Firmware/Connection problem with Cisco air-lap1252ag-e-k9

[maciejzurawek]

Hi

The Cisco air-lap1252ag-e-k9 access point was damaged at the facility we service. In its place, we installed another one from service stock, but the administrator has a problem with adding it to the controller. He said the AP currently has firmware 3.0.51.0 and 8.0.120.0 is required for it to work properly with the controller. Where can I find the appropriate firmware, I know that the device is no longer supported, but does this mean that all files related to it have been removed?

Thank you for any advice, this is an old system that I hope will be modernized soon and we need to fix bugs

Cisco IOS Software, C1250 Software (C1250-RCVK9W8-M), Version 12.4(10b)JA1, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2008 by Cisco Systems, Inc.
Compiled Wed 30-Jan-08 12:11 by prod_rel_team
*Mar  1 00:00:07.511: %LINK-3-UPDOWN: Interface GigabitEthernet0, changed state to up
*Mar  1 00:00:08.511: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
ap>
*Mar  1 00:00:26.559: %LWAPP-5-CHANGED: LWAPP changed state to DISCOVERY
*Mar  1 00:00:26.711: Logging LWAPP message to 255.255.255.255.

Translating "CISCO-LWAPP-CONTROLLER"...domain server (255.255.255.255)
%DHCP-6-ADDRESS_ASSIGN: Interface GigabitEthernet0 assigned DHCP address 172.16.13.8, mask 255.255.254.0, hostname AP8843.e1d1.914a

%LWAPP-3-CLIENTEVENTLOG: Did not get vendor specific options from DHCP.
%LWAPP-3-CLIENTEVENTLOG: Did not get log server settings from DHCP.
%LWAPP-3-CLIENTEVENTLOG: Did not get any DNS options from DHCP.
%SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 255.255.255.255 started - CLI initiated (172.16.12.11) [OK]

%LWAPP-3-CLIENTEVENTLOG: Performing DNS resolution for CISCO-LWAPP-CONTROLLER
%LWAPP-3-CLIENTEVENTLOG: Controller address 172.16.12.2 obtained through  DNS
%LWAPP-5-CHANGED: LWAPP changed state to JOIN
%LWAPP-3-CLIENTERRORLOG: Peer certificate verification failed
%LWAPP-3-CLIENTERRORLOG: Join Reply: certificate is not valid
%LWAPP-3-CLIENTERRORLOG: Join Reply: message decoding failed (controller- WLC-2)
%LWAPP-3-CLIENTERRORLOG: Join Timer: did not recieve join response (controller - WLC-2)
%LWAPP-3-CLIENTERRORLOG: Set Transport Address: no more AP manager IP addresses remain
%LWAPP-3-CLIENTERRORLOG: Peer certificate verification failed
%LWAPP-3-CLIENTERRORLOG: Join Reply: certificate is not valid
%LWAPP-3-CLIENTERRORLOG: Join Reply: message decoding failed (controller- WLC-2)
%LWAPP-3-CLIENTERRORLOG: Join Timer: did not recieve join response (controller - WLC-2)
%LWAPP-3-CLIENTERRORLOG: Set Transport Address: no more AP manager IP addresses remain
%SYS-5-RELOAD: Reload requested by LWAPP CLIENT. Reload Reason: DID NOT GET JOIN RESPONSE.
%LWAPP-5-CHANGED: LWAPP changed state to DOWN
IOS Bootloader - Starting system.
Xmodem file system is available.
flashfs[0]: 3 files, 2 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 31868928
flashfs[0]: Bytes used: 2330624
flashfs[0]: Bytes available: 29538304
flashfs[0]: flashfs fsck took 14 seconds.
Reading cookie from flash parameter block...done.
Base Ethernet MAC address: 88:43:e1:d1:91:4a

[Flavio Miranda]

Hi @maciejzurawek 

 Once the device is retired, cisco remove the download option. 

What you can try, based on this log "Peer certificate verification failed" is run the command:

config ap cert-expiry-ignore mic enable

Run this on the WLC and test. 

[Claes Karlsson]

Hi @maciejzurawek,

From the logs it looks like there is a certificate validation error. You may want to upgrade the AP with the latest code version from CCO with image recovery. It may also be that the controller time is outside the certificate validity interval, see link below to fix it.

https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/119286-lap-notjoin-wlc-tshoot.html#anc14

[Rich R]

> He said the AP currently has firmware 3.0.51.0
No - it is currently running a recovery image (purely allows software download) version 12.4(10b)JA1.
It will need to download 12.4(25e)JAP4 software from the WLC running 8.0.120.0 as per the compatibility matrix below.

As the others have pointed out the AP cannot join because the WLC certificate has expired (AP cert has almost certainly expired too).  This is fully explained in FN63942 below but briefly:
On the WLC you need to configure (if not already done):
config ap cert-expiry-ignore ssc enable
config ap cert-expiry-ignore mic enable
On the WLC you need to disable NTP, then change the date to before the WLC cert expired.
This will allow the AP to join the WLC, download the software from WLC and pick up the config change telling it to ignore the expired WLC cert, after it has reloaded onto the new software.
After the AP has the new software and config you can re-enable NTP on the WLC.