Cisco AIR-CAP1532E-E-K9 at WLC AIR-CT2504-K9

[Hans Juergen Guenter]

Hi,

first I am a German native speaker, so I hope you can understand what I am writing.

Here is my Problem:

I have some problems to connect the AP 1532 to the WLC 2504.

Everytime the AP tryes to connect it want to download the software from
the WLC. The WLC has the Version 8.5.120.0 and the AP has 8.2.166.0.

Spoiler

Image version check passed

Extracting files...
ap1g3-k9w8-mx.153-3.JF5/ (directory) 0 (bytes)
extracting ap1g3-
*Feb 23 11:30:13.023: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Feb 23 11:30:09.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.28.14.230 peer_port: 5246
*Feb 23 11:30:09.303: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 10.28.14.230 peer_port: 5246
*Feb 23 11:30:09.303: %CAPWAP-5-SENDJOIN: sending Join Request to 10.28.14.230k9w8-mx.153-3.JF5/file_hashes (1408 bytes)
extracting ap1g3-k9w8-mx.153-3.JF5/CO5.bin (2594 bytes)
extracting ap1g3-k9w8-mx.153-3.JF5/img_sign_rel_sha2.cert (1371 bytes)
extracting ap1g3-k9w8-mx.153-3.JF5/final_hash.sig (512 bytes)
extracting ap1g3-k9w8-mx.153-3.JF5/info (288 bytes)
extracting ap1g3-k9w8-mx.153-3.JF5/CA5.bin (12962 bytes)!
extracting ap1g3-k9w8-mx.153-3.JF5/ap1g3-k9w8-mx.153-3.JF5 (15641882 bytes)!!!!!!perform archive download capwap:/ap1g3 tar file
*Feb 23 11:30:09.347: %CAPWAP-6-AP_IMG_DWNLD: Required image not found on AP. Downloading image from Controller.
*Feb 23 11:30:09.355: Loading file /ap1g3...
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
extracting ap1g3-k9w8-mx.153-3.JF5/final_hash (141 bytes)
extracting ap1g3-k9w8-mx.153-3.JF5/RO2.bin (5024 bytes)
ap1g3-k9w8-mx.153-3.JF5/html/ (directory) 0 (bytes)
ap1g3-k9w8-mx.153-3.JF5/html/level/ (directory) 0 (bytes)
extracting ap1g3-k9w8-mx.153-3.JF5/CA2.bin (12962 bytes)!!
extracting ap1g3-k9w8-mx.153-3.JF5/CO2.bin (1136 bytes)
extracting ap1g3-k9w8-mx.153-3.JF5/img_sign_rel.cert (1375 bytes)
extracting ap1g3-k9w8-mx.153-3.JF5/RO5.bin (9884 bytes)!
extracting info.ver (288 bytes)
Download image failed, notify controller!!! From:8.2.166.0 to 8.5.120.0, FailureCode:3

archive download: takes 52 seconds

*Feb 23 11:31:01.547: Currently running a Release Image

*Feb 23 11:31:01.555: Using SHA-2 signed certificate for image signing validation.
*Feb 23 11:31:01.567: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed. The certificate (SN: 4E78A210000000000007) has expired. Validity period ended on 21:43:46 UTC Dec 4 2022
*Feb 23 11:31:01.567: Image signing certificate validation failed (1A).

*Feb 23 11:31:01.571: Failed to validate signature
*Feb 23 11:31:01.571: Digital Signature Failed Validation (flash:/update/ap1g3-k9w8-mx.153-3.JF5/final_hash)
*Feb 23 11:31:01.571: AP image integrity check FAILED
Aborting Image Download

Thats the output at the console from the AP 1532.

Can some one help me to solve the Problem?

Best Regards

Hajo

[jagan.chowdam · Accepted solution]

This is the issue "%PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed. The certificate (SN: 4E78A210000000000007) has expired. Validity period ended on 21:43:46 UTC Dec 4 2022".

Refer "Cisco IOS AP fails to join an AireOS WLC whose MIC is expired, as seen on a Cisco IOS AP" section and the Workaround section from the following Field Notice -

https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

You need to 

1. Disable Network Time Protocol (NTP).
2. Change the WLC clock time to a recent earlier time when the certificates were still valid.

Hope this helps.

CJ

/*Please rate all useful responses*/

[Hans Juergen Guenter]

Thanks jagan.chowdam,

thats helps. Now the AP is connected to the WLC.

best regards

Hajo

[Rich R]

So what you actually need to do to avoid this problem in future is upgrade your 2504 to 8.5.182.7.
All required links below:

[Hans Juergen Guenter]

Hi Richard R,

do I need a Service Partner Account to get the Upgrades for my WLC 2504?

[Scott Fella]

Reach out to your vendor and see if they can provide you with image(s) you need.  If not, then you would need to have a support contract in order to download various images.  I don't think you can buy it any longer.  Take a look here, but reach out to the vendor also and see what they can do for you.

https://www.cisco.com/c/en/us/products/collateral/wireless/2504-wireless-controller/eos-eol-notice-c51-740645.html

[Rich R]

Or ... find a recent security advisory that affects 8.5 code and find the section which says "Customers without Contracts" then email TAC (don't phone) quoting the URL of the advisory, the paragraph just mentioned and the version and URL https://software.cisco.com/download/specialrelease/8f166c6d88b9f77aabb63f78affa9749 for the software you want to download and serial number of your WLC.  You'll have to mention which platform you need it for (2504) because they have all of them there at that URL.  Then TAC should publish it to you directly.

This one should be suitable: Cisco Wireless LAN Controller AireOS Software FIPS Mode Denial of Service Vulnerability because CSCwa40778 : Bug Search Tool (cisco.com) lists 8.5.182.7 as a fixed release so spot on. (even though the advisory itself says upgrade to 8.10)

"Customers Without Service Contracts

Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade."

[Hans Juergen Guenter]

Hi,

thanks for the Cisco TAC information?

Thanks

[Rich R]

Primarily tac@cisco.com with some Asian language specific addresses also at https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html

[Hans Juergen Guenter]

I have contact the support via email. But with my Cisco Account I don`t get the
Images, because they say that 3 of 4 WLC has no warranty and for the one WLC
that has Waranty I has to give them a Cisco ID from my Employer.
So I think that I don`t geht the Update IOS for my WLC`s.

[Rich R]

Did you precisely follow the instructions above quoting the security advisory URL and the section for customers without contracts in your email?

If you quote that but they still refuse then ask for escalation to a senior manager and copy psirt@cisco.com.
But normally as long as you quote that correctly there should not be a problem.

If you forget to quote all the correct details then they will always deny assistance.

[Hans Juergen Guenter]

Hello, I wrote that I am a user without a service contract. But after I've done everything that the support asked for, I was told the following: Thank you for contacting Cisco. Your profile is now correctly linked to a GUID with company details, but I have to inform you that we are unable to add the contract linked to the device with the serial number PSZ19271DYU to your profile because the profile is not associated with the entitled party company . The most common reasons for unclear associations are: • Incorrect contract number(s). Please verify with your source that the contract number(s) you provided are correct. Best regards

[Rich R]

And that is why you were denied.  Your email must be EXACTLY as instructed above.   That is the only way to get the software if you don't have an appropriate support contract.
- Quote the security advisory URL
- Quote the paragraph about customers without service contracts
- Quote the URL for the software you need and the model of WLC you need it for
- Quote the serial number of the WLC(s)
- Ask them to publish the software for you in accordance with the security advisory.

If they say no or start discussing contracts then escalate. 
Unfortunately many TAC staff now may not even be aware of these rules so if you don't spell it out for them very clearly then they will just treat it as a standard request and "computer says NO".  If they can't seem to read (a surprisingly common problem these days too) then that's when you need to escalate (or keep repeating yourself until they read if you have time to waste).

[Hans Juergen Guenter]

for my understanding:

so I take the subject: Customers Without Service Contracts

Then I write to you that I want to download version 8.5.182.7 for the following WLC. Then I write them down the SN of the WLC, regardless of whether they still have a guarantee or not.

Then I take the links you took in your posting:
- Field Notice: FN - 72424 - Later Versions of Some Wi-Fi 6 Access Points Fail to Join the WLAN Controller - Software Upgrade Recommended
- Field Notice: FN-63942 Lightweight APs and WLCs Fail to Create CAPWAP Connections Due to Certificate
Expiration - Software Upgrade Recommended
- Field Notice: FN-72524 - During Software Upgrade/Downgrade IOS APs Might Remain in Downloading State

Is it correct that way?

Best regards

[Rich R]

No.  There is no entitlement to free upgrades in/for the field notices.  Free upgrades entitlement only applies to selected high impact security vulnerabilities.

Subject: Cisco Wireless LAN Controller AireOS Software FIPS Mode Denial of Service Vulnerability
Security update required as per https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wlc-dos-mKGRrsCB for customers without contracts as per the advisory:
"Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html
Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade."
Software 8.5.182.7 with the fix for this security vulnerability at https://software.cisco.com/download/specialrelease/8f166c6d88b9f77aabb63f78affa9749 is required for 2504 WLC serial numbers XXXXX, YYYYY, ZZZZ as per security advisory quoted above.
Please could you publish this software for me?