APf07f.0609.e304>capwap ap

Jeremy Koch · ‎04-27-2015

Hi, so I have bought 6 1700 APs and one 2504 WLC. Three of my APs have connected fine to the WLC and are registered. 3 will not!

The WLC is running software: 8.0.115.0

Please help I'm not a cisco iOS expert, I rely a lot on the GUI but I can do some basic CLI stuff. I don't understand why 3 would work no problems and 3 wound not work...

Here is a debug I have managed to grab:

(Cisco Controller) debug>capwap events enable

(Cisco Controller) debug>*spamApTask0: Apr 27 21:21:58.414: f0:7f:06:09:e3:b4 Received LWAPP DISCOVERY REQUEST to ff:ff:ff:ff:ff:ff on port '1'
*spamApTask0: Apr 27 21:21:58.414: f0:7f:06:09:e3:b4 Discarding discovery request in LWAPP from AP supporting CAPWAP

*spamApTask0: Apr 27 21:21:58.414: f0:7f:06:09:e3:b4 Received LWAPP DISCOVERY REQUEST to ff:ff:ff:ff:ff:ff on port '1'
*spamApTask0: Apr 27 21:21:58.414: f0:7f:06:09:e3:b4 Discarding discovery request in LWAPP from AP supporting CAPWAP

*spamApTask2: Apr 27 21:22:08.413: f0:7f:06:09:e3:b4 Discovery Request from 192.168.10.230:40508

*spamApTask2: Apr 27 21:22:08.413: f0:7f:06:09:e3:b4 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 25, joined Aps =0
*spamApTask2: Apr 27 21:22:08.413: apModel: AIR-CAP1702I-Z-K9

*spamApTask2: Apr 27 21:22:08.413: apType = 45 apModel: AIR-CAP1702I-Z-K9

*spamApTask2: Apr 27 21:22:08.413: f0:7f:06:09:e3:b4 Discovery Response sent to 192.168.10.230 port 40508

*spamApTask2: Apr 27 21:22:08.413: f0:7f:06:09:e3:b4 Discovery Response sent to 192.168.10.230:40508

*spamApTask2: Apr 27 21:22:08.414: f0:7f:06:09:e3:b4 Discovery Request from 192.168.10.230:40508

*spamApTask2: Apr 27 21:22:08.414: f0:7f:06:09:e3:b4 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 25, joined Aps =0
*spamApTask2: Apr 27 21:22:08.414: apModel: AIR-CAP1702I-Z-K9

*spamApTask2: Apr 27 21:22:08.414: apType = 45 apModel: AIR-CAP1702I-Z-K9

*spamApTask2: Apr 27 21:22:08.415: f0:7f:06:09:e3:b4 Discovery Response sent to 192.168.10.230 port 40508

*spamApTask2: Apr 27 21:22:08.415: f0:7f:06:09:e3:b4 Discovery Response sent to 192.168.10.230:40508

(Cisco Controller) debug>pm pki enable

(Cisco Controller) debug>*spamApTask2: Apr 27 21:22:18.411: f0:7f:06:09:e3:b4 DTLS connection not found, creating new connection for 192:168:10:230 (40508) 192:168:10:4 (5246)

*spamApTask0: Apr 27 21:24:28.897: f0:7f:06:09:e3:b4 Received LWAPP DISCOVERY REQUEST to ff:ff:ff:ff:ff:ff on port '1'
*spamApTask0: Apr 27 21:24:28.897: f0:7f:06:09:e3:b4 Discarding discovery request in LWAPP from AP supporting CAPWAP

*spamApTask7: Apr 27 21:24:39.895: f0:7f:06:09:e3:b4 Discovery Request from 192.168.10.235:40508

*spamApTask7: Apr 27 21:24:39.895: f0:7f:06:09:e3:b4 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 25, joined Aps =0
*spamApTask7: Apr 27 21:24:39.895: apModel: AIR-CAP1702I-Z-K9

*spamApTask7: Apr 27 21:24:39.895: apType = 45 apModel: AIR-CAP1702I-Z-K9

*spamApTask7: Apr 27 21:24:39.895: f0:7f:06:09:e3:b4 Discovery Response sent to 192.168.10.235 port 40508

*spamApTask7: Apr 27 21:24:39.895: f0:7f:06:09:e3:b4 Discovery Response sent to 192.168.10.235:40508

*spamApTask7: Apr 27 21:24:39.896: f0:7f:06:09:e3:b4 Discovery Request from 192.168.10.235:40508

*spamApTask7: Apr 27 21:24:39.896: f0:7f:06:09:e3:b4 Join Priority Processing status = 0, Incoming Ap's Priority 1, MaxLrads = 25, joined Aps =0
*spamApTask7: Apr 27 21:24:39.896: apModel: AIR-CAP1702I-Z-K9

*spamApTask7: Apr 27 21:24:39.896: apType = 45 apModel: AIR-CAP1702I-Z-K9

*spamApTask7: Apr 27 21:24:39.896: f0:7f:06:09:e3:b4 Discovery Response sent to 192.168.10.235 port 40508

*spamApTask7: Apr 27 21:24:39.896: f0:7f:06:09:e3:b4 Discovery Response sent to 192.168.10.235:40508

*spamApTask7: Apr 27 21:24:50.893: f0:7f:06:09:e3:b4 DTLS connection not found, creating new connection for 192:168:10:235 (40508) 192:168:10:4 (5246)

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCID: called to evaluate <cscoSha2IdCert>

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCID: comparing to row 5, ID cert >bsnSslWebauthCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCID: comparing to row 4, ID cert >bsnSslWebadminCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCID: comparing to row 3, ID cert >cscoSha2IdCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetDERIDCert: Using SHA2 Id cert on WLC

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCertFromCID: called to get cert for CID 193d632b

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCertFromCID: comparing to row 5, certname >bsnSslWebauthCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCertFromCID: comparing to row 4, certname >bsnSslWebadminCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCertFromCID: comparing to row 3, certname >cscoSha2IdCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCID: called to evaluate <cscoSha2IdCert>

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCID: comparing to row 5, ID cert >bsnSslWebauthCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCID: comparing to row 4, ID cert >bsnSslWebadminCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetCID: comparing to row 3, ID cert >cscoSha2IdCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetDERIDCertPrivateKey: Using SHA2 Id cert Private Keys on WLC

*spamApTask7: Apr 27 21:24:50.894: sshpmGetSshPrivateKeyFromCID: called to get key for CID 193d632b

*spamApTask7: Apr 27 21:24:50.894: sshpmGetSshPrivateKeyFromCID: comparing to row 0, certname >bsnOldDefaultIdCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetSshPrivateKeyFromCID: comparing to row 1, certname >bsnDefaultIdCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetSshPrivateKeyFromCID: comparing to row 2, certname >cscoDefaultIdCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetSshPrivateKeyFromCID: comparing to row 3, certname >cscoSha2IdCert<

*spamApTask7: Apr 27 21:24:50.894: sshpmGetSshPrivateKeyFromCID: match in row 3

*emWeb: Apr 27 21:25:04.437: sshpmUpdateCertConfig: called.

*emWeb: Apr 27 21:25:04.437: sshpmUpdateCertConfig: writing out credential index.

*sshpmLscTask: Apr 27 21:25:06.446: sshpmLscTask: LSC Task received a message 4
*spamApTask2: Apr 27 21:25:08.446: f0:7f:06:09:e3:b4 DTLS Handshake Timeout server (192.168.10.4:5246), client (192.168.10.230:40508)
*spamApTask2: Apr 27 21:25:08.447: acDtlsPlumbControlPlaneKeys: lrad:192.168.10.230(40508) mwar:192.168.10.4(5246)

*spamApTask2: Apr 27 21:25:08.450: f0:7f:06:09:e3:b4 DTLS connection closed event receivedserver (192.168.10.4/5246) client (192.168.10.230/40508)
*spamApTask2: Apr 27 21:25:08.450: f0:7f:06:09:e3:b4 No entry exists for AP (192.168.10.230/40508)
*spamApTask2: Apr 27 21:25:08.450: f0:7f:06:09:e3:b4 No AP entry exist in temporary database for 192.168.10.230:40508

UC540 system with 8.6.2 Software Pack

Leo Laohoo · ‎04-27-2015

Maybe the APs have the wrong Regulatory Domain.

Can you post the complete output to the following commands:

1. WLC: sh sysinfo;

2. WLC: sh time; and

3. AP: sh version.

Jeremy Koch · ‎04-27-2015

(Cisco Controller) >show sysinfo

Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 8.0.115.0
Bootloader Version............................... 1.0.20
Field Recovery Image Version..................... 7.6.101.1
Firmware Version................................. PIC 20.0

Build Type....................................... DATA + WPS

System Name...................................... ipswireless
System Location..................................
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.9.1.1279
IP Address....................................... 192.168.10.4
IPv6 Address..................................... ::
Last Reset....................................... Software reset
System Up Time................................... 0 days 1 hrs 21 mins 46 secs
System Timezone Location......................... (GMT+10:00) Sydney, Melbourne, Canberra
System Stats Realtime Interval................... 5
System Stats Normal Interval..................... 180

--More-- or (q)uit

Configured Country............................... AU - Australia
Operating Environment............................ Commercial (0 to 40 C)
Internal Temp Alarm Limits....................... 0 to 65 C
Internal Temperature............................. +31 C
External Temperature............................. +34 C
Fan Status....................................... 3200 rpm

State of 802.11b Network......................... Enabled
State of 802.11a Network......................... Enabled
Number of WLANs.................................. 1
Number of Active Clients......................... 0

Burned-in MAC Address............................ 68:9C:E2:BE:C7:C0
Maximum number of APs supported.................. 75
System Nas-Id.................................... ipswireless
WLC MIC Certificate Types........................ SHA1/SHA2

UC540 system with 8.6.2 Software Pack

Jeremy Koch · ‎04-27-2015

(Cisco Controller) >show time

Time............................................. Mon Apr 27 22:50:18 2015

Timezone delta................................... 0:0
Timezone location................................ (GMT+10:00) Sydney, Melbourne, Canberra

NTP Servers
NTP Polling Interval......................... 86400

Index NTP Key Index NTP Server NTP Msg Auth Status
------- ----------------------------------------------------------------------------------
1 0 192.168.10.2 AUTH DISABLED

UC540 system with 8.6.2 Software Pack

Jeremy Koch · ‎04-27-2015

Hi i need help getting the 'sh version' for the AP...

I can find the temp IP address of the AP by looking in the logs on the WLC. When i SSH into the AP i need to login so i try cisco/cisco. This does not work...access denied.

How do i get this info for you?

UC540 system with 8.6.2 Software Pack

Leo Laohoo · ‎04-27-2015

Configured Country............................... AU  - Australia

Ok, this is telling me your controller is configured for Australia. This means your AP should have the regulatory domain of "-N", "-Z" or "-UX". If the AP does NOT have the following regulatory domain, then this is the cause as to why your AP ain't joining your controller.

If you cannot physically access the AP, then check your delivery receipt.

Jeremy Koch · ‎04-28-2015

all six APs are "-Z" units...

UC540 system with 8.6.2 Software Pack

Leo Laohoo · ‎04-28-2015

Hmmmm ... The only culprit left is that the APs came with MESH IOS.

Jeremy Koch · ‎04-28-2015

ok cool. how do I fix that?

UC540 system with 8.6.2 Software Pack

Leo Laohoo · ‎04-28-2015

Log into your Wireless LAN Controller.
Select the Security tab.
Expand AAA and select AP Policies.
Click the Add button in the far right.
Under Add AP to Authorization Listenter the MAC Address of the Access Point in the MAC Address text box. (The MAC Address can be found either on the bottom of the Access Point on the serial number sticker, or, by starting a console session to the Access Point. When in the console session the default host name is the MAC Address of the AP).
Click the Add button.
Click the Apply button.
Click the Wireless tab.
All access points currently in your network should show up on the Wireless tab. Also, your problem access point should show up here now as well. If not, then your AP may already be at the maximum number of handshake retries. In that case, reboot the Access Point and wait a few minutes. Then refresh the page.
When the AP finally does show up under the Wireless tab, check the AP Modecolumn. It may operating in ‘Bridge’ mode. This is incorrect. It should be in ‘Local’mode.
If your AP is in ‘Bridge’click the name of the AP under the AP Name column.
Under the General tab, click the AP Mode drop down box and select ‘Local’.
Click the Apply button in the top right.
Your AP should now be working fine.

Jeremy Koch · ‎04-28-2015

Hi I have followed these instructions exactly...

No APs are showing up :(

thank you for your help so far. any other ideas?

UC540 system with 8.6.2 Software Pack

Leo Laohoo · ‎04-28-2015

Console into the AP and reboot the AP. I want to see what it's doing.

Jeremy Koch · ‎05-12-2015

here is the output from a telnet session of the ap booting:

n6▒S+F{V▒[6▒▒؍
              ▒+▒s#▒{
6{▒s▒▒▒▒
        ▒▒v{▒+▒sKs;▒k▒{▒▒cVÃ{▒▒cF▒
                                  s▒3+▒s#▒
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco AIR-CAP1702I-Z-K9 (PowerPC) processor (revision A0) with 376810K/134656K bytes of memory.
Processor board ID FGL1839XDHS
PowerPC CPU at 800Mhz, revision number 0x2151
Last reset from power-on
LWAPP image version 8.0.72.236
1 Gigabit Ethernet interface

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: F0:7F:06:09:E3:B4
Part Number                          : 73-16776-01
PCA Assembly Number                  : 000-00000-00
PCA Revision Number                  :
PCB Serial Number                    : FOC18326WPX
Top Assembly Part Number             : 068-05568-01
Top Assembly Serial Number           : FGL1839XDHS
Top Revision Number                  : A0
Product/Model Number                 : AIR-CAP1702I-Z-K9
% Please define a domain-name first.
ipv6 enable
^
% Invalid input detected at '^' marker.

ipv6 address autoconfig
^
% Invalid input detected at '^' marker.

ipv6 address dhcp
^
% Invalid input detected at '^' marker.

Press RETURN to get started!

*Mar 1 00:00:13.447: APAVC: Initial WLAN Buffers Given to System is 2500

*Mar 1 00:00:13.495: APAVC: WlanPAKs 42878 RadioPaks 42270

*Mar 1 00:00:13.499: Starting Ethernet promiscuous mode
*Mar 1 00:00:13.503: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg

*Mar 1 00:00:15.495: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state to up
*Mar 1 00:00:15.635: %SYS-5-RESTART: System restarted --
Cisco IOS Software, c1700 Software (AP3G2-RCVK9W8-M), Version 15.3(3)JA, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2014 by Cisco Systems, Inc.
Compiled Fri 15-Aug-14 12:27 by prod_rel_team
*Mar 1 00:00:15.671: %LINK-6-UPDOWN: Interface GigabitEthernet1, changed state to up
*Mar 1 00:00:15.679: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg
lwapp_crypto_init: MIC Present and Parsed Successfully

*Mar 1 00:00:15.819: %SSH-5-ENABLED: SSH 2.0 has been enabled
*Mar 1 00:00:16.667: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Mar 1 00:00:20.459: DPAA Initialization Complete
*Mar 1 00:00:20.459: %SYS-3-HARIKARI: Process DPAA INIT top-level routine exited
*Mar 1 00:00:21.459: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
*Mar 1 00:00:23.459: %LINK-6-UPDOWN: Interface BVI1, changed state to down
*Mar 1 00:00:24.459: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to down
*Mar 1 00:00:27.667: %LINK-6-UPDOWN: Interface BVI1, changed state to up
*Mar 1 00:00:28.667: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Mar 1 00:00:28.739: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 192.168.10.140, mask 255.255.255.0, hostname APf07f.0609.e3b4

bridge-group 1 source-learning
^
% Invalid input detected at '^' marker.
%Default route without gateway, if not a point-to-point interface, may impact performance
*Mar 1 00:00:34.499: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg

%Error opening flash:/capwap-saved-config (No such file or directory)
*Mar 1 00:01:07.519: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*May 12 12:07:19.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.10.4 peer_port: 5246
*May 12 12:07:25.251: %CDP_PD-4-POWER_OK: 15.4 W power - NEGOTIATED inline power source
*May 12 12:07:27.251: %LINK-5-CHANGED: Interface GigabitEthernet1, changed state to administratively down
*May 12 12:07:48.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0x5860418!

*May 12 12:08:18.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.10.4:5246
*May 12 12:08:39.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*May 12 12:08:40.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.10.4 peer_port: 5246Peer certificate verification failed FFFFFFFF

*May 12 12:08:40.099: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:496 Certificate verified failed!
*May 12 12:08:40.099: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 192.168.10.4:5246
*May 12 12:08:40.099: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.10.4:5246
*May 12 12:08:45.791: %CDP_PD-4-POWER_OK: 15.4 W power - NEGOTIATED inline power source
*May 12 12:09:44.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*May 12 12:09:45.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.10.4 peer_port: 5246
*May 12 12:10:14.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0x58608AC!

*May 12 12:10:44.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.10.4:5246
*May 12 12:11:04.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*May 12 12:11:05.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.10.4 peer_port: 5246
*May 12 12:11:34.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0x5A70E24!

UC540 system with 8.6.2 Software Pack

Leo Laohoo · ‎05-12-2015

Console into the AP and enter the command: capwap ap controller ip address <Management IP Address of the WLC>

Jeremy Koch · ‎05-12-2015

APf07f.0609.e304>capwap ap controller ip address 192.168.10.4
^
% Invalid input detected at '^' marker.

Note: the marker is sitting under the first 'a' in capwap

UC540 system with 8.6.2 Software Pack

Aironet 1700 AP not connection to 2504 WLC - Help please!