I currently have a WLC 4404 running Management Interface IP is AP-management interface is Remote facility (facility A) has a VLAN created for wireless (455) and a VLAN 455 interface created with IP Ports on the remote switch (switch B) have been added to VLAN 455 and AP's have been patched into these ports. The AP's are receiving IP addresses via a DHCP scope created specifically for this VLAN ( /24) which is physically located at the local facility (facility B). The AP's are successfully receiving IP's from this DHCP scope. This switch is trunked to switch A in the same building. Switch A has a VLAN 455 interface configured with IP VLAN 455 is permitted on this trunk port.

From the remote switches (both A and B), I am able to successfully source ping the AP-management interface ( from the VLAN 455 interface (, and However, I am unable to successfully source ping the management interface ( from the same VLAN 455 interfaces.

After working with Cisco TAC for 6.5 hours today, they say my wireless controller is possessed. I am not yet ready to accept a supernatural phenomenon as a reasonable explanation and was hoping someone out there can help!

UPDATE Took a known good AP down to the remote facility and it comes up on the correct VLAN, receives the correct IP and joins the controller. Brought back one of the non functioning AP's and plugged it in here. The AP joined the controller after downgrading its IOS from 15.2(2)JB to 12.4(23c)JA7. Should the AP's at the remote location be able to connect to the controller here and install the correct version of IOS? Or am I going to have to bring them all here for initial config prior to installing at the remote location?

UPDATE We have found a workaround to get the AP's to communicate. Cisco is saying it's a Microsoft issue with not pushing out option 43 properly. They also say there is no MTU issue while traversing the MPLS to the remote site. What we have done is disable the DHCP scope for the remote AP's and configured the remote switch (ios) as a DHCP server with option 43 pointing to the controller using hex not decimal. Once I did a shut/no shut on the interfaces connected to the AP's, they obtained an IP from the switch and joined the controller. Once joined, I removed DHCP from the switch and re-enabled the scope on our DHCP server. Bounced the AP's again and they pulled an address and joined the controller. Not a solution, but at least they're up and running.

  • Been awhile since I used a 4400 controller, but IIRC you shouldn't be able to ping the ap-manager interface (perhaps a code change?). Double check that both interfaces are either untagged or assigned to the same VLAN and that the switch port configuration matches. Next, what is the configuration on the service port? Are you using LAG, if not which ports are the interfaces assigned to? – YLearn May 23 '13 at 3:08
  • 2
    What mechanism is your AP supposed to use for WLC discovery? (and is it working?) – Gerben May 23 '13 at 9:59
  • 1
    Backing up Gerbin, for the APs to discover a controller on another subnet they need to get the controller IP either from DHCP or DNS. Which are you using and are you sure it works correct? – Dave Noonan May 23 '13 at 13:03
  • YLearn - Both management and ap-management are untagged. The Service port is not connected to anything. TAC disabled LAG and shut down two of the ports. Currently only using ports 1, 3 on the wlc. Management and ap-manager are both configured to use port 3. – Sleepy May 23 '13 at 15:08
  • Gerben- we use CAPWAP, yes it's working. I have a test AP in my office on the 10.128.55 /24 network that connects just fine. – Sleepy May 23 '13 at 15:10

I cannot tell you exactly what is happening without looking at the configs of the Switches and the WLC you have as I can think of a number of possibilities. For me, it'd be helpful to have that information but more so, the things that you've done. Basically, what are the items you've tried thus far?

SW-A: <---TRUNK---> SW-B:


First thoughts though are as follows:

1.) Who is able to ping the WLC? a.) no one = check the interface on the switch and the WLC interface config, any firewalls b.) same subnet,, but no other subnets = check routing c.) all subnets on one switch but not from another switch = check trunk on SW-A & SW-B

2.) AP and WLC are able to ping each other but AP not showing up in WLC a.) check DHCP has the proper option 43 (Vendor Specific Info) set which tells the AP what IP the WLC is. b.) check any firewalls inbetween c.) create new interface on WLC with the same VLAN subnet as the AP and test d.) enable ssh on the AP and do a show log to see if anything peculiar sticks out

3.) You've checked all possibilities and as the config stands everything should work a.) reload the switches, AP's, WLC b.) pull out the configuration and put the configuration back in specific to the issue c.) try a different interface on the switch for the WLC d.) try a different interface on the WLC (maybe create a new one) e.) get on Cisco.com and use the bugtoolkit to see what bugs are out there for your particular WLC version. f.) upgrade the WLC version a revision up and test.

I realize that some of my ideas are not really applicable, but I'm just throwing some ideas out there to maybe help give a new perspective on the problem. I've found just taking a break to think about something else and then coming back helps me.

| improve this answer | |
  • The trunk between sw-a and sw-b is passing all vlans correctly. – Sleepy May 23 '13 at 15:16
  • Pinging the WLC ( from sw-a and sw-b works fine. Troubleshooting done: Disable LAG Tried different ports on the core switch (a) that connects the wlc Moved connections from core a to core b Bounced controller updated software on controller from --> Recreated DHCP server option 42 Changed option 42 ip address to HEX, although i'm not sure why this was done. Verified all routing is working correctly – Sleepy May 23 '13 at 15:35
  • both switches have vlan interfaces for vlan 432 (data) and vlan 455 (wireless) Source ping to from vlan432 interface receives replies Source ping to from vlan455 interface no replies Source ping to from vlan432 and vlan455 interface receives replies. Same results from both sw-a and sw-b. WLC is unable to ping the IP's of the AP's on the 10.133.55 /24 network. Wireshark shows the controller receiving icmp from the ap's, just does not respond. This remote location does not traverse the firewall. – Sleepy May 23 '13 at 15:36
  • I'll be heading down to the location this morning to console into the AP's and have a look. The WLC is running the latest version of code. Cisco TAC says everything should work the way it's configured. Controller and switches have been reloaded - same results. – Sleepy May 23 '13 at 15:36
  • @Joseph Drane and Sleepy, do you mean DHCP Option 43 instead of 53 and 42, respectively? – generalnetworkerror May 24 '13 at 0:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.