RAP-109 Provisioning Error

[Taylor Boy]

Hi all

I am having an issue with provisioning a RAP-109. This device worked fine before. I have had it disconnected for a while and when I plugged it up it had a broadcast ssid of "instant". So I connected to it and tried to re-provision it. However, in this process, I encountered an error. 

I have verified that the configuration is still in the Remote AP whitelist.

My controller information is as follows:

Name:	Aruba Operating System Software.
Model:	Aruba3600
Version:	6.3.1.8
Compiled:	2014-06-10 at 18:09:03 PDT (build 44205) by p4build

I have attached the error file that was generated. 

Any help to remedy this issue will be greatly appreciated.

[cjoseph]

It almost looks like you don't have it in the RAP whitelist:

Notify: AUTHENTICATION_FAILED (ESP spi=93163f00)
May 23, 12:19:16: InNotify AP authentication failed
ike2_state.c (7882): errorCode = ERR_IKE_NOTIFY_PAYLOAD
May 23, 12:19:16: IKE_SAMPLE_ikeStatHdlr(CHILD_SA): dwPeerAddr:d8890e43 index:0 mPeerType:0
May 23, 12:19:16: IKE SA failed reason = ERR_IKE_XAUTH_FAILED, errorcode = -8952 ikeVer 2
May 23, 12:19:16: send_sapd_error: InnerIP:0  error:45 debug_error:0

May 23, 12:19:16: send_sapd_error: error:45 debug_error:0

May 23, 12:19:16: IKE_SAMPLE_ikeStatHdlr(SA): dwPeerAddr:d8890e43 index:0 mPeerType:0
May 23, 12:19:16: IKE_SA [v2 I] (id=0xd6d38218) flags 0x41000015 failed reason = ERR_IKE_XAUTH_FAILED, errorcode = -8952
May 23, 12:19:16: IKE_SAMPLE_ikeStatHdlr(IST_FAIL): g_ikeversion:2
Timer ID: 1 Deleted 
rapperSendStatusCB

[Taylor Boy]

I actually do have it in the whitelist. I deleted it and re-added. See pics.

[cjoseph]

on the controller, do this:

config t
logging level debugging security subcat ike
logging level debugging security process aaa
logging level debugging security process authmgr
logging level debugging security subcat l2tp
logging level debugging security subcat vpn

Attempt to convert/connect your RAP, then type "show log security 50" to see if there are any clues.

[Taylor Boy]

cjospeh

Here is the output I got.......

[cjoseph]

Check to make sure your configuration is like in the picture below:

[Taylor Boy]

I have ensured that is the case. 

[cjoseph]

Okay.  You need to check below:

[Taylor Boy]

Here is what I have there.

[cjoseph · Accepted solution]

If the default server group is modified, it could make it so that you cannot bring up a RAP.

Find out why it is configured like you have it.  If you do not know, please revert to how I have it and retest your RAP.  The default server group needs to point to the internal database, but without what you have, to make RAPs come up.