topic Re: RFS4000 and AP6532 adopt issue in ExtremeWireless (WiNG)

RFS4000 and AP6532 adopt issue

kamelek — Fri, 18 Jan 2019 01:16:38 GMT

Hello, guys.
I have a problem with menage AP6532 from RFS4000,

I adopt it but when I change config on configuration profile for it (AP6532) and commit, the configuration is send to AP6532 but for a moment and then came back to old config.

I had AP6532 in standlone config now whe I bought RFS i want to configure it from controller, but the issu is weard.

Could you help me?

Frimware is 5.8.6.5-002R

Re: RFS4000 and AP6532 adopt issue

RobertZ — Fri, 18 Jan 2019 01:22:34 GMT

There is most likely a configuration error: Can you check with CLI command:

sh adoption config-errors on AP6532

Re: RFS4000 and AP6532 adopt issue

Christoph_S — Fri, 18 Jan 2019 01:25:58 GMT

Check to make sure that the same settings are not configured as overrides. If they are, then they will always revert back to the overrides.

Re: RFS4000 and AP6532 adopt issue

ckelly — Fri, 18 Jan 2019 01:52:43 GMT

kamelek, What could be happening here is that the configuration changes that you are making on the controller contain something that causes the 6532 to lose its ability to stay connected to the controller.

In this case, after the AP receives the changes that are pushed out from the controller, it implements them. If one of the changes then breaks the APs ability to stay connected to the controller, the AP will try several times to re-connect, but once it realizes that it can't, it will automatically revert back to the last known configuration that allowed it to connect to the controller (AP will also reboot). This could possibly be why you see the AP receive its changes...and then lose them.

Secondly, regarding the 'overrides' - The AP profile is the master configuration for the AP. The device level configuration is where you make configuration changes that DEVIATE from the master AP Profile. This is where you would make changes for things like static IP addresses or hostnames....values that you don't want to be duplicated to EVERY AP, right?
What might be happening is that you make a change to the AP Profile but then the AP has an override setting on the controller that 'overrides' the Profile setting.
This would NOT explain though if you are seeing the changes briefly on the AP but then they go away. But, this topic *is* extremely important to understand from a controller management perspective.

Re: RFS4000 and AP6532 adopt issue

kamelek — Fri, 18 Jan 2019 02:01:33 GMT

Hello, thanks Robert for replay, there *** no configuration errors.

I clear overides on AP6532 leave only IP, but the issu is the same.

After mommit new profile it is load to AP6532 , AP6532 lost connect to RFS and after while came backe to old connfig

Maybey config on AP6532 is wrong.

DO you think the best way is to reset config to zero?

I do not want this becouse I have another 4 AP6532 to add to conntroller

code:

!
! Configuration of AP6532 version 5.8.6.5-002R
!
!
version 2.5
!
!
ip access-list BROADCAST-MULTICAST-CONTROL
 permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
 permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
 deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
 deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
 deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
 permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list PERMIT-ARP-AND-IPv4
 permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
 permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
 permit any
!
firewall-policy default
 no ip dos tcp-sequence-past-window
 no stateful-packet-inspection-l2
!
!
mint-policy global-default
!
meshpoint-qos-policy default
!
wlan-qos-policy default
 qos trust dscp
 qos trust wmm
!
radio-qos-policy default
!
aaa-policy internal-aaa
 authentication server 1 host 10.0.2.21 secret 0 *******
!
captive-portal gosc
 access-type no-auth
 webpage internal registration field city type text enable label "City" placeholder "Enter City"
 webpage internal registration field street type text enable label "Address" placeholder "123 Any Street"
 webpage internal registration field name type text enable label "Full Name" placeholder "Enter First Name, Last Name"
 webpage internal registration field zip type number enable label "Zip" placeholder "Zip"
 webpage internal registration field via-sms type checkbox enable title "SMS Preferred"
 webpage internal registration field mobile type number enable label "Mobile" placeholder "Mobile Number with Country code"
 webpage internal registration field age-range type dropdown-menu enable label "Age Range" title "Age Range"
 webpage internal registration field email type e-address enable mandatory label "Email" placeholder "you@domain.com"
 webpage internal registration field via-email type checkbox enable title "Email Preferred"
!
wlan xxxx_Internet
 ssid xxxx_Internet
 vlan 6
 bridging-mode local
 encryption-type none
 authentication-type none
 use captive-portal gosc
!
wlan xxxx_test
 ssid xxxx_test
 vlan 1
 bridging-mode local
 encryption-type ccmp
 authentication-type none
 wpa-wpa2 psk 0 **********
!
wips-policy default
!
radius-group upwifi
 policy vlan 1
 policy ssid XXXXXXXXXX
!
radius-server-policy default
 authentication data-source ldap 
 ldap-agent primary domain-name xxxxxxx domain-admin-user ISC domain-admin-password 0 *************
 use radius-group upwifi
!
!
management-policy default
 no telnet
 no http server
 https server
 ssh
 user admin password 1 ********************************************* role superuser access all
 snmp-server community 0 public ro
 snmp-server user snmptrap v3 encrypted des auth md5 0 motorola
 snmp-server user snmpmanager v3 encrypted des auth md5 0 motorola
!
event-system-policy default
!
l2tpv3 policy default
!
profile ap6532 default-ap6532
 ip name-server 10.0.1.50
 ip name-server 10.0.1.51
 ip domain-name unionparts
 ip default-gateway 10.0.2.1
 autoinstall configuration
 autoinstall firmware
 use radius-server-policy default
 no load-balancing neighbor-selection-strategy use-common-clients
 no load-balancing neighbor-selection-strategy use-roam-notification
 no load-balancing neighbor-selection-strategy use-smart-rf
 crypto ikev1 policy ikev1-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ikev2 policy ikev2-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan xxxx_Internet bss 2 primary
  wlan xxxx_test bss 3 primary
 interface radio2
 interface ge1
  switchport mode trunk
  switchport trunk native vlan 1
  no switchport trunk native tagged
  switchport trunk allowed vlan 1-10
 interface vlan1
  ip address dhcp
  ip address zeroconf secondary
  ip dhcp client request options all
 interface pppoe1
 use firewall-policy default
 rf-domain-manager capable
 ip dns-server-forward
 controller host 10.0.1.2 pool 1 level 1
 service pm sys-restart
!
rf-domain default
 location Xxxx_Xxxx
 contact admin@xxxxxx.pl
 timezone Europe/Warsaw
 country-code pl
!
ap6532 B4-C7-99-23-81-8C
 use profile default-ap6532
 use rf-domain default
 hostname ap6532-23818C
 mint mlcp ip
 ip default-gateway 10.0.2.1
 interface ge1
  switchport mode trunk
  switchport trunk native vlan 1
  no switchport trunk native tagged
  switchport trunk allowed vlan 1-10
 interface vlan1
  ip address 10.0.2.23/24
  ip address zeroconf secondary
!
!
end

Re: RFS4000 and AP6532 adopt issue

ckelly — Fri, 18 Jan 2019 02:09:20 GMT

I see a controller address in the main profile of 10.0.1.2. Is this correct?

I also see that the AP has a static IP address setup (10.0.2.23) and a default gateway of 10.0.2.1.

In this case, the AP is not on the same subnet as the controller (if the controller really is at 10.0.2.1).
Is this a routed connection between the AP and controller?

Re: RFS4000 and AP6532 adopt issue

kamelek — Fri, 18 Jan 2019 02:22:00 GMT

Hello Cris, yes, contorler adress is 10.0.1.2, AP is 10.0.2.23 with gw 10.0.2.1
It is routed connection beetwen AP and controller.

I also have AP6521 with 10.0.99.0 subnet and everthing is ok for it.

Re: RFS4000 and AP6532 adopt issue

ckelly — Fri, 18 Jan 2019 02:29:06 GMT

Is the configuration that you posted here directly from the AP? (SSH'd into the AP or console connection)? If yes, does this config STAY on the AP (not changes) ?

If yes, then is the configuration what you expect to see if the controller pushed out the config for the AP? If yes, then that would indicate that the AP received its configuration and is NOT reverting back (which would mean that it should still be adopted)

Can you run the command on the AP's CLI?
#show adoption status

Re: RFS4000 and AP6532 adopt issue

kamelek — Fri, 18 Jan 2019 03:38:07 GMT

Chris thnak you, this help me.
Overides for AP6532 from controller was wrong and after send config to AP it lost connection with AP.
Shool mistake 🙂

Thanks for yours help all guys. Esspecialy You Chris 