Some APs no longer showing on WLC but can still ping the devices

[g.ghir]

Dear Community,

I have been running a network over a number of years (remotely) which has a Cisco 2504 WLC with LAP1042N-E Access Points (x5) and one AP (CAP1602I-E).  The users have reported a problem of poor connectivity, once we have investigated the issue we are not seeing 3 of the 6 APs on the WLC.  Strange thing is that we can ping all 6 APs???

Not sure what is going on.  Happy to provide logs/dumps etc but I am working remotely however I have had one of thWLC, AP1042N,e (faulty) APs shipped to my house.  

[Flavio Miranda]

You may see AP on the network but not on the WLC. And you may see AP on the WLC but not propagating wireless signal. 

Make sure the AP is properly configured on the switch. Check vlan and port mode. 

 Access the AP remotely and try to Ping the wlc

[g.ghir]

Thanks, but it used to work and nothing has changed on the switch, the other 3 APs are continuing to work.  

[MHM Cisco World]

check if AP join WLC, 
check AP Certificate may be it expire.

[Leo Laohoo · Accepted solution]

Read this:  FN - 63942 - Wireless Lightweight Access Points and WLAN Controllers Fail to Create CAPWAP Connections Due to Certificate Expiration

I suspect the WLC is running a fairly old firmware, probably early 8.0, and the APs have rebooted or crashed. 

[g.ghir]

Hi Leo, yes the Software Version is 7.6.100.0.  What version would be recommended to fix this issue please?

[g.ghir]

In doing some more digging you seem to be correct (although I have not fixed this yet).  Once I set the clock back in time on my Wireless Controller the APs started to come back.  I am working remotely so I am not sure if I need to console into the APs to apply a permanent fix.  Exploring further...

[MHM Cisco World]

As I mention in first my comment, the issue is certificate
other workaround is using 

ap cert-expiry-ignore mic enable

[Leo Laohoo]

---

@g.ghir wrote:

Hi Leo, yes the Software Version is 7.6.100.0.  What version would be recommended to fix this issue please?

---

What APs are there?

1042 and 1600.  Any other models?

[Haydn Andrews]

If just the 1042 and 1600 then the highest version you can run is

8.3.150.0

As per the wireless compatibility matrix

https://www.cisco.com/c/en/us/td/docs/wireless/compatibility/matrix/compatibility-matrix.html

Then:

You will need to follow these steps:

Solution for Expired WLC Certificates

Situation: The WLC does not run a fixed software version and some APs cannot join.

1. Upgrade to a fixed version of the software.
2. Enter the config ap cert-expiry-ignore {mic|ssc} enable command.
3. If any of the APs that cannot join have not downloaded the fixed software:
   1. Disable NTP.
   2. Set the clock back to a time before the WLC certificate expired (might keep newer APs from joining).
   3. Have all APs join the WLC, download new software, and rejoin.
   4. Set the clock to the correct time and re-enable NTP.

Situation: The WLC runs fixed software, but some APs cannot join.

1. Enter the config ap cert-expiry-ignore mic enable command.
2. If any of the APs that cannot join have not downloaded the fixed software:
   1. Disable NTP.
   2. Set the clock back to a time before the WLC certificate expired (might keep newer APs from joining).
   3. Have all APs join the WLC, download new software, and rejoin.
   4. Set the clock to the correct time and re-enable NTP.

Alternatively as a work around before the upgrade you can roll the WLC clock manually back to before the certificate expired

Further details here: https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html 

[g.ghir]

1x AIR-CAP1602I-E-K9
5x AIR-LAP1042N-E-K9

Kind thx

[Haydn Andrews]

agree with @Leo Laohoo more than likely APs hitting MIC certificate expiry

[g.ghir]

Thanks Haydn, 

I looked at the article but I have not worked on controllers so I need to do a bit more study.  When I look at the logs I notice this error:

*spamApTask2: May 02 18:03:29.307: #DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:698 Failed to complete DTLS handshake with peer

Does this have something to do with the issue?

[Rich R]

Yes - the field notice tells you exactly what to do and @Haydn Andrews has even summarised that for you above.

You need to upgrade the WLC to a version with the fix/workaround (8.3.150.0 as Hayden suggested) and then apply the correct config as per the instructions.