Change virtual ip according to wlc5520 web-auth certificate change.

JJJHL · ‎08-21-2023

hello.

I am trying to perform web-auth by obtaining a new public certificate and replacing it.

At the same time, I plan to change the virtual IP as well.

I saw in the documentation that the virtual ip should be set to a non-routable ip.

Is it the same when replacing a certificate with a public certificate?

* WLC - 5520

Flavio Miranda · ‎08-21-2023

Hi @JJJHL

The IP address initially used by Cisco was 1.1.1.1 which is actually roteable although cisco recommend non-routable IP.

Now a days cisco use 192.0.2.1 ip address.

The public certificate can be associanted to this IP. Keep in mind that you need to reload the wlc in order to change virtual ip.

Rich R · ‎08-22-2023

The important point is that the DNS fully qualified domain name you're using for that virtual IP matches the domain on the public certificate you're using so that clients don't get certificate errors.

------------------------------
TAC recommended codes for AireOS WLC's   and   TAC recommended codes for 9800 WLC's
Best Practices for AireOS WLC's   and   Best Practices for 9800 WLC's
Cisco Wireless compatibility matrix
Field Notice: FN-63942 APs and WLCs Fail to Create CAPWAP Connections Due to Certificate Expiration
Field Notice: FN-72424 Later Versions of WiFi 6 APs Fail to Join WLC - Software Upgrade Required
Field Notice: FN-72524 - During Software Upgrade/Downgrade IOS APs Might Remain in Downloading State
     after 4 Dec 2022 Due to Certificate Expiration - Fixed in 8.10.185.3 and latest 9800 IOS-XE releases
     also fixed in 8.5.182.11 (8.5 mainline) and 8.5.182.108 (8.5 IRCM) if you can't upgrade to 8.10
     TAC confirmed that Mobility Express AP TFTP download is not affected so ME 8.5.182.0 still works but see FN-74035 below
Field Notice: FN-70479 Out-Of-The-Box AP Fails to Join WLC or Joins with Single Radio due to Country Mismatch - RMA required
How to avoid boot loop due to corrupted image on Wave 2 and Catalyst 11ax Access Points (CSCvx32806)
Field Notice: FN-74035 - Wave2 APs DFS May Not Detect Radar After Channel Availability Check Time
     fixed in 8.10.185.3 and see the field notice for 8.5, Mobility Express and other fixed releases
Check your WLC config with Wireless Config Analyzer using "show tech wireless" output (9800) or "config paging disable" then "show run-config" output (AireOS) and use Wireless Debug Analyzer to analyze your WLC client debugs
Leo Laohoo's list of bugs affecting 2800/3800/4800/1560 APs