01-25-2024 03:44 AM
Hi.
I'm having problems connecting a AP3702 to our WLC9800.
It says the certificate has expired.
So I'm thinking that downloading a newer firmware to the AP will do the trick since we have several other AP3702 onto the network without problems
But I cannot see any archive or copy commands when I ssh into the AP.
Does this mean there is no way to remotely copy a new firmware into the AP3702?
This is the model number: AIR-CAP3702I-E-K9
解決済! 解決策の投稿を見る。
01-25-2024 06:43 AM
- Checkout this solution and give it a try , the first part concerning dhcp is not relevant , (go to the clear capwap commands)
https://community.cisco.com/t5/wireless/ap1700-trying-to-associate-to-wlc-9800/m-p/4775185#M251689
M.
01-25-2024 11:10 PM
This command did the trick:
debug capwap console cli
After i entered that, I could use the copy command as usual.
Thanks!
01-25-2024 04:32 AM
It can be done.
Is the AP remotely accessible (console, telnet, SSH)?
01-25-2024 04:36 AM
It is accessible via SSH
01-25-2024 04:45 PM 01-25-2024 04:48 PM 更新
@dal wrote:
It is accessible via SSH
Perfect! I've got a solution and it will be nasty.
1. First, go to the Cisco Download portal and download the RCV image for the 2600/3600/2700/3700 (Filename: ap3g2-rcvk9w8-tar.153-3.JPQ1.tar). Put the file into a TFTP server. Do not forget FW rules!
2. Next, SSH into the AP in question and do the following command:
debug capwap console cli
delete /f /r flash:ap3g2*
archive TAR /X tftp://<TFTP_IP_ADDRESS>/ap3g2-rcvk9w8-tar.153-3.JPQ1.tar flash:
3. Once this is completed, reboot the AP.
NOTE: Do not worry that the RCV file is meant for IOS-XE version 17.12.2 because it is better to use this version.
When the AP reboots, it will load a Recovery Image (aka RCV) meant for version 17.12.2. Because this is the "latest", the AP should have all the latest certificate installed. The AP will join the controller and download the correct firmware.
Just to set everyone's heart at ease: I have been doing this trick ("tar /x" option) to several hundreds of APs (classic IOS) and for several years so this is not something I have never tried and done before. Every AP we get back (example site decommissioning), I would erase all the firmware and load the latest RCV into the AP.
01-25-2024 05:38 AM
Some C9800 Software versions do not support 3700 Series AP.
You can try to configure the mentioned policy in the section:
Solution for Expired AP Certificates and/or for Scenario of Encrypted Mobility Tunnels That Fail to Form
C9800 Command to Accept Expired Certificates
https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html
I think alternatively you can play with the time, but this might cause other problems or prevent newer APs from joining.
Regards
01-25-2024 06:38 AM
I tried to play with the time, but just ended up disconnecting all the other APs
I tried the Certificate map now as well, but no.
It would have been so much easier if the AP accepted common commands like copy or archive
Surely there must be a way to upload a new image remotely?
01-25-2024 08:12 AM
3702 IOS definitely supports the archive and copy commands!
What version is currently on the AP?
The cert map should workaround the expired cert - double check that you implemented it correctly.
What version is the WLC running? (hint - refer to the TAC Recommended link below).
01-25-2024 06:01 AM
>...It says the certificate has expired.
- Could you show (post) the exact message as you are observing it ?
M.
01-25-2024 06:23 AM
*Jan 25 14:18:38.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 172.xx.xx.254 peer_port: 5246Peer certificate verification failed FFFFFFFF
*Jan 25 14:18:38.003: %CAPWAP-3-ERRORLOG: Certificate verification failed!
*Jan 25 14:18:38.003: DTLS_CLIENT_ERROR: ../capwap/base_capwap/capwap/base_capwap_wtp_dtls.c:467 Certificate verified failed!
*Jan 25 14:18:38.003: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 172.xx.xx.254:5246
*Jan 25 14:18:38.003: %CAPWAP-3-ERRORLOG: Dropping dtls packet since session is not established. 172.30.244.254, 147E, 172.30.244.10, DAB6, 0
01-25-2024 06:43 AM
- Checkout this solution and give it a try , the first part concerning dhcp is not relevant , (go to the clear capwap commands)
https://community.cisco.com/t5/wireless/ap1700-trying-to-associate-to-wlc-9800/m-p/4775185#M251689
M.
01-25-2024 11:10 PM
This command did the trick:
debug capwap console cli
After i entered that, I could use the copy command as usual.
Thanks!
エキスパートの回答、ステップバイステップガイド、最新のトピックなどお気に入りのアイデアを見つけたら、あとで参照できるように保存しましょう。
コミュニティは初めてですか?これらのヒントを活用してスタートしましょう。 コミュニティの活用方法 新メンバーガイド