AP 4800 not join to second controller

[obahammam]

i have AP4800-E-K9 and two controller with IP

first controller :172.20.240.1 

second controller :172.20.241.1

i want AP connect to second controller  i make access list on GW to deny AP looking for first controller also i make 

#capwap ap primary-base Cisco_a4:27:29 172.20.241.1

to force AP join to second controller  

*my controller  image is 8.7.106.0 which is support AP 4800

*i already check the connectivity between AP and second controller  there is ping from both side 

*AP get IP DHCP  AND can reach to GW

*AP still not join to second controller  

APF4DB.E683.C3BE#SHOW RUN

AP Name : APF4DB.E683.C3BE
Admin State : Enabled
AP Mode : Local
AP Submode : None
Location : default location
Reboot Reason :
Primary controller name : Cisco_a4:27:29
Primary controller IP : 172.20.241.1
Secondary controller name :
Secondary controller IP :
Tertiary controller name :
Tertiary controller IP :
AP join priority : 1
IP Prefer-mode : Unconfigured
CAPWAP UDP-Lite : Unconfigured
Last Joined Controller name:
DTLS Encryption State : Disabled
Discovery Timer : 10
Heartbeat Timer : 30
CDP State : Enabled
Watchdog monitoring : Enabled
IOX : Disabled
RRM State : Enabled
LSC State : Disabled
SSH State : Disabled
AP Username : Cisco
Session Timeout : 300
Extlog Host : 255.255.255.255
Extlog Flags : 0
Extlog Status Interval : 0
Syslog Host : 255.255.255.255
Syslog Facility : 0
Syslog Level : errors
Core Dump TFTP IP Addr :
Core Dump File Compression : Disabled
Core Dump Filename :
Client Trace Status : Enabled(All)
Client Trace All Clients : Enabled
Client Trace Filter : 0x0000000E
Client Trace Out ConsoleLog: Disabled
Client Trace Inline-Mon : Enabled
Client Trace Inline-Mon Pkt-Attach: Disabled
WLC Link LAG status : Disabled
AP Link LAG status : Disabled
AP WSA Mode : Disabled
Vlan Interface : Disabled

----------------------------------------------

APF4DB.E683.C3BE#show ip interface brief
Interface IP-Address Method Status Protocol Speed Duplex
wired0 10.193.247.1 static up up 1000 full
wired1 unassigned unset down down n/a unknown
bvi1 unassigned unset up up n/a n/a
wifi0 n/a n/a administatively down down n/a n/a
wifi1 n/a n/a administatively down down n/a n/a
wifi2 n/a n/a administatively down down n/a n/a

---------------------------------------------------

[*01/07/2019 20:06:58.7420] CAPWAP State: Discovery
[*01/07/2019 20:06:58.7486] Discovery Request sent to 172.20.241.1, discovery type STATIC_CONFIG(1)
[*01/07/2019 20:06:58.7512] Discovery Request sent to 172.20.241.1, discovery type STATIC_CONFIG(1)
[*01/07/2019 20:06:58.7527] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0)
[*01/07/2019 20:07:28.3907]
[*01/07/2019 20:07:28.3907] CAPWAP State: Discovery
[*01/07/2019 20:07:28.3938] Discovery Request sent to 172.20.241.1, discovery type STATIC_CONFIG(1)
[*01/07/2019 20:07:28.3965] Discovery Request sent to 172.20.241.1, discovery type STATIC_CONFIG(1)
[*01/07/2019 20:07:28.3992] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0)

[Scott Fella]

If you can place the AP in the same subnet as the controller you want it to be associated with, that would be the easiest way to have it join. Or if it joins the other controller, you can always change the high availability on the AP to move it to the other one.

[pieterh]

first a question both controllers are not setup as HA-pair?

if so you cannot register AP's on different controllers, all register to the primary!

if both controllers are in the same subnet (172.20.241.0 / ?) and in a different subnet than the accesspoint (10.193.247.1 /??)

and a gateway between them, then the AP cannot discover both controllers by broadcast!

so how do you pass this information? by dns-entry, by dhcp option42 ? or .....?

if you allways prime the controller ip on the access point, then please remove the access-list on the GW

it may not do what you want it to do (it may block access to the second controller as well as the first controller).

if discovery of the first controller is successful and the AP registers successfully,

you can also reconfigure the primary controller ip address from the first controller GUI and test if this behaves as desired.