Unifi AP - Isolated state

[bodminman]

Hi there,

 

last week one of our APs went into an Isolated state. So I took it off the wall and got it hooked up in my office where it plays ok.

 

When I take it back to its location it goes back to isolated.

 

Looking at the light srquence it looks though it's struggling connecting to the gateway. So I plug my laptop into another port on the switch, login, ping the g/w etc without issue so I plug the wifi point into the same port the lappy was in but still no joy.

 

I have reset the AP and re-imported it etc but this hasn't made any difference.

 

Anyone got any ideas?

 

Cheers

[m25man]

UAPs use L3 to reach the controller.

On cold boot they look for http://unifi:8080 once configured they look for http://yourunifiserverhere:8080

The reason it's isolated is because it can't find a route back to its controller.

 

Check your Vlans,IP addresses etc as this will be your issue.

Edited December 16, 2014 by m25man

[bodminman]

Cheers for the response.

 

We don't have any VLANs and the IP address is a static one.

[bodminman]

I have also let it grab a dhcp address to see if that sorts it out but still no joy.

[MatthewL]

Have you tested the cable that it is plugged into, could potentially be a damaged cable if its not working.

[bodminman]

Have you tested the cable that it is plugged into, could potentially be a damaged cable if its not working.

 

Yeah, replaced both LAN and PoE cables.

[m25man]

I have also let it grab a dhcp address to see if that sorts it out but still no joy.

 

If you know the IP address you should be able to SSH into it from there where you can see what the inform url is set to.

 

At the Busybox cmd prompt type info to get the current status.

 

You may find it useful to ensure that you have valid DNS entries and reverse lookup info for your UAPs

 

Set an A record or use a CNAME on your local DNS zone that sets the host name UNIFI to resolve to your unifi controller.

 

This way when you reset a UAP to factory and it gets a new IP it will be able to resolve your controller.

[bodminman]

If you know the IP address you should be able to SSH into it from there where you can see what the inform url is set to.

 

At the Busybox cmd prompt type info to get the current status.

 

You may find it useful to ensure that you have valid DNS entries and reverse lookup info for your UAPs

 

Set an A record or use a CNAME on your local DNS zone that sets the host name UNIFI to resolve to your unifi controller.

 

This way when you reset a UAP to factory and it gets a new IP it will be able to resolve your controller.

 

CNAME record has been created and is pointing to you cloud based management console. Other APs are working fine, it's just this one in a particular location. The AP works back in my office but not when it's where it should be.

[m25man]

I would stick a laptop on the same port as the AP connects to.

See what IP it gets and test to see if you can reach the controller.

 

Have you logged into the AP with SSH yet? What does the INFO command return?

[bodminman]

When the AP was in my office I could SSH into it and see that the correct inform URL was present. In it's current star I cannot SSH into it or indeed ping it.

 

It is plugged into a switch that has 9 PCs running from it and on one of those PCs yesterday I was logged into the controller.

 

I shall try both the port with a laptop and moving the AP to a another slot on the switch an see how it goes.

 

Thanks again for your reply @m25man.

Edited December 17, 2014 by bodminman

[bodminman]

I have plugged my lappy into the port and can ping unifi and get a response.

 

I have just SSH'd into another AP and tried pinging unifi it returns: bad address 'unifi'. If I ping FQDN unifi.blah.internal then I get a response.

 

Do I need to fix something there?

[bodminman]

Here's some more info from /var/log/messages:

 

BZ.v3.2.7# set-inform https://xxx.cloudunifi.com:8080/inform

 

Adoption request sent to 'https://xxx.cloudunifi.com:8080/inform'.

 

1. please adopt it on the controller

2. issue the set-inform command again

3. will be saved after device is successfully managed

 

BZ.v3.2.7# info

 

Model: UAP

Version: 3.2.7.2816

MAC Address: dc:9f:db:88:00:04

IP Address: 192.168.1.70

Hostname: UBNT

Uptime: 1026 seconds

 

Status: Server Reject (https://xxx.cloudunifi.com:8080/inform)

BZ.v3.2.7# tail /var/log/messages

Dec 17 01:25:13 UBNT user.info syslog: ace_reporter.reporter_next_inform_url(): next inform url[0]=http://unifi:8080/inform

Dec 17 01:25:28 UBNT user.err syslog: ace_reporter.reporter_fail(): Unable to re solve (http://unifi:8080/inform)

Dec 17 01:25:28 UBNT user.err syslog: ace_reporter.reporter_fail(): initial cont act failed #74, url=http://unifi:8080/inform, rc=1

Dec 17 01:25:28 UBNT user.info syslog: ace_reporter.reporter_next_inform_url(): next inform url[0]=http://unifi:8080/inform

Dec 17 01:25:43 UBNT user.err syslog: ace_reporter.reporter_fail(): Unable to re solve (http://unifi:8080/inform)

Dec 17 01:25:43 UBNT user.err syslog: ace_reporter.reporter_fail(): initial cont act failed #75, url=http://unifi:8080/inform, rc=1

Dec 17 01:25:43 UBNT user.info syslog: ace_reporter.reporter_next_inform_url(): next inform url[0]=http://unifi:8080/inform

Dec 17 01:25:58 UBNT user.err syslog: ace_reporter.reporter_fail(): Unable to re solve (http://unifi:8080/inform)

Dec 17 01:25:58 UBNT user.err syslog: ace_reporter.reporter_fail(): initial cont act failed #76, url=http://unifi:8080/inform, rc=1

Dec 17 01:25:58 UBNT user.info syslog: ace_reporter.reporter_next_inform_url(): next inform url[0]=http://unifi:8080/inform

[DalekSec]

I seem to be having a similar problem where our UAP is flashing orange every second (which means its initializing) and doesn't seem to stop, factory reset has done nothing just keeps flashing and I am unable to ping.

[m25man]

As your log shows the UAP is unable to resolve your controller url.

 

You can set-inform manually to see if that resolves it.

 

Where is the controller? If it's externally hosted make sure you have a CNAME record that translates unifi on your local LAN to the cloud controller.

 

You need to make sure that there is no DNS/DHCP pollution. Purge your DHCP and DNS of any duplicate IP addresses and erroneous unifi hosts.

 

Remember these things are simple.. very simple

 

They just power on, load the OS find the inform URL await instructions.

 

If they can't locate the controller they will default back to http://unifi:8080/inform

 

By having your own DNS entries that point any queries to the correct address in the event they can't find the controller over L2 they get it over L3.

 

Is there any proxy or specific IP filters applied to this subnet that might affect L3 routing?

 

Obviously a dumb device connecting to your LAN getting an IP and trying to access the Internet would be filtered without special exceptions in place?

[m25man]

Sorry just spotted the deliberate mistake

BZ.v3.2.7# set-inform https://xxx.cloudunifi.com:8080/inform

 

The inform URL should be http not https ?

 

Checkout this thread

http://community.ubnt.com/t5/UniFi-Wireless/Adopting-your-Existing-APs-to-set-inform-to-L3-Controller/m-p/471517/highlight/true#M38237

 

Reset the AP to factory and make sure you have unmanaged it on the controller before trying to readopt it.

Edited December 17, 2014 by m25man

[bodminman]

As your log shows the UAP is unable to resolve your controller url.

 

You can set-inform manually to see if that resolves it.

 

Where is the controller? If it's externally hosted make sure you have a CNAME record that translates unifi on your local LAN to the cloud controller.

 

The controller is hosted externally.

 

You need to make sure that there is no DNS/DHCP pollution. Purge your DHCP and DNS of any duplicate IP addresses and erroneous unifi hosts.

 

DNS was purged early yesterday and DHCP has been cleaned up.

 

Remember these things are simple.. very simple

 

They just power on, load the OS find the inform URL await instructions.

 

If they can't locate the controller they will default back to http://unifi:8080/inform

 

By having your own DNS entries that point any queries to the correct address in the event they can't find the controller over L2 they get it over L3.

 

I have created a CNAME record of unifi under our domain in Forward Lookup Zones that points to https://xxx.cloudunifi.com. If I ping unifi on the workstations then I get a response. If I do this via SSH on the AP it says BAD ADDRESS 'UNIFI'. If I ping unifi.domain.internal then I get a response.

 

Is there any proxy or specific IP filters applied to this subnet that might affect L3 routing?

 

We have a Lightspeed box that has been told to allow this particular IP through.

 

I have got Unifi remoting in later so I shall let you know how I get on.

[bodminman]

Sorry just spotted the deliberate mistake

BZ.v3.2.7# set-inform https://xxx.cloudunifi.com:8080/inform

 

The inform URL should be http not https ?

 

Checkout this thread

Adopting your Existing APs to set-inform to L3 Controller Address (No Factory Reset - SSH) - Ubiquiti Networks Community

 

Reset the AP to factory and make sure you have unmanaged it on the controller before trying to readopt it.

 

I double checked this with the hosting people yesterday and they insisted that it has to be https: and that they have about 500 clients that have used https for the inform url.

[bodminman]

I double checked this with the hosting people yesterday and they insisted that it has to be https: and that they have about 500 clients that have used https for the inform url.

 

I have just tried it though and still the same result.

[m25man]

The CNAME record would only need the host details not https

eg. unifi.domain.local = xxx.cloudunifi.com

 

A factory set UAP will only look for http://unifi:8080/inform it has no understanding of anything else.

 

On boot the reset UAP will search Layer2 for a controller, if nothing is found it will use Layer3 and seek http://unifi:8080

 

As you don't have an http://unifi:8080 on your LAN it will die

If you have a working DNS/CNAME it will hopefully find xxx.cloudunifi.com

However it will be looking for http://xxx.cloudunifi.com:8080/inform

(8080 is normally used as an alternate port no for http not https (8443))

https://xxx.cloudunifi.com:8443 would be used for management.

http://xxx.cloudunifi.com:8080/inform is normally a read only config file holder the UAP uses to establish comms with the controller.

Once registered it appears in the console where it can be adopted.

The controller then enrols the device fully and switches to https:// for management.

 

If as you say your Unifi Cloud Host has set your APs to connect to an https server for configuration download then this would have to be set manually into the AP via SSH.

 

I only every see these types of issues where unifi has been deployed in a home network with no proper DNS control.

If the controller and firewall is setup correctly it should just work!

 

Can you not SSH into a working UAP and verify the settings?

 

In your OP however you said if the UAP was on your own segment everything works as normal?

Which only indicates that the issue lies somewhere on your own network??

[bodminman]

I have just run a packet analysis on our Sonicwall box and got it to look at traffic to and from the AP whilst the inform command was run and there isn't anything being dropped.

 

Too make sure I had covered all bases, I created rules in the Sonicwall box to allow everything and anything from the AP IP out to the web and everything and anything from the cloud controller back into the LAN but that analysis was identical to the first one.

 

This is stumping me big time!