018

Firewall.

Carl_perkins4 · ‎03-02-2018

Hi, Leo

they are on the same subnet with no firewall inbetween.

Regards,Carl

Carl_perkins4 · ‎03-02-2018

HI, All

Thanks for your help it looks like it was the EULA that was the problem i've just checked again and now the ap has associated to the controller as advertised.

Thanks for all you help much appreciated

Kind Regards,

Carl

heathen · ‎05-04-2018

@Jhosbell Verdesca De Aguiar wrote:

Did you add the license or accepted the EULA if using the evaluation license under Management--> Software Activation --> License ??

Dear, you've just saved my day. I've spent 6 hours trying to connect an AP to the vWLC. Different versions. Different AP firmwares. 1000s forum posts. Can cite debug log by memory now. No luck. And only after your message I've found why AP didn't want to connect to the vWLC.

Thanks a lot!

Elohim · ‎10-25-2019

This was also found to be the issue for us. We are using 1572APs connecting to 5520WLC. Once we added a permanent adder licence, the AP began to connect.

nnect.