Fail to Migrate Access Point 702 Series From WLC 8540 to IOS-XE 5760

[LongNT1]

Hello everyone, I have an issue. I moving AP from WLC 8540 ( version 8.8.13.0 ) to WLC 5760 ( IOS-XE software 03.07.04E ). But AP is fail download image from 5760. Pls help me check !

 

[Prince.O]

What Ap model are you working with ? it may not be a supported AP . I would recommend checking if the Ap is supported 

[Scott Fella]

@Prince.O The OP mentioned the 702.

[Scott Fella]

I would not go that route.  The 5760 is DEAD and no longer supported, you are better off sticking with the 8540.  The whole converged access didn't pan out and you will run into issues.

[LongNT1]

This is a project I'm working on. I have to deploy a new server room and completely separate the AP from the old system. I have suggested deploying virtual WLC but they disagree

[Scott Fella]

You are the engineer and whom is going to be responsible for making that project successful. You need to call out the risk with your customer. Why put yourself or your company in jeopardy by using equipment that is no longer supported. Is the customer willing to take that risk along with learning Converged Access?
If you still plan on doing this, I have to wish you the best of luck. I don’t know many folks whom every deployed converged access nor have heard of a successful deployment.
Get a 3504 if you don’t have many AP’s and be done with it.

[David Ritter]

While I concur with Scott, you targeted the wrong error.

PKI-3-CERTIFICATE_INVALID_EXPIRED:
this is a known problem as of 12/4/2022.
Image Signing Certificate Post December 4th,
2022 (CSCwd80290)

workaround is to turnoff NTP and reset clock to 12/2/2022
mount the AP and reenable NTP

good luck with whatever path you choose.

[Leo Laohoo]

---

@Scott Fella wrote:
I would not go that route.  The 5760 is DEAD and no longer supported, you are better off sticking with the 8540.  The whole converged access didn't pan out and you will run into issues.

---

@Scott Fella is correct.  

I would not touch Converged Access 1.0 unless this was a deliberate attempt to bring down the network. 

If management is adamant with this decision, get all of those decision in writing and go on leave.  

Cisco abandoned Converged Access 1.0 because it was "terrible" and if this gets implemented, it will be "you're on your own" because TAC will not provide any support (not even a shoulder to cry on).

How many APs?

Is this site a 24x7?

[Rich R]

Agreed with all above.  You've encountered the bug David identified (field notice link below) but it will NEVER be fixed on that platform because as the others have highlighted IOS-XE Converged Access is end of support.  Cisco abandoned it because it was a disaster.  Either stay on 8540 (upgrade to latest code as per TAC link below) or migrate to 9800 series.  Using 5760 is a BAD idea and will cause numerous problems which will never be fixed.  Your users will be very unhappy and they will blame you, not the person who told you to do that. 

If they force you to do it then get a signed disclaimer in writing that they acknowledge that the solution is unsupported by Cisco - has numerous security vulnerabilities - and will never get any bug fixes.  It should also state that the vendor (Cisco) abandoned the solution because it was impossible to support and was replaced by 9800 series and is therefore not recommended.

[LongNT1]

I suggested the customer use virtual WLC temporarily and they agreed. Thanks everyone.