AP2702i AP won't join 9800 vWLC - DLTS handshake error

[liormo]

Hello, I've setup an internal lab which uses the 9800 WLC (on AWS with a VPN to our lab). And now i'm trying to onboard an out of the box 2702i AP.

The join process fails: 

CAPWAP DTLS session closed for AP, cause: DTLS handshake error

* The AP is currently using DHCP 43 option to get the WLC details. are there any other options that needs to be sent (NTP?)

Attached image of packet capture.

[Jurgens L]

Did you ensure you generated a certificate for the AP's on the WLC?

wireless config vwlc-ssc key-size 2048 signature-algo sha256 password 0 <pwd>

[liormo]

Yes, I ran this command before adding the AP. Are there any debug commands which might be useful here?

I haven't logged in to the AP yet . Maybe there are some commands that needs to be executed on the AP before?

[Jurgens L]

You may want to check the syslogs on the WLC otherwise I will suggest getting on the AP cli and see the output. The 9800's come with a 90-day trial license, you can always just double check that under administration > licensing in the GUI.

[alig.norbert]

What kind of license do you have for the AP?

As for the 9800 WLC there is no "add AP license", so the AP needs to have an AIR-DNA license on the smart license portal.

[Ralph Olsen]

I did:

clear capwap ap all-config

That worked.

[crystalcross]

Thanks, this worked for me took me lots of googling to find this answer

clear capwap ap all-config

I first tried clear lwapp private-config and that didn't work at all

[ammahend]

9800 required mandatory smart license for APs to register, might be an issue with licensing, what the smart license status (see image)