Cisco 1852 AP fails to join vWLC

[Dan Yatzeck]

I have a new Cisco 1852 access point and am trying to join a vWLC.  The CAPWAP session on the AP fails to authenticate the vWLC with a certificate error.  AP tested running 8.1.121.0, 8.1.122.0, and 8.1.131.0 code, all fail to join any version of vWLC since support for this AP was introduced.

Cert Verification FAILED with error 20 (unable to get local issuer certificate) at 0 depth...

NTP server is set and time is accurate, and the certificate on vWLC is within the validity period.

Also, this same AP properly joins to a 2504 WLC fine, but will not join the vWLC.  It is clearly a problem with the vWLC.

I did successfully connect a 1702 AP to vWLC version 8.1.122.0, but the 1852 did not work.

Any suggestions are appreciated.

[Scott Fella]

If you have ap's joined to the vWLC, then maybe open up a TAC case and see what the issue is with the 1850 or the vWLC.  I don't run a vWLC but the 1850 I have used for testing has no issues joining any other controller.

-Scott

[Dan Yatzeck]

Thanks Scott for the reply.

My intent was to open a TAC case if nothing else seemed forthcoming.  I find it strange that I can't get this 1852 to join any vWLC due to certificate failure and have not seen a bug report about it.

The problem is basically the AP failing to validate the vWLC SSC, but I don't know whether that is a problem with the certificate on the vWLC or on the 1852 certificate processing mechanism.

[Mirko Grabel · Accepted solution]

Hi Dan,

I had the same issue and just spoke to one of our wireless experts.

The 1850 are simply not supported on the vWLC as of now, hence you (we) can't get it to work with the current vWLC version.

It will be documented here:

http://www/c/en/us/td/docs/wireless/controller/release/notes/crn81mr3.html#51900 

/Mirko

[Dan Yatzeck]

Thank you Mirko for looking into this.

I assume this is something that will be resolved in future versions.  It is surprising to see so many incompatibilities, I find it a bit strange that the 1850 was released before these issues were resolved.

I am working on a good size deployment that was based on 1850s on vWLC, so I hope this can be addressed sooner than later.

[Reuben Farrelly]

The main problem is likely that the 1850 doesn't support Flexconnect mode yet (it only operates in local mode only for now).

But on the other hand the vWLC supports Flexconnect mode only but not local mode operation for APs.

I am hoping the 1850 support for Flexconnect is not far away....

[abdulbari]

I have the same issue and my 1852i ap's are manufactured on 02 nov 2015, and my vWLC is 8.2

1702i and 1532i works like charm.

Has there been any update on this issue with 1852i for vWLC.

please advice

[Reuben Farrelly]

No there is no update.  There is no publically released software released yet for the 1852s which allow them to run in Flexconnect mode, so you cannot use them with your vWLC.  This will likely change in an upcoming release.

[ukirukuk13]

I had similar problem with AP1852 8.2.110 & vWLC 8.3
"Cert Verification FAILED with error 20 (unable to get local issuer certificate) at 0 depth"
I reinstaled AIR-AP1830-K9-8.2.110.0.tar on AP1852 as ME WLC, then I translated it into capwap operation
This operation fixed connection problem

[Divanoatuin]

Hi, 

i have same problem today with Cisco AP 1832i and vWLC 8.2.110

I've read that now Flexconnect is supported on 1832i but AP can't join vWLC.

Pls help :)

[Reuben Farrelly]

Please see the release notes for 8.2:

http://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn82mr1.html#pgfId-1319001

The very first line reads:

Features Not Supported on Cisco Virtual WLCs

• Cisco Aironet 1850 and 1830 Series APs

[Divanoatuin]

I know, but my supplyer said that they should be compatibles.

And, on 1830 datasheet, it seems that vWLC is supported.

Do u know if CISCO give an official answer?

Ty for the help :)

[Reuben Farrelly]

Good point.  Checking... the Release Notes for the software do say that it is not supported, but the Data Sheet for that AP states that it is (but doesn't specify which version is the minimum).  So yes, it is ambiguous.

You can try logging a TAC case to get an official answer.  In fact that probably would be a good idea, because as part of that you might be able to trigger the documentation to be fixed up to be made more consistent.  It will also give you some leverage when talking to your supplier about how they gave you incorrect advice and how they will help you resolve the problem :-)

[Dan Yatzeck]

Opening a new TAC case might be good since Flexconnect mode was just added in 8.2.110.0.

As a follow up, I did open a TAC case about this originally and that is how the specific line in the release notes about 1850 and 1830 series AP being not supported on vWLCs was added - originally it was not there.

[Scott Fella]

You would need to run v8.2.111.0 since there is a known bug for the 1800, 2800, and 3800.

http://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn82mr1.html#53089

-Scott