Wireless Access

Hello together,

I have a master-standby topology, to which two local controllers are attached. One of the local controllers is used for a pool of AP-315 access points, that connect to the local controller via LMS IP settings to the management IP of the local WLC.

Hardware specifications:

Master: Aruba7240 - Firmware 6.5.0.4_58404

Standby: Aruba7240 - Firmware 6.5.0.4_58404

Locals: Aruba7240XM - Firmware 6.5.0.4_58404

The setup was running fine for many weeks and no configuration or topology changes were made.

Since yesterday are APs, which are attached to the local controller, affected by random reboots. Only one AP is affected at a corresponding time frame, it never hits two APs at the same time. The issue affects around five access point within 12 hours.

When the AP reboots randomly, it is not provisioned anymore and is associated to the "default" AP Group, which prevents the AP from working correctly. It's possible to reprovision the AP and it's working fine again afterwards, but several hours later other APs are affected. Sometimes the same AP is affected again.

I checked following at the master WLC:

- Licensing: Seems good, over 100 unused CAP licenses available

- Configuration history: Used show audit-trail to verify that no configuration changes were made

- Power via PoE: I don't see any power problems on the switch, all access points use PoE+ and the switches still have enough power to deliver for more APs. Different switches are involved.

- Whitelist: Seems good to me, affected APs are correctly added to the whitelist (Using auto cert provisioning)

- AP Debug Reboot reason: SAPD: Rebooting after setting cert_cap=1. Need to open a secure channel(IPSEC)

I opened a TAC case and I'm still waiting for the response.

Could someone give me a hint to fix the problem?

Thanks a lot and have a great day.

SSH into the master controller and type "show switches" to make sure that the standby shows up there.

The reboot message seems to show that an access point is trying to get a cpsec certificate again, which could mean that the local controller is somehow connecting to one master with a cpsec database and another master with a different cpsec database.

Hello, thanks for the fast reply. The command "show switches" tells me that all WLCs are configured as planned. I see one master, one standby and two locals.

Well, keep working with TAC.  There must be another reason why.