AP unable to join WLC - solid green light

[cisconn00b]

Hello all, I am having issues with wireless controller Catalyst model 9800 L-F and access point model AIR-CAP3702i-A-K9.  I have 2 of these access points and only one of them is able to join the WLC.  The one giving me issues has a solid green light on and it shows up in the GUI under Configuration>wireless setup > basic > "APs on this location" > it shows the mac address and "not joined", and N/A AP name while the other APs that work, says joined.  

I've tried to wipe the AP using 

ap: delete flash:private-multiple-fs

AP#clear capwap private-config

Below are the error messages I see when consoled into the AP

*Aug 19 16:07:22.999: %SYS-3-MGDTIMER: Uninitialized timer, timer stop, timer = 3AFC900. -Process= "CAPWAP CLIENT", ipl= 0, pid= 73
-Traceback= 119AF80z 12A89C8z 12AA11Cz 16F32C8z 1762360z 16FD224z 1725FFCz 17278A4z 171E070z 1728184z 171E374z 17305D8z 173C56Cz 1728250z 176052Cz 172E614z
*Aug 19 16:07:22.999: %LWAPP-3-CLIENTERRORLOG: LWAPP LED Init: incorrect led state 255
*Aug 19 16:07:22.999: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg

*Aug 19 16:07:22.999: %CAPWAP-3-ERRORLOG: Failed to load configuration from flash. Resetting to default config
*Aug 19 16:07:23.007: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg

*Aug 19 16:07:33.007: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Aug 19 16:08:38.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.1.100.9 peer_port: 5246Peer certificate verification failed FFFFFFFF

*Aug 19 16:08:38.003: %CAPWAP-3-ERRORLOG: Certificate verification failed!
*Aug 19 16:08:38.003: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:467 Certificate verified failed!
*Aug 19 16:08:38.003: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 10.1.100.9:5246
*Aug 19 16:09:42.999: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Aug 19 16:08:38.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.1.100.9 peer_port: 5246Peer certificate verification failed FFFFFFFF

*Aug 19 16:08:38.003: %CAPWAP-3-ERRORLOG: Certificate verification failed!
*Aug 19 16:08:38.003: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:467 Certificate verified failed!
*Aug 19 16:08:38.003: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 10.1.100.9:5246
*Aug 19 16:09:42.999: %SYS-3-MGDTIMER: Uninitialized timer, timer stop, timer = 3AFC900. -Process= "CAPWAP CLIENT", ipl= 0, pid= 73
-Traceback= 119AF80z 12A89C8z 12AA11Cz 16F32C8z 1762360z 16FD224z 1725FFCz 17278A4z 171E070z 1728184z 171E374z 17305D8z 173C56Cz 1728250z 176052Cz 172E614z
*Aug 19 16:09:42.999: %LWAPP-3-CLIENTERRORLOG: LWAPP LED Init: incorrect led state 255
*Aug 19 16:09:42.999: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg

*Aug 19 16:09:42.999: %CAPWAP-3-ERRORLOG: Failed to load configuration from flash. Resetting to default config
*Aug 19 16:09:43.007: %LWAPP-3-CLIENTERRORLOG: Config load from flash failed. Initialising Cfg

AP58f3.9c3e.fdfc#
*Aug 19 16:09:53.007: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Aug 19 16:10:58.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: x.x.x.x peer_port: 5246Peer certificate verification failed FFFFFFFF

*Aug 19 16:10:58.003: %CAPWAP-3-ERRORLOG: Certificate verification failed!
*Aug 19 16:10:58.003: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:467 Certificate verified failed!
*Aug 19 16:10:58.003: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to x.x.x.x:5246

[marce1000]

 - What is the IOS-XE version that the controller is running , not that these are only supported up and to 17.3.x (no later).

 M.

[cisconn00b]

The WLC is running version17.3.5a

[marce1000]

               - Check if controller is set to correct time and or using NTP.

 M.

[Rich R · Accepted solution]

What version of software is installed on the 3702?  It needs to be at least 8.10.162.0 (15.3(3)JK6) to be able to join that WLC.
To save download time simply install the 17.3.5a code manually - 15.3(3)JPJ8a -
https://software.cisco.com/download/home/285029865/type/280775090/release/15.3.3-JPI8a
Note that 17.3.5b is released now.
https://software.cisco.com/download/home/286321399/type/282046477/release/Amsterdam-17.3.5b

[cisconn00b]

It is currently on 15.2(4)JB. I downloaded the image filename: ap3g2-k9w8-tar.153-3.JPN.tar and I was able to run the command

ap: tar -xtract tftp://x.x.x.x/ap3g2-k9w8-tar.153-3.JPN.tar flash:

I tried to boot after this but it booted the old one. I then changed: set BOOT = flash:/ap3g2-k9w8-mx.153-3.JPJ8a/ap3g2-k9w8-xx.153-3.JPJ8a

I don't think this is the right file because it failed.  

when looking in Dir, I can see:

34 drwx 512 <date> ap3g2-rcvk9w8-mx

8 drwx 2496 <date> ap3g2-k9w8-mx.153-3.JPN

11 drwx 2368 <date> ap3g2-k9w8-mx.153-3.JF12

How do I remove the old one and just boot whatever is necessary.  This is for a lightweight AP

[Rich R · Accepted solution]

The correct command to install new software (which automatically updates the boot variables) is:
archive download-sw tftp://x.x.x.x/ap3g2-k9w8-tar.153-3.JPN.tar
Note you've set the boot variable to JPJ8a but the image you installed is JPN!!!

To delete files manually: del /f /r flash:tftp://x.x.x.x/ap3g2-k9w8-tar.153-3.JPN.tar
When you use archive download-sw it will automatically delete old images to make space unless you use the various options to disable that.

[cisconn00b]

Thank you for the help. After updating the AP, it was able to join the controller.  You're right, once I changed the syntax to .JPN, it worked.