AP do not find Controller

[vmhoang2]

I have issue, AP disconnect Controller C9800 and It rejoin controller. I remote SSH to AP and see that It send request to Controller, but Controller do not response ( WLC not found). 

AP run PPoe, so I never power inline on switch and It reboot. After AP send discovery to Controller and Controller response.I have tried troubleshooting, but don't know what the cause is.

Has anyone encountered this problem? help me !!!

[Mark Elsen]

 - (include AP model , controller model and software version being used on the C9800 too)
 - Have a checkup of the C9800 current configuration with the CLI command show tech wireless ; feed the output into
                                                                                                                     Wireless Config Analyzer
 - Check controller logs too when the AP tries to join
 - Use these tools to further debug the AP join problem : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800APJoin

 M.

[vmhoang2]

Hi Marce 1000,

Wireless controller is behind a NAT device and  Wireless Controller manages only Access Points reachable through the public internet (external APs). I configuration Controller in the CAPWAP discovery response to both the public IP and the private IP.

Could this cause a discovery error or could it have any impact?

[Mark Elsen]

 - APs must have an access path to the controller , make sure that is not blocked by firewalling (e.g.) ; simple test could be to try to ping the controller from an external AP.

 M.

[vmhoang2]

AP can ping to Wireless controller and Firewall open  port upd 5246 and 5247.

[Mark Elsen]

                 >...AP can ping to Wireless controller and Firewall open  port upd 5246 and 5247.
  As mentioned before look into : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800APJoin

 M.

[MHM Cisco World]

Show wireless state ap join summary 

Share this here 

[vmhoang2]

Hi NMH,

Wireless controller is behind a NAT device and  Wireless Controller manages only Access Points reachable through the public internet (external APs). I configuration Controller in the CAPWAP discovery response to both the public IP and the private IP.

Could this cause a discovery error or could it have any impact?

[MHM Cisco World]

Yes it can be NAT issue ,

do you use NAT 1:1 or port forwarding? 

[vmhoang2]

i used Nat 1:1.

 I have enabled capwap debug application events. I have seen AP send discovery to controller both public and private ip. But the Controller is not responding. Then I turned off POE on the SWitch and turned it back on. The AP reboots, sends the discovery to the controller, and Controller  responds.

Now the AP joins the Controller.
I still don't understand why this problem occurs.

[MHM Cisco World]

When it happened again check NAT translate in fw is it add or not. 

Also how ap discover wlc IP via dhcp or dns? 

[vmhoang2]

Yes,

AP discovery WLC ip, I used command Capwap ap primary-base on each APs.

[MHM Cisco World]

Let make second look to issues 

Why shut no shut porr make connection success?

Wlc is behind NAT and it use public IP but sure AP not use public IP

It use private and hence AP also behind NAT, this NAT is dynamic I think and it have absolute times when end the NAT is remove and this make wlc receive packet from new AP port source. 

Make udp nat timeout of AP is long enough. 

MHM

[vmhoang2]

That's a great explanation.

I want to recreate that environment. Can you give me direction to solve that problem.

[Rich R]

If the AP joins after power cycle then you've hit a software bug which was preventing join.

Make sure your WLC software is up to date as per TAC recommended link below - currently 17.9.4 + SMUs + APSP6.