ap fallback

[qsosan20]

I have 3 wlc9800 as below: 

2 in SSO and third is configured as N+1

Am testing ap backup primary option under ap join profile , so i configured an ACL on switch to prevent communication to primary controller then ap successfully registered to N+1 backup primary controller ,

Now i removed the ACL to make the ap fallback to primary SSO but it does not , even ap fallback option are enabled under ap join profile , is there anything else need to be configured to make it fallback ?

[marce1000]

  - What is the purpose of this ACL anyway if you want full (additional) redundancy between the SSO pair and the N+1 controller ?

 M.

[qsosan20]

ACL is a just simulation for SSO disconnection 

[marce1000]

 - It may not be a correct simulation ; power down the N+1 to have 'healthy fallback'.....

 M.

[qsosan20]

Does fallback happens when N+1 being down , or when primary (SSO) become up again ?

[marce1000]

 - FYI : https://community.cisco.com/t5/wireless/wlc-9800-ha-n-1-ap-not-falling-back-to-primary-wlc/m-p/4503744#M235654

 M.

[qsosan20]

Thank you , 

I already tested that as well by configured primary and secondary under AP HA itself , 

Still its not falling back to primary after communication restored ,

[marce1000]

 - aireos had an automatic fallback option in the AP join profile ; check if you have something similar in IOS-XE (on the 9800) , 

 M.

[Rich R]

ap profile default-ap-profile
 capwap timers primary-discovery-timeout 600
When you have AP HA primary and secondary set (not the primary and backup in the join profile) then it should make the AP fall back to primary within 10 minutes (mostly does) but it sometimes just doesn't work (ongoing bugs with join problems) and you need to do a capwap restart or reload of the AP.

What version of software are you using?  You should be at least compliant with the TAC recommended releases (link below) - currently 17.9.4 + SMU_CSCwh87343 + APSP8 OR 17.9.4a + APSP8 - and I'd suggest considering recently released 17.9.5 although that won't become recommended until it's been in stable deployment for 4-6 weeks.

[qsosan20]

Thanks guys,

I manged to fix it by configuring per-AP HA rather than join profile HA, 

[Rich R]

The primary and secondary on the join profile are not HA settings.  It's purely to assist WLC discovery in case primary/secondary/tertiary HA WLCs are not available - they effectively become fourth and fifth options for discovery.

If you want to set HA from the WLC globally you have to use the AP Fallback to Controllers Using AP Priming Profile feature available since 17.9.2:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_ap_fb_wlcs.html