Solved: Aironet 2800 access points and Catalyst 9800-40 with IOS XE 17.9.3

Bernd Nies · ‎08-31-2023

Hi,

We have some branch offices with Aironet 2700 and 2800 access points and old WLC 2504 running 8.5.151.0. As the WLC 2504 are beyond end of life and support for Aironet 2700 and 2800 has been re-introduced with 17.9.x we migrate our old access points to new Catalyst 9800-40 controller in the headquarter.

With the Aironet 2700 this went smooth. With the Airnet we hit this bug here: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe07802.

Cisco 2800/3800/4800/1562 drop upstream EAP packets
CSCwe07802

Symptom:EAP negotiations fail. Client sends its certificate (CLIENT HELLO), but the AP fails to forward it to CAPWAP. Conditions:Seen with 2800/3800/4800/1562 series AP (no other models). Problem may be more prevalent when using 80MHz wide rather than 20/40MHz.

Workaround:Let the AP mode be mesh mode

Certificate based EAP/TLS authenticated sessions get timeouts and disconnect. Moving all APs to mesh authentication mode is not an option here.

Bug description says it is fixed in Cupertino-17.9.4 but that release is not yet flagged with a star in Cisco download portal. We've had bad experience using software not with a star from the download portal. Is 17.9.4 stable enough for production?

Regards,

Bernd

Rich R · ‎08-31-2023

The TAC recommended list (below) is more authoritative (and comes with relevant advice) than the * designation on the download page but TAC generally won't promote a release till it's been in stable deployment (without any major issues reported) for at least 4 weeks. 17.9.4 was released 31st July so should replace 17.9.3 anytime soon in the next week or two. I already have it deployed so I agree with Marce - yes.

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs

View solution in original post

marce1000 · ‎08-31-2023

>....Is 17.9.4 stable enough for production?
- Consider that a yes ,

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Rich R · ‎08-31-2023

The TAC recommended list (below) is more authoritative (and comes with relevant advice) than the * designation on the download page but TAC generally won't promote a release till it's been in stable deployment (without any major issues reported) for at least 4 weeks. 17.9.4 was released 31st July so should replace 17.9.3 anytime soon in the next week or two. I already have it deployed so I agree with Marce - yes.

------------------------------
Please click Helpful if this post helped you and Select as Solution (drop down menu at top right of this reply) if this answered your query.
------------------------------
TAC recommended codes for AireOS WLC's and TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's, Best Practices for 9800 WLC's and Cisco Wireless compatibility matrix
Check your 9800 WLC config with Wireless Config Analyzer using "show tech wireless" output or "config paging disable" then "show run-config" output on AireOS and use Wireless Debug Analyzer to analyze your WLC client debugs
Field Notice: FN63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN72524 IOS APs stuck in downloading state after 4 Dec 2022 due to Certificate Expired
- Fixed in 8.10.196.0, latest 9800 releases, 8.5.182.12 (8.5.182.13 for 3504) and 8.5.182.109 (IRCM, 8.5.182.111 for 3504)
Field Notice: FN70479 AP Fails to Join or Joins with 1 Radio due to Country Mismatch, RMA needed
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
Leo's list of bugs affecting 2800/3800/4800/1560 APs

Bernd Nies · ‎08-31-2023

Thanks. Then we will wait migrating the branch offices with Aironet 2800 access points until the C9800-40 has been upgraded from 17.9.3 to 17.9.4.