Catalyst 9800 automatic AP registration

[marcelma]

Hi, I'm running a WLC 5508 and got some new 9800.

Put the 9800 in the same network and after initial configuration wizard it just grabbed all APs that were registered to the 5508 making the wifi unusable. 

As I can't find anything about this "feature", how do I disable this behavior?

[JPavonM]

What kind of WLC discovery process are you using for the APs to find the controller in the network? Have you taken the IP address of the old controller or are your APs located o the same L2 subnet?

Take a look at available discovery methods in this articke https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/119286-lap-notjoin-wlc-tshoot.html#backinfo

For a proper discovery process, try to configure DHCP option 43 in your AP DHCP pool (https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/97066-dhcp-option-43-00.html) or even configuring DNS resolution to cisco-capwap-controller creating a host entry in your DNS.

HTH
-Jesus

*** Rate All Helpful Responses ***

[marcelma]

The whole Wifi stuff is locate in one subnet. I'm using Option 43 and dns cisco-capwap-controller to deploy / register the APs. Both show to the 5508.

After joining the 9800 he probably did a broadcast and got controll of the APs and updated the firmware, making them unable to join the old 5508. 

[JPavonM]

APs registered in c9800 are able to rejoin a ct5508 as far as they do not receive an answer from c9800. APs do not register to a new controller if the previous one (c9800) they have been registered is still there and it is responding to the join process. APs join to the previously known controller then, if not responding, looking for DHCP option 43 learned IP address then, if not there or it is badly configured, looking for cisco-capwap-controller entry in DNS.

If you need all of them to come back to the 5508, change c9800 IP address, shutdown the wireless management interface on the c9800, or shutdown the new controller, APs will go to the discovery process again.

If even configuring DHCP option 43 your APs are coming to the c9800 controller, review it as this seems to be wrong.

[marcelma]

The APs were unable to come back. I removed the 9800 from the network and checked on the APs, they were unable to register. I had to downgrade the firmware on all APs to have them back in my WLC. 

Thats why I want to disable the broadcast discovery in the 9800 or I'm unable to deploy the new system. If the 9800 broadcasts to the APs and installs his firmware image again I will have the same problem again.

[JPavonM]

It happened to me in the past while the fgirst tests, and I managed to come back to AireOS controller after configure HA on the APs to the old controller and then resetting them.

controller#ap name <AP_Name> controller primary <5508_name> <5508_ip>

controller#ap name <AP_Name>reset

[marcelma]

I will keep that in mind but the 9800 is not in the network anymore and won't be until I found a way to disable that stupid broadcast. 

On a side note, I find it quite strange that some new "unknown" device can just contact my registered access points and update them...

[Scott Fella]

There are documents for example on the EWC access points, Mobility Express, not to place them on the same network as an existing controller. This is also best practice. I have multiple types of controllers in my work lab and at home and each controller is on its own subnet.

[joseponceiii]

Hi, just wondering when you did this, you mean the AP did redownload the image from the old controller again? or it doesn't have to? We have exact same WLC (9800 and 5508) and I wanted to test AP joining to the new WLC 9800 using CLI only, and what I'm afraid of is if I can roll back using same command. Will that work? From 5508 to 9800 WLC, then roll back to 5508 from 9800 WLC? 

[marce1000]

- Confirming other reply : grabbing is a bit confusing (if needed elaborate) ; and indeed use DHCP option 43 to control designated WLC for AP.

 M.

[marcelma]

Yeah grabbing wasn’t the best word. 

Based on the link provided the controller did a broadcast to get control or at least update the firmware on the access points. 

But it doesn't seem like I can disable this. 

[marce1000]

 - Could you share the link ?

   M.