topic Re: how to add aerohive ap to a xiq va on-premise? in ExtremeWireless (IQE)

how to add aerohive ap to a xiq va on-premise?

zlinuxboy — Thu, 22 Apr 2021 07:45:56 GMT

hi, community.

I have setup a xiq va on-premise, and config the ap with:

#show run | inc capwap
capwap client server name 172.16.220.250
capwap client server backup name 172.16.220.250
#show capwap client
AH-491600#show capwap client
CAPWAP client:   Enabled
CAPWAP transport mode: UDP
RUN state: Connected securely to the CAPWAP server
CAPWAP client IP:        192.168.9.150
CAPWAP server IP:        172.16.220.250
HiveManager Primary Name:172.16.220.250
HiveManager Backup Name: 172.16.220.250
CAPWAP Default Server Name: redirector.aerohive.com
Virtual HiveManager Name:
Server destination Port: 12222
CAPWAP send event:       Enabled
CAPWAP DTLS state:       Enabled
CAPWAP DTLS negotiation: Enabled
     DTLS next connect status:   Enable
     DTLS always accept bootstrap passphrase: Enabled
     DTLS session status: Connected
     DTLS key type: passphrase
     DTLS session cut interval:     5 seconds
     DTLS handshake wait interval: 60 seconds
     DTLS Max retry count:          3
     DTLS authorize failed:         0
     DTLS reconnect count:          0
Discovery interval:      5 seconds
Heartbeat interval:     30 seconds
Max discovery interval: 10 seconds
Neighbor dead interval:105 seconds
Silent interval:        15 seconds
Wait join interval:     60 seconds
Discovery count:         0
Max discovery count:     3
Retransmit count:        0
Max retransmit count:    2
Primary server tries:    0
Backup server tries:     0
Keepalives lost/sent:    0/969
Event packet drop due to buffer shortage: 0
Event packet drop due to loss connection: 3

here are my question:

does this ap successfully form a dtls with xiq va?
why the ap is still offline on the xiq va manage > device page?
is there any tutorial about how to add ap to xiq va on-premise?

Re: how to add aerohive ap to a xiq va on-premise?

SamPirok — Thu, 22 Apr 2021 21:44:50 GMT

Hello, thank you for sharing that data. To answer your questions:

Does this ap successfully form a dtls with xiq va?

Yes, it looks like the AP thinks it successfully connected to your on premises XIQ instance, based on the run state seen in the data you shared:
- RUN state: Connected securely to the CAPWAP server

Why the ap is still offline on the xiq va manage > device page?

It could be a few different things, if you could enable some CAPWAP debugs, cycle CAPWAP, wait for the AP to attempt to connect a few times (5-10 minutes), and then pull tech data, I could take a look at the tech data for you to see if we can find any clues in there.
- This guide reviews how to enable CAPWAP debugs: https://extremeportal.force.com/ExtrArticleDetail?an=000057308&q=CAPWAP%20DEBUG
- To cycle CAPWAP, run these two commands in this order:
  - no capwap client enable
  - capwap client enable
- This guide reviews how to get tech data: https://extremeportal.force.com/ExtrArticleDetail?an=000081084&q=Tech%20dat
- If you can email that to me at community@extremenetworks.com, I can review it for you and let you know what I find.

Is there any tutorial about how to add ap to xiq va on-premise?

This guide reviews how to add and remove devices, the process is the same for online instances and on premises/virtual appliance instances: https://extremeportal.force.com/ExtrArticleDetail?an=000056853&q=adding%20and%20removing%20devices%20in%20extremecloud%20iq

Re: how to add aerohive ap to a xiq va on-premise?

zlinuxboy — Thu, 22 Apr 2021 22:58:02 GMT

hi @Sam Pirok

I have send the tech data to community@extremenetworks.com, please check if you could received it.

Re: how to add aerohive ap to a xiq va on-premise?

SamPirok — Thu, 22 Apr 2021 23:49:43 GMT

Thank you for sending that to me, and for letting me know, it was in my junk mail folder for some reason (also found your previous email that we had discussed, very sorry about that). I reviewed the tech data, thank you for enabling those debugs. I’m seeing a lot of echo time outs, which would explain why the AP is not connecting to your XIQ instance, even though the CLI says it has connected.

ExtremeCloud IQ (XIQ) and the APs have a call and response check-in system that allows them to confirm that each side of the connection is still responsive; these call and response packets are called echos. There is a specific time window within which an AP would need to respond to an echo to be considered still responsive. If the AP misses a certain number of echos back to back, it is considered disconnected until it responds again. If an AP is still connected to the internet and passing traffic while missing echos, it's likely due to latency on the network; the AP is unable to process the echo request quickly enough due to the amount of traffic it has to process before responding. You can see what I’m seeing if you search your tech data file for “echo” or “timed out”, look for these messages: ah_capwap_echo_timer timed out

Since the AP isn’t passing client traffic yet, the latency would likely be on your backend network between the AP and XIQ. I’d be interested to see a packet capture to take a look at the traffic the AP is seeing currently.

Re: how to add aerohive ap to a xiq va on-premise?

zlinuxboy — Fri, 23 Apr 2021 06:30:22 GMT

@Sam Pirok

here is the tcpdump data:

tcpdump -nvi wg0 port 12222

tcpdump: listening on wg0, link-type RAW (Raw IP), capture size 262144 bytes
07:18:53.751931 IP (tos 0x0, ttl 63, id 51753, offset 0, flags [none], proto UDP (17), length 125)
    172.16.230.5.49674 > 172.16.220.250.12222: LWAPP version 1 packet not supported
07:18:53.753092 IP (tos 0x0, ttl 63, id 32414, offset 0, flags [DF], proto UDP (17), length 141)
    172.16.220.250.12222 > 172.16.230.5.49674: LWAPP version 1 packet not supported
07:19:23.907938 IP (tos 0x0, ttl 63, id 8224, offset 0, flags [none], proto UDP (17), length 125)
    172.16.230.5.49674 > 172.16.220.250.12222: LWAPP version 1 packet not supported
07:19:23.909260 IP (tos 0x0, ttl 63, id 59164, offset 0, flags [DF], proto UDP (17), length 141)
    172.16.220.250.12222 > 172.16.230.5.49674: LWAPP version 1 packet not supported

my network environment is a little complicated.

ap-->vpn node(wireguard-client)-→ dsl gateway -→ Internet-→ server (wireguard-server) --→ bridge-→ xiq va

the wireguard-client and wireguard-server form a secure vpn tunnel.

xiq va vm(172.16.220.250)’s nic is a member to the bridge logic nic(172.16.220.254)

ap’s ip is 192.168.9.150, vpn node’s ip is 192.168.9.200,I add some static route on ap:

ip route net 172.16.220.0 255.255.255.0 gateway 192.168.9.200
ip route net 172.16.230.0 255.255.255.0 gateway 192.168.9.200

when the traffice from ap to visit xiq va, the src ip of ap will be masq to 172.16.230.5

wireguard-server’s ip is 172.16.230.1

wireguard-client’s ip is 172.16.230.5

any hints?

Re: how to add aerohive ap to a xiq va on-premise?

SamPirok — Thu, 29 Apr 2021 21:48:05 GMT

Hi there, thank you for your patience. I haven’t been able to find anything in those logs and the engineers I’ve asked requested that we open a case for this. Would you be able to open a support case for this question?

Re: how to add aerohive ap to a xiq va on-premise?

zlinuxboy — Fri, 30 Apr 2021 06:28:28 GMT

yes, of cos, but how to open a support case?

Re: how to add aerohive ap to a xiq va on-premise?

SamPirok — Fri, 30 Apr 2021 21:43:39 GMT

You would want to log in to extremeportal.force.com and then go to Support to open a case. If you don’t have a current support contract with us, I can get you in touch with a local SE in your area to see about getting you a support contract, either as a one time deal or longer term. If you need to speak with an SE, please let me know generally where you are located so I can find someone in your area.