If you have an Mobility Express AP that you wan’t to connect to another ME or a WLC controller you can easily convert it to a lighweight or a CAPWAP AP.
Connect to the AP using SSH or the console port. When you are connected go to the enable mode and enter the following command.
ap-type capwap
The AP will now restart, when it’s booted it will connect to a WLC or another ME AP on the network.
Lately I have started playing with the Meraki API. The API gives us the possibility to tweak and manage whatever you want to do on the Meraki devices.
To begin with you need to get the API code from the Meraki Dashboard. You can get the API code if you click on your username in the upper right corner and then proceed to My Profile. In that window you can enable and generate API keys for your scripts.
The first script you should use is the code below. This should give you a list of organizations that you have access to with the user account you generated the API key with. Normally you only have 1 organization but many might have several organizations in the list.
curl --request GET -L \
--url https://api.meraki.com/api/v0/organizations \
--header 'X-Cisco-Meraki-API-Key: <API key>'This could create the follwoing output:
[{"id":"692333","name":"Organization 1"},{"id":"293843","name":"Organization 2"},{"id":"551234","name":"Organization 3"},{"id":"123476","name":"Organization 4"}]At this point you can choose what organisation you want to create the API for. You need to take the ID and add it to the end of the URL. If I want to towrk with organization 3 I would use 551234 as the ID. After the ID you need to add networks to list the networks for the organization. I ahve added an example below:
curl --request GET -L \
--url https://api.meraki.com/api/v0/organizations/551234/networks \
--header 'X-Cisco-Meraki-API-Key: <API key>'From that you should get the following output:
[{"id":"L_662029145123456789","organizationId":"551234","name":"Site 1","timeZone":"Europe/Oslo","tags":null,"type":"combined","disableMyMerakiCom":false,"disableRemoteStatusPage":true}]You now have all the information needed to start playing around with API’s on Meraki. Meraki got alot of documentation showing what you can do. You can find the documentation here.
As an example on what you can do I can show you how to enable and disable an SSID on a network. In the Meraki documentation for SSID’s you find the various settings that you can configure. In this example I only want to change the enabled or disabled settings for the SSID. In the data-binary setting you switch between false and true to swap between disabled and enabled setting for the SSID.
curl -L -H 'X-Cisco-Meraki-API-Key: <API key>'
-X PUT -H 'Content-Type: application/json'
--data-binary '{"enabled":true}' 'https://api.meraki.com/api/v0/organizations/551234/networks/L_662029145123456789/ssids/1'Hi all
Today I’m going to write a short post on how to convert a lightweight AP to an Mobility Express AP. It’s a very simple process and only takes a few minutes to complete.
First you need to download the ME image from the Cisco webpage. Extract the compressed file to a TFTP server.
Login to the AP with console access using Cisco / Cisco as username and password (this is offcourse only if you haven’t changed the password on the AP.
ap-type mobility-express tftp://<TFTP Server IP>/<filename>When the file is uploaded the AP will reboot and load the new image. The AP will use 2 IP’s. 1 for the ME and 1 for the AP.
During my upgrade I had one issue. It failed repeatedly and I worked a while before I discovered the reason.
Image transfer complete.
Image downloaded, writing to flash...
do CHECK_ME, part1 is active part
upgrade.sh: Error: image not found.
+ do_upgrade CHECK_ME
+ [ ! -r /tmp/part.tar ]
+ loudlog Error: image not found.
+ logger -p 0 -t upgrade Error: image not found.
+ echo upgrade.sh: Error: image not found.
upgrade.sh: Error: image not found.
+ return 1
+ status=1
+ set +x
Error: Image update failed.
I read on the internet that this error could be caused due to lack of space. I had free space left so I could quickly rule that issue out. I have another ME in the same network, it seems that the ME image can’t be uploaded when there is an ME of the same L2 network as the ME you are trying to install. The issue I had dissapeared when I disconnected the other ME.
After the upgrade has been completed the ME will reboot and start a setup wizard.
Enter Administrative User Name (24 characters max): admin
Enter Administrative Password (3 to 127 characters): ********
Re-enter Administrative Password : ********
System Name [Cisco-dcf7.193e.4c00] (24 characters max): hostname
Enter Country Code list (enter 'help' for a list of countries) [US]: NO
Configure a NTP server now? [YES][no]: yes
Use default NTP servers [YES][no]:
Enter timezone location index (enter 'help' for a list of timezones): 14
Management Interface IP Address Configuration [STATIC][dhcp]: dhcp
Create Management DHCP Scope? [yes][NO]:
Employee Network Name (SSID)?: SSIDName
Employee Network Security? [PSK][enterprise]:PSK
Employee PSK Passphrase (8-63 characters)?: ***********
Re-enter Employee PSK Passphrase: ***********
Enable RF Parameter Optimization? [YES][no]:
Client Density [TYPICAL][Low][High]:
Traffic with Voice [NO][Yes]:
Configuration correct? If yes, system will save it and reset. [yes][NO]: yes
Configuration saved!
There is a few things that you need to get correct when going trough the options. The first one is country code. This is important to have correct freqency since it need to meet the local regulations. Since my AP’s are in Norway I choose NO as the country code.
The second one is the management interface. You can choose to have it set to static or dhcp. I normally set these ME’s up for clients and configure them with DHCP. If you choose DHCP it’s important to note the correct DHCP address when the ME boots up. As previously mentioned the AP will request 2 IP’s. 1 for the ME and 1 for the CAPWAP AP.. After the bootup you should see the following output
[*08/01/2019 17:24:33.6830] ethernet_port wired0, ip 192.168.50.108, netmask 255.255.255.0, gw 192.168.50.1, mtu 1500, bcast 192.168.50.255, dns1 195.159.0.100, dns2 8.8.8.8, domain hjortsenter.internal, vid 0, static_ip_failover false, dhcp_vlan_failover false
[*08/01/2019 17:24:33.6930] chatter: MeshNat: config_ip IP=192.168.50.108 mask=255.255.255.0 GW=192.168.50.1
[*08/01/2019 17:24:38.7614] ethernet_port wired0, ip 192.168.50.110, netmask 255.255.255.0, gw 192.168.50.1, mtu 1500, bcast 192.168.50.255, dns1 195.159.0.100, dns2 8.8.8.8, domain test.internal, vid 0, static_ip_failover false, dhcp_vlan_failover false
[*08/01/2019 17:24:38.7814] chatter: MeshNat: config_ip IP=192.168.50.110 mask=255.255.255.0 GW=192.168.50.1
[*08/01/2019 17:24:41.8004] AP IPv4 Address updated from 0.0.0.0 to 192.168.50.110The first IP in my example is the IP for the ME (192.168.50.108)
The last IP is for the CAPWAP (192.168.50.110)
Hi all
Lately I have been working with the mobility express AP’s from Cisco. One of the important things to do when you set up new equipment is to have a backup and restore policy for the config.. I chose the easy way out using tftp, it’s the quickest and easiest way to transfer files as long as you have the tftp server secured. The other option you have is ftp.
transfer upload mode tftp
Sets the mode to tftp, you can also choose ftp but then you need to add in username and password too.
transfer upload datatype config
Choose config as the information to store on the server
transfer encrypt enable
Turns on encryption for the file
transfer encrypt set-key supersecret
Gives the encryption a password
transfer upload serverip 10.10.10.10
Gives the ME an IP to the server where to store the config
transfer upload filename MEconfig.cfg
Filename for the config.
transfer upload start
Start the upload.
transfer upload mode tftp transfer upload datatype config transfer encrypt enable transfer encrypt set-key supersecret transfer upload serverip 10.10.10.10 transfer upload filename MEconfig.cfg transfer upload start
You should then get the following output.
Mode……………………………………… TFTP TFTP Server IP…………………………….. 10.10.10.10 TFTP Path…………………………………. TFTP Filename……………………………… MEconfig.cfg Data Type…………………………………. Config File Encryption………………………………… Enabled Are you sure you want to start? (y/N) y File transfer operation completed successfully.
So far you have done the backup. Then the second most important thing comes, do the restore. It’s almost the same, but you swap out upload with download.
transfer download datatype config transfer download mode tftp transfer encrypt enable transfer encrypt set-key supersecret transfer download serverip 10.10.10.10 transfer download filename MEconfig.cfg transfer download start
After the commands have been entered you should see the following output.
Mode............................................. TFTP Data Type........................................ Config TFTP Server IP................................... 10.10.10.10 TFTP Packet Timeout.............................. 6 TFTP Max Retries................................. 10 TFTP Path........................................ TFTP Filename.................................... MEconfig.cfg Encrypt/Decrypt Flag............................. Enabled Warning: Downloading configuration will cause the controller to reset... This may take some time. Are you sure you want to start? (y/N) y TFTP Config transfer starting. TFTP receive complete... updating configuration. CCO Username & Password will NOT be imported. Please Re-Configure the Credentials 'transfer download ap-images cco-username ' 'transfer download ap-images cco-password ' after bootup for Image Download TFTP receive complete... storing in flash. Sync config to peers. System being reset.
Today I did change IP of one of our HA Wireless Controllers. Since the company I work for got bought last year we have to change IP of our systems to fit into our new and bigger network.
Changing the IP address isn’t a big thing and you can do it without any downtime on the AP’s if you run flexconnect. If you run in local mode you will be looking at a short downtime. If you want to do it with the minimal of downtime you need a third controller that can host your AP’s while the HA cluster is down.
If you have a third controller that can host your AP’s you have to make sure that the mobility groups are configured and working to your HA. You can check this in the following menu: Controller -> Mobility Management -> Mobility Groups. In this menu all your mobility groups are listed. If the mobility group towards the controller is Up you should see it on the right side of the page. You also have to check this on the HA controller.
If the mobility group is up and running then the next thing is to change primary controller for the AP’s. This is a very easy task but it’s time consuming if you don’t have Cisco Prime ( I got that luckily). From Cisco Prime you can just send out a template to all the AP’s and make them move to another primary controller. If you want to do it manually you can do it to. Then you have to first open an AP and choose High Availability. Then you configure the third controller as Primary. Within the next few minutes all the AP’s should be moved to a new controller.
When there is no connected AP’s left we can start the work to re-IP the HA controller. The first thing we have to do is to break the HA cluster. We are not able to change the IP without breaking the cluster. When breaking the cluster there will also be a restart, so if you don’t have another controller for your AP’s, be ready for some downtime!
To disable the cluster you go to Controller -> Redundancy -> Global Configuration. In the lower part of the page you have the option to Disable or Enable the cluster. Set the drop down to Disabled and press Apply in the top right corner. The controller will then ask you if you are sure about breaking the cluster and that the controller will restart. Accept this and wait for a few minutes.
The WLC will after a few minutes boot up again on the same IP address as before. Then you should go to the Interface menu to change the management IP address.
Change the IP Address, Netmask and Gateway to the new values and press Apply. You will now loose connection and need to connect on the new IP’s It’s very important to enter the correct IP’s so you don’t loose contact (or you could use the integrated service port if you have a 550x).
The next interface you need to change is the redundancy management IP address. This IP should be in the same subnet as the management IP. So unless you change the IP to something in the same subnet as your previous IP you need to change this IP also. This IP also needs to match the Redundancy mgmt IP in Controller -> Redundancy -> Global Configuration.
The last thing you need to do o this controller is go back to Controller -> Redundancy -> Global Configuration and change the IP’s for the Redundancy mgmt IPs and enable the cluster again.
You should now be finished With the first Controller. The IP for the WLC HA is now active and if you want to move the AP’s to the New Controller you can do that now. You shoudl be able to Connect to the remaining Controller on the old management IP address. You should repeat the steps for changing the Redundancy mgmt IP and Redundancy port IP. When this is done you only need to enable the cluster on this Controller also and the HA should be working again as before.
When you have enable HA on the second Controller you can go to Monitor -> Redundancy -> Summary. There you will be able to see if the HA cluster is running successfully again.
Your cluster should now be working correctly. If you got questions or feedback please leave a comment!
Hi all
Today I did something new to me. I did a downgrade from a lightweight AP to an standalone AP remotely. I have previously used the old method with the console cable and TFTP server at a local network (until yesterday I only knew about this method). Today I did not have that possibilty and I then took advantage of the following command:
config ap tftp-downgrade tftp-server-ip-address filename access-point-name
You enter the command into the controller and it then starts the downgrade. But there is one thing that bothers me, you can’t monitor the process. My AP’s are located on boats with an controller in the datacenter. They have been running flexconnect but I wan’t to turn them into standalone AP’s since that works better for the solution I have on the boats. The problems is that the boats has low bandwidth and they loose the connection from time to time. For the TFTP downgrade it seemed fine with a 30 sec downtime for the transfer but I got some issues when it was above that. So how do I monitor the downgrade of the AP?
The solution was to log into the AP by SSH and check that the AP contained an upgrade folder in the flash. The command to do this is:
dir flash:
If the folder upgrade shows up in the list it should be working on an upgrade, normally if the upgrade fails the folder is autmaticly deleted. But I have seen this does not always happen. You could the check the files inside the upgrade folder and look for a change in the filesize. If you type “dir flash:update/<version-folder>” you should see the filesize of normally the last file change every second. I have added an example below where you can see the filesize of 8005.img is 627200.
boat-wl-01#dir flash:update/ap1g2-k9w7-mx.153-3.JC Directory of flash:update/ap1g2-k9w7-mx.153-3.JC/ 22 -rwx 123464 May 12 2016 10:14:52 +00:00 ap1g2-k9w7-mx.153-3.JC 24 drwx 64 May 12 2016 10:14:52 +00:00 html 253 -rwx 9029888 May 12 2016 10:45:05 +00:00 ap1g2-k9w7-xx.153-3.JC 254 -rwx 627200 May 12 2016 10:46:58 +00:00 8005.img 31808000 bytes total (8753152 bytes free)
If you look at the text below you can also see that the size is changing for the file 8005.img. In the example below the filesize is 833536.
boat-wl-01#dir flash:update/ap1g2-k9w7-mx.153-3.JC Directory of flash:update/ap1g2-k9w7-mx.153-3.JC/ 22 -rwx 123464 May 12 2016 10:14:52 +00:00 ap1g2-k9w7-mx.153-3.JC 24 drwx 64 May 12 2016 10:14:52 +00:00 html 253 -rwx 9029888 May 12 2016 10:45:05 +00:00 ap1g2-k9w7-xx.153-3.JC 254 -rwx 833536 May 12 2016 10:47:39 +00:00 8005.img 31808000 bytes total (8546816 bytes free)
Examples of issues I got when testing other ways of downgrading:
I tried to do the downgrade directly from the AP while downgrading from the WLC at the same time ( I thought the downgrade from the WLC failed). It then gave me the following error:
boat-wl-01#archive download-sw tftp://172.17.76.231/ap1g2-k9w7-tar.153-3.JC.tar Unable to create temp dir "flash:/update" Download image failed, notify controller!!! From:8.0.121.0 to 8.2.100.0, FailureCode:7
Obviously that won’t work but the command itself should work, but I liked more doing it from the controller. I just found it easier that way.
If you try several times to downgrade from the controller you will see the following message in the event log of the lightweight AP:
*May 12 10:18:09.351: lwapp_image_proc: encounter flash problem, retry here *May 12 10:18:09.351: lwapp_image_proc: encounter flash problem, retry here *May 12 10:18:09.351: lwapp_image_proc: encounter flash problem, retry here
I was converting AP’s from Autonomous to Lightweight AP’s yesterday when I ran into issues with a couple of old 1121G. I only saw the AP register to the controller for 3-4 seconds before it disconnected. While pinging the AP it responded for 1 minute before it did go into a reboot.
I then logged into the WLC to do a debug. I used the following debug command:
(Cisco Controller) >debug capwap errors enable
The output from this repeated itself every time the AP was up and running.
Dec 03 11:26:02.616: 00:1e:4a:a8:b1:88 Join Priority Processing status = 0, Incoming Ap's Priority 0, MaxLrads = 100,joined Aps =1 *spamApTask0: Dec 03 11:26:12.645: Could not find BoardDataPayload *spamApTask0: Dec 03 11:26:14.685: 00:1e:4a:a8:b1:88 Refusing image download to AP 00:1e:4a:a8:b1:88 - unable to open image file /bsn/ap//c1100 Error:No such file or directory(2) *spamApTask0: Dec 03 11:26:14.685: 00:1e:4a:a8:b1:88 Number of open file descriptors for spam process is: 97 *spamApTask0: Dec 03 11:26:14.685: 00:1e:4a:a8:b1:88 Decoding of Image Data failed from AP 00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:15.683: 00:1e:4a:a8:b1:88 Error decrypting packet from AP 00:1e:4a:a8:b1:88 sessionId 2367ed6d, recvNonce 2367ed6e, sendNonce 2367ed6d key b9.87.16.0b.97.72.4e.e8 c4.c5.ee.e1.d4.c7.f3.62 *spamApTask0: Dec 03 11:26:15.683: 00:1e:4a:a8:b1:88 rxN 00.23.67.ed.6e.00.00.00 00.00.00.00.00 txN 00.00.00.00.00.00.00.00 00.00.00.00.00 *spamApTask0: Dec 03 11:26:15.683: 00:1e:4a:a8:b1:88 Decryption of message from AP failed00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:15.683: 00:1e:4a:a8:b1:88 Security processing of Image Data failed for AP 00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:16.687: 00:1e:4a:a8:b1:88 Error decrypting packet from AP 00:1e:4a:a8:b1:88 sessionId 2367ed6d, recvNonce 2367ed6e, sendNonce 2367ed6d key b9.87.16.0b.97.72.4e.e8 c4.c5.ee.e1.d4.c7.f3.62 *spamApTask0: Dec 03 11:26:16.687: 00:1e:4a:a8:b1:88 rxN 00.23.67.ed.6e.00.00.00 00.00.00.00.00 txN 00.00.00.00.00.00.00.00 00.00.00.00.00 *spamApTask0: Dec 03 11:26:16.687: 00:1e:4a:a8:b1:88 Decryption of message from AP failed00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:16.687: 00:1e:4a:a8:b1:88 Security processing of Image Data failed for AP 00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:17.686: 00:1e:4a:a8:b1:88 Error decrypting packet from AP 00:1e:4a:a8:b1:88 sessionId 2367ed6d, recvNonce 2367ed6e, sendNonce 2367ed6d key b9.87.16.0b.97.72.4e.e8 c4.c5.ee.e1.d4.c7.f3.62 *spamApTask0: Dec 03 11:26:17.686: 00:1e:4a:a8:b1:88 rxN 00.23.67.ed.6e.00.00.00 00.00.00.00.00 txN 00.00.00.00.00.00.00.00 00.00.00.00.00 *spamApTask0: Dec 03 11:26:17.686: 00:1e:4a:a8:b1:88 Decryption of message from AP failed00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:17.686: 00:1e:4a:a8:b1:88 Security processing of Image Data failed for AP 00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:18.687: 00:1e:4a:a8:b1:88 Error decrypting packet from AP 00:1e:4a:a8:b1:88 sessionId 2367ed6d, recvNonce 2367ed6e, sendNonce 2367ed6d key b9.87.16.0b.97.72.4e.e8 c4.c5.ee.e1.d4.c7.f3.62 *spamApTask0: Dec 03 11:26:18.687: 00:1e:4a:a8:b1:88 rxN 00.23.67.ed.6e.00.00.00 00.00.00.00.00 txN 00.00.00.00.00.00.00.00 00.00.00.00.00 *spamApTask0: Dec 03 11:26:18.687: 00:1e:4a:a8:b1:88 Decryption of message from AP failed00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:18.687: 00:1e:4a:a8:b1:88 Security processing of Image Data failed for AP 00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:19.690: 00:1e:4a:a8:b1:88 Error decrypting packet from AP 00:1e:4a:a8:b1:88 sessionId 2367ed6d, recvNonce 2367ed6e, sendNonce 2367ed6d key b9.87.16.0b.97.72.4e.e8 c4.c5.ee.e1.d4.c7.f3.62 *spamApTask0: Dec 03 11:26:19.690: 00:1e:4a:a8:b1:88 rxN 00.23.67.ed.6e.00.00.00 00.00.00.00.00 txN 00.00.00.00.00.00.00.00 00.00.00.00.00 *spamApTask0: Dec 03 11:26:19.690: 00:1e:4a:a8:b1:88 Decryption of message from AP failed00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:19.690: 00:1e:4a:a8:b1:88 Security processing of Image Data failed for AP 00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:20.733: Unable to find deleted AP 00:1e:4a:a8:b1:88 *spamApTask0: Dec 03 11:26:20.733: 00:1e:4a:a8:b1:88 Join Priority Processing status = 0, Incoming Ap's Priority 0, MaxLrads = 100,joined Aps =1 *spamReceiveTask: Dec 03 11:26:32.658: b4:b6:76:c3:56:db Unable to get RadId. Sending of PMK cache entry to all APs in flexconnect group failed :: bssid 00:00:00:00:00:00
Security processing of Image Data failed for AP was a message in the output that I thought was strange and also other references to the image. I then checked the Cisco Wireless Controller Compability Matrix, to my dissapointment the AP was no longer supported. It ended up with a long and slow process of having one of the local guys in Chile downgrading from Controllerbased AP to a Standalone….
Networks and rants 