Wireless Access

This should be simple. I've got a 3600 and some AP135s new out of the box and trying to get things set up.

I have a DHCP pool enabled on the controller. I am consoling into the AP watching it boot up. It gets an IP address, ADP runs and gets the correct LMS IP. Everything from the standpoint of the AP looks good. However, it never shows up on the controller... not as up, not down, not in the list of unprovisioned. I can ping the AP from the controller and vice-versa. Both the controller and AP show 6.1.1.0 so it shouldn't be downloading an image.

Any ideas?

Do you have licenses installed on that controller?  does the Unprovisioned AP have a Flag, saying why it is unprovisioned?

Please run the following command from the CLI and post the output:

show ap database | include 135

Re: Licensing, yes - this is a 3600-64 actually.

show ap database | include 135 yields no results at all.... when I omit the pipe it just shows APs:0.

I have done nothing whatsoever to the original config other than adding the DHCP pool and a couple AP groups.

Thanks for the assistance, guys...

cjoseph: It's not showing up as unprovisioned... that's the problem. It's not showing up at all.

CPsec is enabled by default in ArubaOS 6.x . check whether the AP is the the campus whitelist. Did you add the ap to the campus whitelist?

In GUI

AP installation --->campus whitelist

Diasble CPSec and see whether the AP shows up.

What version of code is on your controller?  You will need a relatively new ArubaOS to support the AP-135.

Is there any messages in the system log (show log system all) about the AP not being recognized?

Is the AP continually rebooting?

Thanks for the continued help on this!

1) CPSec has been turned off but it did not help.

2) Code was 6.1.1.0 out of the  box. Should I upgrade? If so, to what?

3) As a matter of fact.... the AP IS rebooting. I hadn't noticed. It's doing it every 5 minutes or so. Here's what is reported in the log on the controller:

Nov 22 07:13:13  nanny[732]: <303022> <WARN> |AP d8:c7:c8:c0:c7:c8@10.201.255.25

4 nanny|  Reboot Reason: AP rebooted Fri Dec 31 16:04:19 PST 1999; SAPD: Unable

to contact switch. Called by sapd_hello_cb:4

Nov 22 07:17:58  nanny[732]: <303022> <WARN> |AP d8:c7:c8:c0:c7:c8@10.201.255.25

4 nanny|  Reboot Reason: AP rebooted Fri Dec 31 16:04:19 PST 1999; SAPD: Unable

to contact switch. Called by sapd_hello_cb:4

Nov 22 07:22:43  nanny[732]: <303022> <WARN> |AP d8:c7:c8:c0:c7:c8@10.201.255.25

4 nanny|  Reboot Reason: AP rebooted Fri Dec 31 16:04:19 PST 1999; SAPD: Unable

to contact switch. Called by sapd_hello_cb:4

Nov 22 07:27:28  nanny[732]: <303022> <WARN> |AP d8:c7:c8:c0:c7:c8@10.201.255.25

4 nanny|  Reboot Reason: AP rebooted Fri Dec 31 16:04:19 PST 1999; SAPD: Unable

to contact switch. Called by sapd_hello_cb:4

Nov 22 07:32:13  nanny[732]: <303022> <WARN> |AP d8:c7:c8:c0:c7:c8@10.201.255.25

4 nanny|  Reboot Reason: AP rebooted Fri Dec 31 16:04:19 PST 1999; SAPD: Unable

to contact switch. Called by sapd_hello_cb:4

Here's the reality check question - can APs terminate to a master, or do they have to terminate to a standalone or local? This is a master-local pair but before I got the local configured I just wanted to see if I could get an AP provisioned on the master. I am setting up the local now.

6.1 should be OK.

You can terminate APs on a master, as long as it is not a backup master in a redundant master design.

On the master, do a "show controller-ip".  On the AP, look at the master address.  Do they match?

---

@olino wrote:

 

You can terminate APs on a master, as long as it is not a backup master in a redundant master design.

 

---

Interesting. The controller's IP and the "Master" according to the AP were definitely both the same, but until the local came online the AP wasn't showing up.

Was the LMS IP in the AP system profile already pointing to the local IP (which wasn't up until now)?  If the AP found the master and the master said "go to the LMS IP x" and x doesnt exist, the AP would try to connect to x until it gave up and then reboot.

Well here we go again. :(

AP boots up. Gets IP from DHCP on controller (10.206.255.254/16) ADP runs and it sees 10.206.1.80 as master.

I can ping the AP from the controller and I can ping the controller from the AP.

Control Plane Security is disabled.

Yet the AP reboots every 5 minutes cause it "cannot contact the switch." What else could be keeping this from "contacting the switch" if there's definitely connectivity there?

What ap-group is the ap in?

...

Type  "show ap system-profile default" and see if there is an LMS-ip in there.  That could be where the AP is being redirected.

Let me try to summarize for clarity.  Confirm this for me please.

AP boots up and discovers the master IP.  You have network connectivity since you can ping both AP and master controller.

You added a local controller and the AP came up but it is now bootstraping every five minutes?

As cjoseph asked you need to check the AP System Profile that is being used by the AP Group you have put the AP in.  Examine the LMS and BKLMS IP entries.  The LMS entry is the controller the AP will attempt to talk to after it gets the configuration from the master.  If you haven't put the AP into a group yet it will use the 'default' ap group.

Also in the AP System Profile is a parameter called bootstrap threshold.  The default value is 8.

Look at the firewall datapath for the IP of the AP.  'show datapath session table <AP-IP>'. Any entries?  Try both the master and local controller.  It will age out quickly so try to catch it as the AP contacts the controller.

Are the AP and controllers on the same subnet or different subnets?

Are the physical ports you are using Trusted?

---

dbourque wrote:

 

As cjoseph asked you need to check the AP System Profile that is being used by the AP Group you have put the AP in.  Examine the LMS and BKLMS IP entries.  The LMS entry is the controller the AP will attempt to talk to after it gets the configuration from the master.  If you haven't put the AP into a group yet it will use the 'default' ap group.

 

---

  

Bingo.

 

I actually changed all the IPs of everything but missed the LMS-IP in the default group. It was set to the old IP of the local which explains why it didn't work before until the local was in place.... and of course now as well. Good to go!

 

Thanks for all the help!

 

I think I just answered my own question. Once I got the local online, the AP showed up right away and I was able to provision it. On to the next problem..... :)

Thanks again so much for the assistance on this!

Nice!