AP 9115 access

[heyjunsun]

Hello AP9115 I have a question while setting up.

SSID configuration completed and checked ping to AP-> Radius server

However, the connection does not persist in the AP and clicking SSID does not connect or disconnects after attempting.

The log that comes out through "sh log" is

*Mar 25 03:27:03.792 KST: %DOT1X-5-FAIL: Chassis 1 R0/0: wncd: Authentication failed for client (02c7.0719.bd20) with reason (Timeout) on Interface capwap_90000003 AuditSessionID E86013AC0000002414D993C7 Username: 191539                

 *Mar 25 03:28:28.789 KST: %CLIENT_ORCH_LOG-6-CLIENT_ADDED_TO_RUN_STATE: Chassis 1 R0/0: wncd: Username entry (191539) joined with ssid (DBLIFE_19096_232) for device with MAC: 02c7.0719.bd20                                               

 *Mar 25 03:28:32.981 KST: %CLIENT_ORCH_LOG-6-CLIENT_ADDED_TO_RUN_STATE: Chassis 1 R0/0: wncd: Username entry (191539) joined with ssid (DBLIFE_19096_232) for device with MAC: 02c7.0719.bd20                                               

 *Mar 25 03:29:19.486 KST: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: dbliug] [Source: 172.19.96.11] [localport: 23] at 03:29:19 KST Sat Mar 25 2023  

I set it up by referring to the two websites below. SSID/ping test was successful normally, but why can't I access it?....

https://www.youtube.com/watch?v=kW9nJ3MEZX0 

https://lihaifeng.net/?p=699 

[marce1000]

  - Have a checkup of the 9800 controller configuration with the CLI command show tech wireless and feed the output into :
                                                                                                                    Wireless Config Analyzer

 M.

[heyjunsun]

hello marce 

When I analyzed it, I found four red error messages.

1. 

Version: IOS-XE Controller with deferred or security impacted (PSIRT) code:16.12.4a, it is strongly advised to migrated to recommended code

Action: Controller is running deferred code and should be upgraded. Check: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214749-tac-recommended-ios-xe-builds-for-wirele.html

2.

WCAE: Parsing: missing configuration file section(s), checks may not be executed properly:VLAN Config,Interface Config,RF Profile Conversion,Policy Profiles

Action: One or more configuration sections were not found, this is indication of corrupted file, or very old software version. If the file is believed to be correct, please contact wcae@cisco.com, otherwise try to capture it again: https://developer.cisco.com/docs/wireless-troubleshooting-tools/#!how-to-colletct-sh-run-config

3.

RRM: RF tag points to non-existing RF profile name. This may cause severe controller issues. Tag(s) name: Typical_Client_Density_rf_24gh

Action: Check the show wireless tag rf all, and confirm all RF profiles entries are present in show ap rf-profile summary. Fix any missing entry

4.

Authentication: Profile(s) with AAA Policy pointing to non-existing value. Profile: DBLIFE_TEST_WLANID_1,Profile: default-policy-profile

Action: Check the configuration item, and change/replace it with an existing value

What I suspect is the 4th, and you want me to change my profile ID to default-policy-profile instead of DBLIFE_TEST?

[marce1000]

           >....Version: IOS-XE Controller with deferred or security impacted (PSIRT) code:16.12.4a,
                        - This is very old software indeed ; upgrade to 17.9.4a

 M.

[Rich R]

https://www.cisco.com/c/en/us/support/wireless/catalyst-9800-series-wireless-controllers/products-configuration-examples-list.html

Also check Best Practice guide (link below).

I guess you're using EWC on 9115 AP, in which case only flexconnect local switching is supported so take that into account when following any guides.  And EWC does not support VLANs (because no central switching possible) so that part of the config check can be ignored.  VLANs for the local switching WLANs must be defined in flex profiles for the AP.

As @marce1000 says you must upgrade to a currently supported IOS as per the TAC recommended link below (because there are so many bugs and incomplete features in that old version), and fix all the errors highlighted by config analyzer.
> you want me to change my profile ID to default-policy-profile instead of DBLIFE_TEST?
You can only reference policies which exist so whatever policy you use in your config must exactly match (case sensitive) the policy you have already defined in the config.

Also check out these links which will help to understand all you need to configure:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/ewc/17-12/config-guide/ewc_cg_17_12/overview_of_the_controller.html
https://www.cisco.com/c/en/us/products/collateral/wireless/embedded-wireless-controller-catalyst-access-points/white-paper-c11-743398.html
https://www.youtube.com/watch?v=oS68E25wc4A
https://www.wiresandwi.fi/blog/cisco-wlc-9800-base-initial-configuration-cli