Option 43 vs. DNS Resolution

[Scott Pickles]

For those of us that are familiar with the process by which an AP finds its controller, we know that there is L2 broadcast, Option 43, DNS resolution, and shared neighbor information via OTP, as well as the final option to statically assign a controller IP via the 'lwapp ap controller ip address x.x.x.x'. If you watch the process via 'debug lwapp client event' process on an AP, you will see that each IP address is categorized as to how it was learned using a number (0-4). Here's my question: Are these numbers used in a priority order when an AP attempts to join a controller? I had a 1252 on a 2106 running 5.2.157.0 and no domain (the AP got its controller IP via 'option 43 ascii x.x.x.x' from a DHCP scope on a 2960 switch). Then I moved it to my lab setting, where it's a 4402-25 running 4.2.130.0 and a domain. I expected the new resolution of CISCO-LWAPP-CONTROLLER to be successful and have it join my controller. However, all I saw was the stored entries in NVRAM from the previous controller to which it was joined. I had a couple of options to force it to join my lab controller, and I chose Option 43. That seemed to work and the AP happily downgraded its code. Any thoughts/comments? I'm just surprised that the new DNS resolution (which did work b/c the debug showed 'translating [OK]') didn't allow the AP to join my lab controller.

Regards,

Scott

[laxcis]

The AP actually does join a controller (just the wrong one), so I can do those commands. Let me try that and see how it goes first.

[Scott Pickles]

If it does join a controller, then all you need to do is go into the AP and update the PRIMARY controller field and you'll be all set!!

Regards,

Scott

[laxcis]

Nope, even though the right controller name is in there, it still joins the wrong controller. Firmware version 4.1.8 of the WLC.

[laxcis]

Ok, so I was able to get the pwd changed on the AP, and clear the lwapp and configure it for the other controller. Do I need to do any sort of save like a copy run start that I normally do on Cisco switches?

[Scott Pickles]

No. It saves immediately.

[laxcis]

Scott - Just want to say thank you for all the time you spent on this with me. I really appreciate it. The AP's are now locating the right controller, but it's not due to manually configuring the AP. Honestly, I'm not 100% sure why they are locating it now but I think it may be because I removed one of the two DNS entries for the LWAPP Controller. I had two entries for both controllers. Removed one, and now the AP's go to the right controller. I'll probably re-add the other entry now after the fact. Thanks again. I think this is solved.

[Scott Pickles]

Laxcis -

No problem, my pleasure. To clarify, you can have multiple DNS entries for CISCO-LWAPP-CONTROLLER, but each time it must point to a different IP address. The fact that you had 4 DNS entries when you only needed 2 surely confused your APs. If you would be so kind as to rate the post(s), I'd appreciate it.

Edit: Even with multiple ways of finding a controller, you still want to make sure you fill in your PRIMARY and SECONDARY controller host names. This is what the AP will use to query a controller to join first, and if that controller is full it will go on to the next one. This is also the method by which you can manually distribute and load balance your APs across multiple controllers, as well as what the APs use for failover/fallback.

Now, does anyone have an answer to my original post..? :)

Regards,

Scott

[laxcis]

I actually had 2 DNS entries, and each one was indeed pointing to a different controller. So in theory, it should have been ok, but in reality, it wasn't. Once I deleted the 1 entry, then they only found the other controller, which is what I wanted. I always do fill in the Primary and Secondary, but it doesn't seem to always work that great. I have read to on here that the GUI for those fields really don't do much. It's better to use the CLI. Thanks again.

[Scott Pickles]

Got it - you can't run the command 'clear lwapp private-config' UNLESS the default user/pass HAS been changed. Once those parameters are changed, you'll have the ability to run that command. However, in this case it isn't necessary. Just use the 'lwapp ap controller ip address x.x.x.x' command and you should be all set. Never hurts to use the reset button too. Just hold it down for 1-2 sec. while powering on the AP and let go when you see the LED go amber.

Regards,

Scott

[laxcis]

I'm confused. I need to change the username/pwd, but not sure how to do that.

[Leo Laohoo]

You'll get this error message when you are running the IOS that the WLC has dished out. Boot into the RCV firmware and then you can run the command.

[Scott Pickles]

Laxcis -

If I wasn't clear in my previous post, if you are either telnetted or consoled into the controller, your debug should show up immediately in your terminal emulation software (i.e. HyperTerminal/PuTTY/CRT/etc.). If you are NOT seeing any debug traffic, then your APs are not able to reach the controller and thus you are not seeing any traffic. A few things that will cause this immediately are these:

1. Firewall blocking ports UDP 12222/12223 (used to send LWAPP packets to/from controller)

2. Incorrect tagging on the interface directly connected to the controller. Remember, the controller ports are hard coded 1 gigabit, full duplex, dot1q trunks.

3. Incorrect port configuration on the switch. Your switchport that connects to your controller MUST be 1 gigabit, full duplex, dot1q trunk.

4. You are not allowing all VLANs across your trunk link (only applies if you chose not to put your controller management IP address on your native VLAN).

Regards,

Scott

[laxcis]

Thanks. Would you be able to tell me how to hard code my AP with the controller I want? That would be terrific. It's a 1242.

I do have another question relating to Option 43 vs DNS. What happens if you have both? I'm thinking this may be my problem, and why my AP's are going to the wrong controller. In DNS, we have the entry for the one wireless controller (CISCO-LWAPP-CONTROLLER), but not for the other WLC. Instead, for that we have option 43. I guess what I am wondering is, how do you do multiple DNS entries for more than 1 WLC? Doesn't the name in DNS need to be CISCO-LWAPP-CONTROLLER? Or should that be the name of the controller?

[talmadari]

Hi Scott,

After moving the AP into your LAB, where the WLC 4402 is connected, did the AP was connected into the same segment where the WLC is sitting?

I think that it is obvious that the AP will keep his controller IP (if it was retained through DNS or DHCP) because of the redundancy issue.

[Scott Pickles]

Talmadari -

Whether the AP is on the same subnet or not really just tells me which discovery methods the AP can/will use. Cisco hasn't recommended L2 in quite a while, and my particular configuration is L3. The APs are on a different subnet. Therefore, it should have gotten a controller address from either DNS or Option 43, or possibly both. Prior to adding Option 43, it should have picked up the address for the 4402 from the DNS server in the domain since it is configured to respond. In addition, debug on the AP indicated that it resolved CISCO-LWAPP-CONTROLLER successfully. So I'm not really sure what your point is. Whether it was on the same subnet or not, the LWAPP join process should have shown the new controller IP address for my lab controller. I agree with you that the AP properly stored the previous controller addresses, but it should have at least learned the new ones via the standard LWAPP join process and then decided 'I already have a primary configured so I'm going to use that.'

Regards,

Scott