Hi all!
For CMX 10.x and WLC 8.5.x i had the same problem and found a solution. I am posting this for future reference.
WLC 8.5.140.0
CMX 10.4.1-28
On WLC connection was down, cipher high option was enabled:
WLC > show nmsp status
NMSP Cipher High Option......................... Enabled
Max number of Nmsp Connections supported : 4
MSE IP Address Echo Resp Echo Req Tx Data Rx Data
-------------- ------------ ----------- ------- -------
WLC > show nmsp statistics connection
NMSP Connection Counters
0.0.0.0
Connection status: DOWN
Debug shows SSL wrong version number and Decode Failure detected at MSE:
WLC > debug nmsp all enable
SSL routines:ssl3_get_client_hello:wrong version number
Decode Failure detected at MSE: Sending out keys to MSE
On CMX:
cmxctl config controllers show
+------------+------+-----------+------+----------+
| IP Address | Type | Version | SHA2 | Status |
+------------+------+-----------+------+----------+
| 172.29.0.4 | WLC | 8.5.140.0 | Yes | INACTIVE |
+------------+------+-----------+------+----------+
The solution was to disable NMSP cipher high option:
WLC > config nmsp cipher-option high disable
NMSP high cipher option will be enabled/disabled after WLC Reboot.
Power MUST be ON while 'save config' is getting executed.
Both controllers need to be rebooted for this to work, as stated above. If your controllers are in HA, you can reboot one at the time without service interruption - reset system self
After reboot:
cmxctl config controllers show
+------------+------+-----------+------+--------+
| IP Address | Type | Version | SHA2 | Status |
+------------+------+-----------+------+--------+
| 172.29.0.4 | WLC | 8.5.140.0 | Yes | ACTIVE |
+------------+------+-----------+------+--------+
WLC > show nmsp status
NMSP Cipher High Option......................... Disabled
Max number of Nmsp Connections supported : 4
MSE IP Address Echo Resp Echo Req Tx Data Rx Data
-------------- ------------ ----------- ------- -------
172.29.0.11 22 22 937 10
Downside to turning off cipher high is the loss of advanced security. I hope someone from Cisco can clarify this.
I hope this helps.
BR,
Tom
