Cisco 1131 to 2106 Wireless Controller Registration Issue

Cisco 1131 Access Points Failing to Register to 2106 Wireless Controller

Issue:

Two of four 1131 APs not registering to WLC 2106 after replacing legacy switches with new 3650 switching

Troubleshooting:

Power cycling of APs, by unplugging from network and by cycling POE on the switchport, still failing to register.
Confirmed switchport configurations were correct for an AP and matched the configurations on the decommissioned switches.
Debugging of CAPWAP from the WLC showed the APs were attempting to join the WLC but the connections were being closed by the controller due to DTLS errors
debug capwap events enable
debug capwap detail enable
debug capwap error enable

"Discarding non-ClientHello Handshake OR DTLS encrypted packet from 10.43.98.98:55643) since DTLS session is not established "

Because of the DTLS errors, started looking at certificate issues. Debugging certificates showed the APs installed certificate expired April 2016
debug pm pki enable

"sshpmGetIssuerHandles: Current time outside AP cert validity interval: make sure the controller time is set"

AP certificates installed from factory are valid for 10 years. We can check the manufacture year by looking at the serial number of the AP. The first two numbers correspond to the manufacturing year:

First two numbers of this serial are 10, placing the manufacture date in 2006, which corresponds with the validity of the cert we see above (2006/4/15 to 2016/4/15).
Checking an AP which was working shows it was manufactured in 2007, so its certificate was still valid (11 = 2007)

Based on this info, it appears that replacing the switching was the first time the APs have attempted to re-register to the WLC after their certificates expired in April 2016. The old switches and the WLC all had uptimes of over 1year, so they haven’t had to re-register recently. Following the switch upgrades, the APs manufactured in 2007 registered without issue, but the two APs built in 2006 could not reconnect.

Solution/Workaround:

The permanent solution would be upgrading the WLC and AP code versions, 7.0.98 is from 2011, but this requires a current Smartnet contract. The WLC 2106 was also announced end-of-life in 2011, so it’s currently out of support as of 2013. As a workaround, I changed the system time on the WLC to April 10 2016, and confirmed the APs were able to register correctly. This is not a permanent solution, as the time will need to be constantly set back to prevent future issues.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>