AP 9115 join issue

[Claudio Battan]

I have a problem with APs in a WiFi system with 9800-CL, version 17.9.4.a.
In a branch, connected with IPSEC VPN, the APs (all C9115AX) are regularly joined to the controller, located in the headquarter.
In recent days, the connection had problems and remained down for several minutes.
The APs, which are configured in FLEX-mode, work fine, but after some time on the controller they appear as non-joined - and this is obvious and normal.
The anomaly is that, even when the line comes back UP, the APs do not return Joined (even after a long time), but I have to restart them.
Anyone have any ideas?
Thank you

[Mark Elsen]

 - Depending how connection states are preserved or not , the (flapping) IPSEC VPN tunnel(s) may not always provide a clear connectivity path for the AP(s) to the controller ; check the VPN server logs too at the branch and check if you can see connecting attempts for the AP and if they are handled  properly (e.g.)
                   Also look into : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800APJoin

  Appendix : review the 9800-CL configuration with the CLI command show tech wireless and feed the output into : 
                                                                                                         Wireless Config Analyzer

 M.

[Rich R]

@Claudio Battan If you remain on 17.9.4a then make sure you have the latest SMUs and APSPs installed.

You could also consider installing recently released 17.9.5 which has some bug fixes for AP disconnections.

However it is suspicious that none of your APs reconnect automatically (if it's one of those bugs then it won't usually affect all of them).  Is there any NAT or firewall between the APs and the WLC?

[MHM Cisco World]

First check the IPSec status when the AP's can not join

MHM