AP Registration
AP Registration
AP Registration
P AP R
≈ ₄₉ C
Tags
Cisco AP Registration
AP Registration to a WLC is two parts; the discovery & the join phase. Following diagram shows this
concept.
Usually Discovery request handled by Management Interface of a WLC & Join Requests handled by AP-
Manager Interface. In 5508 only management interface available & it act as AP-Manager interface for
these join request.
These are the steps AP will go through in order to register with a WLC.
Step 1. AP begins with a WLC discovery & join phase. AP send CAPWAP discovery request messages to
WLC.
Step 2. Any WLC receiving the CAPWAP discovery request responds with an CAPWAP discovery
response message.
Step 3. From the CAPWAP responses received from WLCs, AP selects a WLC to join.
Step 4. AP sends a CAPWAP join request to the WLC, expecting CAPWAP join response.
Step 5. WLC validates the AP and then CAPWAP join response to the AP. The AP validates the WLC to
49
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 1/20
6/19/2019 AP Registration | mrn-cciew
complete the discovery & join process. The validation on both the AP & WLC is a mutual authentication
mechanism.An encryption key derivation process occur subsequently and that ensure future CAPWAP
control messages are encrypted.
First challenge is to find where to send CAPWAP discovery messages ? AP first go through a hunt
process to find a WLC. Here are the different methods AP can used for this. The order of these are not
important
1. AP issues a DHCP discover request to get an IP address, unless it has previously configured static IP.
2. AP send a layer 3 local broadcast(255.255.255.255) message to find a WLC
3. DHCP Option 43 in the DHCP offer messages.
4. DNS- AP try to resolve CISCO-CAPWAP-CONTROLLER.local-domain or CISCO-LWAPP-
CONTROLLER.local-domain to find an IP of a WLC
5. Previously known WLC IP, AP will rememberup to 24 previosly learnt WLC IP address & send
discovery to them.
6. Statically configured from WLC
7. Statically Configured from AP CLI
To see AP registration process in detail will remove CAPWAP AP configurations in order to remove the
previously known IP. You can do this as follows via AP CLI.
Once rebooted it will complain about no IP. Yes without IP AP cannot do anything to register with WLC.
AP5475.d0dd.a488>
*Mar 1 00:00:32.955: %LINK-3-UPDOWN: Interface Dot11Radio1, changed state to up
*Mar 1 00:00:32.983: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Mar 1 00:00:33.935: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1
*Mar 1 00:00:33.935: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 255.255.255.25
*Mar 1 00:00:33.963: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0
*Mar 1 00:00:38.719: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does no
*Mar 1 00:00:48.719: %CAPWAP-3-ERRORLOG: Not sending discovery request AP does no
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 2/20
6/19/2019 AP Registration | mrn-cciew
Let’s configure static IP & see the console output( Remember that I have not configure the switch port for
any access vlan yet). Since these are lightweight image we cannot configure like normal IOS AP. So here
are the command to do this.
Since I have not configured the switch port for vlan 113, still AP cannot reach its gateway. Then AP try to
reboot & see to learn an IP again.
AP5475.d0dd.a488#
*Mar 1 00:11:09.499: %CAPWAP-3-STATIC_TO_DHCP_IP: Could not discover WLC using st
Now we will configure our switch port (fa1/0/12) to access vlan 113. This time you can see AP
successfully able to complete Discovery & Join process as it can reach WLC. Note that since I have 4402
WLC it has AP manager interface with an IP (10.10.111.11) which respond to Join Request. (see below)
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 3/20
6/19/2019 AP Registration | mrn-cciew
If you took a wireshark packet capture of the WLC connected switch port you can see the details of each
of these types of packet. See below wireshark capture shows different type of packets in discovery
process.
Here is the Discovery Request packets details. Note that discovery request is sent to WLC management
IP with destination port UDP 5246 (capwap-control). Also Message Element value 1 which indicate Static
Configuration. Different IE value indicates the type of discovery method used. We will see few other
options (DHCP, DNS, Broadcast) discovery in some other post.
0- Broadcast
1- Configured
2- OTAP
3- DHCP Server
4- DNS
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 4/20
6/19/2019 AP Registration | mrn-cciew
Here is the discovery response packet. As you can see WLC is providing all the information to AP
(including WLC IP – AP mgr, Name, etc)
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 5/20
6/19/2019 AP Registration | mrn-cciew
Then AP send the Join Request & expecting Join Response from WLC. First step is to establishing a
secure CAPWAP connection with complete DTLS handshake as shown in the packet capture. This
include Client Hello, HelloVerifyRequest/ ClientHello(with Cookie), ServerHello/Certificate,
ClientKeyExchange/ ChangeCipherSpec, ServerChangeCipherSpec (See below)
Subsequent traffic is DTLS encrypted & cannot be decode to see what’s inside. You can disable
encryption for CAPWAP by using “test capwap encr <ap-name> disabe” command on WLC CLI or “test
capwap dtls ctrl disable” on AP CLI.
But once I disable it , AP could not join the WLC & could not verify the complete process without DTLS
encryption. In HREAP mode you can do this & see this complete process without encryption( Refer How
Does OEAP Works for more detail).
Related Posts
1. Split MAC vs Local MAC Architecture
2. WLC Discovery via DHCP Option 43
3. WLC Discovery via DNS
4. WLC Discovery via Broadcast
5.
1. said:Ashish Bhadouria
REPLY
said:nayarasi
Thanks Ashish….
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 6/20
6/19/2019 AP Registration | mrn-cciew
REPLY
2. said:CiscoDude
While the order is not important for real life they ask about it in the CCIE wri en exam
REPLY
said:nayarasi
True
REPLY
3. said:dennyak
Hi Nayarasi, my name is Denny. Can you help me to configure my Aironet 2600 series, it’s won’t
discover on my WLC, thanks and I appriceate for you help
REPLY
4. said:bkassaye
Hey Rasika,
I am trying to migrate APs (2702i) from WLC 2500 on 8.0.100 to a new WLC 8510 on 8.0.110. These
APs were working fine and they were configured as flexconnect modes. It looks like my APs are
stuck somewhere in between the migration process. I can see the discovery request and respose from
these APs to the new controller. But I dont see any join request coming to the WLC. The APs are
remote so i can not console into them for now. Doing “debug capwap events enable” gives me this
line of output…
For migration, i already have the DNS entry pointing to the new controller and I have configured the
new controller IP on the high availability tab of each AP.
REPLY
5. said:bkassaye
–More– or (q)uit
– Configuration requests received…………………….. 0
– Successful configuration responses sent……………… 0
– Unsuccessful configuration request processing………… 0
– Reason for last unsuccessful configuration a empt……. Not applicable
– Time at last successful configuration a empt………… Not applicable
– Time at last unsuccessful configuration a empt………. Not applicable
AP disconnect details
– Reason for last AP connection failure……………….. Not applicable
REPLY
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 8/20
6/19/2019 AP Registration | mrn-cciew
6. said:bkassaye
h p://serialnumbervalidation.com/63916/cgi-bin/index.cgi
REPLY
7. said:Ghassan
REPLY
said:nayarasi
Thanks
REPLY
8. said:Nitin Jain
Hi, We are trying to register 3700 AP to 5520 WLC with 8.1.102 code running and we are seeing LCB
allocation failed for the new AP under ap join response section error in AP join status on controller.
Any idea what is this issue ? Controller time base is correct and sync. There are two firewalls in
between AP subnet and WLC. we have opened udp/5246-5247 and udp/12222 and udp/12223 ports
bi-directional but still APs are not joining
REPLY
said:Stefan Ko wi
Hi Nithin!
Stefan
REPLY
said:Nitin Jain
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 9/20
6/19/2019 AP Registration | mrn-cciew
Hi yes I was able to fix it up. It was firewall rule issues we had to correct firewall rules in order
to allow controller to send response to ap subnet.
said:Iain H
The error “LCB allocation failed for the new AP” was also experienced under WLC version 8.2
when a empting to join APs under the 12-week evaluation license, but not having accepted
the EULA:
9. said:Darkplayer
For 2 days, I have been struggling to bring up a 2504 controller and cap3602I. Both of which had old
software versions going back 2013. I was able to upgrade the controller from 7.6 to 8.0.121 without
any issues. After entering the static IP, bam, my 3602I AP joined the WLC and upgraded itself. Thank
you.
REPLY
said:nayarasi
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 10/20
6/19/2019 AP Registration | mrn-cciew
Great, make sure you configure WLC name & IP address in AP High Availability ( primary,
secondary, )tab once registered the AP to WLC
REPLY
10. said:Tokwa
Hi Guys,
Is it possible to assign Static IP address to Cisco 1832/1852 AP? If so, what are the CLI commands? I
can only see the capwap ap primary-base . Thanks in advance!
REPLY
REPLY
said:nayarasi
Pls open a thread in CSC forum given below. You will get faster response to troubleshoot your
issue.
h ps://supportforums.cisco.com/community/5956/ge ing-started-wireless
HTH
Rasika
REPLY
said:Greg Browne
Need to add their the mac to the MAC filter. I have 2 have them and had the same issue. it is
under security tab
REPLY
said:nayarasi
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 11/20
6/19/2019 AP Registration | mrn-cciew
Thanks Greg
12. said:Sajid
Hi Nayarasi,
we have cisco 5508 wlc and 180 numbers of 702i APs installed at multiple locations.
its been a three months for the setup, earlier all were working fine but recently we are ge ing
problems at some locations. i.e.
AP shows TRANSLATING CISCO CAPWAP …….Controller (255.255.255.255) error
and LED starts blinking RED,GREEN,BLUE,ORANGE, the error remains same untill and unless we
RESET the AP after working fine for sometimes it again shows the same error.
Thanks.
REPLY
said:nayarasi
Hi Sajid,
It seems due to some reason those AP lost its controller & cannot find it again for registration.
Could be a bug of the software code/AP model.
HTH
Rasika
REPLY
Hi,
REPLY
said:nayarasi
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 12/20
6/19/2019 AP Registration | mrn-cciew
If you simply want to factory default WLC configuration, you can reload this current WLC &
“Recover-config” on CLI. Refer below
h ps://supportforums.cisco.com/document/8941/how-reset-wireless-lan-controller-wlc-factory-
defaults
HTH
Rasika
REPLY
14. said:KP
Hi,
I am using 8510 WLC and cisco 2700, 3700 access point. currently, I am facing an issue of few access
points are disconnecting with short period of time. I did PoE off and then on from the connecting
switch port. so after that, they all are connect successfully for a short period of time and again
disconnected from the WLC. how to solve this issue.?
REPLY
said:nayarasi
REPLY
15. said:Gene
REPLY
said:PM
Hi,
from my point of view, start with considering how the AP obtains WLC IP address (local bcast,
DNS, DHCP, manual priming), Define these steps (DHCP Option 43 documentation from Cisco,
DNS configuration, CLI commands to manual prime AP). Document WLC IP Address and
Firewall rules included for AP to reach WLC using CAPWAP ports. Document necessary switch-
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 13/20
6/19/2019 AP Registration | mrn-cciew
port config (either local-mode or Flexconnect, consider VLANs and possibly 802.1x/ port-security
(is this still a thing?) on the switchport. Also consider PoE and requirements (802.3af/at). Upon
connecting the AP to the network, take a debug from WLC and AP on successful join and
highlight critical steps. After that, Using Either WLC GUI or CLI (whichever suits you be er)
rename AP, assing mode, assign AP group, consider Flexconnect, Ensure AP admin mode and
radios are set to enabled state.
Once done, document AP radio se ings, channel and power-level, check (for FC) if VLAN
assignments were required and are working.
I have no solid documentation on this by my own right now but I think this is a good
startingpoint.
REPLY
16. said:Pradeep
Hi ,
I have 3 Controller in Setup and I need only one to be use for registration purpose .
How is it possible that the request from new AP goes to only 1 WLC or only that WLC respond back .
I need like disable the request response on WLC that are not used as registration purpose.
REPLY
17. said:Bharath
Hi
I am using controller 2500. I am trying to integrate stand alone AP which has been converted into
Controller based AP. but it showing last logs as Nov 24 14:03:25.343: %CAPWAP-5-SENDJOIN:
sending Join Request to
REPLY
said:nayarasi
What AP model you got and what software version running on your WLC ?
2.
h p://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/119286-lap-
notjoin-wlc-tshoot.html
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 14/20
6/19/2019 AP Registration | mrn-cciew
HTH
Rasika
REPLY
18. said:Zeeshan
I usually go through your web for wireless help, I found your web very useful. I am stuck with Cisco
3605 AP for a registration with the Cisco virtual WLC. The AP is keeping trying to resolving CICSO-
LWAPP-CONTROLLER. The environment is running a dhcp where I neither I can configure option
43 nor host entry for CICSO-LWAPP-CONTROLLER in the DHCP server.
The AP console is not allowing me to enter anything in the console, it is keep renewing the IP
address from the DHCP to get the controller IP address in the either by option 43 or by resolving the
name.
REPLY
said:nayarasi
Try to put AP on to the same as WLC management interface vlan & see
HTH
Rasika
REPLY
said:Zeeshan
Hi
Both the AP and vWLC are in same subnet, but AP still tyring to discover the controller. The
AP is not allowing me to enter any command in the console. The AP is keep showing
messages of DCHP renewing address and search controller.
said:nayarasi
Enter the above command & then you should be able to issue those CLI commands.
Rasika
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 15/20
6/19/2019 AP Registration | mrn-cciew
19. said:jonhurd
FYI on capwap control packet encryption, test capwap encr was removed from 8.0 code per
CSCut91240.
REPLY
said:nayarasi
It seems Cisco does not want this command to be available any further
HTH
Rasika
REPLY
Great explanation !
REPLY
said:nayarasi
Thanks Mahesh
REPLY
Hi Nayarasi,
I´m Luciano from Brazil, and I have a Serie 1600 and my AP give this message after update Firmware
to version Most actual.
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 16/20
6/19/2019 AP Registration | mrn-cciew
regards,
Luciano.
REPLY
said:nayarasi
Do you have a WLC ? Looks like you have upload a lightweight image that require a WLC
Rasika
REPLY
said:Luciano
Hi Rasika,
No I dont have WLC (Wireles Lan Controler), this equipament is only for uses in AP WIFI,
maybe I updated with wrong IOS???
Look Description of my AP
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 17/20
6/19/2019 AP Registration | mrn-cciew
Regards,
Luciano.
said:nayarasi
Yes, you have uploaded the wrong image. Look for k9w7 for autonomous ap
Regards
Rasika
22. said:Kennedy
REPLY
said:nayarasi
Rasika
REPLY
23. said:Jeff
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 18/20
6/19/2019 AP Registration | mrn-cciew
Good day and THANK YOU for all of your awesome posts! I find them all very enlightening. I am
currently upgrading / migrating from three 5508 controllers to two 5520 controllers. I find it
interesting the minimal downtime the AP (and associated clients) see when I change the Primary
Controller (in HA tab of AP) as this is how I’m moving them from the old WLC to the new WLC. I
would suspect that the CAPWAP tunnel to the old WLC stays up and functional until the new
CAPWAP tunnel is built and ready to pass traffic to the 5520 WLC. I think I need to watch debug for
the AP MAC address on old and new WLC simultaneously to verify this, but it is a REALLY quick
process / minimal outage to the client when they migrate over to new WLC. I’d love to hear your
experience and/or input on the subject. Thanks again for your tremendously useful posts! Cheers…
REPLY
said:nayarasi
Hi Jeff,
I assume your 5520 & 5508 got same image versions. Also do you have mobility peering with 5520
& 5508 ? I have upcoming work involve similar migration, will let you know once I have tested in
that environment.
Yes, if you could have some packet capture (AP connected switchport), that would be really
helpful to see the clear steps with timing involve.
Rasika
REPLY
24. said:Tokwa
What are the reasons why the AP tears down its CAPWAP tunnel to the controller?
I have two controllers on my test environment (same subnet), no WLC in master controller mode, the
AP is not configured with primary, secondary and tertiary WLC. Upon checking, AP is joined first
with WLC1 but then switch to and joined WLC2, AP does not reboot nor encountered power loss,
same uptime. I am wondering what is the possible reason for this? Any thoughts?
Thank you!
REPLY
Blog at WordPress.com.
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 19/20
6/19/2019 AP Registration | mrn-cciew
https://mrncciew.com/2013/03/17/ap-registration/?blogsub=confirming#subscribe-blog 20/20