AIR-CAP3602I-C-K9 ap can't join the ac wlc2504

[fishlonely]

the ac information following:

show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 7.2.110.0
Bootloader Version............................... 1.0.16
Field Recovery Image Version..................... 1.0.0
Firmware Version................................. PIC 16.0

Build Type....................................... DATA + WPS

System Name...................................... WLC_2504
System Location..................................
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.9.1.1279
IP Address....................................... 10.60.21.10
Last Reset....................................... Power on reset
System Up Time................................... 226 days 16 hrs 1 mins 29 secs
System Timezone Location......................... (GMT +8:00) HongKong, Bejing, Chongquing

Configured Country............................... CN - China
Operating Environment............................ Commercial (0 to 40 C)

--More-- or (q)uit
Internal Temp Alarm Limits....................... 0 to 65 C
Internal Temperature............................. +21 C
External Temperature............................. +27 C
Fan Status....................................... 5100 rpm

State of 802.11b Network......................... Enabled
State of 802.11a Network......................... Enabled
Number of WLANs.................................. 8
Number of Active Clients......................... 82

Burned-in MAC Address............................ 54:78:1A:AC:A3:9F
Maximum number of APs supported.................. 25

(Cisco Controller) >show time

Time............................................. Wed Jun 3 15:54:55 2020

Timezone delta................................... 0:0
Timezone location................................ (GMT +8:00) HongKong, Bejing, Chongquing

NTP Servers
NTP Polling Interval......................... 86400

Index NTP Key Index NTP Server NTP Msg Auth Status
------- ---------------------------------------------------------------

(Cisco Controller) >show license summary

License Store: Primary License Storage
StoreIndex: 0 Feature: base-ap-count Version: 1.0
License Type: Permanent
License State: Active, In Use
License Count: 25 /25 (Active/In-use)
License Priority: Medium
License Store: Primary License Storage
StoreIndex: 1 Feature: base Version: 1.0
License Type: Permanent
License State: Active, Not in Use
License Count: Non-Counted
License Priority: Medium
License Store: Evaluation License Storage
StoreIndex: 0 Feature: base-ap-count Version: 1.0
License Type: Evaluation
License State: Inactive
Evaluation total period: 8 weeks 4 days
Evaluation period left: 8 weeks 4 days
License Count: 50 / 0 (Active/In-use)
License Priority: None

(Cisco Controller) > show license capacity

Licensed Feature Max Count Current Count Remaining Count
-----------------------------------------------------------------------
AP Count                25                  17                   8

(Cisco Controller) >debug client 7c:95:f3:30:6c:60

(Cisco Controller) >debug capwap errors enable

(Cisco Controller) >debug capwap events enable

(Cisco Controller) >*spamReceiveTask: Jun 03 14:51:52.402: Received SPAM_ADD_MOBILE

*spamApTask7: Jun 03 14:52:14.990: 7c:95:f3:30:6c:60 Discovery Request from 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:14.990: 7c:95:f3:30:6c:60 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 25, joined Aps =17
*spamApTask7: Jun 03 14:52:14.990: 7c:95:f3:30:6c:60 Discovery Response sent to 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:14.990: 7c:95:f3:30:6c:60 Discovery Response sent to 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:34.987: 7c:95:f3:30:6c:60 Discovery Request from 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:34.987: 7c:95:f3:30:6c:60 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 25, joined Aps =17
*spamApTask7: Jun 03 14:52:34.987: 7c:95:f3:30:6c:60 Discovery Response sent to 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:34.987: 7c:95:f3:30:6c:60 Discovery Response sent to 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:34.987: 7c:95:f3:30:6c:60 Discovery Request from 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:34.988: 7c:95:f3:30:6c:60 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 25, joined Aps =17
*spamApTask7: Jun 03 14:52:34.988: 7c:95:f3:30:6c:60 Discovery Response sent to 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:34.988: 7c:95:f3:30:6c:60 Discovery Response sent to 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:54.984: 7c:95:f3:30:6c:60 Discovery Request from 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:54.984: 7c:95:f3:30:6c:60 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 25, joined Aps =17
*spamApTask7: Jun 03 14:52:54.985: 7c:95:f3:30:6c:60 Discovery Response sent to 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:54.985: 7c:95:f3:30:6c:60 Discovery Response sent to 10.60.21.18:1493

*spamApTask7: Jun 03 14:52:54.985: 7c:95:f3:30:6c:60 Discovery Request from 10.60.21.18:1493

==================================the ap  information =====================

sh ver
Cisco IOS Software, C3600 Software (AP3G2-K9W8-M), Version 12.4(25e)JA1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Wed 30-May-12 03:30 by prod_rel_team

ROM: Bootstrap program is C3600 boot loader
BOOTLDR: C3600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(23c)JY, RELEASE SOFTWARE (fc1)

AP7c69.f660.1d45 uptime is 1 hour, 7 minutes
System returned to ROM by power-on
System image file is "flash:/ap3g2-k9w8-mx.124-25e.JA1/ap3g2-k9w8-mx.124-25e.JA1"

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco AIR-CAP3602I-C-K9 (PowerPC) processor (revision A0) with 167926K/81920K bytes of memory.
Processor board ID FGL1731X1FU
PowerPC CPU at 800Mhz, revision number 0x2151
Last reset from power-on
LWAPP image version 7.2.110.0
1 Gigabit Ethernet interface
2 802.11 Radio(s)

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 7C:69:F6:60:1D:45
Part Number : 73-14521-02
PCA Assembly Number : 800-37501-02
PCA Revision Number : A0
PCB Serial Number : FOC17292GKQ
Top Assembly Part Number : 800-35852-02
Top Assembly Serial Number : FGL1731X1FU
Top Revision Number : C0
Product/Model Number : AIR-CAP3602I-C-K9

Configuration register is 0xF

AP7c69.f660.1d45#sh capwap client rcb
AdminState : ADMIN_ENABLED
SwVer : 7.2.110.0
NumFilledSlots : 2
Name : AP7c69.f660.1d45
Location : default location
MwarName :
MwarMacAddr : ffff.ffff.0000
MwarHwVer : 0.0.0.0
ApMode : Local
ApSubMode : Not Configured
OperationState : DISCOVERY
CAPWAP Path MTU : 576
LinkAuditing : disabled
AP Rogue Detection Mode : Enabled
AP Tcp Mss Adjust : Disabled
Band Direct : Disabled
Predownload Status : None
Auto Immune Status : Disabled
RA Guard Status : Disabled
Efficient Upgrade State : Disabled
Efficient Upgrade Role : None
TFTP Server : Disabled
802.11bg(0) Radio
GPR Period : 0
Beacon Period : 0
DTIM Period : 0
World Mode : 1
VoceraFix : 0
Fragmentation Threshold : 2346
Current Tx Power Level : 2
Current Channel : 11
802.11a(1) Radio
GPR Period : 0
Beacon Period : 0
DTIM Period : 0
World Mode : 1
VoceraFix : 0
Fragmentation Threshold : 2346
Current Tx Power Level : 1
Current Channel : 149

AP7c69.f660.1d45#sh inventory
NAME: "AP3600", DESCR: "Cisco Aironet 3600 Series (IEEE 802.11n) Access Point"
PID: AIR-CAP3602I-C-K9 , VID: V01, SN: FGL1731X1FU

[Leo Laohoo]

No NTP configured.

[fishlonely]

i set the corrrec time on the ap,but  ap also  can't join the ac.

[Rich R]

Have you read this field notice?
https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html
You're running 7.2.110.0 - that is EXTREMELY old!
Minimum version you need for applying the workaround config for this FN is 7.4.140.0 but you should really think about moving to a supported release like 8.5 if your APs are still supported (check https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html) The latest 7.4 release is 7.4.150.0 so if you need to stay on an old release that's probably the best compromise to get the fix and support old APs!
Note that 3602i is supported in 8.5.

[fishlonely]

two same modle ap with same software ver. the one joined the ac successly,but the orher can't join the ac

[fishlonely]

two same modle ap with same software ver. the one joined the ac successly,but the orher can't join the ac

[Leo Laohoo]

---

@fishlonely wrote:

i set the corrrec time on the ap,but  ap also  can't join the ac.

---

NTP needs to be correctly configured on the WLC.  Time must be accurately set, hence NTP is the best method.  Manually configuring the time and date on the WLC means time drift will happen.

[fishlonely]

i see,

but i have 18 aps join the ac successly .

(Cisco Controller) > show license capacity

Licensed Feature Max Count Current Count Remaining Count
-----------------------------------------------------------------------
AP Count                  25                       17                    8

[Daniel Ordóñez Flores]

Hi @fishlonely 

Question... have you ever tried to configure statically configure the IP parameters?

[fishlonely]

hi, the ap's ip is from dhcp server.

ap and ac‘s   network is  10.60.21.0/24   
the ap can obtained ip from dhcp server and can ping  ac's ip.

[Jurgens L]

Check the certs on both the WLC and AP, based on your AP serial number you should be good, but your WLC might have expired and you may have the same issue for your associated AP's if you reload them.
AP_CLI#show crypto pki certificates
WLC_CLI: show certificate all

[Rich R]

Exactly like @Jurgens L said!
Did you read the field notice or not?
And then do the required checks.

[fishlonely]

hi,thank you 

this is the result:

   ap:

AP7c69.f660.1d45#show crypto pki certificates
CA Certificate
Status: Available
Certificate Serial Number: 00
Certificate Usage: General Purpose
Issuer:
ea=support@airespace.com
cn=ca
ou=none
o=airespace Inc
l=San Jose
st=California
c=US
Subject:
ea=support@airespace.com
cn=ca
ou=none
o=airespace Inc
l=San Jose
st=California
c=US
Validity Date:
start date: 23:38:55 UTC Feb 12 2003
end date: 23:38:55 UTC Nov 11 2012
Associated Trustpoints: airespace-old-root-cert

CA Certificate
Status: Available
Certificate Serial Number: 00
Certificate Usage: Signature
Issuer:
ea=support@airespace.com
cn=Airespace Root CA
ou=Engineering
o=Airespace Inc.
l=San Jose
st=California
c=US
Subject:
ea=support@airespace.com
cn=Airespace Root CA
ou=Engineering
o=Airespace Inc.
l=San Jose
st=California
c=US
Validity Date:
start date: 13:41:22 UTC Jul 31 2003
end date: 13:41:22 UTC Apr 29 2013
Associated Trustpoints: airespace-new-root-cert

CA Certificate
Status: Available
Certificate Serial Number: 03
Certificate Usage: General Purpose
Issuer:
ea=support@airespace.com
cn=Airespace Root CA
ou=Engineering
o=Airespace Inc.
l=San Jose
st=California
c=US
Subject:
ea=support@airespace.com
cn=Airespace Device CA
ou=Engineering
o=Airespace Inc.
l=San Jose
st=California
c=US
Validity Date:
start date: 22:37:13 UTC Apr 28 2005
end date: 22:37:13 UTC Jan 26 2015
Associated Trustpoints: airespace-device-root-cert

CA Certificate
Status: Available
Certificate Serial Number: 5FF87B282B54DC8D42A315B568C9ADFF
Certificate Usage: Signature
Issuer:
cn=Cisco Root CA 2048
o=Cisco Systems
Subject:
cn=Cisco Root CA 2048
o=Cisco Systems
Validity Date:
start date: 20:17:12 UTC May 14 2004
end date: 20:25:42 UTC May 14 2029
Associated Trustpoints: cisco-root-cert

Certificate
Status:

===========================AC  =============================================

(Cisco Controller) >show certificate compatibility
Certificate compatibility mode:.................. off

(Cisco Controller) >show certificate lsc

Incorrect usage. Use the '?' or <TAB> key to list commands.

(Cisco Controller) >show certificate lsc ?

summary Display LSC Summary
ap-provision Display LSC AP Provisioning Details

(Cisco Controller) >show certificate lsc summary

LSC Enabled...................................... No
LSC CA-Server.................................... None

LSC AP-Provisioning.............................. No

LSC Params:
Country......................................
State........................................
City.........................................
Orgn.........................................
Dept.........................................
Email........................................
KeySize...................................... 0

LSC Certs:
CA Cert...................................... Not Configured
RA Cert...................................... Not Configured

(Cisco Controller) >show certificate lsc ap-provision

LSC AP-Provisioning.............................. No

(Cisco Controller) >show certificate summary
Web Administration Certificate................... 3rd Party
Web Authentication Certificate................... Locally Generated
Certificate compatibility mode:.................. off

[Jurgens L]

I suggest you follow the Field Notice @Rich R mentioned.