Cisco 9800 WLC - AIR-AP1810W-E-K9 -Client failing to join

[Network Team - LCC]

Hello all,

Im after some additional support with a WLC/AP issue.

. 

I have a Client failing to connect to our Cisco 9800 WLC from a AIR-AP1810W-E-K9. 

I am seeing DTLS errors with a unknown ciphersuite.

CAPWAP DTLS session closed for AP, cause: DTLS server session shutdown

This is the only affected client on the WLC. 

WLC running - C9800 Software (C9800_IOSXE-K9), Version 17.4.1, RELEASE SOFTWARE (fc5)

Please see attached .txt file for further info

[marce1000]

                          >....Yes, that would incicate that our 1810w's shoudn't work. 

 I would strongly discourage doing anything that is 'beyond' the compatibility matrix, it will get you in  all sorts of troubles in the end.

 M.

[Network Team - LCC]

Thanks Marce, I'd agree this shouldn't be our way of approching things and looks like it has slipped under the radar. I have raised this to be addressed and look  to replace these 1810w's as soon as we can. It isn't within our normal best practice to go beyond what is recommended by Cisco. 

[marce1000]

 - You can have debug trace analyzed with : https://cway.cisco.com/tools/WirelessDebugAnalyzer/ , also useful is overall checkup of controller configuration with (CLI) show tech wireless , have this processed by : https://cway.cisco.com/tools/WirelessAnalyzer/

 M.

[Rich R]

I agree with @Flavio Miranda - according the docs the 1810W is not supported on 17.4.1.
They went end of software maintenance 29 Oct 2020 and 17.4.1 was only released 29 Nov 2020 so makes sense.
https://www.cisco.com/c/en/us/products/collateral/wireless/aironet-1810w-series-access-points/eos-eol-notice-c51-741565.html

If those 1810s are working on 17.4.1 then that's the real mystery - I suspect they just forgot to remove them from IOS-XE lol

So if it's just that one AP then it's standard AP troubleshooting:
- get the logs off the AP console
- factory default reset on the AP
- packet capture of the CAPWAP from the AP and see if you can see if there's something wrong with that.  For example sometimes when the radio hardware goes faulty the CAPWAP packets are missing half the data that should be in them which prevents the join from ever completing.