If a WLC fails?

Hi,
I've been asked to find out what happens if a WLC fails?
Do clients stay connected but can't connect new clients? Does everyone get kicked off?
Does the same happen with the Virtual WLC as does with a hardware box? Should I really have two WLC's ?
Thanks,

I've been asked to find out what happens if a WLC fails? Do clients stay connected but can't connect new clients?
Depends. If you don't have FlexConnect AND you don't have any redundant WLC, then clients get booted off.
Let say you don't have a redundant WLC but you have FlexConnect. If the WLC fails then the OLD client will stay connected. Unless you have a local authentication server at each site, then NO NEW clients will be able to authenticate. Another thing, when the WLC fails, the AP must NOT be reloaded. If it does, then no clients, old and new, will be able to join the wireless network
Let's say you don't have FlexConnect. When the primary WLC fails, the AP will join the secondary WLC. During the "move" from Primary to Seconday, the clients will loose connection.

Similar Messages

TFTP 'configuration update' from 5508 WLC fails stating reason as '%Error: Config file transfer failed – Unknown error –refer to log'

Dear Experts,
I have two WLCs and other management devices as part of same subnet. I am able to upload ‘configs’ from all the devices on to my TFTP server. However when I am attempting to do the same from one of my WLC, it is failing consistently stating error message as:
‘%Error: Config file transfer failed – Unknown error –refer to log
Has anyone else too faced the same issue and how would we overcome this? Any specific debug that could help get more details on it?
Though the error message says, refer to log but still I don’t see anything that gets reflected in ‘Monitor logs’ which is related to ‘configuration file’ upload failure.
WLC code: 7.4.100.0
PFA as the error snippet.
Thanks and Regards,
Adnan

Hi Kaneswaran,
Just a soft reboot helped me solved the problem :). Still I am on 7.4 and facing no issues after this.
Apologies for coming too late to respond. Getting a down time window was not that easy and so was much delayed to try soft reload. I am still on 7.4 and facing no issue.
Glad that in your case it starting working all of a sudden. Could you please verify from 'show tech-support' to confirm if by chance your WLC had undergone any crash that could have caused the WLC to reload and thus accidently fixing the issue :)
Best Regards,
Muhammed Adnan

WLC Failed to complete DTLS handshake with peer

WLC 5508 running 7.0.98.0
Site was running fine until the WLC had a hardware failure.
A new WLC was shipped out, was running 6.0.99 then manually upgraded to 7.0.98. Clients cannot authenticatewith recurrent logs messages like this.
*dot1xMsgTask: Feb 23 17:05:03.648: %DOT1X-3-MAX_EAP_RETRIES: 1x_auth_pae.c:2914 Max EAP identity request retries (3) exceeded for client 00:21:5c:<snip>
*spamApTask0: Feb 23 17:05:01.926: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:629 Failed to complete DTLS handshake with peer 192.168.214.91
I have tried changing the key on the radius server to no avail.Anybody have any ideas?

DTLS message corresponds to an AP not joining or disconnecting.
The EAP message above is about a client not finishing its dot1x authentication.
Since what changed is the WLC itself, I would check for changes :
-did it change ip address ? is the config EXACTLY the same as before ?
-What does your radius server reports as failed attempt reason ?
Nicolas

WLC Failed to process an association request

Hi
I am usig a 4402 WLC with s/w version 4.1.171.0.
I keep seeing the following messages in the syslog very frequently.
2008-01-07 07:44:56 Local0.Notice 185.1.137.5 Jan 07 07:44:54.339 apf_80211.c:2847 APF-4-ASSOCREQ_PROC_FAILED: Failed to process an association request from00:15:70:46:43:e7. WLAN:1, SSID:. message recived from disabled WLAN.
Any ideas why ?
Regards
Lee

Make sure the admin status of the WLAN is enabled. On controller CLI use the command "show WLAN summary" .If you get this message even when the SSID is enabled delete and reconfigure the SSID. Check the URL http://cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080665d18.shtml#c3 to enable a WLAN.

WLC failed to connect to WCS by snmp

Hi fellows,
I've a solution implemented that contains 1 WCS and 3 WLC.
For some unknown reason, started from some point, one of the WLC started to fail to connect by snmp to the WCS, given the next error "
%AAA-3-LDAP_CONNECT_SERVER_FAILED: ldap_db.c:1037 Could not connect to LDAP server 2, reason: 49 (Invalid credentials)."
I've made upgrade for the last version of firmware on all WLC's, have rewritten the credentials of SNMP, but the problem remains with only one of the WLC's, all others are working fine.
The SNMP is v.3.
The version of WCS is 6.0.132.0.
Any ideias?
Best regards,
Luis Matos

Hi Scott Fella,
Thanks for your answer.
When the problem appears, the version of the wlc was 6.0.182. We 've made upgrade to version 7.0.116.0 to try to resolve the problem, but the problem remains.
The 2 others WLC that is working fine, have the version 6.0.182.
There isn't any FW between the WLC's and WCS.
Best Regards,
Luis Matos

If anchor WLC fails, roaming wireless users get "stuck"

I did a test in our lab where I roamed from an AP on WLC A to an AP on WLC B. My client kept its same IP address and connectivity remained. I'm running WLC 4.0.219, so the traffic at this point was not symetrical, but the connectivity was up. WLC A was the Anchor WLC.
Then, I failed WLC A. My wireless client still had its original IP address from WLC, so I lost all connectivity. WLC B did not try to anything so that my client would get a new IP address (from WLC B) and regain connectivity.
The only way I could get my client to work again was to go to WLC B and "Remove" the client. It looks like this forced the client to re-authenticate and get a new IP address.
Is this the only way to get a client back on the network in this type of failure scenario?

Did both WLC's have dynamic interfaces on the same subnet or did each WLC have interfaces on different subnets. I have tried this failure before with no issues, as long as the WLC have interfaces on the same subnet for the users.

CPI Device add (WLC) failed (InventoryCollection Error)

Hi,
I have a WLC (2500) and want to add it into the CPI.
There are many other WLCs already in the CPI with no problems.
So when the CPI starts the collection of SNMP information from the "evil"-WLC this process ends with an failure:
"Collection failure"
Other error::Wireless Controller inventory collection failed. Failure to collect feature class com.cisco.server.managedobjects.bridge.SnmpCommunity.
Software on the WLC is 7.4.100
Software on the CPI is 2.0.0.0.294
So I checked the WLC.....found nothing.
A SNMP debug on the WLC was OK.
Than I checked the Jobs on the CPI and the following Jobs status was failed:
PushCollectionPlanToDA
A check of the log shows the error why the CPI could no add the WLC:
hread Id : [2,490] : SAM_COLLECTION_INFO: [DACollectionPlanPushTask > executeTask: Device IP LIST =[192.168.142.50], Template=-1]
733: loopback: Jan 07 2014 15:19:05.074 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [CollectionPlanBuilder:updateDeviceForTemplate: updating for templateID=-1]
734: loopback: Jan 07 2014 15:19:05.084 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [CollectionPlanBuilder:metricsTemplate is not found for metric basic id:-1]
735: loopback: Jan 07 2014 15:19:05.084 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [CollectionPlanBuilder getInterfacesWithDevice():-1deviceIp192.168.142.50:Exception:null]
736: loopback: Jan 07 2014 15:19:05.084 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [CollectionPlanBuilder:metricsTemplate is not found for metric basic id:-1]
737: loopback: Jan 07 2014 15:19:05.084 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [CollectionPlanBuilderImpl: Error finding collection profile type.]
738: loopback: Jan 07 2014 15:19:05.085 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [DAOrchestrator:deployPlan:Entry]
739: loopback: Jan 07 2014 15:19:05.085 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [DAOrchestrator:deployPlan: Now deploying for ****templateId=-1]
740: loopback: Jan 07 2014 15:19:05.086 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [DAOrchestrator:deployPlan: isMultipleDA=false]
741: loopback: Jan 07 2014 15:19:05.188 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [DAClientProxy:getRestUrl():URL https://localhost:443/da/rest/daRest/CollectionPlan]
742: loopback: Jan 07 2014 15:19:05.214 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [RESTDynamicInvocationProxy:collection service:SAM to DA REST:StatusPUSHED]
743: loopback: Jan 07 2014 15:19:05.224 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [DADeployInfoDAOImpl:createDADeplyInfo: Successfuly created DADeployInfo details]
744: loopback: Jan 07 2014 15:19:05.224 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [DAOrchestrator.deployPlan: DA1:PUSHED, PersistStatus: Success:Create DADeployInfo id:1,]
745: loopback: Jan 07 2014 15:19:05.224 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [DAOrchestrator:deployPlan: Time taken to complete deploy plan for templateId=-1 (ms) 139]
746: loopback: Jan 07 2014 15:19:05.224 +0100: %IFM-6-WITH_INFO: %[ch=com.cisco.ifm.sam][mid=201]: Thread Id : [2,490] : SAM_COLLECTION_INFO: [DAOrchestrator.deployPlan:Exit]
So the error is: CollectionPlanBuilderImpl: Error finding collection profile type.
Can anybody help me to fix the problem?

I also tried this many times - but always with the same result.
I tried SNMP v1, v2, v3, created other credentials on the WLC and used them.
Might there be a problem when exporting a config from an running WLC, modify it and upload the modified config to a new WLC? Thats the only thing that differ from the other WLC managed from the CPI.

Web authentication on WLC fails to redirect when we enter URL i browser

I have a problem with a customer of mine. We have deployed two new WLC5508 running r7.0.116.0 and AP1142s, also WCS with r7.0.172. When we setup a "Guest Access" we ran into trouble .....
The problem is that we can associate to the SSID/AP and get an ip-adress. When we open the web-browser we do not get redirected to the virtual interface but instead the _hostname_ of the WLC. Like this:
https://cisco6a19c4/login.html?redirect=nyttintranet.sem10.se/
I we manually replace "cisco6a19c4" with 1.1.1.1 it works as it should, the login page appears, we login and can access the internet.We have tested and disabled web-auth on the ssid an everything works, we can directly go out on the internet, DNS works without any problems.
A little more info:
2x WLC5508 runnnig r7.0.116.0 and APs are 1142
WLCs connected to Cat4503 via LAG
Guest network (VLAN) is transfered from WLC via the trunk to the Cat4503 and then connected on a access-port to a separate broadband-router, then to the inetrnet.
DHCP to guest-users from separate broadband-router which is def gwy and "DNS".
On the virtual interfaces no hostname is configured.
ANY ideas??!?!?!???
Best Regards
Göran Blomqvist

Ooop.... waddyaknow.... As it turned out, one of the WLC _did have_ a name configured under the virtual interface, of course it was NOT the one that "our" AP was associated with....
That has now been corrected and the guest access is working as intended......
(Oh, yes we tried with 3 PCs and 2 smartphones when we discovered the 'malfunction'....)
Thanx for the mental push Stefan!!
Regards
Göran

Connectivity to WLC failed

We have a WLC connected to a 6500 Switch, when tried to enable LAG the connectivity goes down, the switch can't ping the controller nor the controller to the switch, we check tha cables, the minigybics, we changed them for new ones,the status of the interfaces is UP UP, we tried revert the config, using LAG disabled and no success, i can't reach the management interface. with the service port i can connect to the controller.
Thanks, Regards

Make sure you have the management and ap-manager interface set to "0" untagged and also make sure the trunk ports are set to native vlan . Also make sure that the trunk port is set to channel-group X mode on.

Aironet 2602 - Operation when WLC fails?

Hi,
we are using a WLC2504 with several Aironet 2602 Access Points.
So far it is working fine but when I turn off the WLC all SSIDs disappear after some seconds as they couldn't find the controller anymore.
Is it somehow possible to configure the Access Points for some "Failsafe"-Mode so that operation is still possible in the case of a controller failure?
Thanks in advance,
Christoph

Hi Cristoph,
we are using a WLC2504 with several Aironet 2602 Access Points.
So far it is working fine but when I turn off the WLC all SSIDs disappear after some seconds as they couldn't find the controller anymore.
Well the LWAPs are dumb devices. We do not do any configuration on the AP. We configure the WLC and APs broadcast the ssids which are configured on the WLC. That is the reason why all the ssids disappear when you turn off the WLC.
We have the option of AP-SSO which is also called HA-SKU.
All the APs on the Active WLC will also be seen on the Secondary WLC via the CAPWAP mirror image.
It is really a good option but I guess it is not supported on the 2504 WLC. it is supported on 5508 WLCs.
Link for the HA is:
http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/7-5/High_Availability_DG.html
Thanks and regards,
Manas Pratap Singh.

WLC fails to correctly apply a local policy

We have a virtual WLC AIR-CTVM-K9.
We are trying to force mobile devices (on tablets, mobile phones, etc) to use the wlan that we defined to be for the mobile users.
We have created a few local policies, for Android (using items like Android, Android-HTC, etc), Apple, Samsung.... And applied it to the wlan from which we don't want them to use with the mobiles.
The problem is that in the 5% of the cases, even with the local profiling identifying the device as a "Workstation" (profile NOT included in the policy), it takes them to the "Mobile" wlan.
Couldn't find any other topic regarding this problem.
Can anybody help us?
Thank you!

enabling profiling from the configuration mentioned in below link
http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-5/config_guide/b_cg75/b_cg75_chapter_01100000.html

Understanding Flexconnect - Local vs Central Switching, and WLC failover scenario ??

Hello Experts
We have one WLC 5508 in Building1, few 2700 Series AP in Building1, and one 1252AG in Building2. The LAN subnet is same for both Buildings connected via a dark fiber.
My requirement is to have Central Switching in Building1 since WLC is located locally, and Local Switching in Building2 to avoid inter-building traffic, for both Buildings we already one VLAN/IP Subnet. (Both Buildings access resources from a central Datacenter which hosts all the servers.)
Questions:
1. Is the above scenario possible using single SSID ? My understanding is that one WLAN+SSID can't have both Local and Central switching enabled.
2. In Flexconnect Central Switching mode, during WLC failure, does the switching change to Local switching automatically ?
3. When I choose Local Switching for a specific WLAN, does it Locally switch always , or does it Locally switch only when WLC is down ?
4. We want to use Microsoft PEAP using AD User Authentication. When Local Authentication is enabled on WLC, I understand that when WLC fails (and RADIUS Server is still reachable), can we still have the AP directly contact RADIUS server as a direct client and provide 802.1X Microsoft PEAP authentication. Guess this is Primary Backup Radius Server configuration. Is this understanding correct ?
Thanks.

Hi
The LAN subnet is same for both Buildings connected via a dark fiber.
If this is the case there is no need of FlexConnet, as you have enough bandwidth & same L2 extended in those two buildings. Typically FlexConnect is for branch deployment where WAN link bandwidth is a concern.
Anyway if you want to do this & here is the answer for your specific queries.
1. Is the above scenario possible using single SSID ? My understanding is that one WLAN+SSID can't have both Local and Central switching enabled.
You can have both local switching & central switching available for a given SSID. Only FlexConnect mode AP will do Local switching & all Local mode AP will do central switching, though both using the same SSID.
2. In Flexconnect Central Switching mode, during WLC failure, does the switching change to Local switching automatically ?
No, if it is central switching SSID, when WLC is not available client won't able to join this SSID. It is not fall back to Local switching.
3. When I choose Local Switching for a specific WLAN, does it Locally switch always , or does it Locally switch only when WLC is down ?
This is applicable only to FlexConnect mode APs & it always do local switching if that configured. If WLC is not reachable AP will go on "standalone mode" & still do local switching.
4. We want to use Microsoft PEAP using AD User Authentication. When Local Authentication is enabled on WLC, I understand that when WLC fails (and RADIUS Server is still reachable), can we still have the AP directly contact RADIUS server as a direct client and provide 802.1X Microsoft PEAP authentication. Guess this is Primary Backup Radius Server configuration. Is this understanding correct ?
Yes, when this option configured & WLC is not reachable (but RADIUS is reachable) then AP will act as Authenticator & pass radius messages to Auth Server directly.
This is a very good Ciscolive presentation you should see as it describe lots of these features & which WLC codes they introduced.
BRKEWN-2016 - Architecting Network for Branch Offices with Cisco Unified Wireless
HTH
Rasika
**** Pls rate all useful responses ****

WLC 5508 7.4.X - N+1

Hi,
I don't undestand this document
http://www.cisco.com/c/en/us/td/docs/wireless/technology/hi_avail/N1_High_Availability_Deployment_Guide/N1_HA_Overview.html
How can the third 5508 (suport max 500 AP) backup all other WLC ? n+1 how ?
With secondary wlc configured in HA-SKU (without AP SSO) the 500 licenze are permanent ?
who can explain me.. this is a document bug ??

What they're describing is HA N+1, not HA 1:1 AP SSO. This option, which is "NON-AP-SSO", allows you to use an HA-SKU or > -50-k9 SKU coverted, to operate as a dedicated +1 WLC in HA. When using this configuration, this WLC allows the use of the "hardware maximum" of the device: Thus 500 APs for WLC 5508, or 1000APs for a WISM2 (as an example). Since this WLC can wait as a backup to multiple WLCs, that's why it's not capable of the AP SSO, which requires a 1:1 pairing of the HA WLC with an Active HA WLC.
When using the HA N+1 the WLC acts the same as the pre AP-SSO "HA" concept; where you had Primary, Secondary Tertiary configs on your APs (which you may still have). All it is saying is that the N+1 HA WLC can act as one of these Secondary/Tertiary WLCs, much like a WLC you had licenesed for 250 or 500 APs could do previously.
In the past you would use, lets say a 250 WLC AP as this backup WLC. Many people were frustrated that they had to have a $60,000 WLC just sitting there "waiting for something to fail". But that's what it did. If a WLC failed, lets say one with 100 APs, this backup WLC would take on the APs and use 100 of it's 250 AP license count. If additional WLCs failed, the process continued until this backup WLC was filled.
The idea of using the HA-SKU in an N+1 is that while yes, you don't get the 1:1 AP SSO configuration, you are getting more bang for your buck in that this WLC can sit as a backup (as it did in the past) but it can accept up to the maximum it's hardware can handle in terms of AP count, not only what it was permanently licensed for. Rather than spending $100,00 on a 500 AP count WLC to backup your 2x250 AP count WLCs, why not look at a $50,000 HA-SKU that can "handle" up to 500 APs.
So given this scenario, this WLC is "backuping up all other WLCs" for whom it is a Secondary/Tertiary WLC backup.
As far as the HA-SKU "licenese", it's not "permanent" per se. With an HA SKU in N+1 you have a 90 day timer which will then "nag you" (via console) that this HA WLC is not truly intended to permanently house these APs. The idea is that if the Primary WLC failed, you would get it back online and then move your APs back to where they belong and return the HA N+1 WLC back to 0 APs.

Can a WLC Control AP's at 2 Sites?

I have 2 sites with 2 IOS AP's each. I would like to use a WLC to control all 4 AP's. I want to have the same SSID at both sites, but have 2 different DHCP servers, one for each site.
The reason that made me think this might be possible is that I have several sites today with their own WLC's and when one WLC failed the AP's from that site immediately connected to a WLC at another site and the users continued getting site appropriate DHCP addresses. Not sure how that happened. I realize the AP's did not have to restart, they just connected to a new WLC at a different site. Hope that is clear.

A WLC can control APs at remote sites by using APs in REAP and H-REAP modes. Just see whether these documents helps you in a way..
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a00807d4d32.shtml
http://www.cisco.com/en/US/products/ps6521/products_tech_note09186a0080736123.shtml
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a008081103d.shtml

WLC 5508 7.4.100.0 HA standby reboot loop

Hi.....
We have been running two 5508 WLCs in HA mode for a while now connecting 25 2602 APs. We disconnected the heartbeat utp cbale to change the positision of the standby WLC in the rack. We did not power it off. After we plugged back the Heartbeat cable the standby WLC goes into a reboot loop and gives the following error message
Error:Unable to add Licenses on secondary Controller
Now I did not try to reboot the primary one as users are connected and am afraid I will have two WLCs down instead of one. From what I have been reading it seemed that several HA issues were resolved in code 7.4.100.0...
I hope there is simple fix/workaround for this situation.
All help is appreciated

Hello,
As per your query i can suggest you the following solution -
This document provides information on the theory of operation and configuration for the Cisco Unified Wireless LAN Controller (WLC) as it pertains to supporting stateful switchover of access points (AP SSO).
The new High Availability (HA) feature (that is, AP SSO) set within the Cisco Unified Wireless Network software release version 7.3 allows the access point (AP) to establish a CAPWAP tunnel with the Active WLC and share a mirror copy of the AP database with the Standby WLC. The APs do not go into the Discovery state when the Active WLC fails and the Standby WLC takes over the network as the Active WLC.
There is only one CAPWAP tunnel maintained at a time between the APs and the WLC that is in an Active state. The overall goal for the addition of AP SSO support to the Cisco Unified Wireless LAN was to reduce major downtime in wireless networks due to failure conditions that may occur due to box failover or network failover.
For more information please refer to the link-
http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bd3504.shtml
Hope this will help you.

If a WLC fails?

Similar Messages

Maybe you are looking for