C5210 HA pair , AP's disassociate from one controller and randomly reattach to the backup wireless controller

[Rod_Robertson2]

C5210 We have recently upgraded to 09.21.11.0004 code which we hoped would resolve this issue.

This system has nearly 1000 AP spread across the two controllers.
We are seeing AP's swap from their primary controller to the back up . this is totally random and unpredictable ( so ,so far no packet capture to sniff ) ( 180/500 swap)

We have been advise so far to increase the poll timers, for the AP's. ( WASSP/CAPWAP ) AP >Global Settings> AP Registration > discovery timers

There does not seem to be any underling networking issues ,as we have no other reported issues or concerns.

Is there a known issue ?
Has anybody else seen this issue and how was it resolved.
Can I priorities the WASSP traffic through the network ( DSCP? )

Regards

[Rod_Robertson2]

Hi

Our timers were set to default, We had been advised by GTAC to extend the timer to 60 , we have done this for a group of AP's and are now waiting to see what happens.

[Rod_Robertson2]

We are using bridge at EWC( B@EWC ) for all AP's ,( Approx 1000 ) I have a meeting next week , with the customer ,to come up with a plan of how we are going to try and resolve the issue..

[Rod_Robertson2]

Thanks for the reply , Im not sure that my customer will accept that as a " solution" a work round yes ..

I have been looking at changing the AP timers , is there a difference between verion 9 and 10 ?

Also looking at an ACL policy to put the UDP AP WASSP traffic into QP8..

I will talk to my customer about removing the " fast failover option.

[Rod_Robertson2]

Hi

We are on version 09.21 are the various timers different in version 10.

[Ronald_Dvorak]

To enable legacy failover just remove the checkmark for fast failover.

Legacy failover is slower as the AP doesn't has a tunnel to the 2nd controller already established - slow means that you'd loose 1-2 pings during failover... in my experience.

The difference is that legacy failover has two requirements that MUST be fulfilled to allow the AP to authenticate/switch to the second controller.
1) the AP lose connection to the home controller
2) the controllers lose the connection to each other (=availability tunnel down)

Let's talk about the case in which you don't use legacy failiover.
If the APs connect via i.e. ESA0 and the availbility tunnel is configured on i.e. ESA1.
If ESA0 is down (i.e. broken cable) on the home controller the AP is not longer able to communicate with the controller but as ESA1 is still up (=availability tunnel is still up) the AP is not allowed to authenticate/switch to the second controller.

It's very important if you use legacy failover to use the same interface for AP registration also for the availabilty tunnel configuration.
In a "normal" setup with both controller in the same room and are setup for the same subnets that shouldn't be a problem and you are able to use legacy failover.

So the one thing that you need to make sure in the network design is that there is no such case where the AP is not able to reach the AP registration interface but the controllers could reach each other via the availabilty interface.