Introduction
This document describes how to recover the embedded access point of the IR829 when it is stuck in the bootloader/rommon.
Problem
The IR829 has an embedded Access Point, AP803. This AP is running a separate uboot, bootloader (rommon) and IOS AP image.
In some cases, for example, when the AP IOS image is corrupt or accidentally removed, you need to be able to recover and copy a fresh image to the AP-part of the IR829.
There is no easy possibility to copy files from the flash: that is accessible on the IR829's IOS to the flash: accessible by the embedded AP803.
Solution
First, make sure that the AP IOS image was not booted and the device ended in rommon.
The easiest way to see this is by looking at the prompt presented after connecting to the AP803 console from the IR829's IOS:
To connect to the console of the AP803, first make sure you have an IP-address configured on the wlan-ap0 interface, then issue the following command:
IR829#conf t
Enter configuration commands, one per line. End with CNTL/Z.
IR829(config)#int wlan-ap0
The wlan-ap 0 interface is used for managing the embedded AP.
Please use the "service-module wlan-ap 0 session" command to console into the embedded AP
IR829(config-if)#ip addr 192.168.100.1 255.255.255.0
IR829(config-if)#end
IR829#service-module wlan-ap 0 session
Trying 192.168.100.1, 2004 ... Open
Connecting to AP console, enter Ctrl-^ followed by x,
then "disconnect" to return to router prompt
You are presented with one of these:
When the AP has the Unified image loaded.
AP2c5a.0f08.a4a8>
When the AP has the Autonomous image loaded.
ap>
When the AP is in rommon.
ap:
In the first two cases, the image on the AP is loaded and you can use the CLI to switch to another version if needed. More info can be found here: https://www.cisco.com/c/en/us/td/docs/routers/access/800/829/software/configuration/guide/b_IR800config/b_ap803.html
In the third case, the bootloader or rommon is not able to boot a suitable image on the AP.
When this is the case, you can copy a working image to the AP through Trivial File Transfer Protocol (TFTP) with these steps.
Step 1. Prepare a TFTP-Server that has an AP-Image Available.
You can download AP-images from this location: https://software.cisco.com/download/home/286289725/type
Step 2. Ensure that the AP can Reach the TFTP-Server.
For this document, TFTP-server is 192.168.99.1 and it runs on a PC that is directly connected to GigabitEthernet 1 of the IR829.
GigabitEthernet0 on the AP-side is connected to interface Wlan-GigabitEthernet0 on IR829 router side. This is also the interface over which the TFTP-download happens.
Wlan-GigabitEthernet0 is a L2-interface, same as GigabitEthernet1-4 on the physical IR829 so you can just assign them to the same VLAN.
In IOS, configure this:
IR829#conf t
Enter configuration commands, one per line. End with CNTL/Z.
IR829(config)#interface GigabitEthernet1
IR829(config-if)# switchport access vlan 99
IR829(config-if)#interface Vlan99
IR829(config-if)# ip address 192.168.99.2 255.255.255.0
IR829(config-if)#interface Wlan-GigabitEthernet0
IR829(config-if)# switchport access vlan 99
IR829(config-if)# no ip address
IR829(config-if)#end
The above assigns GigabitEthernet1, physically on the IR829 to VLAN 99, then assigns IP-address 192.168.99.2 to the VLAN interface and finally, you also assign Wlan-GigabitEthernet0 to the same VLAN 99.
Step 3. Connect to the Console of the AP and Initialize for TFTP Copy.
ap: set IP_ADDR 192.168.99.3
ap: set NETMASK 255.255.255.0
ap: tftp_init
ap: ether_init
ap: flash_init
Initializing Flash...
mifs[0]: 7 files, 2 directories
mifs[0]: Total bytes : 131334144
mifs[0]: Bytes used : 55296
mifs[0]: Bytes available : 131278848
mifs[0]: mifs fsck took 0 seconds.
...done Initializing Flash.
Optionally, if the first attempt fails due to a corrupt flash: file system, you can run this command:
ap: format flash:
Are you sure you want to format "flash:" (all data will be lost) (y/n)?y
mifs[0]: 0 files, 1 directories
mifs[0]: Total bytes : 131334144
mifs[0]: Bytes used : 4096
mifs[0]: Bytes available : 131330048
mifs[0]: mifs fsck took 0 seconds.
Filesystem "flash:" formatted
In case you need a default-GW to reach another subnet, you can use this:
ap: set DEFAULT_ROUTER <ip>
Step 4. Initiate the Copy and Extract of the Image.
At this point, you copy the file from the TFTP-server and extract it to the flash of the AP803:
ap: tar -xtract tftp://192.168.99.1/ap1g3-k9w7-tar.153-3.JI1.tar flash:
extracting info (282 bytes)
ap1g3-k9w7-mx.153-3.JI1/ (directory) 0 (bytes)
ap1g3-k9w7-mx.153-3.JI1/html/ (directory) 0 (bytes)
...
extracting ap1g3-k9w7-mx.153-3.JI1/img_sign_rel_sha2.cert (1371 bytes)
extracting info.ver (282 bytes)
ap:
If all went well, you should now have a directory in flash: with the name of the image and the image in there:
ap: dir flash:
Directory of flash:/
2 -rwx 282 <date> info
3 drwx 2048 <date> ap1g3-k9w7-mx.153-3.JI1
208 -rwx 282 <date> info.ver
116649984 bytes available (14684160 bytes used)
ap: dir flash:/ap1g3-k9w7-mx.153-3.JI1
Directory of flash:/ap1g3-k9w7-mx.153-3.JI1/
4 drwx 2048 <date> html
195 -rwx 13028126 <date> ap1g3-k9w7-mx.153-3.JI1
196 -rwx 1136 <date> CO2.bin
197 -rwx 2594 <date> CO5.bin
198 -rwx 5024 <date> RO2.bin
199 -rwx 9884 <date> RO5.bin
200 -rwx 12962 <date> CA2.bin
201 -rwx 12962 <date> CA5.bin
202 -rwx 282 <date> info
203 -rwx 32004 <date> file_hashes
204 -rwx 141 <date> final_hash
205 -rwx 512 <date> final_hash.sig
206 -rwx 1375 <date> img_sign_rel.cert
207 -rwx 1371 <date> img_sign_rel_sha2.cert
116649984 bytes available (14684160 bytes used)
Step 5. Boot the Copied and Extracted Image.
The final step is to let the AP boot the freshly copied image:
ap: boot flash:/ap1g3-k9w7-mx.153-3.JI1/ap1g3-k9w7-mx.153-3.JI1
Loading "flash:/ap1g3-k9w7-mx.153-3.JI1/ap1g3-k9w7-mx.153-3.JI1"...######...#######
File "flash:/ap1g3-k9w7-mx.153-3.JI1/ap1g3-k9w7-mx.153-3.JI1" uncompressed and installed, entry point: 0x60080000
executing...
Stop MAC.
Starting IOS...
...
At this point, the image should be started and after some time you are presented with the prompt of the image of your choice.
The bootloader/rommon uses this image, depending on the configuration from IOS regarding image type, from now on.
Feedback