Failed to join AP-RADIUS authorization is pending for the AP

[R T]

Hi All,

Recently my AP failed to join the controller (AIR-CT2504-K9) after I rebooted the controller. I tried to restored factory default to reconfigure them. But it is still failed to join the controller. 

I'm not able to identify the issue 

Sysinfo:

(Cisco Controller) >show sysinfo   

Manufacturer's Name.............................. Cisco Systems Inc.

Product Name..................................... Cisco Controller

Product Version.................................. 8.5.171.0

Bootloader Version............................... 1.0.20

Field Recovery Image Version..................... 7.6.101.1

Firmware Version................................. PIC 16.0

OUI File Last Update Time........................ Sun Sep 07 10:44:07 IST 2014

Build Type....................................... DATA + WPS

System Name...................................... WLC.HOME

System Location.................................. 

System Contact................................... 

System ObjectID.................................. 1.3.6.1.4.1.9.1.1279

IP Address....................................... 172.10.1.254

IPv6 Address..................................... ::

Last Reset....................................... Software reset

System Up Time................................... 0 days 1 hrs 12 mins 53 secs

--More-- or (q)uit

System Timezone Location......................... 

System Stats Realtime Interval................... 5

System Stats Normal Interval..................... 180

Configured Country............................... US  - United States

Operating Environment............................ Commercial (0 to 40 C)

Internal Temp Alarm Limits....................... 0 to 65 C

Internal Temperature............................. +33 C

External Temperature............................. +38 C

Fan Status....................................... 4600 rpm

State of 802.11b Network......................... Enabled

State of 802.11a Network......................... Enabled

Number of WLANs.................................. 1

Number of Active Clients......................... 0

OUI Classification Failure Count................. 0

Memory Current Usage............................. 38

Memory Average Usage............................. 38

CPU Current Usage................................ 0

CPU Average Usage................................ 0

--More-- or (q)uit

Flash Type....................................... Compact Flash Card

Flash Size....................................... 1073741824

Burned-in MAC Address............................ 50:17:FF:26:72:A0

Maximum number of APs supported.................. 75

System Nas-Id.................................... 

WLC MIC Certificate Types........................ SHA1

=========================

(Cisco Controller) >show auth-list 

Authorize MIC APs against Auth-list or AAA ...... disabled

Authorize LSC APs against Auth-List ............. disabled

APs Allowed to Join

  AP with Manufacturing Installed Certificate.... yes

  AP with Self-Signed Certificate................ no

  AP with Locally Significant Certificate........ no

Mac Addr/Serial No.      Cert Type    Key Hash

------------------       ----------   ------------------------------------------

a0:e0:af:37:f6:f0         MIC          

Debug:

(Cisco Controller) >*spamApTask4: Jan 01 12:38:26.946: a0:e0:af:38:58:40 DTLS Handshake Timeout server (172.10.1.254:5246), client (172.10.1.10:50564)

*spamApTask4: Jan 01 12:38:26.946: a0:e0:af:38:58:40 acDtlsPlumbControlPlaneKeys: lrad:172.10.1.10(50564) mwar:172.10.1.254(5246)

*spamApTask4: Jan 01 12:38:26.946: a0:e0:af:38:58:40 Deleting AP 172.10.1.10 which has not been plumbed

*spamApTask4: Jan 01 12:38:26.946: a0:e0:af:38:58:40 DTLS connection closed event receivedserver (172.10.1.254/5246) client (172.10.1.10/50564)

*spamApTask4: Jan 01 12:38:26.946: a0:e0:af:38:58:40 No entry exists for AP (172.10.1.10/50564)

*spamApTask4: Jan 01 12:38:26.947: a0:e0:af:38:58:40 No AP entry exist in temporary database for 172.10.1.10:50564 

*spamApTask4: Jan 01 12:38:49.379: a0:e0:af:38:58:40 Discarding non-ClientHello Handshake OR DTLS encrypted packet from  172.10.1.10:50564)since DTLS session is not established 

*spamApTask4: Jan 01 12:38:49.379: a0:e0:af:38:58:40 DTLS connection not found, creating new connection for 172.10.1.10 (50564) 172.10.1.254 (5246)

*spamApTask4: Jan 01 12:38:49.769: a0:e0:af:38:58:40 acDtlsPlumbControlPlaneKeys: lrad:172.10.1.10(50564) mwar:172.10.1.254(5246)

*spamApTask4: Jan 01 12:38:49.770: a0:e0:af:38:58:40 Allocated index from main list, Index: 1

*spamApTask4: Jan 01 12:38:49.770: a0:e0:af:38:58:40 Reserved LCB index for 172.10.1.10:1

*spamApTask4: Jan 01 12:38:49.770: a0:e0:af:38:58:40 Using CipherSuite AES128-SHA

*spamApTask4: Jan 01 12:38:49.770: a0:e0:af:38:58:40 DTLS keys for Control Plane are plumbed successfully for AP 172.10.1.10. Index 2

*spamApTask4: Jan 01 12:38:49.770: a0:e0:af:38:58:40 DTLS Session established server (172.10.1.254:5246), client (172.10.1.10:50564)

*spamApTask4: Jan 01 12:38:49.770: a0:e0:af:38:58:40 Starting wait join timer for AP: 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:49.772: a0:e0:af:37:f6:f0 Join Request from 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:49.772: a0:e0:af:37:f6:f0 using already alloced index 1

*spamApTask4: Jan 01 12:38:49.773: a0:e0:af:37:f6:f0 Unable to get Ap mode in Join request

*spamApTask4: Jan 01 12:38:49.773: a0:e0:af:37:f6:f0 Allocate database entry for AP 172.10.1.10:50564, already allocated index 1

*spamApTask4: Jan 01 12:38:49.773: a0:e0:af:37:f6:f0 AP Allocate request at index 1 (reserved)

*spamApTask4: Jan 01 12:38:49.773: a0:e0:af:38:58:40 Deleting AP entry 172.10.1.10:50564 from temporary database.

*spamApTask4: Jan 01 12:38:49.773: a0:e0:af:37:f6:f0 Dropping request or response packet to AP :172.10.1.10 (50564)  by Controller: 172.10.1.254 (5246), message Capwap_wtp_event_response, state Capwap_no_state

*spamApTask4: Jan 01 12:38:49.773: a0:e0:af:37:f6:f0 Message type Capwap_wtp_event_response is not allowed to send in state Capwap_no_state for AP 172.10.1.10

*spamApTask4: Jan 01 12:38:49.773: a0:e0:af:38:58:40 spamProcessJoinRequest : RAP, Check MAC filter 

*spamApTask4: Jan 01 12:38:49.774: a0:e0:af:37:f6:f0 In AAA state 'Idle' for AP a0:e0:af:37:f6:f0

*spamApTask4: Jan 01 12:38:49.774: a0:e0:af:38:58:40 Mesh AP username a0e0af385840.

*aaaQueueReader: Jan 01 12:38:49.774: Unable to find requested user entry for a0e0af385840

*aaaQueueReader: Jan 01 12:38:49.774: a0:e0:af:37:f6:f0 [Response] Client requested no retries for mobile A0:E0:AF:37:F6:F0 

*aaaQueueReader: Jan 01 12:38:49.774: a0:e0:af:37:f6:f0 Returning AAA Error 'User not found' (-9) for mobile a0:e0:af:37:f6:f0

*aaaQueueReader: Jan 01 12:38:49.774: AuthorizationResponse: 0x2c4bb304

*aaaQueueReader: Jan 01 12:38:49.774: structureSize................................104

*aaaQueueReader: Jan 01 12:38:49.774: resultCode...................................-9

*aaaQueueReader: Jan 01 12:38:49.774: protocolUsed.................................0x00000008

*aaaQueueReader: Jan 01 12:38:49.774: proxyState...................................A0:E0:AF:37:F6:F0-00:00

*aaaQueueReader: Jan 01 12:38:49.774: Packet contains 0 AVPs:

*aaaQueueReader: Jan 01 12:38:49.774: a0:e0:af:37:f6:f0 User entry not found in the Local FileDB for the client.

*spamApTask0: Jan 01 12:38:49.774: ??7??

*spamApTask0: Jan 01 12:38:49.775: a0:e0:af:37:f6:f0 Join Version: = 134589184

*spamApTask0: Jan 01 12:38:49.775: 00:00:00:00:00:00 apType = 36 apModel: AIR-CAP3702I-B-K9

*spamApTask0: Jan 01 12:38:49.775: 00:00:00:00:00:00 apType: Ox24 bundleApImageVer: 8.5.171.0

*spamApTask0: Jan 01 12:38:49.775: 00:00:00:00:00:00 version:8 release:5 maint:171 build:0

*spamApTask0: Jan 01 12:38:49.775: a0:e0:af:37:f6:f0 Join resp: CAPWAP Maximum Msg element len = 92

*spamApTask0: Jan 01 12:38:49.775: a0:e0:af:37:f6:f0 Join Failure Response sent to 0.0.0.0:50564

*spamApTask0: Jan 01 12:38:49.775: a0:e0:af:37:f6:f0 Radius Authentication failed. Closing dtls Connection.

*spamApTask0: Jan 01 12:38:49.775: a0:e0:af:37:f6:f0 Finding DTLS connection to delete for AP (172:10:1:10/50564)

*spamApTask0: Jan 01 12:38:49.775: a0:e0:af:37:f6:f0 Disconnecting DTLS Capwap-Ctrl session 0x1a456f30 for AP (172:10:1:10/50564). Notify(true)

*spamApTask0: Jan 01 12:38:49.775: a0:e0:af:37:f6:f0 CAPWAP State: Dtls tear down

*spamApTask0: Jan 01 12:38:49.776: a0:e0:af:37:f6:f0 acDtlsPlumbControlPlaneKeys: lrad:172.10.1.10(50564) mwar:172.10.1.254(5246)

*spamApTask0: Jan 01 12:38:49.776: a0:e0:af:37:f6:f0 DTLS keys for Control Plane deleted successfully for AP 172.10.1.10

*spamApTask0: Jan 01 12:38:49.777: a0:e0:af:37:f6:f0 AP Delete request 

*spamApTask4: Jan 01 12:38:49.777: a0:e0:af:37:f6:f0 Join Request failed!

*spamApTask4: Jan 01 12:38:49.777: a0:e0:af:37:f6:f0 State machine handler: Failed to process  msg type = 3 state = 0 from 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:49.777: a0:e0:af:38:58:40 Failed to parse CAPWAP packet from 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:49.777: a0:e0:af:37:f6:f0 DTLS connection closed event receivedserver (172.10.1.254/5246) client (172.10.1.10/50564)

*spamApTask4: Jan 01 12:38:49.777: a0:e0:af:37:f6:f0 No entry exists for AP (172.10.1.10/50564)

*spamApTask4: Jan 01 12:38:49.777: a0:e0:af:37:f6:f0 No AP entry exist in temporary database for 172.10.1.10:50564 

*spamApTask4: Jan 01 12:38:49.777: a0:e0:af:38:58:40 Discarding non-ClientHello Handshake OR DTLS encrypted packet from  172.10.1.10:50564)since DTLS session is not established 

*spamApTask4: Jan 01 12:38:49.777: a0:e0:af:38:58:40 DTLS connection not found, creating new connection for 172.10.1.10 (50564) 172.10.1.254 (5246)

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 Discovery Request from 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 ApModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 Join Priority Processing status = 0, Incoming Ap's Priority 4, MaxLrads = 5, MaxLicense=5 joined Aps =0

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 apType = 36 apModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 apType: Ox24 bundleApImageVer: 8.5.171.0

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 version:8 release:5 maint:171 build:0

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10 port 50564

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 Discovery Request from 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 ApModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.777: a0:e0:af:37:f6:f0 Join Priority Processing status = 0, Incoming Ap's Priority 4, MaxLrads = 5, MaxLicense=5 joined Aps =0

*spamApTask4: Jan 01 12:38:58.778: a0:e0:af:37:f6:f0 apType = 36 apModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.778: a0:e0:af:37:f6:f0 apType: Ox24 bundleApImageVer: 8.5.171.0

*spamApTask4: Jan 01 12:38:58.778: a0:e0:af:37:f6:f0 version:8 release:5 maint:171 build:0

*spamApTask4: Jan 01 12:38:58.778: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10 port 50564

*spamApTask4: Jan 01 12:38:58.778: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:58.782: a0:e0:af:37:f6:f0 Discovery Request from 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:58.783: a0:e0:af:37:f6:f0 ApModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.783: a0:e0:af:37:f6:f0 Join Priority Processing status = 0, Incoming Ap's Priority 4, MaxLrads = 5, MaxLicense=5 joined Aps =0

*spamApTask4: Jan 01 12:38:58.783: a0:e0:af:37:f6:f0 apType = 36 apModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.784: a0:e0:af:37:f6:f0 apType: Ox24 bundleApImageVer: 8.5.171.0

*spamApTask4: Jan 01 12:38:58.784: a0:e0:af:37:f6:f0 version:8 release:5 maint:171 build:0

*spamApTask4: Jan 01 12:38:58.785: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10 port 50564

*spamApTask4: Jan 01 12:38:58.785: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:58.786: a0:e0:af:37:f6:f0 Discovery Request from 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:58.786: a0:e0:af:37:f6:f0 ApModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.786: a0:e0:af:37:f6:f0 Join Priority Processing status = 0, Incoming Ap's Priority 4, MaxLrads = 5, MaxLicense=5 joined Aps =0

*spamApTask4: Jan 01 12:38:58.787: a0:e0:af:37:f6:f0 apType = 36 apModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.787: a0:e0:af:37:f6:f0 apType: Ox24 bundleApImageVer: 8.5.171.0

*spamApTask4: Jan 01 12:38:58.787: a0:e0:af:37:f6:f0 version:8 release:5 maint:171 build:0

*spamApTask4: Jan 01 12:38:58.787: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10 port 50564

*spamApTask4: Jan 01 12:38:58.787: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:58.788: a0:e0:af:37:f6:f0 Discovery Request from 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:58.788: a0:e0:af:37:f6:f0 ApModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.788: a0:e0:af:37:f6:f0 Join Priority Processing status = 0, Incoming Ap's Priority 4, MaxLrads = 5, MaxLicense=5 joined Aps =0

*spamApTask4: Jan 01 12:38:58.788: a0:e0:af:37:f6:f0 apType = 36 apModel: AIR-CAP3702I-B-K9

*spamApTask4: Jan 01 12:38:58.788: a0:e0:af:37:f6:f0 apType: Ox24 bundleApImageVer: 8.5.171.0

*spamApTask4: Jan 01 12:38:58.788: a0:e0:af:37:f6:f0 version:8 release:5 maint:171 build:0

*spamApTask4: Jan 01 12:38:58.789: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10 port 50564

*spamApTask4: Jan 01 12:38:58.789: a0:e0:af:37:f6:f0 Discovery Response sent to 172.10.1.10:50564

*spamApTask4: Jan 01 12:38:59.167: a0:e0:af:38:58:40 acDtlsPlumbControlPlaneKeys: lrad:172.10.1.10(50564) mwar:172.10.1.254(5246)

*spamApTask4: Jan 01 12:38:59.168: a0:e0:af:38:58:40 Allocated index from main list, Index: 2

*spamApTask4: Jan 01 12:38:59.168: a0:e0:af:38:58:40 Reserved LCB index for 172.10.1.10:2

*spamApTask4: Jan 01 12:38:59.168: a0:e0:af:38:58:40 Using CipherSuite AES128-SHA

*spamApTask4: Jan 01 12:38:59.169: a0:e0:af:38:58:40 DTLS keys for Control Plane are plumbed successfully for AP 172.10.1.10. Index 3

*spamApTask4: Jan 01 12:38:59.169: a0:e0:af:38:58:40 DTLS Session established server (172.10.1.254:5246), client (172.10.1.10:50564)

*spamApTask4: Jan 01 12:38:59.170: a0:e0:af:38:58:40 Starting wait join timer for AP: 172.10.1.10:50564

*spamApTask4: Jan 01 12:39:08.770: a0:e0:af:38:58:40 ipv4 conn marked for delete by openssl wrapper

*spamApTask4: Jan 01 12:39:08.771: a0:e0:af:38:58:40 acDtlsPlumbControlPlaneKeys: lrad:172.10.1.10(50564) mwar:172.10.1.254(5246)

*spamApTask4: Jan 01 12:39:08.771: a0:e0:af:38:58:40 DTLS keys for Control Plane deleted successfully for AP 172.10.1.10

*spamApTask4: Jan 01 12:39:08.772: a0:e0:af:38:58:40 DTLS connection closed event receivedserver (172.10.1.254/5246) client (172.10.1.10/50564)

*spamApTask4: Jan 01 12:39:08.772: a0:e0:af:38:58:40 No entry exists for AP (172.10.1.10/50564)

*spamApTask4: Jan 01 12:39:08.772: a0:e0:af:38:58:40 Deleting AP entry 172.10.1.10:50564 from temporary database.

*spamApTask4: Jan 01 12:39:08.773: a0:e0:af:38:58:40 Discarding non-ClientHello Handshake OR DTLS encrypted packet from  172.10.1.10:50564)since DTLS session is not established 

[marce1000]

               >...Radius Authentication failed. Closing dtls Connection.
             - Check the radius server's logs for this authentication , 

 M.

[balaji.bandi]

even though you have disable auth list - still shows that auth pending.

Radius authorization of the AP has failed   - may be required to add MAC in to Controller for auth or ap profiles (Security > AP Policies)

i would reset AP to factory mode and try to join again. have you done any Airos upgrade ?

follow below guide : if you like to use auth system :

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/98848-lap-auth-uwn-config.html

[R T]

The MAC address has been added into the AP policies before... but it doesn't help.

[balaji.bandi]

can you post the screenshots the config done on WLC - but we do not see the output what MAC added , make sure you added the Correct MAC of AP Ethernet one.

have reset the AP to factory and try join post complete logs until fail or success here in text file.

[Rich R]

1. Upgrade the WLC to 8.5.182.11 - download link below
2. Review all the field notices below - some may apply to you
3. Your screen shows Jan 1 - I suspect the WLC does not have valid time set.  Pretty much everything about networks (including WLC and APs) relies on accurate time - ideally from NTP.  Make sure your WLC has correct time for a start.
4. What do the AP console logs show?
5 The AP MAC in your auth list (a0:e0:af:37:f6:f0) does not match the MAC a0:e0:af:38:58:40 which the WLC is logging.

[R T]

Thanks, somehow I copied the wrong MAC address when showing cdp neighbor. Corrected it and the image and configuration were pushed into the AP.

[Rich R]

Easy mistake to make - always check the logs and double check what you've configured <smile>
ARP cache and switch mac-address table are other good places to find the MAC address, not to mention the label on the AP.