cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5047
Views
2
Helpful
4
Replies

AP not joint dtls error

Ramprasad2
Level 1
Level 1

hi team

i have wlc 2500 and running IOS ( 8.1.102.0 )

i have ap 3602i

but not join ap with wlc even i have runn below command


1 (Cisco Controller) >config ap dtls-wlc-mic sha2 ( its taken )

2


(Cisco Controller) >config ap cert-expiry-ignore mic enable

Incorrect usage. Use the '?' or <TAB> key to list

 

Even erro showing below

*Jan 1 00:34:40.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 172.31.33.250:5246
*Jan 1 00:34:40.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Jan 1 00:34:41.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.31.33.250 peer_port: 5246
*Jan 1 00:35:10.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0x7346F84!

Translating "CISCO-CAPWAP-CONTROLLER"...domain server (255.255.255.255)
*Jan 1 00:35:40.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 172.31.33.250:5246

*Jan 1 00:36:08.999: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Jan 1 00:35:51.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.31.33.250 peer_port: 5246
*Jan 1 00:35:51.011: %PKI-3-CERTIFICATE_INVALID_NOT_YET_VALID: Certificate chain validation has failed. The certificate (SN: 5832A5BA00000002C661) is not yet valid Validity period starts on 03:37:53 UTC Aug 31 2015Peer certificate verification failed 001A

*Jan 1 00:35:51.011: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:497 Certificate verified failed!
*Jan 1 00:35:51.015: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 172.31.33.250:5246
*Jan 1 00:35:51.015: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 172.31.33.250:5246

 

how to fix it

 

2 Accepted Solutions

Accepted Solutions

marce1000
Hall of Fame
Hall of Fame

 

   - Ref : https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

                >....(Cisco Controller) >config ap cert-expiry-ignore mic enable
      - You need 8.3.x or above to be able to use that command , also consider : https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html

 M.



-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
    When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

View solution in original post

Leo Laohoo
Hall of Fame
Hall of Fame

Look at the time and date of the AP. 

Please post the complete output to the following commands: 

  1. WLC:  sh sysinfo
  2. WLC:  sh time
  3. AP:  sh version

View solution in original post

4 Replies 4

balaji.bandi
Hall of Fame
Hall of Fame
%PKI-3-CERTIFICATE_INVALID_NOT_YET_VALID: Certificate chain validation has failed. The certificate (SN: 5832A5BA00000002C661) is not yet valid Validity period starts on 03:37:53 UTC Aug 31 2015Peer certificate verification failed 001A

check the valid certs and also check the below FN :

https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

BB

***** Rate All Helpful Responses *****

How to Ask The Cisco Community for Help

marce1000
Hall of Fame
Hall of Fame

 

   - Ref : https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

                >....(Cisco Controller) >config ap cert-expiry-ignore mic enable
      - You need 8.3.x or above to be able to use that command , also consider : https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html

 M.



-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
    When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Leo Laohoo
Hall of Fame
Hall of Fame

Look at the time and date of the AP. 

Please post the complete output to the following commands: 

  1. WLC:  sh sysinfo
  2. WLC:  sh time
  3. AP:  sh version

Rich R
VIP
VIP

Read all the field notices below ...

 

Review Cisco Networking for a $25 gift card