Unable to gain access to an Aironet 3700

[netmon-27]

Hi everyone,

I bought a used Aironet 3700 but I'm unable to gain access to it. I have it connected with a PoE injector ("802.23at" spec I'm led to believe). The AP powers up with a blinking green light, then sets on a green-red-off pattern which I understand means it's waiting.

I attempted to reset it, by disconnecting PoE, holding the MODE button, then connecting power again until the light is solid red/amber. I then release the MODE button and wait for it to grab an IP address. When I try connecting by SSH (port 22), I get a login prompt and try Cisco/Cisco for username and password. Access is denied every time. If I try telnet, then I get a message stating "Password required, but none set" then the session terminates.

Some strange behavior I've noticed is that it appears the AP is resetting its self about every minute. It will acquire a new IP address from the DHCP server when it does this.

I do not have a special Console cable to gain serial access. Can anyone help me?

[Leo Laohoo]

---

@netmon-27 wrote:

I do not have a special Console cable to gain serial access. Can anyone help me?

---

Without console access, there is nothing to determine what the mode (autonomous or CAPWAP) the AP is booting into.

[netmon-27]

For the sake of argument then, let's assume that the device is in LWAP mode. I understand that I need it in Autonomous mode, so I'm currently following various guides to convert it, such as this one. I have an autonomous firmware file ready to go, as well as Tftpd64 running with the renamed firmware (ap3g2-k9w7-tar.default) available. My Ethernet NIC is set to 10.0.0.2/8, and in Wireshark I can see the AP trying to access that file via TFTP by sending the request to broadcast (255.255.255.255). For whatever reason though, Tftpd64 doesn't appear to be responding to this request. Any ideas why?

[Leo Laohoo]

If the AP is in ROMMON, the Mode button will not work.  

[netmon-27]

Are you sure this is what mode it's in?

Here's what I'm observing now:

When I boot the AP without touching the MODE, button it goes through a procedure of flashing green LEDs. In Wireshark, it requests and obtains an IP from the DHCP server. I can see SSH and Telnet are up, with the aforementioned behaviors. Cisco/Cisco does not authenticate.

Now if I attempt the MODE-reboot, the TFTP packets I was seeing before have been replaced with a couple of malformed Ethernet packets in Wireshark. The AP then falls back to a blinking red LED.

The ultimate question here is, do I have no other choice than to go out and get the specialized console cable? Is there nothing I can do with an ethernet cable at this point?

[Leo Laohoo]

---

@netmon-27 wrote:

The ultimate question here is, do I have no other choice than to go out and get the specialized console cable? Is there nothing I can do with an ethernet cable at this point?

---

Ask friends if they have one they are willing to lend.

[netmon-27]

I'll make that my next mission then. In the meantime, hear me out on this idea and let me know if it will work:

I have a 2901 ISR currently configured. It has an AUX port, which as I understand now from some research, would allow me to communicate to another device's Console port via Reverse Telnet. I've done the configuration below:

interface Loopback0
ip address 192.168.44.1 255.255.255.255
!

line aux 0
modem InOut
no exec
transport preferred telnet
transport input all
transport output all
stopbits 1
speed 38400
flowcontrol hardware

But when I attempt to telnet 192.168.44.1 2001 (Line 1 is AUX), I am given the prompt for the router's telnet, as if I just connected to localhost. Is the issue that I'm not using a rollover-type ethernet cable?

[Leo Laohoo]

---

@netmon-27 wrote:

But when I attempt to telnet 192.168.44.1 2001 (Line 1 is AUX), I am given the prompt for the router's telnet, as if I just connected to localhost. Is the issue that I'm not using a rollover-type ethernet cable?

---

One of the "rules" for remotely-accessing Cisco-branded devices is this:  If there is the absence of a manually configured username/password, no access will be allowed.  

[netmon-27]

---

@Leo Laohoo wrote:One of the "rules" for remotely-accessing Cisco-branded devices is this:  If there is the absence of a manually configured username/password, no access will be allowed.

---

I'm sorry, I think I might've been unclear:

Currently I have a functioning 2901 ISR, which comes with both Console and AUX ports. In lieu of a Serial-USB adapter to legitimately connect to and configure the Aironet, I've learned about the concept of a Reverse Telnet. My understanding is that this allows me to connect from a device's Console port to my router's AUX port by using a basic Ethernet cable. I'm a little unclear on whether this needs to be a straight-through cable (according to the aforementioned blog), or a Rollover type which I've seen mentioned on these forums. I'll try making a CAT6 cable tomorrow and see if I can get this working. It's just a little strange to me that, even with the wrong cable, my telnet command is still connecting to something, and in this case its self (the router). This makes me wonder if it's only a matter of me having my configuration incorrect. Hoping you wouldn't mind taking a look at it above. Thank you for your guidance so far, by the way!

[Rich R]

Reverse telnet requires you to authenticate to your local device before connecting you to the port.

So you login to your local device to get access then press enter and should then get console prompt on the other device.

Straight through cable.

https://www.tek-tips.com/faqs.cfm?fid=1312 
https://community.cisco.com/t5/vpn/reverse-telnet-aux-console/td-p/1235693

And remember baud rate is always 9600 unless you've explicitly changed it which generally isn't recommended.

[netmon-27]

Thank you for confirming that. I've verified with a cable tester that I have a straight-through cable connecting the ports, and I've corrected the baud rate to 9600. Despite this, after logging in initially with my admin user from the router, the prompt freezes and I have to restart the session (PuTTY derivative called KiTTY). This is while the AP is booting and after it has completed, yet no output so I wonder if I have something wrong still. Some comments on another thread recommended adding no exec and flowcontrol hardware to the line configuration, but that didn't seem to help. Here's the output of sh line aux 0, can you see anything that needs fixing?

cisco-router#sh line aux 0
Tty Line Typ Tx/Rx A Modem Roty AccO AccI Uses Noise Overruns Int
* 1 1 AUX 9600/9600 - inout - - - 1 0 0/0 -

Line 1, Location: "", Type: "xterm"
Length: 24 lines, Width: 80 columns
Baud rate (TX/RX) is 9600/9600, no parity, 2 stopbits, 8 databits
Status: Ready, Connected, Active, No Exit Banner, Modem Signals Polled
Capabilities: EXEC Suppressed, Hardware Flowcontrol In,
Hardware Flowcontrol Out, Modem Callout, Modem RI is CD
Modem state: Ready
Modem hardware state: noCTS noDSR DTR RTS
Special Chars: Escape Hold Stop Start Disconnect Activation
^^x none - - none
Timeouts: Idle EXEC Idle Session Modem Answer Session Dispatch
00:10:00 never none not set
Idle Session Disconnect Warning
never
Login-sequence User Response
00:00:30
Autoselect Initial Wait
not set
Modem type is unknown.
Session limit is not set.
Time since activation: 00:19:50
Editing is enabled.
History is enabled, history size is 20.
DNS resolution in show commands is enabled
Full user help is disabled
Allowed input transports are pad telnet rlogin lapb-ta mop udptn v120 ssh.
Allowed output transports are pad telnet rlogin lapb-ta mop v120 ssh.
Preferred transport is telnet.
Shell: enabled
Shell trace: off
No output characters are padded
No special data dispatching characters

[Rich R]

Just noticed your output shows: Baud rate (TX/RX) is 9600/9600, no parity, 2 stopbits, 8 databits

The standard console setting is 9600 8N1.

That's 9600 baud, 8 data bits, no parity, 1 stop bit.

You can also try turning flow control off.

[netmon-27 · Accepted solution]

Thank you for taking a second look. I noticed that too and tried correcting both things... but no luck.

Stubborn as I am, I could not just give up. I went ahead and made my rollover cable. The cable tester was reluctant to test it, however...

cisco-router#telnet 10.0.0.2 2001
Trying 10.0.0.2, 2001 ... Open
Home Cisco Router!

User Access Verification

Username: user
Password:

AP003a.7d73.634c>

Success! I have a prompt.

Thank you and @Leo Laohoo for your help on this.

For anyone else struggling with this, here are the important bits of config:

version 15.7

!

!- Choice of network below isn't important, only useful for your local telnet session.
interface Loopback0
ip address 10.0.0.2 255.255.255.0
!

line aux 0
modem InOut
no exec
transport input all
transport output all
stopbits 1

[Rich R]

Maybe just consider getting yourself a console cable like https://www.amazon.com/OIKWAN-Compatible-Opengear-Aruba%EF%BC%8CJuniper-Switches/dp/B075V1RGQK/ - they really aren't that expensive!

Otherwise you need a standard console cable eg: https://www.amazon.com/CAB-CONSOLE-RJ45-Cisco-RJ45-DB9/dp/B00SWPR4VI/ + serial to usb cable eg: https://www.amazon.com/Serial-Adapter-Prolific-Chipset-Windows/dp/B0753HBT12/