Your Cisco WLC is 10 years old and everything will break

[mavhc]

Turns out Cisco WLCs (4402 etc) have a 10 year certificate, and if you reboot after then all the APs mysteriously fail to connect

 

https://supportforums.cisco.com/t5/wireless-mobility-documents/lightweight-ap-fail-to-create-capwap-lwapp-connection-due-to/ta-p/3155111

 

For 7.0.252.0:

config ap lifetime-check mic enable

config ap lifetime-check ssc enable

 

then save the new settings

[Koldov]

Am I right in reading that link was from 2015?

 

I have contacted our support contractor to ask whether this is on their radar.

 

They have said they are aware of it, but Cisco have not released any patches yet...

 

We have a Cisco Catalyst 3750G Integrated Wireless LAN Controller and I see about a third of the way down the page there is a section with various software maintenance releases for various flavours of AireOS to fix it.

 

Does anyone know if this is the OS used on our controller?

 

If so should I get back to them and ask for it to be rolled out asap?

[mavhc]

Yeah, you want the final upgrade for it 7.0.252 which adds the ability to fix the 10 year problem

 

https://software.cisco.com/download/home/280636453/type/280926587/release/7.0.252.0?catid=278875243

 

https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn70mr7.html

[christhetech]

We migrated away from controller based Cisco to Meraki a couple of years ago, and the best advice that I can give is if you don't have to do it, don't. I hate the Meraki solution that we have in place with a passion. Just wish we had the budget to start all over again.

[mavhc]

We migrated away from controller based Cisco to Meraki a couple of years ago, and the best advice that I can give is if you don't have to do it, don't. I hate the Meraki solution that we have in place with a passion. Just wish we had the budget to start all over again.

 

Interesting, what's the problem with it?

[christhetech]

Interesting, what's the problem with it?

 

It was done by a colleague, who is no longer with us and he was a bit of a wide boy tbh. He tried to do it all as cheaply as possible and rolled it out in stages. The only problem is, every time he added APs, he didn't co-term the licensing and just bought whatever was the easiest option at the time, or within budget, so some of the licences were for 5 years, some for 3 and some just 1 and it's all over the place. What I discovered a couple of months back was that the APs were actually linked to separate accounts, so when the one year licences expired, the AP's couldn't "borrow" from the other existing APs with valid licensing in place, so only a bit of the school's WiFi coverage was down, which drove me potty whilst I tried to work out the problem. I've now finally managed to co-term all of the licensing into a single account and it's working fine - touch-wood. It was a real ball-ache to sort out though and I could have quite happily choked the absolute chode who set it all up in the first place. Still don't like it though and still have nightmares about the constant moaning about the WiFi not working in a few selected classrooms and being really flaky in a couple of others - all the areas where the APs were bought with single year licences, as I later discovered!

[atcoates]

Still don't like it though and still have nightmares about the constant moaning about the WiFi not working in a few selected classrooms and being really flaky in a couple of others - all the areas where the APs were bought with single year licences, as I later discovered!

 

Just in case you haven't seen it the new wireless health section in the Meraki dashboard will give you a better picture of what's happening now. Might be useful in working out why they're dropping connection.

[mavhc]

Yeah, I wouldn't buy anything that required ongoing licences in the first place, if your product has bugs, that's your fault, you should pay me for beta testing it, and free updates should be a standard thing

[atcoates]

There's a big difference between getting updates and getting product development as part of a licence.

[mavhc]

Right, it's wifi, what else are they going to add, if they're selling you a new AP then they get the money that way.

[Koldov]

if your product has bugs

 

Well, in all honesty that could be said about every piece of software/hardware/firmware in the history of computing....

 

Anyway, our support have looked into it:

 

I have checked the bug report for LAP/WLC MIC or SSC lifetime expiration causes DTLS failure CSCuq19142 and the version you are running is not on the list of known affected releases. I have also checked the release notes for version 7.4.110.0 and there is no mention of this bug in the known caveats. As everything is currently working and you do not appear to be at risk I would advise to keep the controller at it's current firmware revision.

 

Whether that's true or not, I don't know...

 

As this seems to contradict:

 

https://www.cisco.com/c/en/us/support/docs/field-notices/639/fn63942.html

 

But he did link me to this (not sure if the bug would appear in release notes if it's been found afterwards...):

 

https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn74mr01.html#pgfId-978472

 

Wow, talk about bugs... (or should I say Open Caveats).

Edited June 20, 2018 by Koldov

[atcoates]

Right, it's wifi, what else are they going to add, if they're selling you a new AP then they get the money that way.

Updates are more in the backend management of them.

[mavhc]

we updated the admin web page because we wrote it badly in the first place

 

Looks like you want 7.4.140.0 if you're on the 7.4 track. You'd think a managed service would be actually installing new versions proactively, otherwise what's the point in having one? Tell them to do their job, test new releases and then install them.

[Koldov]

You'd think a managed service would be actually installing new versions proactively, otherwise what's the point in having one?

 

Yeah, they were originally given the contract by the LEA to install a whole new network during the BSF funding project.

 

It's a legacy that we have retained (just a support contract rather than a fully managed service though) so it was just installed and then forgotton about. Letting it limp on until it eventually dies and trying to do the minimum of work until then, unless something actually breaks...

[mavhc]

Yeah, they were originally given the contract by the LEA to install a whole new network during the BSF funding project.

 

It's a legacy that we have retained (just a support contract rather than a fully managed service though) so it was just installed and then forgotton about. Letting it limp on until it eventually dies and trying to do the minimum of work until then, unless something actually breaks...

 

A private company is trying to do the min work possible on a government contract? I'm shocked.

 

Council said we should get this Cisco VoIP system, had BT set it up, they had the login, and an external ip set up, used the same password everywhere I guess because one day a chinese ip connected and started trying to make calls on random numbers, we only noticed when they accidentally called 999 at 3am and 999 complained to us. Phoned the council, "we don't know how to use that system that we said you should get and BT were supposed to be managing"

 

IBM makes all its money from selling support and then doing the least possible with the least trained most outsourced cheapest labour, the entire managed system idea is a complete scam in 99% of cases

[Koldov]

I'm wondering whether it's worth trying to get the school to pay to get me a couple of Cisco qualifications and then just not renewing the support contract....

 

Just a little unsure about taking on a whole network!

[mavhc]

If you have some time and a spare switch (£10 from ebay) it's pretty easy to learn, loads of online docs, videos etc

[Koldov]

Looks like you want 7.4.140.0 if you're on the 7.4 track.

 

Thanks, I have queried their initial response with the link I posted and have had a reply back that they will remote in to upgrade to version 7.4.140.0.

 

Is this a 'fixed' version? Or does it just have the ability to allow the commands to be input?

 

If you have some time and a spare switch (£10 from ebay) it's pretty easy to learn, loads of online docs, videos etc

 

Unfortunately I'm not sure it will fly. I can't tell the Head that he can cancel the contract because I watched a few videos online (even though between that and EDUGEEK, it's how I fix most things)... Also, I don't think I have THAT much spare time!

[mavhc]

Thanks, I have queried their initial response with the link I posted and have had a reply back that they will remote in to upgrade to version 7.4.140.0.

 

Is this a 'fixed' version? Or does it just have the ability to allow the commands to be input?

 

 

 

Unfortunately I'm not sure it will fly. I can't tell the Head that he can cancel the contract because I watched a few videos online (even though between that and EDUGEEK, it's how I fix most things)... Also, I don't think I have THAT much spare time!

 

It's fixed as in you can input the commands to disable the date check.

 

If he wants to pay for you to watch some videos and then get a certificate, that'll do too. Start by getting the current switch/wifi configs, and learn what everything in there means, then you'll know more than the people who just copy and pasted the config from the last person

[goldenratio]

if you want an easy fix to the 10 year issue, just set the date back APJoin will kick back in, change the date back to current... we are having to do this, its a pain

[mavhc]

Can't you upgrade to the latest version?

[mavhc]

Testing some old APs, they won't connect because they never got the update to ignore the date, so have to disable ntp on wlc, set time back, plug each one in, wait 5 mins...

[bonjour]

Sorry for reviving an old thread...

 

We're starting to experience this issue, with our WLAN having been installed under BSF 10 years ago. Unfortunately our WLAN controller is running software version 7.0.220.0, so we can't run the command/s to ignore the certificate and we're manually setting the time back in order to allow access points to join the WLAN controller.

 

Is there any way to get hold of a more recent version of the software without a maintenance contract? Would save a bit of hassle in changing the date back and forth.

[mavhc]

Sorry for reviving an old thread...

 

We're starting to experience this issue, with our WLAN having been installed under BSF 10 years ago. Unfortunately our WLAN controller is running software version 7.0.220.0, so we can't run the command/s to ignore the certificate and we're manually setting the time back in order to allow access points to join the WLAN controller.

 

Is there any way to get hold of a more recent version of the software without a maintenance contract? Would save a bit of hassle in changing the date back and forth.

 

Yes, handily the cisco website gives md5 hashes for their downloads....

[bonjour]

Sneaky. Thank you...