AP MAC 0000.5e00.0101

[DJay11]

I am seeing this all the time randomly to different Access Point in our network. Seems that this is related to EWC. Need help on how to resolve this. 

AP MAC Address: 0000.5e00.0101

Sharing logs where an incident copied the IP of the network gateway (172.25.124.1). 

From Core Switch (Gateway)

2023 Sep 26 16:18:17 CAMPUS_VDC1 %ARP-3-DUP_VADDR_SRC_IP:  arp [14848]  Source a

ddress of packet received from 0000.5e00.0101 on Vlan124(port-channel1010) is du

plicate of local virtual ip, 172.25.124.1

Pointing to Access Point 

Seems that some AP is acting as controller. We have force the ap-type capwap command on 1 AP and plan to execute in all our stand alone APs. All our APs are connected to a 9800-Controller.  

AP Model: C9120AXI-A

[marce1000 · Accepted solution]

                               >...AP MAC Address: 0000.5e00.0101
  - EWC based APs use VRRP as a redundancy mechanism the virtual MAC address  0000.5e00.010f is part of the VRRP failover setup ,

M.

[DJay11]

Is there a way to disable VRRP on Access point? 

[DJay11]

It is best practice to disable the EWC feature of AP which connects to a central controller? All our APs should function as capwap only and not EWC.  

How do the election process of which AP will act as controller? 

[marce1000 · Accepted solution]

         >...It is best practice to disable the EWC feature of AP which connects to a central controller? 
 It is , if you only need client/capwap mode on the AP : https://www.cisco.com/c/en/us/support/docs/wireless/embedded-wireless-controller-on-catalyst-access-points/215303-embedded-wireless-controller-conversion.html#toc-hId-1622399608

        >...How do the election process of which AP will act as controller? 
            That question disappears if you have a central controller only.

 M.

[David Ritter · Accepted solution]

what happened to:

You are already running EWC in the AP as per the logs. So to convert it back to capwap just go to the CLI of the AP and type "ap-type capwap" ?

[Rich R · Accepted solution]

I've explained this on many previous posts but here we go again:

The problem with running APs with EWC installed is that any time they cannot discover the WLC they may automatically re-activate the EWC even after you've told them to switch to CAPWAP mode previously.

You can also use option 43 to discourage switching to EWC as per 
https://www.cisco.com/c/en/us/products/collateral/wireless/embedded-wireless-controller-catalyst-access-points/white-paper-c11-743398.html#Conversion
however take note of https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwc75102

But ultimately I recommend completely removing the EWC software from the AP and the only way I've found to reliably do that is by re-flashing the AP as per https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9120axi-access-point/217537-repairing-c9120-c9115-access-points-from.html (which installs 8.10.130.0 CAPWAP code) and then upgrading to your required version of CAPWAP software.

Next time make sure you order the correct Cisco product code with CAPWAP software pre-installed not EWC:
C9120AXI-A = CAPWAP
C9120AXI-EWC-A = EWC
It's the same piece of hardware but one has CAPWAP software installed at factory while the other has EWC software installed at factory.

ps: just to add that this is documented on bug https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx22243 which suggests getting TAC to remove the EWC software for you but you can do it yourself as I mentioned above.  As EWC is now end of life Cisco will not fix this.

[DJay11]

Thank you for this information. Helpful indeed. This has been a longstanding issue in our company and even TAC didn't give a concrete diagnosis and solution for this issue. 

[Rich R]

You're welcome - it can be a very irritating problem!

[DJay11]

I have a C9120AXI-A model that has no EWC capable indicated in the show version. Does this mean that imaga loaded is purely capwap? 

[Rich R]

Yes that looks like a CAPWAP image from that screenshot.

[DJay11]

We have converted around 50% of our AP to pure CAPWAP. There are still AP running in EWC. Is there still a chance that those AP-Capwap will connect to AP-EWC if the central controller (9800) is not reachable? 

[Rich R · Accepted solution]

Yes that is my experience - that EWC can get re-activated then other APs will join EWC - so it's best to make sure none can do that.

[DJay11]

Update: 

We have disabled the EWC capability on all our Access Points by forcing the ap capwap command. We no longer encounter this issue. Thank you for all the help.