WLC JOIN PROBLEM WHEN IN THE CONFINES OF A SHIP

[KWSEISER]

I HAVE 2702 CAPS,  A LAPTOP AND A  WLC 5508 CONNECTED TO A 3560 G SWITCH.  AP'S POWERED FORM THE SWITCH.  FOR DISCUSSION PURPOSES  THE WLC AND SWITCH IS POWERED FORM A UPS NOT PLUGGED INTO AN OUTLET.  EVERYTHING WORKS FINE ON MY LIVING ROOM TABLE  AP'S  JOIN.  USING THIS SAME CONFIG INSIDE OF A RETIRED NAVAL SHIP USED AS A MUSEUM  I AM UNABLE TO GET A JOIN ON ANY OF THE AP'S.  REMOVE FORM THE SHIP AND ALL AP'S AGAIN JOINS AND FUNCTIONS PROPERLY.   JOIN STATUS IS SEEN ON THE   STATISTICS  JOIN  SCREEN ONF THE WLC.  WHEN JOINED  I SET THE  AP POWER LEVELS TO MINIMUM.  THE SWITCH WHEN USED FOR ANY OTHER PURPOSE ON THE SHIP  HAS WORKED FINE CONNECTING HTE SHIP TO THE WWW.   STATISTICS JOIN  ---- SHOWS AP'S WITH THE IP ADDRESS  BUT NOT JOINED. 

[Leo Laohoo]

ARE THE WIRELESS CLIENTS GETTING A VALID IP ADDRESS?

HAVE YOU TRIED USING OPEN AUTHENTICATION?

[KWSEISER]

HAVE NOT TRIED OPEN AUTHENTICATION?  THE SYSTEM WORKS PERFECT IN MY OFFICE,, AS IS,,, BUT NOT ON THE SHIP.  I USED A UPS TO AVOID ANY ISSUES IN THE SHIPS POWER DIFFERENCES ( 60V  60V)  AS OPPOSED TO HOME OUTLETS (  VS  120  0V ) .  I AM USING THE SYSTEM NOW TO POST THIS.  I HAVE USED A 2ND AND THIRD  WLC AND HAVE THE SAME RESULTS. 

[KWSEISER]

FOR SOME CLARIFICATION .    I AM LOOKING AT THE GENERAL PROCESS OF

1.  AP  GETS IP ADDRESS      2.  AP JOINS  WLC      3.  CLIENT LOGS ON 

AT HOME ALL THREE STEPS  HAPPEN  AND CAN BE SEEN INTHE STATIXZTICS AND THE AP INFO.  WHEN ON THE SHIP  STEP 2 DOES NOT OCCURE AND HENCE  STEP 3 IS MOOT AT THIS POINT.  THERE IS NO HARDWARE DIFFERENCE IN THE 2 LOCATIONS ( INCLUDING CABLING)   WITH EXCEPTION OF WHICH TABLE THE EQUIPMENT IS PHYSICALY SITTING ON.   CURRENTLY THERE IS NO LEVEL 2 OR 3 SECURITY ON THE WLC  IT IS OPEN AND WORKS FINE WHEN THE ADDITIONAL PATCH CORD IS CONNECTED TO MY HOME NETWORK LIKE IT IS NOW.  I AM USING IT TO MAKE THIS POST FROM MY HOME.

[Leo Laohoo]

CONNECT A CONSOLE CABLE TO THE AP AND REBOOT.  POST THE ENTIRE BOOT-UP PROCESS OF THE AP.

[KWSEISER]

i will try to get that done.  it is note worthy to say it is fully working in the home location.     i am at home,,, the ap is joined to the wlc,,  i am connected to the ap as a desktop cell and pad client. ( blue light on ap").    i am unable to get the boot up  data,,, as the ship site is 100 miles away  I am assuming you want to see a failed join process in the  boot up.  

[Leo Laohoo]

---

@KWSEISER wrote:
I am assuming you want to see a failed join process in the  boot up.  

---

Correct.

[Rich R]

> THERE IS NO HARDWARE DIFFERENCE IN THE 2 LOCATIONS
But it's different pieces of hardware?  You're not actually taking the switch or WLC from home to the ship?
So there could be config differences on the APs, the WLC or the switch - so you need side by side config comparison to look for differences.  And obviously make sure you're running the same versions of software. Or you could have certificates with different dates on them on APs or WLCs ...

Have a long slow read (twice if you need to) through https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html
In summary:

1. Upgrade to latest version which supports your APs and WLC - probably 8.5.182.0
   https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc10
   2. Apply the config workaround on the WLC
   3. Disable NTP and set time manually to before your certs expired
   4. Allow all the APs to join, download new code, pick up the config workaround
   5 Re-enable NTP

And like @Leo Laohoo said post the full console log from power-on from one of the APs - that will almost certainly tell us what the problem is.
What version of software is your 5508 running?  What version of IOS is currently installed on the APs? We'll get that from the console log but you could do a "show ver" anyway for good measure.

[KWSEISER]

there is NO difference in the hardware.  i am moving the entire hardware group from location to location.  everything is the same right down to the patch cables.  i am using a switch,,  2702 ap's and a lap top with the 5508 wlc.  all those items are  the package of hardware that remains together.   i move the entire set from home to the ships site.  it works at home and not on the ship irrelivant as to whether it is further connected to a existing site network. the only difference is whose kitchen able the package sits on.   even the power being used is the same.  it is from a ups that is not plugged in to either site outlet.  there is  LITERALLY  no hardware differences.  i am right now using the same equipment paackage  leaving this post ( at home) that i am transporting to the site.    perhaps one exception  at home i can also connect the switch to the home network like it is now to get to the www.   when not connected to the home network and these components are stand alone  the ap's  join the wlc  at the ship  the same physical ap's  will not join the wlc.  certificate issues  is moot.   because the equipment package is the same at home as on the ship.

[KWSEISER]

all your suggestions should be moot because the entire package works in the home.  teh software is  i think 8.4 on the wlc and the ap's.  they work fine to gether at home.  i am doing the side by side comparison,,,, as not a thing in the hardware changes from the home to the ship site.  using the same  wlc  saame  switch  same ap's  same laptop.  and on the ship i can not get aps to join the wlc.  again the only difference is the table the identical hardware equipment is sitting on.  

[Rich R]

Ok mate - we're just trying to help you with the limited info you've provided - without the AP logs it's all calculated guesswork! 

8.4 was a very short-lived single release which got deferred shortly after release due to serious defects so regardless of anything else you should consider moving to the latest 8.5.

So assuming they're all identical then one last idea based on what you've side about the internet router at home... 
Where is your DHCP server for the APs? 
Is it possible that the APs are getting their DHCP IP address from your internet router when at home and you don't have a DHCP server at the ship?

[KWSEISER]

sorry about the limited info.  its all i have being not on the site to get the ap boot  log.   the dhcp is from the wlc and works fine while sitting on the dining room table  and not connected to the home router  it gives me a  join status onthe statistics  join screen .  the phone shows  the ssid  of hte wlc and i can client connect with the wlc  and ultimately get to the www if I patch the equipment to the home  network.  . again the exact process on the ship dining table will not yeild a join.  i can use advanced ip scanner and see the IP's  on the AP's  and when logging into the wlc  i can also see the IP's  but no join like at home.   would be glad to video connect via face book  and we can talk live.  fb  namd  is Keith Seiser

[Rich R]

I'm afraid you're going to have work through this logically and methodically to work out what the problem is:
- full console log from AP
- AP join stats from WLC
- Connectivity between AP and WLC and join method for AP to discover WLC (I know you think this is all good but need to confirm)
- Debugs on the WLC
- Packet captures of the AP-WLC join interaction.
We've covered all the obvious causes so either it *is* one of those or you've encountered some other problem, but we need to see the data to make any progress. We all have full time jobs and normal lives but if anyone here is able to help you live on Facebook, I'm sure they'll reach out to you directly.