Enable Export anchor, SSID stops broadcasting

[richyvrlimited]

I'm enabling export anchor on a 9800 for a coproprate network. The policy currently is applied to a number of SSID, so I've cloned the policy and enabled the 'Export Anchor' config.

The Foriegn anchor is an AireOS 5520, I've created an idently named SSID with the pofile name the same as the policy name on the 9800.

When I apply this policy to the SSID on the 9800, it stops broadcasting the SSID entirely. I can't see anything in the logs as to why this would occur, have I missed some configuration somewhere?

FWIW we have SSID working fine between the 9800 and 5520 with the 9800 as the foriegn anchor, but this is the 1st SSID in the other direction.

Cheers

[marce1000]

 - Check the configuration of the 9800 with the CLI command show tech wireless ; feed the output into 
                                                                                           Wireless Config Analyzer

 M.

[richyvrlimited]

I've tried using that tool a few times. it sits and thinks for 15 or so seconds then just dumps me back to the upload a file page. I never get any outpuit from it.

[marce1000]

 (Reminder) :            - When using Wireless Config Analyzer
                    use the output of CLI show tech wireless ; not 'simple' show tech  (neither show tech-support)

 M.

[richyvrlimited]

I was/am running sho tech wireless, but I took a look at the logfile and realised I'd set my ssh client to prepend each line with the date/time which had thrown the anayser off, thank you.

the anaysys reported a few errors i.e. which I would expect

32	WLAN: WLAN with WPA3 in use with IOS APs. Not supported scenario

but nothing has been has been seen regarding issues with policy configuration.

[marce1000]

 - Ok , take note of https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html#cat-9800_ctrls 
 too , 4th column (check software compatibilities) 

 M.

[JPavonM]

Remember all config must much 100% between Foreign and Anchor and software codes should be the recommended ones:

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/ConfiguringIRCM/b-configuring-inter-release-controller-mobility-in-wireless-deployments-supporting-aireos-and-catalyst-9800-controllers/m-supported-platforms-and-releases.htm...

[richyvrlimited]

All config matches, but even if it didn't I wouldn't expect that to break the Achor SSID, merely that it wouldn't work from the foriegn controller. That's how it's works on the AireOS controllers?

[richyvrlimited]

the 9800 is on 17.9.3 and the 5520 is currenly on 8.10.183.0 so hits the compatability matix no problem.

[marce1000]

   >...the 9800 is on 17.9.3 and the 5520 is currently on 8.10.183.0 so hits the compatibility matrix no problem.
 As per https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html  on the 5520 go for https://software.cisco.com/download/home/286284738/type/280926587/release/8.10.190.0
             On the 9800 go for 17.9.4a  ; all of this may be difficult to do 'quickly' ; so start with the 5530 first (aireos should be using last/latest advisory)

                                                    Check if that makes any difference , 

 M.

[JPavonM]

By the way, keep-off from using WPA3 if there are IOS-APs as they do not support it so they won't broadcast the SSID.

[richyvrlimited]

Yes aware of this, but that's not the cause of my issue.

The SSID is broadcast and works fine, as soon as I switch to the cloned policy with the export mobility option enabled the SSID is no longer broadcast from any AP associated with the 9800.

[marce1000]

 - Check configuration of the 5520 too , using : WirelessAnalyzer procedure of AireOs
   (check procedure on top of page) ; also feed the output into : Wireless Config Analyzer

 M.

[richyvrlimited]

No issues highlighted on the 5520, but again I wouldn't expect these to cause an issue?

[KrisStewart]

"You must not use the Export Anchor setting, for any policy profile tied to a WLAN profile on a controller with access points. This prevents the SSID to be broadcasted, so this policy must be used exclusively for Anchor functionality."

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213912-configure-mobility-anchor-on-catalyst-98.html