AP can ping WLC but still not associating

[Moudar]

Hi

I have an Access Point (AP) powered via Power over Ethernet (PoE) from a power injector. When the switch reloads for any reason, the AP loses connectivity with the Wireless LAN Controller (WLC) and fails to re-associate, even though it can ping the WLC and resolve the IP address of the WLC using DNS for cisco-capwap-controller.

It shows this log again and again:

Not in Bound state.
*Jun 27 14:36:58.875: %CAPWAP-3-DHCP_RENEW: Could not discover WLC. Either IP address is not assigned or assigned IP is wrong. Renewing DHCP IP.
*Jun 27 14:37:01.947: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 192.168.3.3, mask 255.255.255.0, hostname TBA

The only way to restore normal operation is to disconnect and reconnect the PoE (restart the AP). Only then does it successfully discover the WLC without any issues.

Any ideas?

[klnnnnng]

Hi,

what WLC are you running? I guess that all discovery, retry and heartbeat timers just time out and the AP needs to be rebooted.

You can try playing with the retransmit, retry and heartbeat timers.

Regards

[marce1000]

  - It looks like because of the power injector there is a race condition , between controller discovery and acquiring an IP which can only be done , if the switch has full network connectivity. Do you have the possibility of  using switch-based-poe ?

 M.

[Leo Laohoo]

---

@Moudar wrote:

Could not discover WLC.​

  

---

What is the IP address of the WLC and what is the DHCP Option 43?

[Rich R]

What model of AP?
What model of WLC?
What version of software?
Since you are using DHCP why not use option 43 instead of DNS?
Is it possible you have option 43 and DNS configured with different IPs?

[Moudar]

WLC 5520 version 8.10.190

AP 9120

My setup is a bit unusual.

I have a 9120 AP connected to a Check Point SMB firewall. This firewall has a VPN connection to the central office where the WLC is located.

The setup works, but only if the firewall reboots. After a firewall reboot, the AP can still be reached via SSH, it can ping the WLC, and it can resolve the cisco-capwap DNS. However, it displays the message I mentioned earlier and refuses to associate.

To resolve this, I log in to the AP and run 'capwap ap restart,' after which it associates immediately.

[Rich R]

We've had problems before with customers trying to put firewalls and IDS/IPS between the APs and WLC and the CAPWAP (UDP 5246 & 5247) can sometimes be incorrectly detected as some sort of DOS attack and then gets rate limited.  Make sure you don't have any of that happening on the firewall.

Otherwise I'd say you need to do a simultaneous packet capture on either side of the firewall to work out what is getting dropped/blocked and preventing the AP from joining.

You might also want to upgrade to recommended version 8.10.196.0.

I also suggest using option 43 instead of DNS for WLC discovery.