WM3600 - AP2600 - Configure Error with seperate WLAN between AP and controller

[Andre_h_]

Hello,

we have a VM3600 controller with Motorola AP-650 (4610-EU) in use. One AP must be operated in a different WLAN than the controller. At first, the controller was not found from AP. With the command "controller host" the IP of the controller was entered. Now the AP is displayed in the controller as online. Unfortunately, it does not emit any WLANs and in the "Apopted Devices" the "Config Status" displays error. If I put the AP in the same VLAN as the controller everything works fine. I hope you can help me.Thanks a lot for this!!

Andre

[ckelly]

So let’s break this down…

At first, the controller was not found from AP. With the command "controller host" the IP of the controller was entered. Once the AP was told the layer-3 location of the controller, it was able to find it. 

Based on this statement, the AP was NOT able to discover the controller using layer-2 discovery (VLAN). 

After you entered the controller host entry address of the controller and it was then able to find it, that indicates that there’s a VLAN configuration issue [somewhere].  Ideally though, for performance and scaling reasons, you do want to configure the APs for layer-3 adoption, so I would suggest using the controller host <controller address> configuration as standard.

Now the AP is displayed in the controller as online. Unfortunately, it does not emit any WLANs and in the "Adopted Devices" the "Config Status" displays error. If I put the AP in the same VLAN as the controller everything works fine.

What’s happening here is that once the AP was able to find the controller after you entered the controller host entry, the controller most likely then attempted to push a configuration to the AP that is not correct.  This is preventing the AP from receiving its profile.

So next, let’s find out if the “HOF” AP is still actually adopted right now and go from there.

SSH into the “HOF” AP and log in.  Run the commands:

• show adoption status  (post the output)
• show mint links (post the output)
• show ip interface brief (post the output)
• show mint mlcp history (post the output)
• show adoption config-errors HOF (post the output)

Somewhere, there’s an issue in the config that is causing the AP to not receive the profile from the controller.  This is why you are not seeing the SSIDs.  If you look at the running-config on the AP, I’m assuming that the config will look nothing like what you have setup on the controller for the AP.

[Andre_h_]

The AP with the problems is Hostname HOF with Profile AP4600_Hof. He is attached to VLAN TAG 20 and reaches the controller (controller shows online). But says error and no wifi emitting.

The other error probably happened to me when I generalized the config for the forum. But now has nothing to do with the actual problem.

Do you have a solution?

[ckelly]

Which AP in this config file is the one behaving as you described? (There are 2 listed)

1. hostname: AP-xx-xx
2. HOF

Looking at the #1 AP’s override value, I see an issue:

ap4600 00-xx-xx-xx-xx-xx

 use profile "R Lau"

 use rf-domain "S Lau"

 hostname AP-xx-xx

I don’t see an actual ap4600 profile name “R Lau” anywhere in the config that you posted.   There is one called “R”, but the name must match exactly for the AP to be assigned the profile.

Is this the AP that is having the issue you described?

[Andre_h_]

Thank you - here ist the config.

The AP in secound vlan is ap4600 00-04-xx-xx-xx- with profile ap4600_Hof.

!
! Configuration of WM3600 version 5.5.5.0-018R
!
!
version 2.3
!
!
ip access-list BROADCAST-MULTICAST-CONTROL
permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit D                                                                                                                                                             HCP replies"
deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-descriptio                                                                                                                                                             n "deny windows netbios"
deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP l                                                                                                                                                             ocal broadcast"
permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list MAC-FILTER-INTERN
permit host xxxxxx any rule-precedence 29 rule-description Tablet
deny any any rule-precedence 1060
!
mac access-list PERMIT-ARP-AND-IPv4
permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
permit any
!
firewall-policy default
no ip dos tcp-sequence-past-window
alg sip
!
!
mint-policy global-default
!
wlan-qos-policy bib-voice
voice-prioritization
qos trust dscp
qos trust wmm
!
wlan-qos-policy default
qos trust dscp
qos trust wmm
!
radio-qos-policy default
!
association-acl-policy Intern_Zugriff
deny 00-00-00-00-00-00 FF-FF-FF-FF-FF-FF precedence 3
!
wlan Hof
ssid Hof
vlan 252
bridging-mode tunnel
encryption-type ccmp
authentication-type none
wpa-wpa2 psk 0 xxxxxx
!
wlan B-Inet
description Freies WLAN fuer Besucher
ssid B-Inet
vlan x
bridging-mode tunnel
encryption-type none
authentication-type none
no client-client-communication
!
wlan B-Voice
description WLAN T
ssid B-Voice
vlan 11
bridging-mode local
encryption-type ccmp
authentication-type none
no broadcast-ssid
no answer-broadcast-probes
wpa-wpa2 psk 0 
 wpa-wpa2 exclude-wpa2-tkip
use wlan-qos-policy bib-voice
!
wlan M-Intern
description Internes WLAN
ssid M-Intern
vlan 1
bridging-mode local
encryption-type ccmp
authentication-type none
no broadcast-ssid
no answer-broadcast-probes
wpa-wpa2 psk 0 
 wpa-wpa2 exclude-wpa2-tkip
use mac-access-list in MAC-FILTER-INTERN
!
wlan S-Inet
description WLAN fuer freies Internet
ssid S-Inet
vlan 255
bridging-mode tunnel
encryption-type ccmp
authentication-type none
no broadcast-ssid
wpa-wpa2 psk 0 
!
wlan S-Hotspot
description Hotspot
ssid S-Hotspot
vlan 301
bridging-mode tunnel
encryption-type none
authentication-type none
!
wlan b-gastnetz
description Netz fuer Veranstaltungen
shutdown
ssid B-Inet
vlan 255
bridging-mode tunnel
encryption-type ccmp
authentication-type none
wpa-wpa2 psk 0 

smart-rf-policy "S Lau"
group-by area
assignable-power 2.4GHz min 14
!
auto-provisioning-policy "S Lau"
!
!
management-policy default
no http server
https server
ssh
user admin password 1 xxx role superuser access all
snmp-server community 0 private rw
snmp-server community 0 public ro
snmp-server user snmpoperator v3 encrypted des auth md5 0 operator
snmp-server user snmptrap v3 encrypted des auth md5 0 admin123
snmp-server user snmpmanager v3 encrypted des auth md5 0 admin123
banner motd Welcome to CLI
!
profile wm3600 default-wm3600
ip name-server xxx
ip name-server xxx
ip domain-name xxx
ip default-gateway xxx
autoinstall configuration
autoinstall firmware
crypto ikev1 policy ikev1-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ikev2 policy ikev2-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
crypto ikev1 remote-vpn
crypto ikev2 remote-vpn
crypto auto-ipsec-secure
crypto remote-vpn-client
interface me1
interface up1
 switchport mode trunk
  switchport trunk native vlan 2
  no switchport trunk native tagged
  switchport trunk allowed vlan 2,6,252,255,301
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface ge1
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface ge2
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface ge3
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface ge4
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface ge5
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface ge6
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface ge7
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface ge8
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface vlan2
  description LAN
 ip address 10.216.x.x/24
interface vlan6
  description b-inet
interface vlan252
  description Hof
interface vlan255
  description s-inet
interface vlan301
  description Hotspot
interface wwan1
interface pppoe1
use firewall-policy default
use auto-provisioning-policy "S Lau"
ntp server 10.216.x.x
no ip routing
service pm sys-restart
router ospf
!
profile ap4700 default-ap4700
autoinstall configuration
autoinstall firmware
crypto ikev1 policy ikev1-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ikev2 policy ikev2-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
crypto ikev1 remote-vpn
crypto ikev2 remote-vpn
crypto auto-ipsec-secure
crypto remote-vpn-client
interface radio1
interface radio2
interface radio3
interface ge1
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface ge2
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface vlan1
  ip address dhcp
  ip address zeroconf secondary
  ip dhcp client request options all
interface wwan1
interface pppoe1
use firewall-policy default
logging on
service pm sys-restart
router ospf
!
profile ap4532 default-ap4532
autoinstall configuration
autoinstall firmware
crypto ikev1 policy ikev1-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ikev2 policy ikev2-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
crypto ikev1 remote-vpn
crypto ikev2 remote-vpn
crypto auto-ipsec-secure
crypto load-management
crypto remote-vpn-client
interface radio1
interface radio2
interface ge1
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface vlan1
  ip address dhcp
  ip address zeroconf secondary
  ip dhcp client request options all
interface pppoe1
use firewall-policy default
logging on
service pm sys-restart
router ospf
!
profile ap4600 "R"
no autoinstall configuration
no autoinstall firmware
crypto ikev1 policy ikev1-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ikev2 policy ikev2-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
crypto ikev1 remote-vpn
crypto ikev2 remote-vpn
crypto auto-ipsec-secure
crypto load-management
crypto remote-vpn-client
interface radio1
  wlan S-Inet bss 1 primary
  wlan M-Intern bss 3 primary
  wlan Hotspot bss 4 primary
interface radio2
  wlan S-Inet bss 1 primary
interface ge1
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface vlan1
interface pppoe1
use firewall-policy default
service pm sys-restart
!

profile ap4600 ap4600_Hof
no autoinstall configuration
no autoinstall firmware
crypto ikev1 policy ikev1-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ikev2 policy ikev2-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
crypto ikev1 remote-vpn
crypto ikev2 remote-vpn
crypto auto-ipsec-secure
crypto load-management
crypto remote-vpn-client
interface radio1
  wlan hof bss 1 primary
interface radio2
  wlan S-Inet bss 1 primary
interface ge1
  ip dhcp trust
  qos trust dscp
  qos trust 802.1p
interface vlan1
interface pppoe1
use firewall-policy default
service pm sys-restart
!

rf-domain "S Lau"
location xxx
timezone Europe/Berlin
country-code de
use smart-rf-policy "S Lau"
channel-list dynamic
layout area Bib
layout area Bib floor Erdgeschoss map-location bibErdgeschoss.jpg units feet
layout area Haus
!
rf-domain default
no country-code
!
wm3600 00-xx-xx-xx-xx-xx
use profile default-wm3600
use rf-domain "S Lau"
hostname wm-xx-xx
license AP xxxx
interface up1
  switchport mode trunk
  switchport trunk native vlan 2
  no switchport trunk native tagged
  switchport trunk allowed vlan 2,6,252,255,301
!

ap4600 00-xx-xx-xx-xx-xx
use profile "R Lau"
use rf-domain "S Lau"
hostname AP-xx-xx
!

ap4600 00-04-xx-xx-xx-
use profile ap4600_Hof
use rf-domain "S Lau"
hostname HOF
area Rxxx
interface ge1
  switchport mode access
  switchport access vlan 20
!

!
end

[ckelly]

When the AP is adopted and shows an error message in the Config Status, this is indicating that there was an issue with the configuration that was sent to the AP.  This is most likely why you are not seeing your WLAN operating on the AP.

There’s many things that could be causing this issue.  Instead of playing 20-questions, the fastest way to diagnose this would be to see the running-config from the controller (WM2600).  [Remove any clear-text passwords/passphrases or anything sensitive from the config before posting]