8

I have a 1260 AP that I upgraded this morning. Prior to the upgrade, the system permitted ssh and would respond to pings on the network, however now it does not respond.

I hooked up a serial cable and surfing around the config I can't seem to find anything amiss, and turning on ssh debugging is not producing any output.

I tried regenerating the RSA key in the off chance that was causing ssh to not come online, however it has not affected the inability to contact the unit over the network.

I also tried turning on "ip routing" and "ip cef" thinking they might be the issue, but no effect. I also added a static default route out to our management gateway in hopes that perhaps it was a default route issue but it also did not help

Here's the current version of IOS on the unit:

Cisco IOS Software, C1260 Software (AP3G1-K9W7-M), Version 15.2(2)JB, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Mon 10-Dec-12 23:42 by prod_rel_team

ROM: Bootstrap program is C1260 boot loader
BOOTLDR: C1260 Boot Loader (AP3G1-BOOT-M), Version 12.4 [mpleso-ap_jmr3_esc_0514 125]

Here's the current running config:

DEN-AP01#sh run full
Building configuration...

Current configuration : 3535 bytes
!
! Last configuration change at 00:22:30 UTC Mon Mar 1 1993 by gbeech
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname DEN-AP01
!
!
logging rate-limit console 9
logging console warnings
enable secret 5 redacted
!
no aaa new-model
ip cef
ip domain name ds.stackexchange.com
!
!
!
dot11 syslog
dot11 vlan-name DEN-CLIENTS vlan 20
dot11 vlan-name DEN-MGMT vlan 10
dot11 vlan-name DEN-WIRELESS vlan 50
!
dot11 ssid StackGuest
   vlan 50
   authentication open
   authentication key-management wpa version 2
   mbssid guest-mode
   wpa-psk ascii 7 redacted
!
!
dot11 network-map
crypto pki token default removal timeout 0
!
!
!
!
bridge irb
!
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption mode ciphers tkip
 !
 encryption vlan 50 mode ciphers aes-ccm tkip
 !
 ssid StackGuest
 !
 antenna gain 0
 mbssid
 speed  basic-1.0 basic-2.0 basic-5.5 basic-11.0 basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0
 channel 2427
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.50
 encapsulation dot1Q 50
 no ip route-cache
 bridge-group 50
 bridge-group 50 subscriber-loop-control
 bridge-group 50 spanning-disabled
 bridge-group 50 block-unknown-source
 no bridge-group 50 source-learning
 no bridge-group 50 unicast-flooding
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 !
 encryption vlan 50 mode ciphers tkip
 !
 encryption mode ciphers tkip
 !
 ssid StackGuest
 !
 antenna gain 0
 dfs band 3 block
 mbssid
 channel dfs
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.50
 encapsulation dot1Q 50
 no ip route-cache
 bridge-group 50
 bridge-group 50 subscriber-loop-control
 bridge-group 50 spanning-disabled
 bridge-group 50 block-unknown-source
 no bridge-group 50 source-learning
 no bridge-group 50 unicast-flooding
!
interface GigabitEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 no keepalive
 bridge-group 20
 bridge-group 20 spanning-disabled
 no bridge-group 20 source-learning
!
interface GigabitEthernet0.10
 encapsulation dot1Q 10
 no ip route-cache
 bridge-group 1
 bridge-group 1 spanning-disabled
 no bridge-group 1 source-learning
!
interface GigabitEthernet0.50
 encapsulation dot1Q 50
 no ip route-cache
 bridge-group 50
 bridge-group 50 spanning-disabled
 no bridge-group 50 source-learning
!
interface BVI1
 ip address 10.15.0.6 255.255.255.0
 no ip route-cache
!
interface BVI50
 no ip address
 no ip route-cache
!
ip default-gateway 10.15.0.1
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip route 0.0.0.0 0.0.0.0 10.15.0.1
!
access-list 111 permit tcp any any neq telnet
bridge 1 route ip
!
!
!
line con 0
 access-class 111 in
line vty 0 4
 login local
 transport input ssh
line vty 5 15
 login local
 transport input ssh
!
end

Any suggestions would be appreciated, I'm pretty stumped as to why this would suddenly go wrong.

EDIT: Here's the recreating of crypto keys output.

DEN-AP01(config)#crypto key generate rsa modulus 1024
% You already have RSA keys defined named DEN-AP01.ds.stackexchange.com.
% They will be replaced.

% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 1 seconds)

DEN-AP01(config)#
*Mar  1 01:02:01.411: %SSH-5-DISABLED: SSH 1.99 has been disabled
*Mar  1 01:02:02.515: %SSH-5-ENABLED: SSH 1.99 has been enabled
Improve this question
3
  • I would turn "no ip routing" back on. Can you ping from the AP to your gateway? To something beyond your gateway?
    – Peter
    May 15, 2013 at 18:32
  • I don't notice any wired ethernet port configuration. How are you trying to reach this IOS host? Over the wired? Wireless? If you have console access (looks like it), can you see what routes are known with "show ip route" or interfaces with "show ip interface brief"? Does "show interface" show packet counters increasing?
    – jof
    May 16, 2013 at 0:52
  • We had similar problems after upgrading our Aironets to the 15.0 Family. I've been told that the dot1q support is pretty buggy and, if you need VLANs on your AP, the only solution is to downgrade to 12.4 .
    – Marco Marzetti
    May 16, 2013 at 9:05

4 Answers 4

Reset to default
4

They only support BVI1. This wasn't enforced either by bug or whatever in 12.X but in 15.X any extra BVI breaks management access. Worked with TAC on this issue over a week period. Can reproduce the issue on any of the APs with 15.X.

So a simple no int BVI50 should fix the original config. Plus a reload after making the change.

Made a couple edits now that I'm not on my iPad. Anyways, I had this issue on 2 1262s that I updated at my local office and 1 1252 at a remote plant (20min away thankfully). Once the issue was resolved by removing the extra BVIs I had on all the APs (before upgrading anymore), I was able to update 25 remotely across the globe without a hitch.

Improve this answer
1

Your configuration above doesn't show a crypto key configuration. There should be something like:

crypto pki certificate chain TP-self-signed-1306837737  
  certificate self-signed 01  
  3082022B 30820194  
  ((snip snip :))  
  quit

I would try re-running the crypto key generate rsa command.

Improve this answer
2
  • 1
    after recreating the rsa key, I then decided to do a "sh run all" and was greeted to 4500 lines of "no logging source-interface" -- I don't know if this is expected or not, but now I'm thinking its time to nuke the unit from orbit and start fresh.
    – Peter Grace
    May 15, 2013 at 18:31
  • I think that's related to IOS 15 trying to log to a remove server... but, yeah, I'm not sure what else to suggest. I've worked with ssh/IOS15, but not with the APs.
    – Craig Constantine
    May 15, 2013 at 18:42
1

After restoring the unit to factory defaults and reprogramming it, the AP began functioning properly once more. I'm chalking it up to "attempted upgrade gone awry."

Improve this answer
0
0

Different beast in that it's a router with an integrated AP module but after upgrading my 897VAW router's AP to 15.3 from 12.x, I couldn't ping / http / ssh to BVI. Reviewing @petergrace's config, I notice I was missing the ip route command. Not sure if this was removed by the upgrade or I didn't need it before.

In the AP config, I added:

ip route 0.0.0.0 0.0.0.0 10.10.40.1

Where 10.10.40.1 is the default gateway of interface VLAN40. The 897 is a router with an AP module. On the router side, I also had to add switchport trunk native vlan 40 to interface Wlan-GigabitEthernet8 as in:

interface Wlan-GigabitEthernet8
 description Internal switch interface connecting to the embedded AP
 switchport trunk native vlan 40
 switchport mode trunk
 no ip address
!

Which I believe is what is meant by Cisco's release note, documented here:

Autonomous AP Will Treat The Sub-interface Tied To Bridge-group1 As The Native Vlan When using a configuration on an autonomous AP where there is no native VLAN defined, each interface is being dot1q tagged, communication will fail after upgrading to releases 15.3(3)JC5 or later. It appears that the configuration is still correct after the upgrade, but the AP sends the untagged frames for bridge-group 1, even though the encapsulation is not defined as native. The autonomous AP will treat the sub-interface tied to bridge-group 1 as the native VLAN, even if it is not defined with the native keyword: "encapsulation dot1 native". The VLAN associated with bridge-group 1 must be set to native on the connecting switchport configuration

The workaround for this is to configure VLAN 100 as the native VLAN on the connected switchport trunk, even though the encapsulation is not specified as native on the AP.

Similar issue discussed here, however, I didn't need to add switchport trunk native vlan 40 to the Dot11RadioX.40 and GigabitEthernet0.40 interfaces, but I did have to add encapsulation dot1Q 40 native to Dot11RadioX.40 and GigabitEthernet0.40.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.