Re: Cisco 3702i-A-K9 won't join an 1832i configured as master controller mobility express

Paul Jose · ‎07-11-2018

I have an older 3702i-A-K9 that I'm trying to join into an 1832i-B-K9 runing mobility express software as a controller.

3702 has LWAPP version 8.0.115.0

System image file is "flash:/ap3g2-rcvk9w8-mx/ap3g2-rcvk9w8-xx"

1832i has Mobility Express version 8.7.106.0

Below is the output I get from the 3702 console

*Jul 11 23:44:54.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.10.69.160 peer_port: 5246
*Jul 11 23:44:54.255: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 10.10.69.160 peer_port: 5246
*Jul 11 23:44:54.255: %CAPWAP-5-SENDJOIN: sending Join Request to 10.10.69.160
*Jul 11 23:44:59.255: %CAPWAP-5-SENDJOIN: sending Join Request to 10.10.69.160
*Jul 11 23:44:59.255: %DTLS-5-ALERT: Received WARNING : Close notify alert from 10.10.69.160
*Jul 11 23:44:59.255: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.10.69.160:5246
Not in Bound state.
*Jul 11 23:45:14.755: %CAPWAP-3-DHCP_RENEW: Could not discover WLC. Either IP address is not assigned or assigned IP is wrong. Renewing DHCP IP.
*Jul 11 23:45:18.851: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 10.10.69.210, mask 255.255.255.0, hostname APd8b1.90df.c3d8

Translating "CISCO-CAPWAP-CONTROLLER"...domain server (208.67.222.222)

*Jul 11 23:45:45.767: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Jul 11 23:45:46.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.10.69.160 peer_port: 5246
*Jul 11 23:45:47.251: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 10.10.69.160 peer_port: 5246
*Jul 11 23:45:47.251: %CAPWAP-5-SENDJOIN: sending Join Request to 10.10.69.160
*Jul 11 23:45:52.251: %CAPWAP-5-SENDJOIN: sending Join Request to 10.10.69.160
*Jul 11 23:45:52.251: %DTLS-5-ALERT: Received WARNING : Close notify alert from 10.10.69.160
*Jul 11 23:45:52.251: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.10.69.160:5246
*Jul 11 23:45:52.255: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Jul 11 23:45:52.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.10.69.160 peer_port: 5246
*Jul 11 23:45:52.255: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 10.10.69.160 peer_port: 5246
*Jul 11 23:45:52.255: %CAPWAP-5-SENDJOIN: sending Join Request to 10.10.69.160
*Jul 11 23:45:57.255: %CAPWAP-5-SENDJOIN: sending Join Request to 10.10.69.160
*Jul 11 23:45:57.255: %DTLS-5-ALERT: Received WARNING : Close notify alert from 10.10.69.160
*Jul 11 23:45:57.255: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.10.69.160:5246

Flavio Miranda · ‎07-11-2018

Hi

3700 should have Mobility Express on it.

You can check that by running show version command in cli.

-If I helped you somehow, please, rate it as useful.-

Paul Jose · ‎07-11-2018

Thank u for your response.

The 3702 does not support mobility express software on it according to this doc. It's only a subordinate AP/member of the ME controller.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-4/b_cisco_mobility_express_8_4/b_Mobility_Express_Deployment_guide_chapter_0100.pdf

In any case here is my show version output

APd8b1.90df.c3d8# sho ver
Cisco IOS Software, C3700 Software (AP3G2-RCVK9W8-M), Version 15.3(3)JA3, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2015 by Cisco Systems, Inc.
Compiled Thu 19-Feb-15 10:27 by prod_rel_team

ROM: Bootstrap program is C3700 boot loader
BOOTLDR: C3700 Boot Loader (AP3G2-BOOT-M) LoaderVersion 15.2(4)JB, RELEASE SOFTWARE (fc1)

APd8b1.90df.c3d8 uptime is 18 minutes
System returned to ROM by power-on
System restarted at 23:59:12 UTC Wed Jul 11 2018
System image file is "flash:/ap3g2-rcvk9w8-mx/ap3g2-rcvk9w8-xx"
Last reload reason:

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco AIR-CAP3702I-A-K9 (PowerPC) processor (revision A0) with 376810K/134656K bytes of memory.
Processor board ID FCW1923N037
PowerPC CPU at 800Mhz, revision number 0x2151
Last reset from power-on
LWAPP image version 8.0.115.0
1 Gigabit Ethernet interface

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: D8:B1:90:DF:C3:D8
Part Number                          : 73-15243-01
PCA Assembly Number                  : 000-00000-00
PCA Revision Number                  :
PCB Serial Number                    : FOC19213N5R
Top Assembly Part Number             : 068-100374-02
Top Assembly Serial Number           : FCW1923N037
Top Revision Number                  : A0
Product/Model Number                 : AIR-CAP3702I-A-K9

Flavio Miranda · ‎07-11-2018

Subordinate is all you need as you have the 1800 which can play as master.

The problem is that your AP is not Mobility Express capable. You need to convert it.

-If I helped you somehow, please, rate it as useful.-

Paul Jose · ‎07-11-2018

Flavio

Can you assist pointing me to the ME software for the 3702i? I haven’t been able to find it

Leo Laohoo · ‎07-12-2018

Is NTP configured on the ME AP?

Paul Jose · ‎07-12-2018

Yes it is.

patoberli · ‎07-12-2018

Is your ME set for Americas or any other region where an -A- AP can join?

Paul Jose · ‎07-12-2018

The ME is configured for United States. The 3702i-A-K9 was purchased before US FCC changed the Regulatory domain to -B for the US in 2016.

patoberli · ‎07-13-2018

Yeah that sounds ok and should work.
You could try to install the latest LW image onto the 3702i, maybe it helps:
https://software.cisco.com/download/home/285029865/type/280775090/release/15.3.3-JH1
Otherwise I'd try 8.5.131.0 on the ME AP, maybe 8.7 has some bug with the 3700 series (wouldn't be the first time).
Here the release notes of 8.5 ME: https://www.cisco.com/c/en/us/td/docs/wireless/access_point/mob_exp/85/release_notes/b_ME_RN_85.html