AIronet 1815i Cant reach WebGUI / Roaming Problems

[EdholmR]

Hi! I'm having issues with connecting to our webgui for our AIronet1815i APs. I can ping them and I can SSH to them, but I cant reach the webgui(https/http) I checked to see if https/http was disabled in the settings but they are enabled. The APs are located in a different subnet than the one im trying from, I can reach the webgui from the same subnet that they are located in.

Aironet are located in Subnet A and Im trying to manage them from Subnet B (This doesnt work with HTTPS, only ping/SSH)

Aironet are located in Subnet A and Im trying to manage them from Subnet A(This works fine with HTTPS/SSH/Ping).

I found a reddit post about there was a bug that you couldnt reach the webgui from the wifi and updated to the lastest version that would fix this problem but im afraid it didnt. I still cant reach them from the wifi.

And I getting reports that our clients arent roaming while they move around the buildings. They have to disconnect and reconnect then they will be placed on the AP closest to them.

[pieterh]

are these stand-alone access points?

then roaming is not as natural as you seem to think, each AP handles it's associations individually, even if the same SSID is used.

is this a WLC or mobility express environment? then there is something wrong that needs to be investigated

[Jhosbell Verdesca De Aguiar]

Is there any access-list between Subnet B and Subnet A?
Is there any CPU access-list at the AP?

[EdholmR]

There is only an ACL that permits subnet B to A (SSH/Ping works fine) if I use ethernet on Subnet B it works fine, so I assume there is something going with wifi. I havent added any CPU access-list but i'm gonna check.

edit: no acl on the cpu and I tried using config network mgmt-via-wireless enable still not working.

[pieterh]

do you use a proxy server in your network? 

if yes, try http(s) access with proxy disabled or add subnet-A to the exclusion list.

[EdholmR]

We're not using any proxies, How do I add a subnet to the exclusion list?

[pieterh]

if you dont use a proxy then the exclusion list need no change

[EdholmR]

I dont know why I'm having such a problem with these APs. I just started getting complaints that our users cant reach the Internet, and I tried it out and sure enough I cant even connect to the AP with some devices. Tried with an Iphone didnt work, but android works fine. Dell doesnt work but HP works. 

We havent done any configuration to these APs except adding a SSID and connecting them together. Shouldnt be a problem but seems like our APs are cursed as we're experiencing a lot of issues. Can they be broken or something? I really dont know what I should do.

[pieterh]

I come back to my first question that is not yet answered

are these stand-alone access points?

or is this a WLC or mobility express environment? 

[EdholmR]

Mobility Express

[pieterh]

then you don't manage access points individuallly! you manage them from the mobility express controller.

this explains you can access ssh (for some basic troubleshooting) but not gui of the AP (because you don't config the ap locally.

- can you access the ME controller GUI or SSH?

- what version?

- is there one or multiple AP's running the ME image?

- please post some config information

[EdholmR]

- can you access the ME controller GUI or SSH?

I',m sorry but its the ME controller i've been talking about. The APs have IPs in 192.168.90.x through our DHCP server, and the mananger have ip in 192.168.90.x too but a static address. I can ping / ssh to the manager address but not reach it through the web interface.

- wh

at version?

Cisco Aironet 1815i with 8.8.100.0 image.

- is there one or multiple AP's running the ME image?

By doing show version on both APs I get this

AP Image type : MOBILITY EXPRESS IMAGE
AP Configuration : MOBILITY EXPRESS CAPABLE

I assume they both are running ME.

- please post some config information

AP1

AP Name : X
Admin State : Enabled
AP Mode : FlexConnect
AP Submode : None
Location : default location
Reboot Reason : Controller Reload command
Primary controller name :
Primary controller IP :
Secondary controller name :
Secondary controller IP :
Tertiary controller name :
Tertiary controller IP :
AP join priority : 1
IP Prefer-mode : IPv4
CAPWAP UDP-Lite : Unconfigured
Last Joined Controller name: Controller
DTLS Encryption State : Disabled
Discovery Timer : 10
Heartbeat Timer : 30
CDP State : Enabled
Watchdog monitoring : Enabled
IOX : Disabled
RRM State : Enabled
LSC State : Disabled
SSH State : Enabled
AP Username : X
Session Timeout : 300
Extlog Host : 0.0.0.0
Extlog Flags : 0
Extlog Status Interval : 0
Syslog Host : 255.255.255.255
Syslog Facility : 0
Syslog Level : errors
Core Dump TFTP IP Addr :
Core Dump File Compression : Disabled
Core Dump Filename :
Client Trace Status : Disabled(All)
Client Trace All Clients : Disabled
Client Trace Filter : 0x00000000
Client Trace Out ConsoleLog: Disabled
WLC Link LAG status : Disabled
AP Link LAG status : Disabled
AP WSA Mode : Disabled
Vlan Interface : Disabled

AP2

AP Name :X
Admin State : Enabled
AP Mode : FlexConnect
AP Submode : None
Location : default location
Reboot Reason : Static IP Addr Reset
Primary controller name :
Primary controller IP :
Secondary controller name :
Secondary controller IP :
Tertiary controller name :
Tertiary controller IP :
AP join priority : 1
IP Prefer-mode : IPv4
CAPWAP UDP-Lite : Unconfigured
Last Joined Controller name: Controller
DTLS Encryption State : Disabled
Discovery Timer : 10
Heartbeat Timer : 30
CDP State : Enabled
Watchdog monitoring : Enabled
IOX : Disabled
RRM State : Enabled
LSC State : Disabled
SSH State : Enabled
AP Username : X
Session Timeout : 300
Extlog Host : 0.0.0.0
Extlog Flags : 0
Extlog Status Interval : 0
Syslog Host : 255.255.255.255
Syslog Facility : 0
Syslog Level : errors
Core Dump TFTP IP Addr :
Core Dump File Compression : Disabled
Core Dump Filename :
Client Trace Status : Disabled(All)
Client Trace All Clients : Disabled
Client Trace Filter : 0x00000000
Client Trace Out ConsoleLog: Disabled
WLC Link LAG status : Disabled
AP Link LAG status : Disabled
AP WSA Mode : Disabled
Vlan Interface : Disabled