Configuring SSO on a pair of 9800-L issue

[tdennehy]

I am trying to configure what should be a very simple setup.  Two 9800-Ls on a bench with a switch in between.  They can ping each other when I configure SSO on both boxes, and I can ping the secondary.  But neither will ever become the standby.

I'm wondering if there is "something else", that everyone always forgets to do when configuring SSO.  Its so simple, just using vlan1 on both, with 192.168.1.x addresses.

Waiting for remote chassis to join
#######################################################################################

wc01:

interface Port-channel1
description ** uplink **
switchport mode trunk
!
interface Port-channel2
description ** uplink **
switchport mode trunk

 
interface TenGigabitEthernet0/1/0
switchport mode trunk
no negotiation auto
no mop enabled
channel-group 1 mode on
!
interface TenGigabitEthernet0/1/1
switchport mode trunk
no negotiation auto
channel-group 1 mode on
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
ip address 192.168.1.100 255.255.255.0
negotiation auto
no mop enabled
!
interface Vlan1
ip address 192.168.1.249 255.255.255.0 secondary
ip address 192.168.1.251 255.255.255.0
ip helper-address 192.168.1.254
no mop enabled
! 
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 192.168.1.254
ip route vrf Mgmt-intf 0.0.0.0 255.255.255.0 192.168.1.254
redun-management interface Vlan1 chassis 2 address 192.168.1.249 chassis 1 address 192.168.1.250

wc02:

!
interface Port-channel1
description ** uplink **
switchport mode trunk
!
interface Port-channel2
description ** uplink **
switchport mode trunk
!

interface TenGigabitEthernet0/1/0
switchport mode trunk
speed 1000 (its a 1gig SFP)
no negotiation auto
no snmp trap link-status
no mop enabled
channel-group 2 mode on
!
interface TenGigabitEthernet0/1/1
switchport mode trunk
speed 10000
no negotiation auto
no snmp trap link-status
channel-group 2 mode on
!
interface GigabitEthernet0
vrf forwarding Mgmt-intf
ip address 192.168.1.101 255.255.255.0
negotiation auto
no mop enabled
!
interface Vlan1
ip address 192.168.1.250 255.255.255.0 secondary
ip address 192.168.1.252 255.255.255.0
ip helper-address 192.168.1.254
no mop enabled
! 
!
ip tftp source-interface GigabitEthernet0
ip route 0.0.0.0 0.0.0.0 192.168.1.254
ip route vrf Mgmt-intf 0.0.0.0 255.255.255.0 192.168.1.254

redun-management interface Vlan1 chassis 1 address 192.168.1.250 chassis 2 address 192.168.1.249

Could I be missing something?  This should not be that difficult!!!

[tdennehy]

I just did.  Backup is now DEFINITELY on 17.9.04a     The Primary is also on same code. 

Again, when I connect both to the switch, the Primary changes to  edh001-001-wc01(recovery-mode)>

Both are in INSTALL mode.

Both are 9800-L, however one has SFP ports the other has copper.  Therefore, this isn't going to work, apparently.  Unless someone knows a workaround?
All chassis in the stack have been discovered. Accelerating discovery
Jan 30 00:49:43.996: %BOOT-3-BOOTTIME_MISMATCH_RESTRICTED_STACK_SETUP_DETECTED: R0/0: issu_stack: Mismatch detected. Details: Stacked members detected different chassis models. Local chassis model C9800-L-F-K9 different from remote chassis model C9800-L-C-K9
Jan 30 00:49:44.134: %AUTO_UPGRADE-5-AUTO_UPGRADE_START_CHECK: R0/0: auto_upgrade_client: Auto upgrade start checking for incompatible switches.

[marce1000]

 @tdennehy >...Both are 9800-L, however one has SFP ports the other has copper.  Therefore, this isn't going to work, apparently.  Unless someone knows a workaround?
          No , that can't work indeed , for SSO the configuration of both partners must be completely symmetrical,

 M.

[Rich R · Accepted solution]

No that will never work. The rules for SSO are absolutely clear - both chassis must have the identical PID.

[tdennehy]

Oddly, I was told that the two 9800-L controllers would work... with the SFP/Copper difference.

[Rich R]

Whoever told you that did not know what they were talking about!
https://www.cisco.com/c/dam/en/us/td/docs/wireless/controller/9800/17-6/deployment-guide/c9800-ha-sso-deployment-guide-rel-17-6.pdf page 6:

SSO Pre-requisites
■ HA Pair can only be form between two wireless controllers of the same form factor
■ HA between 9800-L-C and 9800-L-F cannot be formed
■ HA between Copper RP and Fiber RP cannot be formed
■ Both controllers must be running the same software version to form the HA Pair
■ Maximum RP link latency = 80 ms RTT, minimum bandwidth = 60 Mbps and minimum MTU = 1500
■ If you are using a copper cable to connect the Redundancy Ports (RPs) back-to-back, the maximum length of the cable can be 30 meters. If you want to use a longer cable, you need to switchover to the fiber optic cables.

[MHM Cisco World]

You inform us that it work before??

This issue make me more confuse

MHM

[marce1000]

   - That's a negative (rest assured)

 M.

[Scott Fella]

I tend to watch some videos before I try anything.  It's easier to follow at times. The GUI is very easy and you should probably try that first and then wipe the units and try again from the cli.  That way you can learn and document both process.

[tdennehy]

I have gotten this to work in the past, but for some reason, I cannot get it to work on the bench.  I figured I missed a vrf or something.  The last time I have touched a pair of 9800s was a year ago, and I'm trying to refresh my memory on how to do it and I cannot get it to work.  I have followed this link before with success:  https://justdowifi.blogspot.com/search?updated-max=2023-08-28T17:44:00-07:00&max-results=7

There must be something I am missing, and its going to be blatantly stupid when I find it.

[Scott Fella]

I bet.... you try to just connect the RP ports direct?

[tdennehy]

I haven't tried the RP ports yet, but I might just end up doing it.  We are not using that method in production, so that is why I'm not attempting to do it on the bench.  I am going to make sure both boxes have 17.9.4 on them, with the same exact image just in case something is wonky there.  This is the way we learn, right?  We bang our heads on the wall until it works!

[marce1000]

  - Also validate the configuration of the (primary) 9800-L controller using the CLI command show tech wireless
    (not a simple show tech ) and feed the output from that into Wireless Config Analyzer

 M.

[MHM Cisco World]

can i see 

show etherchannel summary << in SW

[tdennehy]

9k_sw1#sho etherchannel summary
Flags: D - down P - bundled in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use N - not in use, no aggregation
f - failed to allocate aggregator

M - not in use, minimum links not met
m - not in use, port not aggregated due to minimum links not met
u - unsuitable for bundling
w - waiting to be aggregated
d - default port

A - formed by Auto LAG

Number of channel-groups in use: 2
Number of aggregators: 2

Group Port-channel Protocol Ports
------+-------------+-----------+-----------------------------------------------
1 Po1(SU) - Gi0/25(P) Gi0/26(D)
2 Po2(SD) - Gi0/27(D) Gi0/28(D)

9k_sw1#

[MHM Cisco World]

You see there is problem in PO

One  is single leg and other totally down

Re-config wlc and SW without PO and check

MHM