Troubleshoot an AP that Does Not Join a Controller
Available Languages
Introduction
This document describes the show ap join stats commands in Cisco Wireless AireOS controller and demonstrates how to use them effectively.
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
This document uses Cisco AireOS controller versions.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Conventions
Refer to Cisco Technical Tips Conventions for more information on document conventions.
Background Information
This document provides information about the new show ap join stats commands in controller version 4.2.61.0 and demonstrates how to use them effectively. For more information, refer toTroubleshoot a Lightweight Access Point Not Joining a Wireless LAN Controller to effectively troubleshoot why an access point (AP) does not join a controller. If the AP does not send a join to the controller, you need to troubleshoot at the AP.
This document applies to all the controller (WLC) versions from 4.2.61 to the latest version of 7.2.103.
Several example outputs of different errors that occur on the controller are after the Background Information and Troubleshoot Algorithm sections.
In controller version 4.2.61.0, the controller now keeps track of all APs that send it a discovery request and which APs it sends a discovery reply to. It also tracks APs that try to join the controller and whether or not they are successful. There are 2 new CLI (console or SSH) commands on the controller to help troubleshoot why an AP can fail to join the controller:
show ap join stats summary [all | AP_Mac_Address] show ap join stats detail <AP_Mac_Address>
Troubleshoot Algorithm
Use the show ap join stats summary all command to see which APs do not join the controller. The AP is inserted into the show ap join stats list as soon as the controller receives a discovery request.
Note: The controller never removes the AP from the show ap join stats list until the controller is rebooted. In some cases, the failed APs have tried to join for more than a day or are completely offline. Use the show ap join stats detail command to find out when the last discovery request and last join request were sent from the AP to determine if the AP has lost connectivity to the controller or has possibly moved to another controller.
The output gives the total number of APs from which the controller has received discovery requests, and then lists whether or not those APs are currently joined to the controller.
(Cisco Controller) > show ap join stats summary all Number of APs................................. 3 00:0b:85:1b:7c:b0............................. Joined 00:12:44:bb:25:d0............................. Joined 00:13:19:31:9c:e0............................. Not joined
Once you have the MAC address of the AP that is not joined, use the show ap join stats summary <mac addr> to discover the last join and reason for failure.
(Cisco Controller) >show ap join stats summary 00:14:f2:63:12:50 Is the AP currently connected to controller............. Yes Time at which the AP joined this controller last time... Jan 24 12:21:32.414 Type of error that occurred last........................ AP got or has been disconnected Reason for error that occurred last..................... Timed out while waiting for ECHO response from the AP Time at which the last join error occurred.............. Jan 24 12:21:14.751
If you want detailed information on discovery requests, join requests, and configuration requests, use thecommand show ap join stats detail <mac-address>. This command also indicates whether or not the controller sees only a discovery request from the AP but does not see a join request.
(Cisco Controller) >show ap join stats detail 00:14:f2:63:12:50 Discovery phase statistics - Discovery requests received........................... 2 - Successful discovery responses sent................... 2 - Unsuccessful discovery request processing............. 0 - Reason for last unsuccessful discovery attempt........ Not applicable - Time at last successful discovery attempt............. Jan 24 12:21:20.547 - Time at last unsuccessful discovery attempt........... Not applicable Join phase statistics - Join requests received................................ 2 - Successful join responses sent........................ 2 - Unsuccessful join request processing.................. 0 - Reason for last unsuccessful join attempt............. Not applicable - Time at last successful join attempt.................. Jan 24 12:21:30.669 - Time at last unsuccessful join attempt................ Not applicable Configuration phase statistics - Configuration requests received....................... 2 - Successful configuration responses sent............... 2 - Unsuccessful configuration request processing......... 0 - Reason for last unsuccessful configuration attempt.... Not applicable - Successful configuration attempt...................... Jan 24 12:21:32.414 - Time at last unsuccessful configuration attempt....... Not applicable Last AP message decryption failure details - Reason for last message decryption failure............ Not applicable Last AP disconnect details - Reason for last AP connection failure................. Timed out while waiting for ECHO response from the AP Last join error summary - Type of error that occurred last...................... AP got or has been disconnected - Reason for error that occurred last................... Timed out while waiting for ECHO response from the AP - Time at which the last join error occurred............ Jan 24 12:21:14.751
Example 1
In this case, the time on the controller is incorrect. The error indicates that the APs certificate payload is invalid. This error occurred because the time on the controller was outside of the certificates validity time interval. Ensure that the show time command indicates the correct time.
Note: The Mar 6, 1993 time values in the output below. This is where the clock starts for the controller without NTP configured.
The three phases of the AP that join report statistics with time stamps are the Discovery, Join, and Configuration Phase. Check the Last Error Summary to find out why the AP failed to join or disconnect reason.
(Cisco Controller) >show ap join stats detailed 00:14:1b:5a:40:10 Discovery phase statistics - Discovery requests received........................... 2 - Successful discovery responses sent................... 1 - Unsuccessful discovery request processing............. 2113123 - Reason for last unsuccessful discovery attempt........ Discovery request received on unsupported VLAN - Time at last successful discovery attempt............. Mar 06 19:03:50.779 - Time at last unsuccessful discovery attempt........... Mar 06 19:03:50.782 Join phase statistics - Join requests received................................ 1 - Successful join responses sent........................ 0 - Unsuccessful join request processing.................. 1 - Reason for last unsuccessful join attempt............. Certificate payload in join request contains invalid certificate - Time at last successful join attempt.................. Not applicable - Time at last unsuccessful join attempt................ Mar 06 19:04:00.810 Configuration phase statistics - Configuration requests received....................... 0 - Successful configuration responses sent............... 0 - Unsuccessful configuration request processing......... 0 - Reason for last unsuccessful configuration attempt.... Not applicable - Time at last successful configuration attempt......... Not applicable - Time at last unsuccessful configuration attempt....... Not applicable Last AP message decryption failure details - Reason for last message decryption failure............ Not applicable Last AP disconnect details - Reason for last AP connection failure................. Not applicable Last join error summary - Type of error that occurred last...................... Lwapp join request rejected - Reason for error that occurred last................... Certificate payload in join request contains invalid certificate - Time at which the last join error occurred............ Mar 06 19:04:00.810
Example 2
In this case, the AP sends the discovery request on a VLAN other than the management IP address VLAN. The controller rejects all discovery requests that are not received on the management interface subnet.
(Cisco Controller) >show ap join stats detailed 00:14:1b:5a:40:10 Discovery phase statistics - Discovery requests received........................... 10 - Successful discovery responses sent................... 5 - Unsuccessful discovery request processing............. 2113123 - Reason for last unsuccessful discovery attempt........ Discovery request received on unsupported VLAN - Time at last successful discovery attempt............. Jan 30 14:30:12.284 - Time at last unsuccessful discovery attempt........... Jan 30 14:30:12.288 Join phase statistics - Join requests received................................ 4 - Successful join responses sent........................ 0 - Unsuccessful join request processing.................. 4 - Reason for last unsuccessful join attempt............. Certificate payload in join request contains invalid certificate - Time at last successful join attempt.................. Not applicable - Time at last unsuccessful join attempt................ Mar 06 19:19:03.345 Configuration phase statistics - Configuration requests received....................... 0 - Successful configuration responses sent............... 0 - Unsuccessful configuration request processing......... 0 - Reason for last unsuccessful configuration attempt.... Not applicable - Time at last successful configuration attempt......... Not applicable - Time at last unsuccessful configuration attempt....... Not applicable Last AP message decryption failure details - Reason for last message decryption failure............ Not applicable Last AP disconnect details - Reason for last AP connection failure................. Not applicable Last join error summary - Type of error that occurred last...................... Failed to send Lwapp discovery response - Reason for error that occurred last................... Discovery request received on unsupported VLAN - Time at which the last join error occurred............ Jan 30 14:30:12.288 (Cisco Controller) >
Example 3
In this case, the AP moved from this controller to its primary controller.
Note: The error can be generated for multiple reasons, one of which is a network interruption.
(Cisco Controller) >show ap join stats detailed 00:14:1b:5a:40:10
Discovery phase statistics
- Discovery requests received........................... 23
- Successful discovery responses sent................... 23
- Unsuccessful discovery request processing............. 0
- Reason for last unsuccessful discovery attempt........
Not applicable
- Time at last successful discovery attempt.............
Jan 30 14:39:38.526
- Time at last unsuccessful discovery attempt...........
Not applicable
Join phase statistics
- Join requests received................................ 21
- Successful join responses sent........................ 21
- Unsuccessful join request processing.................. 0
- Reason for last unsuccessful join attempt.............
Not applicable
- Time at last successful join attempt..................
Jan 30 14:39:07.085
- Time at last unsuccessful join attempt................
Not applicable
Configuration phase statistics
- Configuration requests received....................... 21
- Successful configuration responses sent............... 21
- Unsuccessful configuration request processing......... 0
- Reason for last unsuccessful configuration attempt....
Not applicable
- Time at last successful configuration attempt.........
Jan 30 14:39:09.481
- Time at last unsuccessful configuration attempt.......
Not applicable
Last AP message decryption failure details
- Reason for last message decryption failure............
Not applicable
Last AP disconnect details
- Reason for last AP connection failure.................
Timed out while waiting for ECHO response from the AP
Last join error summary
- Type of error that occurred last......................
AP got or has been disconnected
- Reason for error that occurred last...................
Timed out while waiting for ECHO response from the AP
- Time at which the last join error occurred............
Jan 30 14:40:15.451
Example 4
In this case, the self-signed certificate (SSC) of the AP was not correct on the controller. The controller always checks its local database before it forwards the request to a defined radius server. As a result, the"RADIUS authorization pends for AP" error message appears when the controller does not find the SSC locally.
(Cisco Controller) >show ap join stats detailed 00:13:5f:fa:88:50 Discovery phase statistics - Discovery requests received........................... 2 - Successful discovery responses sent................... 1 - Unsuccessful discovery request processing............. 2113123 - Reason for last unsuccessful discovery attempt........ Discovery request received on unsupported VLAN - Time at last successful discovery attempt............. Jan 30 14:58:58.070 - Time at last unsuccessful discovery attempt........... Jan 30 14:58:58.071 Join phase statistics - Join requests received................................ 1 - Successful join responses sent........................ 0 - Unsuccessful join request processing.................. 1 - Reason for last unsuccessful join attempt............. RADIUS authorization is pending for the AP - Time at last successful join attempt.................. Not applicable - Time at last unsuccessful join attempt................ Jan 30 14:59:13.111 Configuration phase statistics - Configuration requests received....................... 0 - Successful configuration responses sent............... 0 - Unsuccessful configuration request processing......... 0 - Reason for last unsuccessful configuration attempt.... Not applicable - Time at last successful configuration attempt......... Not applicable - Time at last unsuccessful configuration attempt....... Not applicable Last AP message decryption failure details - Reason for last message decryption failure............ Not applicable Last AP disconnect details - Reason for last AP connection failure................. Radius authorization of the AP has failed Last join error summary - Type of error that occurred last...................... AP got or has been disconnected - Reason for error that occurred last................... Radius authorization of the AP has failed - Time at which the last join error occurred............ Jan 30 14:59:13.117 (Cisco Controller) >
Example 5
(Cisco Controller) >show ap join stats detailed 0026cb8168c0 Discovery phase statistics - Discovery requests received.............................. 202 - Successful discovery responses sent...................... 0 - Unsuccessful discovery request processing................ 0 - Reason for last unsuccessful discovery attempt........... Not applicable - Time at last successful discovery attempt................ Not applicable - Time at last unsuccessful discovery attempt.............. Not applicable Join phase statistics - Join requests received................................... 122 - Successful join responses sent........................... 0 - Unsuccessful join request processing..................... 0 - Reason for last unsuccessful join attempt................ Not applicable - Time at last successful join attempt..................... Not applicable - Time at last unsuccessful join attempt................... Not applicable Configuration phase statistics - Configuration requests received.......................... 115 - Successful configuration responses sent.................. 0 - Unsuccessful configuration request processing............ 0 - Reason for last unsuccessful configuration attempt....... Not applicable --More-- or (q)uit - Time at last successful configuration attempt............ Not applicable - Time at last unsuccessful configuration attempt.......... Not applicable Last AP message decryption failure details - Reason for last message decryption failure............... Not applicable Last AP disconnect details - Reason for last AP connection failure.................... Image data request received from an unsupported AP Last join error summary - Type of error that occurred last......................... AP got or has been disconnected - Reason for error that occurred last...................... Image data request received from an unsupported AP - Time at which the last join error occurred............... Feb 16 00:50:16.841
Discovery phase statistics - Discovery requests received.............................. 44 - Successful discovery responses sent...................... 44 - Unsuccessful discovery request processing................ 0 - Reason for last unsuccessful discovery attempt........... Not applicable - Time at last successful discovery attempt................ Feb 26 18:36:24.098 - Time at last unsuccessful discovery attempt.............. Not applicable Join phase statistics - Join requests received................................... 44 - Successful join responses sent........................... 0 - Unsuccessful join request processing..................... 44 - Reason for last unsuccessful join attempt................ Join request receive d from an unsupported AP - Time at last successful join attempt..................... Not applicable - Time at last unsuccessful join attempt................... Feb 26 18:36:39.497 Configuration phase statistics - Configuration requests received.......................... 0 - Successful configuration responses sent.................. 0 - Unsuccessful configuration request processing............ 0 - Reason for last unsuccessful configuration attempt....... Not applicable - Time at last successful configuration attemp--More-- or (q)uit t............ Not applicable - Time at last unsuccessful configuration attempt.......... Not applicable Last AP message decrytion failure details - Reason for last message decryption failure............... Not applicable Last AP disconnect details - Reason for last AP connection failure.................... Not applicable Last join error summary - Type of error that occurred last......................... Lwapp join request r ejected - Reason for error that occurred last...................... Join request receive d from an unsupported AP - Time at which the last join error occurred............... Feb 26 18:36:39.497
Related Information
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
5.0 |
12-Jun-2024 |
Added Note Container.
Updated Formatting. |
4.0 |
09-May-2024 |
Recertification. |
3.0 |
11-Apr-2023 |
Update formatting. Reviewed technical information. Recertification. |
1.0 |
26-Feb-2008 |
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)