Mobility group 5520 and 5508 different software

[Moudar]

Hi!

We run 5520 with software 8.3.133 and want to upgrade it to 8.10.x to be able to run the Catalyst 9120 APs.

The problem is that we have 100 APs 2600 model in production that we can not change right now because of very long wait time of new APs, and 8.10.x software does not support these.

We have kept our old 5508  and the idea is to move the 2600s to 5508 which will run last supported software 8.5.

The question is about Roaming.

What problems could we get if we do as said above?
Would roaming work at all?

When i check the software release it says: Mobility groups can be comprised of any combination of controller platforms as long as the controllers are running compatible AireOS versions

When i check the IRCM Compatibility Matrix for AireOS Releases i see a "Y" over all. Does "Y" mean yes ? and  if it means yes, does that mean that no problem for roaming when different software releases?

Please see the attached! 

[JPavonM · Accepted solution]

That's cprrect, it is expected to have seamless roaming between different WLC models on different AireOS releases unless there would be an unknown defect.

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html#ircm_aireos_rls

[Flavio Miranda]

You are coverd by the docs  but if you wanto to see working before moving, you can easily verify this. by transfering the APs to the 5508 WLC, upgrade the 5520 and use at least one 9200 for test.  Configure a Mobility Group between both WLC and check if tunnel is UP.

 Although this is not your final scnario, will give you a good clue about what might happen. 

[Moudar]

Thank you for your answers!

Another question came to me.

We are using Prime 3.8 and ISE 2.4. 

When moving our WLC to 8.10.x and using Catalyst APs, is there any concerns about Prime and ISE?

Do we need to Upgrade these to be able to run the catalyst APs?

We are runnig a plenty of different AP models as 2800, 1850, 2700, 2600, 3700 and 1500

[marce1000]

 - In general you will find device compatibility info's for prime here :

                https://www.cisco.com/c/en/us/support/cloud-systems-management/prime-infrastructure/products-device-support-tables-list.html

 M.

[Flavio Miranda]

ISE 2.4 supports up to 8.10.151.0 WLC. So, you are good.

Prime 3.8 supports up to 8.10.171.0, so you are good also. 

[Moudar]

If i want to upgrade the WLC to 8.10.171.0 do I need to upgrade ISE also?

[Flavio Miranda]

Not necessary.  8.10.171.0  is supported in ISE 2.4

[Arshad Safrulla]

Even though 8.10 supported by ISE 2.4, ISE 2.4 software itself is EOS and no more maintained by Cisco. So you have to expect limited support from TAC.

Cisco Identity Services Engine - End of Life Announcement for the Cisco Identity Services Engine Software Version 2.4 - Cisco

So IMHO, it is recommended that you upgrade your ISE nodes to latest Cisco recommended to extend its support cycle and importantly ISE 2.4 without the hot patch is vulnerable to log4j attacks as well.

[Moudar]

Thank your answers!

Another question about a Python tool that checks the flash memory before an WLC upgrade.

Is this tool important to test before upgrading?

How to use this tool? I am not a programmer, i could not find a good guide how to use it, the provided guide is not very expressive!

[Arshad Safrulla]

Hi,

I would strongly recommend you to run the WLAN poller before the upgrade, otherwise it will become a hectic task. You do not need any programming knowledge to run this. Cisco has provided an extensive guide on what needs to be done. Please keep in mind this flash  issue impacts only 1600, 1700, 2600, 2700, 3600, and 3700 Series APs.

Field Notice - Field Notice: FN - 70330 - Cisco IOS Access Point Stranded Due to Flash Corruption Issue - Workaround Provided - Cisco

WLAN poller deployment guide - Understanding Various AP-IOS Flash Corruption Issues - Cisco

Upgrade path - Wireless LAN Controller (WLC) Software Upgrade - Cisco

TAC recommended codes - Recommended AireOS Wireless LAN Controller Releases - Cisco

Always follow the Cisco documentation and the recommended process unless you have staged the upgrade previously in a test bed and the results and use cases are well documented.

[Moudar]

When running the tool i got so many warnings as " MD5 check - Failure determining active IOS image"

What does that mean?

See the attached!

[Rich R]

Those APs are probably affected and need fixing before upgrade.  You'll need to go and check those APs yourself manually.

Did you read the documentation @Arshad Safrulla linked above?  Did you run the script twice as per the instructions?

"md5_fail: True when md5 at least one file is different from the stored in the database."

• md5_error: Error message retrieving md5 value if it was not possible to get md5 for the filename.

Note: There could be scenarios where the WLAN Poller recovery script is unable to recover certain AP's and those AP remains flagged as failed in the report. In those scenarios, manual AP recovery by telnet/SSH/console into AP CLI is recommended. Please open TAC SR if you needed assistance on this process. Attach all output generated from WLAN poller to the case. 

[Flavio Miranda]

 I´ve been working with WLC since 2011 and I never used this. The WLC is one the most intelligent cisco device I know when it comes to upgrade. By it self, the WLC check all the necessary to upgrade.  And, all WLC model  is also over dimentioned in terms of hardware. 

[Rich R]

One of our eng's wrote his own custom version of the tool based on Cisco's because unlike Flavio we needed to use it because hundreds of our APs (we have thousands) were affected at each upgrade by the flash corruption issue.  If you haven't upgraded in a while there's a very high risk you'll encounter it and then some of the APs won't come back (doesn't matter how intelligent the WLC is, the bugs are in the AP IOS code).  If you have remote PoE control then you might be able to recover them with power cycling but if they're on power injectors it may need visits to the APs.  Save yourself all that trouble by doing the homework before you start the upgrades.  I don't think we've seen the flash corruption in the last 2 years so I think they eventually got the various bugs fixed in current releases but definitely not in the older releases.