WLC 5508 HA Problem Soft.ver 7.4.100

Dear Support,
we are using two WLC 5508 software ver.7.4.100 with first 50AP license and in the next day we add 50AP license again to the primary WLC. when we activate HA base in the following guiden http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/7-5/High_Availability_DG.html but when we doing test the failover we found a couple log message on the Secondary WLC like below and not for long time all AP on the Secondary WLC was drop off.
1. DP Critical Error
2. *RRM-DCLNT-2_4: May 23 07:43:53.204: #RRM-3-RRM_LOGMSG: rrmTables.c:682 RRM LOG: Could not retrieve RRM Coverage Measurement DataKey BSSID:34:db:fd:dd:3e:20,Key SlotId:0
*RRM-DCLNT-2_4: May 23 07:43:53.164: #RRM-3-RRM_LOGMSG: rrmTables.c:682 RRM LOG: Could not retrieve RRM Coverage Measurement DataKey BSSID:34:db:fd:dd:3e:20,Key SlotId:0
*RRM-DCLNT-2_4: May 23 07:43:52.854: #RRM-3-RRM_LOGMSG: rrmTables.c:682 RRM LOG: Could not retrieve RRM Coverage Measurement DataKey BSSID:2c:36:f8:72:fc:c0,Key SlotId:0
I also send a complete log for both problem above and enclose it with pdf file. need you advice and assistance,
regard, afriansyah

I agree go to version 7.4.121.0 I has some strange issues on prior releases. Personally I am running 7.6.120.0 right now but that's mainly due to support for the 3702 access points.
http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/7-5/High_Availability_DG.html#pgfId-74573
that's a good guide just to double check yourself just in case. -

Similar Messages

WLC 5508, DHCP Problem after Update Cisco ASA(DHCP-Server)

Hello,
our Problem is, our Apple Devices get no ip adress from our Cisco ASA Cluster(ASA 9.1.2) over Wireless(Cisco WLC 5508). All other devices(Windows, Android,...) work correct, without problems. Our WLC is in HA-Mode.
Does anybody have an Idea?
Thank you very much and Best regards,
Stefan

Hello again,
I hope this case is the solution.
https://supportforums.cisco.com/message/3942112#3942112
I will let you know after downgrade.
Best regards,
Stefan

Wlc 5508 upgrade problem from 7.0.116.0 to 7.0.235.3

We have two WLC model 5508 with the follwing information
Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 7.0.116.0
Bootloader Version............................... 1.0.1
Field Recovery Image Version..................... 6.0.182.0
Firmware Version................................. FPGA 1.3, Env 1.6, USB console 1.27
Build Type....................................... DATA + WPS + LDPE
System Name...................................... WLC-IDB-3
System Location..................................
System Contact...................................
System ObjectID.................................. 1.3.6.1.4.1.9.1.1069
IP Address....................................... 10.80.2.250
Current Boot License Level....................... base
Current Boot License Type........................ Permanent
Next Boot License Level.......................... base
Next Boot License Type........................... Permanent
Configured Country............................... SA - Saudi Arabia
I tried to upgrde the software version to 7.0.230.0 or 7.0.235.3 but wlc displayed the following message
ERROR: Incompatible SW image.ERROR: Please install the Data Payload Encryption licensed image”
please i need the necessary steps to resolve the problem.
Regards ,

Hi,
This issue occurs because the Controller has an LDPE image installed, which is only needed in Russia where Data DTLS Payload Encryption is regulated by the Government. Cisco only recommends using this image if you reside in Russia. To resolve this issue and put the standard image on
To follow the steps go through the below link
http://sigkillit.com/tag/error-incompatible-sw-image-error-please-install-the-data-payload-encryption-licensed-image/

WLC 5508 configuraton

We are planning to add a WLC 5508 to our network to support about 100 APs with two interfaces one for internal users and the other for guest users. This later will be integrated with WLC 4402 which will be installed in the remote site.
Is there any documents that can help me to do so..
Appricate your support

Here is the link which gives u all the info that u need!!
http://www.cisco.com/en/US/tech/tk722/tk809/tech_configuration_examples_list.html
Please dont forget to rate the usefull posts!!
Regards
Surendra

WLC 5508 - wlan stability problems

Hi.
I have a WLC 5508 with half a dozen LAPs (AIR-CAP3502I-E-K9).
They have been working but sometimes clients detect conectivity problems with the wlan.
Here is the message log I can obtain from the controller:
Nov 09 12:16:31.886: [ERROR] pemTimers.c 330: invalid interface name (john_doe) in mscb!!!*dot1xMsgTask: Nov 09 12:16:10.286: %DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444 Max EAPOL-key M1 retransmissions exceeded for client 00:26:c6:12:e8:32Previous message occurred 7 times.Nov 09 11:55:24.682: [ERROR] pemTimers.c 330: invalid interface name (john_doe) in mscb!!!*apfReceiveTask: Nov 09 11:51:30.788: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg *spamApTask2: Nov 09 11:51:20.144: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.23.1.118*dot1xMsgTask: Nov 09 11:50:44.878: %DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444 Max EAPOL-key M1 retransmissions exceeded for client e0:ca:94:93:be:67*apfReceiveTask: Nov 09 11:50:40.672: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg *apfReceiveTask: Nov 09 11:50:38.625: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg *apfReceiveTask: Nov 09 11:50:35.531: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg *apfReceiveTask: Nov 09 11:50:31.068: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg *apfReceiveTask: Nov 09 11:50:29.257: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg *apfReceiveTask: Nov 09 11:50:28.707: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg *apfReceiveTask: Nov 09 11:50:24.065: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg
Can somebody help me to understand these messages?
1)
*apfReceiveTask: Nov 09 11:50:24.065: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg
2)
Nov 09 11:55:24.682: [ERROR] pemTimers.c 330: invalid interface name (john_doe) in mscb!!!
3)
*dot1xMsgTask: Nov 09 11:50:44.878: %DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444 Max EAPOL-key M1 retransmissions exceeded for client e0:ca:94:93:be:67
Thanks

1)
*apfReceiveTask: Nov 09 11:50:24.065: %RRM-3-RRM_LOGMSG: rrmChanUtils.c:290 RRM LOG: Airewave Director: Could not find valid channel lists for 802.11bg
//APs are rebooting. don't panic, check the up time of AP. This message seen when AP rebooted/freshly joined and waiting for wlc to assign channel.
2)
Nov 09 11:55:24.682: [ERROR] pemTimers.c 330: invalid interface name (john_doe) in mscb!!!
//It is cosmetic and can be ignored.
3)
*dot1xMsgTask: Nov 09 12:16:10.286: %DOT1X-3-MAX_EAPOL_KEY_RETRANS: 1x_ptsm.c:444 Max EAPOL-key M1 retransmissions exceeded for client 00:26:c6:12:e8:32
//Keys M1-M5 used for wireless auth, here client having struggle completing the auth process.
get output of, WLC>debug client

WLC 5508 Problem with #DOT1X-3-INVALID_REPLAY_CTR

Hi all,
I have WLC 5508 with version 7.4.110.0 and with 13 AccessPoints.So 12 of this AP are AIR-LAP1142N-E-K9 and 1 is AIR-CAP3602I-E-K9.
Logs of my WLC are:
*Dot1x_NW_MsgTask_1: Jan 11 01:15:05.167: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 90:c1:15:c6:c3:49 - got 00 00 00 00 00 00 00 01, expected 00 00 00 00 00 00 00 02
*Dot1x_NW_MsgTask_4: Jan 11 01:09:41.015: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 5c:0a:5b:c1:16:34 - got 00 00 00 00 00 00 00 01, expected 00 00 00 00 00 00 00 02
*Dot1x_NW_MsgTask_3: Jan 11 01:03:32.269: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 40:b3:95:13:da:cb - got 00 00 00 00 00 00 00 03, expected 00 00 00 00 00 00 00 04
*Dot1x_NW_MsgTask_3: Jan 11 01:03:32.266: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 40:b3:95:13:da:cb - got 00 00 00 00 00 00 00 02, expected 00 00 00 00 00 00 00 04
*Dot1x_NW_MsgTask_0: Jan 11 01:03:31.648: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 24:77:03:67:01:48 - got 00 00 00 00 00 00 00 02, expected 00 00 00 00 00 00 00 03
*Dot1x_NW_MsgTask_5: Jan 11 01:03:31.638: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 14:10:9f:da:c1:cd - got 00 00 00 00 00 00 00 02, expected 00 00 00 00 00 00 00 03
*Dot1x_NW_MsgTask_2: Jan 11 01:03:31.638: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client cc:78:5f:29:cc:82 - got 00 00 00 00 00 00 00 02, expected 00 00 00 00 00 00 00 03
*Dot1x_NW_MsgTask_4: Jan 11 01:03:31.633: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 08:11:96:55:81:c4 - got 00 00 00 00 00 00 00 02, expected 00 00 00 00 00 00 00 03
*Dot1x_NW_MsgTask_0: Jan 11 01:03:31.631: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 84:3a:4b:56:36:50 - got 00 00 00 00 00 00 00 02, expected 00 00 00 00 00 00 00 03
*Dot1x_NW_MsgTask_1: Jan 11 01:03:31.630: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 14:10:9f:e2:d4:91 - got 00 00 00 00 00 00 00 02, expected 00 00 00 00 00 00 00 03
*Dot1x_NW_MsgTask_0: Jan 11 00:59:52.593: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client a0:88:b4:60:20:f8 - got 00 00 00 00 00 00 00 01, expected 00 00 00 00 00 00 00 02
*apfRogueTask_3: Jan 11 00:59:32.168: #APF-1-UNABLE_TO_CONTAIN_ROGUE: apf_rogue.c:4414 Unable to contain rogue 40:01:C6:11:F9:F1 - Not enough Container AP(s). Number of Container AP(s) 2, Requested containment level 4
*apfRogueTask_3: Jan 11 00:58:38.635: #APF-1-UNABLE_TO_CONTAIN_ROGUE: apf_rogue.c:4414 Unable to contain rogue 40:01:C6:11:F9:F1 - Not enough Container AP(s). Number of Container AP(s) 1, Requested containment level 4
*Dot1x_NW_MsgTask_0: Jan 11 00:50:06.885: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 10:68:3f:46:4e:e8 - got 00 00 00 00 00 00 00 01, expected 00 00 00 00 00 00 00 02
*Dot1x_NW_MsgTask_0: Jan 11 00:50:06.883: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 10:68:3f:46:4e:e8 - got 00 00 00 00 00 00 00 00, expected 00 00 00 00 00 00 00 02
*dot1xMsgTask: Jan 11 00:49:05.842: #DOT1X-3-PSK_CONFIG_ERR: 1x_ptsm.c:618 Client c8:e0:eb:19:2a:97 may be using an incorrect PSK
*apfRogueTask_3: Jan 11 00:40:42.576: #APF-1-UNABLE_TO_CONTAIN_ROGUE: apf_rogue.c:4414 Unable to contain rogue 40:01:C6:11:F9:F1 - Not enough Container AP(s). Number of Container AP(s) 3, Requested containment level 4
*Dot1x_NW_MsgTask_3: Jan 11 00:40:17.471: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client c4:43:8f:f1:8c:8b - got 00 00 00 00 00 00 00 01, expected 00 00 00 00 00 00 00 02
*Dot1x_NW_MsgTask_4: Jan 11 00:40:03.368: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client f0:d1:a9:8e:1a:dc - got 00 00 00 00 00 00 00 02, expected 00 00 00 00 00 00 00 03
*Dot1x_NW_MsgTask_1: Jan 11 00:39:30.528: #DOT1X-3-INVALID_REPLAY_CTR: 1x_eapkey.c:360 Invalid replay counter from client 14:10:9f:d8:84:09 - got 00 00 00 00 00 00 00 01, expected 00 00 00 00 00 00 00 02
I already go to this link to check the Description of errors-
http://www.cisco.com/en/US/docs/wireless/controller/message/guide/msgs4.html#wp1000139
Appreciate all feedback. Thank you.

Hi Ruben,
a) After successful dot1x authentication, session keys are derived from pairwise master key.
b) When the AP transmits a key to a station by default, it expects a response back within a set timeframe.
c) If the station does not respond, the AP increments the counter and retransmits the key.
d) If the AP receives a response to first message just after the retransmission of the key, a mismatch occurs in the counter.
This in most of the cases will be a client driver problem.
Solution :
1) try to increase the EAPOL-Key Timeout ( config advanced eap ).
2) Upgrade the client driver.
*****Help out other by using the rating system and marking answered questions as "Answered"*****

Upgrade WLC 5508 Ver. 7.0.98.0 to Ver 7.6.110.0

i will upgrade WLC 5508 Ver 7.0.98.0 with License 50 AP. to Ver 7.6.110.0 will it ask to install license ?

No, It will not ask for again.
Just upgrade the software.
Regards
Dont forget to rate helpful posts

Upgrade WLC 5508 to 7.4.121.0 problem

After I upgraded WLC 5508 from 7.2.111.3 to 7.4.121.0, all 3602i APs don't associate with the controller. All APs were working/associating with controller on 7.2.111.3 at same setting. IP address of APs are setup as DHCP.
The error message is "AP couldn't get IP address".
Any one has this type of problem when you upgrade WLC 5508 from 7.2.111.3 to 7.4.121.0.
Thanks,

Hi,
This doesn't look like software issue.
You have to check why the APs are not able to get ip address. Try connecting a PC to a swtich port where one of these APs are connected and see if you are able to get IP on PC.
Also check if the DHCP server is reachable and if there are IP address in the pool assigned for APs.
HTH,
Thanks & Regards,
Ishant
*** Please rate the post if you find it useful ***

WLC 5508 WPA Authentication Problems

Hello,
We have a WLC 5508 with 7.4.100.0 Firmware.
We are using 1141 and 1142 APs and we are having authentication problems with clients that are connecting to our WLAN with WPA+AES autentication. The clients receive in her laptop a password error, and we receive the following log in wlc:
Client Excluded: MACAddress:f8:f1:eb:dd:ff:cd Base Radio MAC :08:ad:dd:76:4d:30 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.1x Authentication failed 3 times. ReasonCode: 4
The strange thing is that the problem is solved restarting the Access-points.
Anyone had this problem previusly?
Thanks in advance.

I made the configuration using the Cisco Recommended settings, the strange thing its that the users connect normally, until they starts with authentication problems. I restart the access points and the problem its solved.
Cisco Recommended and not recommended Authentication Settings
Security encryption settings need to be identical for WPA and WPA2 for TKIP and AES as shown in this image:
These images provide examples of incompatible settings for TKIP and AES:
Note: Be aware that security settings permit unsupported features.
These images provide examples of compatible settings:

Upgrade WLC 5508 to ver 7.5

hi,
I need upgrade a WLC 5508 to ver 7.5. we have aironet 1242 AG y 1131 AG and I dont see any ver AP to join
please, are there IOS to do these?
thanks
RAHA
[email protected]

Below AP models supported by WLC 7.5.x software. (see the below release note for detail)
Cisco 1040, 1130, 1140, 1240, 1250, 1260, 1600, 2600, 3500, 3500p, 3600, Cisco 600 Series OfficeExtend Access Points, 700 Series, AP801, and AP802
http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn75.html
AP will get updated image from WLC once you upgrade controller software to 7.5.x
HTH
Rasika
**** Pls rate all useful responses ****

Problem uploading SSL certificat on a WLC 5508

Hello,
I'm trying to upload a SSL-certificate (RSA:2048) on a WLC 5508 via the "Management->HTTP-HTTPS" - Tab and get the following problem :
*TransferTask: Jul 18 16:36:14.487: %UPDATE-3-CERT_INST_FAIL: updcode.c:1276 Failed to install Webauth certificate. rc = 1
*TransferTask: Jul 18 16:36:14.487: %SSHPM-3-KEYED_PEM_DECODE_FAILED: sshpmcert.c:4028 Cannot PEM decode private key
I've generated it using the following commands:
# openssl pkcs12 -export -in my.crt -inkey my.key -certfile my.ca-bundle -out CA.pfx
# openssl pkcs12 -in CA.pfx -nodes -out CA.pem
But it doesn't work...
Does anyone have an idea?
Best regards,
Eric

Hello Eric,
I'm facing the same problem, when trying to upload a chained SSL certificate (2048bits) to the wlc version 7.0.116.0
Did you use an unchained certificate and what size is your cert?
According to a Cisco document, for controllers version 5.1.151.0 and later, only unchained certificates are supported for the management certificate.
I'm just wondering, if this limitation still applies to the newer versions.
Regards,
Oliver

RF Grouping problem WLC 5508

Hi,
We have a problem regarding RF Grouping between two WLC 5508.
The two controllers have the same RF Group name,RF Grouping is enabled,they belong to the same mobility group,their management IP
address is on the same subnet, they ping each other but they don't elect a Group Leader. Each one
elects itself as the Group Leader.
We have tried to place 2 APs,each belonging to different controller, close one to the other but nothing changed.
Any help would be much appreciated.

Hi Nicolas,
Because we have an almost live network, we wouldn't like to go public with our configurations. Is there any other way we can send them to you?
Thanks in advance,
Theofilos

Windows Sharing problem from WLC 5508 to wired LAN

Dear All,
I'm having problem with windows sharing (file/printer sharing) from Wireless lan client which is connected to AP3500 and
WLC 5508 then to Nexus 7010. It's already using ip command, for example \\192.168.84.65
WLC os version 7.0.116.0 (using AP groups)
Nexus os version 4.2(6)
The weird thing is i can connect using windows sharing from wired LAN to wireless user however not vice versa.
for better explanation, here are the scenarios
1. Wireless lan to wired LAN using windows sharing - failed
1. Wired LAN to Wireless lan using windows sharing - success.
I've been analyzing by making sure that all the to end, there would be no firewall within source pc(s) and destination pc(s) and also
the ACL inside Nexus.
Been dying here to find solution for this, due to the customer is using it for file and printer sharing service.
Anyone has idea to solve this problem, i'm looking forward for any suggestion coming.
Arrai.

Peer to peer within wlc is using default setting which is allowed and as you may know, peer to peer permission only related between wireless client not wired one. CMIIW.

WLC 5508 7.0.98.0 problem with locpRxServerTask missed software watchdog

Hi
today my wlc 5508 crash. after trying to get access via sp. i doesnt reponds. so i rebooted. in the sh tech i saw this message which i gues indicates the RC of the failure.    ANY IDEAS...
*             Start Cisco Crash Handler Serv               *
Sys Name:       usa-5354-wlc-02
Model:          AIR-CT5508-K9
Version:        7.0.98.0
Timestamp:      Thu Jan 5 05:43:13 2012
SystemUpTime:   254 days 4 hrs 46 mins 24 secs
pid:            1225
TID:            944042816
Task Name:      locpRxServerTask
Reason:         Reaper Reset
timer tcb:      0x2572
timer cb:       0x10354e28 ('rrmTimerInit+600')
timer arg1:     0x19b11010
timer arg2:     0x0
Long time taken timer call back inforamtion:
--More-- or (q)uit
Time Stamp:     Thu Sep 22 15:56:24 2011
timer cb:       0x100d6f48 ('apfRldpScheduleSet+656')
Duration : 103753 usecs, cbCount= 15
Analysis of Failure:
Software was stopped by the reaper for the following reason:
     Reaper Reset: Task "locpRxServerTask" missed software watchdog

May be here is the bug that u r hitting..
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCti21343
Upgrade the image to the latest that we have (7.0.220)
Please dont forget to rate the useful posts!!
Regards
Surendra

WLC 5508 + NPS MS-CHAP v2 Auth problems

Hi,
I am having a lot of trouble trying to set up a Cisco WLC 5508 to use NPS on Windows Server 2008 as it's authentication.
When a client attempts to connect to the WLAN, the authentication is denied on Windows 7/Vista/XP, however, on Mac/iOS clients, it asks to accept the certificate (this is a public cert, issued by Entrust - however, it is a wildcard cert..), but then it will connect.
So I have two questions:
1/ Why won't the windows clients authenticate? If I set up the WLAN profile on the windows machine, and I deselect "Validate server certificate", then they connect just fine....
2/ Is it possible to make it so the user is not prompted to accept the certificate? Why can't this certificate be validated locally by the client?
Thanks,
Josh

Looks like it might have been an issue with that certificate, I don't know.
Either it didn't like the wildcard, or it didn't like the intermediate/root CA.
I downloaded a Comodo Trial SSL and plugged that in - works like a charm now!

WLC 5508 HA Problem Soft.ver 7.4.100

Similar Messages

Maybe you are looking for