Wireless Access

I have four 7210 controllers - 2 are less than a year old - these two have no problem connecting to MM. MM localip configured as 0.0.0.0.

MM localip 0.0.0.0

masterip: 172.22.2.20 - VRRP

MM-0 ip:172.22.2.100

MM-1 ip 172.22.2.101 . vlan1

7210 ip 172.22.5.15 .  VLAN5

The other 7210s are five-years old. Configured as Master/Local - upgraded just the local from 6.5.4.10 - to 8.x . Cannot connect to MM VRRP or MM static addresses. I tried many 8.x versions. 

From the 7210, I can ping the masterip gateway MM-0 and 1. Regardles of the masterip value, I cannot ping. I moved these three addresses, 172.22.2.0/24 around with one another. I can ping them all, provided it's not the masterip.

I tried PSKwithIP and PSKwithMAC

I also tried with the controller ip on the same subnet as the masterip.

I recreated the localip 0.0.0.0. I also created a localip specific to the controller.

Using 'show datapath session' on the controller, I do see the controller attempting to connect on port 8211. "show crypto ipsec sa" is empty.

"show ip route" displays the masterip: C 172.22.2.20/32 is an ipsec map default-local-master-ipsecmap

Has anyone seen this behavior?

TIA

Greg Crockett

To connect a controller to an MM, you need to do a "write erase all" and connect it to the MM using the startup dialog.  You cannot just execute "masterip".

I did 'write erase'. Plus, I used the following from /mm/mynode with 'disaster-recovery on':

masterip 172.22.2.20 IPSec xxxxxxxx interface VLAN x.

the controller will reboot automatically.

If you have not already, please contact TAC.  It is hard to say from here what could be wrong.  You could have a bug.

Thanks. Just opened TAC.

The contents set in mm / mynode are as follows
localip 0.0.0.0 ipsec ******
Register md group below md
In md, md will automatically reboot when set as below.
masterip 10.10.30.xx ipsec ****** interface vlan 30
If you set up local-master interworking, it will not ping until interworking is completed.
If it does not work, you may need to reset md after initialization.

I ran into a similar issue while lab testing a 7010 upgraded from 6.x to 8.4. 

I initially just "wr erase" the 7010 and configured through the full-setup wizard. I configured the controller from MM and added the 7010 as a managed device. After initially joining the MM the controller kept losing conectivity, stayed in CONFIG ROLLBACK state, lost connectivity and kept rebooting after a few minutes up. I then did a "wr erase all" and started the process again. Problem fixed.

Thanks for your help!

The fix: do not mix firmware. I had FIPS on the MM and non-FIPS on controller.

all is fine.

greg