AP Join issue with WLC9800 in AWS

[axom789]

Hello All,

I am trying to add C9136I -b access point to a production wlc 9800 for a new site. We are moving from Aruba to Cisco. I am testing this on one access point now. I have created a new mgmt wlan scope in my dhcp server and the ap is getting an ip but its failing to get past the discovery stage. From the logs it looks like its unable to reach the ntp server but I am able to reach the ntp server from the wlc. I have create fw rules and opened the necessary ports. I have also configured the Site Tags for the AP and added the mac to the AP list statically. I am not sure where else to look. Any advise is appreciated. From WLC I cannot ping the Access point so i suspect it could be some rules issue. Any advise is appreciated. Below are the logs from the Access point. 

CAPWAP State: Discovery

21:08:45.6909] Got WLC address x.x.x.x from DHCP.

21:08:45.6910] IP DNS query for CISCO-CAPWAP-CONTROLLER.test.local

21:08:45.6924] DNS resolved CISCO-CAPWAP-CONTROLLER.test.local

21:08:45.6924] DNS discover IP addr: x.x.x.x

21:08:45.6987] Discovery Request sent to x.x.x.x, discovery type DHCP(2)

21:08:45.7014] Discovery Request sent to x.x.x.x, discovery type DNS(3)

21:08:45.7169] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0)

21:08:45.7178] Discarding msg CAPWAP_WTP_EVENT_REQUEST(type 9) in CAPWAP state: Discovery(2).

21:08:45.7179] Discarding msg CAPWAP_WTP_EVENT_REQUEST(type 9) in CAPWAP state: Discovery(2).

21:08:45.7180] Discarding msg CAPWAP_WTP_EVENT_REQUEST(type 9) in CAPWAP state: Discovery(2).

ipv6 gw config loop in discovery timer expiry

Set PnP NTP Server pnpntpserver.test.local.

Could Not resolve NTP server IP address from hostname pnpntpserver.test.local.

NTP server config: Wrong NTP server IP address format pnpntpserver.test.local

PNP:Server not reachable, Start CAPWAP Discovery

[ 21:09:56.7225]

[ 21:09:56.7225] Going to restart CAPWAP (reason : Post startCapwapDiscovery)...

[ 21:09:56.7225]

[ 21:09:56.7226] Restarting CAPWAP State Machine.

[* 21:09:56.7228] OOBImageDnld: OOBImageDownloadTimer expired for image download..

[*121:09:56.7228] OOBImageDnld: Do common error handler for OOB image download..

[* 21:09:56.7727] OOBImageDnld: OOBImageDownloadTimer expired for image download..

[*21:09:56.7728] OOBImageDnld: Do common error handler for OOB image download..

[*21:09:56.8210]

[* 21:09:56.8211] CAPWAP State: DTLS Teardown

[*21:09:56.9056] OOBImageDnld: Do common error handler for OOB image download..

[* 21:09:57.0240] status 'upgrade.sh: Script called with args:[CANCEL]'

[* 21:09:57.0680] do CANCEL, part1 is active part

[* 21:09:57.0953] status 'upgrade.sh: Cleanup tmp files ...'

Thank You!!

[Flavio Miranda · Accepted solution]

@axom789 

 I would not worry about NTP, your problem seems to be here

21:08:45.6987] Discovery Request sent to x.x.x.x, discovery type DHCP(2)

21:08:45.7014] Discovery Request sent to x.x.x.x, discovery type DNS(3)

We should see some Discovery response coming from the WLC. It seems you do have connectivity issue which is hard to say where as we dont know your topology.

[axom789]

Thanks. The issue was a missing policy in aws. 

[marce1000]

                           >...OOBImageDownloadTimer expired for image download..
 - Messages like that indicate that the AP can not contact the controller. (Also) Start with a checkup of the WLC9800 in AWS
using the CLI command show tech wireless (not a simple show tech) and feed the output from that into Wireless Config Analyzer
For the rest , check if there is a free 'capwap path' possible , not hampered by any firewalling.

 M.