Cisco AIR-CAP3702E-A-K9 cannot connect to my Cisco WLC2504

[yangtao72]

I have my WLC2504 running at 8.1.102.0,  three of APs are connecting and working. I recently added 3 more and non of them can register or connect to WLC. I checked the working units and non-working unit. Their images on AP are different. So image on working APs is ap3g2-k9w8-xx.153-3.JBB, I tried to TFTP this image from working AP and copied and unzipped to non-working AP, and set it as BOOT image, however, I got "magic number mismatch: bad mzip file" error.

I also tried to download an image ap3g2-k9w8-mx.152-4.JB6 from Cisco, it seems loading fine, but it failed to hook up with WLC after I applied "capwap ap primary-base xxxx x.x.x.", . I am attaching the following output. I guess it was caused my kind of version unmatch? My working units have SN# AIR-CAP3702E-A-K9 AND REVISION NUMBER REV02, REV 04 REV 06; My non-working AIR-CAP3702E-A-K9 have rev 01, rev05.

AP0035.1aa2.0d30#capwap ap hostname myofficeAP
ERROR!!! Command is disabled.
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
Not in Bound state.
*Mar 1 00:35:11.559: %CAPWAP-3-DHCP_RENEW: Could not discover WLC using DHCP IP. Renewing DHCP IP.
*Mar 1 00:35:16.579: %CAPWAP-3-ERRORLOG: Invalid event 40 & state 2 combination.
*Mar 1 00:35:16.679: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 10.30.58.3, mask 255.255.254.0, hostname AP0035.1aa2.0d30

AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
Translating "CISCO-CAPWAP-CONTROLLER"...domain server (75.75.75.75)
*Mar 1 00:35:22.559: %CAPWAP-3-ERRORLOG: Did not get log server settings from DHCP.
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#cap
AP0035.1aa2.0d30#capwap (75.75.76.76)ap
AP0035.1aa2.0d30#capwap ap pri
AP0035.1aa2.0d30#capwap ap primar
AP0035.1aa2.0d30#capwap ap primary-base SCC
AC
AP0035.1aa2.0d30#capwap ap primary-base SCCAC
*Mar 1 00:35:40.559: %CAPWAP-3-ERRORLOG: Could Not resolve CISCO-CAPWAP-CONTROLLER
AP0035.1aa2.0d30#capwap ap primary-base SCCACWLC
AP0035.1aa2.0d30#capwap ap primary-base SCCACWLC 10.30.60.253?
A.B.C.D

AP0035.1aa2.0d30#capwap ap primary-base SCCACWLC 10.30.60.253
AP0035.1aa2.0d30#
*Mar 1 00:36:10.559: %CAPWAP-3-ERRORLOG: Selected MWAR 'SCCACWLC'(index 0).
*Mar 1 00:36:10.559: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Aug 25 23:08:18.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.30.60.253 peer_port: 5246
*Aug 25 23:08:18.399: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 10.30.60.253 peer_port: 5246
*Aug 25 23:08:18.399: %CAPWAP-5-SENDJOIN: sending Join Request to 10.30.60.253
*Aug 25 23:08:23.399: %CAPWAP-5-SENDJOIN: sending Join Request to 10.30.60.253
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
*Aug 25 23:09:17.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.30.60.253:5246
*Aug 25 23:09:18.003: %LWAPP-3-CLIENTERRORLOG: LWAPP LED Init: incorrect led state 255
*Aug 25 23:09:22.999: bsnInitRcbSlot: slot 0 has venus radio(UNSUPPORT)
*Aug 25 23:09:22.999: bsnInitRcbSlot: slot 1 has venus radio(UNSUPPORT)
*Aug 25 23:09:22.999: bsnInitRcbSlot: Slot 1 has same radio type as slot 0. Disabling radio in slot 1.
*Aug 25 23:09:23.011: %CAPWAP-3-ERRORLOG: Binding Config Initialization failed for binding 1

*Aug 25 23:09:23.011: bsnUnlockDevice: not bring radio up: radio 0 is in admin disable state
*Aug 25 23:09:23.011: bsnUnlockDevice: not bring radio up: radio 1 is in admin disable state
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
*Aug 25 23:09:33.019: %CAPWAP-3-ERRORLOG: Selected MWAR 'SCCACWLC'(index 0).
*Aug 25 23:09:33.019: %CAPWAP-3-ERRORLOG: Go join a capwap controller
*Aug 25 23:09:33.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.30.60.253 peer_port: 5246
*Aug 25 23:09:33.319: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 10.30.60.253 peer_port: 5246
*Aug 25 23:09:33.319: %CAPWAP-5-SENDJOIN: sending Join Request to 10.30.60.253
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#
*Aug 25 23:09:38.319: %CAPWAP-5-SENDJOIN: sending Join Request to 10.30.60.253
AP0035.1aa2.0d30#
AP0035.1aa2.0d30#

[Leo Laohoo · Accepted solution]

Post the complete output to the following commands: 

1. WLC:  sh sysinfo
2. WLC:  sh time
3. AP:  sh version
4. AP:  sh ip int brief
5. AP:  sh capwap client rcb
6. AP:  sh inventory

[marce1000]

                  - Let the AP(s) find the controller by using DHCP option 43 and try again.

 M.

[Rich R · Accepted solution]

"WLC2504 running at 8.1.102.0" !

8.1 was deferred by Cisco a long time ago - meaning it was not supported by Cisco due to serious bugs in that code version.

And that was the first 8.1 release 6 years ago so guaranteed to be buggy.

Refer to https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html and upgrade to the latest 8.5 release.  Read through the release notes carefully.

Make sure you carefully read and follow https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

Then if you still have problems it's worth troubleshooting but I wouldn't waste another minute on that old code.

And remember to factory default those APs using the button on the AP to make sure you have cleared any old config that could be causing problems.

[yangtao72]

Thanks to everyone who helped to answer my question! I came across a Cisco matrix for WLC and AP version compatibility, the WLC version 8.1.102.0 only accepts ap3g2-k9w8-tar.153-3.JBB,  and this is not provided by Cisco. I found the file from elsewhere and TFTP to the AP, after 2nd try and it works now.

I would not upgrade the version if it could cause any expiration on cert / license.

[Rich R]

If none of your certs are expired yet that's great but just to clarify - the new version will NOT cause the certs to expire.  The certs expire due to the date going past their expiry date.  The new versions of code have a fix which allows you to configure the AP and WLC to ignore the expired certs and keep working.  By keeping the old version your kit will stop working when that time arrives.

I suggest you check the cert expiry dates on all your equipment so that you know when that will happen and then you need to be prepared to upgrade and apply the workaround - ideally before it happens.

[yangtao72]

Thanks for reminding me! Will check for sure