Wireless Access

I have an AP125 which is appearing in my controller as being down for a period of about 5 minutes, for every minute. When I look at the device physically, the Pwr LED is constantly flashing green. I went ahead and reset it back to factory defaults but the condition hasn't changed. I'm feeling that this AP has gone bad on me, just looking for another opinion. Here are my results when consoled into the AP125 direct:

 

 

<<<<<       Welcome to the Access Point     >>>>>

 

The system is going down NOW !!

Sending SIGTERM to all processes.

Please stand by while rebooting the system.

Restarting system.

.

 

 

APBoot 1.0.8.3 (build 20343)

Built: 2008-12-27 at 17:03:46

 

Model: AP-12x

CPU:   OCTEON CN50XX-SCP revision: 1

Clock: 500 MHz, DDR clock: 333 MHz (666 Mhz data rate)

Power: POE

POST1: passed

POST2: passed

DRAM:  64 MB

Flash: 16 MB

Clear: done

BIST:  passed

PCI:   PCI 32-bit; scanning bus 0 ...

       dev fn venID devID class  rev    MBAR0    MBAR1    MBAR2    MBA

R3

       03  00  168c  ff1d 00002   01 80000000 00000000 00000000 000000

00

       04  00  168c  ff1d 00002   01 80010000 00000000 00000000 000000

00

Net:   en0, en1

Radio: ar9160#0, ar9160#1

 

Hit <Enter> to stop autoboot:  0

Checking image @ 0xbed00000

 

Image is signed; verifying checksum... passed

Signer Cert OK

Policy Cert OK

RSA signature verified.

ELF file is 64 bit

Allocated memory for ELF segment: addr: 0xe00000, size 0x4e4400

Loading .MIPS.options @ 0x80e00000 (0xa0 bytes)

Loading .text @ 0x80e000a0 (0x4e4318 bytes)

Loading .data @ 0x812e43c0 (0x20 bytes)

Clearing .bss @ 0x812e43e0 (0x20 bytes)

## Loading OS kernel with entry point: 0x80e000a0 ...

Bootloader: Done loading app on coremask: 0x1

Uncompressing...

 

Aruba Networks

ArubaOS Version 6.4.2.8 (build 50314 / label #50314)

Built by p4build@formentera.arubanetworks.com on 2015-06-03 at 10:31:3

1 PDT (gcc version 4.3.3)

CVMSEG size: 2 cache lines (256 bytes)

Setting flash physical map for 16MB flash at 0x1ec00000

Determined physical RAM map:

Primary instruction cache 32kB, virtually tagged, 4 way, 64 sets, line

size 128 bytes.

Primary data cache 16kB, 64-way, 2 sets, linesize 128 bytes.

Using 500.000 MHz high precision timer. cycles_per_jiffy=1000000

Memory: 54528k/65536k available (2134k kernel code, 11000k reserved, 9

81k data, 4232k init, 0k highmem)

Calibrating delay using timer specific routine.. 1000.30 BogoMIPS (lpj

=1000309)

available.

Checking for the multiply/shift bug... no.

Checking for the daddi bug... no.

Checking for the daddiu bug... no.

detected lzma initramfs

initramfs: LZMA lc=3,lp=0,pb=2,dictSize=8388608,origSize=23404544

LZMA initramfs by Ming-Ching Tiew <mctiew@yahoo.com> .................

......................................................................

......................................................................

......................................................................

......................................................................

.............................................................

PCI Status: PCI 32-bit

slot 3, pin 1, dev_num 3, irq A

PCI dev  3.0 slot  3 pin 1: 168c:ff1d using irq 44

slot 4, pin 1, dev_num 4, irq B

PCI dev  4.0 slot  4 pin 1: 168c:ff1d using irq 45

/proc/octeon_perf: Octeon performace counter interface loaded

hw_random hardware driver 1.0.0 loaded

wdt: registered with refresh

Enabling Watchdog

isa bounce pool size: 16 pages

physmap flash device: 1000000 at 1ec00000

phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank

Amd/Fujitsu Extended Query Table at 0x0040

phys_mapped_flash: CFI does not contain boot bank location. Assuming t

op.

number of CFI chips: 1

Parsing the partition  info

i2c /dev entries driver

i2c-palomino: using default base 0x8001070000000000

: Found DS1374 on octeon twsi

AD7416 driver probing for devices on Palomino TPM0

.AD7416 driver probing for devices on octeon twsi

.FOUND AD7416 at address: 48

Found AD7416 on bus octeon twsi.

lo: Disabled Privacy Extensions

IPv6 over IPv4 tunneling driver

 

Starting HW SHA1 KAT ...Completed HW SHA1 KAT

Starting HW HMAC-SHA1 KAT ...Completed HW HMAC-SHA1 KAT

Starting HW DES KAT ... Completed HW TRIPLE DES KAT

Starting HW AES KAT ... Completed HW AES KAT

 

Starting Kernel AESGCM KAT ...Completed Kernel AESGCM KAT

 

Domain Name: arubanetworks.com

 

No panic info available

cavium_ethernet: module license 'Proprietary' taints kernel.

Octeon ethernet driver version: 1.5.0, build 187 Jun  3 2015 10:31:01

        Interface 0 is RGMII

eth0:   1Gbs Full duplex, port  1, queue  1

Ethernet port 1 mode: active-standbyEthernet Channel Bonding Driver: v

3.0.1 (January 9, 2006)

 

ADDRCONF(NETDEV_UP): eth0: link is not ready

ADDRCONF(NETDEV_UP): eth0: link is not ready

bonding: bond0: enslaving eth0 as a backup interface with a down link.

ADDRCONF(NETDEV_UP): eth1: link is not ready

bonding: bond0: enslaving eth1 as a backup interface with a down link.

AP xml model 24, num_radios 2 (jiffies 2928)

init_asap_mod: installation:0

radio 0: band 1 ant 0 max_ssid 16

radio 1: band 0 ant 0 max_ssid 16

ethernet_device_event: dev eth0 is up

ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

bonding: bond0: link status definitely up for interface eth0.

bonding: bond0: making interface eth0 the new active one.

Starting watchdog process...

Getting an IP address...

172.16.152.109 255.255.192.0 172.16.128.1

Running ADP...Done. Master is 192.168.128.2

ath_hal: 0.9.17.1 (AR5416, REGOPS_FUNC, PRIVATE_DIAG, WRITE_EEPROM, 11

D)

ath_rate_atheros: Copyright (c) 2001-2005 Atheros Communications, Inc,

All Rights Reserved

ath_rate_atheros: Aruba Networks Rate Control Algorithm

ath_dfs: Version 2.0.0

Copyright (c) 2005-2006 Atheros Communications, Inc. All Rights Reserv

ed

ath_dev: Copyright (c) 2001-2007 Atheros Communications, Inc, All Righ

ts Reserved

ath_pci: 0.9.4.5 (Atheros/multi-bss)

ath_attach: scn a800000003a60400 sc a800000002b60000 ah a800000002a800

00

wifi0: Base BSSID d8:c7:c8:b7:37:70, 16 available BSSID(s)

eth0 address=d8:c7:c8:c3:73:76

br0 address=d8:c7:c8:c3:73:76

wifi0: AP type AP-125, radio 0, max_bssids 16

wifi0: Atheros 9160: mem=0x11b00f0000000, irq=44 hw_base=0x90011b00f00

00000

ath_attach: scn a800000001b20400 sc a800000001b40000 ah a800000001b800

00

wifi1: Base BSSID d8:c7:c8:b7:37:60, 16 available BSSID(s)

eth0 address=d8:c7:c8:c3:73:76

br0 address=d8:c7:c8:c3:73:76

wifi1: AP type AP-125, radio 1, max_bssids 16

wifi1: Atheros 9160: mem=0x11b00f0010000, irq=45 hw_base=0x90011b00f00

10000

ath_ahb: 0.9.4.5 (Atheros/multi-bss)

ath_ahb: No devices found, driver not installed.

 

Starting FIPS KAT ... Failed FIPS KAT.

Using saved lms 192.168.128.2 as the master directly

AP rebooted Thu Apr 14 11:03:00 EST 2016; SAPD: Rebooting after settin

g cert_cap=1. Need to open a secure channel(IPSEC)

shutting down watchdog process (nanny will restart it)...

 

        <<<<<       Welcome to the Access Point     >>>>>

 

~ #

Looks like you have cpsec enabled.

1) is the AP either white listed or do you have auto cert provisioning enabled?
2) is UDP 4500 open between the AP and controller?

I found the AP in the whiteliest but it is listed as "certified-hold-factory-cert". I modify the state to "certified-factory-cert", reboot the AP and then I stil lhave the same condition and the state reports as "certified-hold-factory-cert" again. Got a direction to point me in?

 

UDP 4500 is open, we have 100 other AP125s with no issue.

 

 

Thanks for the help!

This is what the user guide says - "certified-hold-factory-cert: An AP is put in this state when the controller thinks the AP has been certified with a factory certificate yet the AP requests to be certified again. Since this is not a normal condition, the AP will not be approved as a secure AP until a network administrator manually changes the status of the AP to verify that it is not compromised."

 

I would open a TAC case to make sure that AP does not have a hardware issue.  You could always turn of CPSEC during a maintenence window to see if it will work in that state, if your deployment does not require CPSEC.

 

Worked with Aruba Support, they are RMAing the unit.

 

Thank you.

It seems you have control plane security enabled. Do you have that AP in the whitelist?