Understand AP Join Issues with Regulatory Mismatch and -ROW Domain

Introduction

This document describes AP join issues relating to domain mismatch or -ROW domain specificities.

Know the Right Domain for Your Country and Versions

Cisco has unified domain C,D,I,G,H,K,N,L,M,S and T into the -ROW (Rest Of World) domain, which starts with the 9124 and 9136 access points, continuing with the 916X APs. Other domains are still manufactured separately and do not require any particular procedure or change in the way they operate. However, it is important to note that certain countries have recently changed regulatory domains and it is therefore important to validate the right domain for your country and version.

Wi-Fi 7 access points from the 917x series do not have any domain anymore and this article does not apply to them. Those APs are referred as Global Use AP and do not have any domain. This article does not cover them.

The easiest way to figure our which regulatory domain suits your country for a given AP model and release is to check the configuration guide for that version. For example, the 17.12 configuration guide table 1 and 3 show the right domain, in that version, for available countries. If your country is not mentioned, check with your authorities if you can use a neighboring country code or check with your Cisco account team about adding your country code to the product.

Verify this section for the right software version you intend to run on your 9800 WLC. This also allows you to identify 6GHz band availability in your country.

Note: RMA on an incorrectly ordered PID (wrong country code) cannot be processed by Cisco TAC. Please reach out to your accounts/sales team for further help with this.

-ROW Domain Specifics

As of writing this document, the new WIFI 6E APs 916x access points can be shipped using -ROW models for selected countries that do not match any of the largest regulatory domains or needed unique regulatory constraints.

Cisco IOS® XE release 17.6 and later provide support for -ROW domain access points and the list of countries targeted by -ROW continues to grow with later releases.

The -ROW APs maintain a power table of all countries under the -ROW domain and apply the right channel and power settings when they join a 9800 WLC and when they receive a country code, assigned by the 9800 configuration.

The list of countries that are part of the ROW domain depends on the AP model and the software version and constantly evolves.

If you want to know if a specific release for a specific AP model supports 6GHz in a specific country or is part of the -ROW domain, check the document titled "Detailed Channels and Maximum Power Settings for Cisco Catalyst Wireless <AP model>".

For example, for 9166 you can find this list of documents: Detailed Channels and Maximum Power Settings for Cisco Catalyst Wireless 

9160 Detailed Channel and Power

Such a document exists for each AP model and is updated each time a release brings new countries/channels support.

Check the country to tab mapping to see which country is part of which regulatory domain (including -ROW) and which frequency bands are supported in that country for that AP model on that release.

Countries are regularly added to the -ROW domain. Verify with the compliance lookup tool which regulatory your country of interest belongs to for a specific AP model.

Compliance Lookup Tool

Configure the Catalyst 9800 WLC for the Non-ROW/Fixed Domain Access Point

If your AP is of a. fixed regulatory domain (For example, -A, -B or -E), then it joins the WLC if there is one country code belonging to that domain configured on the WLC.

Navigate to Configure > Wireless > Access points > Country to enable countries for the WLC itself.

Here, the Canada Country Code Enables -A Domain on the WLC

This automatically makes the domain-specific APs pick the first country from the list of that domain.

For maximum accuracy, you can then configure in the AP join profile the very specific country code, in case you have more than one country code in the same domain.

Select The Right Country Code for the APs in each AP Join Profile

Configure the Catalyst 9800 WLC for the -ROW Access Point

An Access Point of the -ROW domain is able to join a 9800 WLC (provided that the software release supports the -ROW domain, for example in 17.6.2 or later) regardless of the countries configured on the controller. The hardware model shows as -ROW as depicted in this AP 360 page:

WLC Dashboard

The AP joins the WLC successfully regardless of the country configuration. However, a red dot is displayed in the access point dashboard widget to indicate that some APs still need to have their country code provisioned:

AP Statistics Page

Click this dot in order to display the list of -ROW access points that do not have a country code assigned. In that state, the -ROW AP has its 5ghz radio shut down and the 2.4ghz radio operates on standard channels and lower power to avoid any country rule violation.

AP Statistics Page

A country can be assigned to a -ROW AP when you set a country code in the AP join profile. By default, it is possible that your default AP join profiles that have no country code set, and therefore, any new -ROW domain AP has no country code assigned and operate in compatibility mode.

The country code checkbox in the AP join profile lists all countries, and therefore, you can potentially configure a country code that is not enabled globally on the WLC (In the Configure > Wireless > Access points  page, then the country subpage). In that case, the AP ignores the country code configuration in the AP join profile and stays in compatibility mode.It is mandatory to configure the correct country code in the AP join profile that the -ROW AP uses to join. This allows the AP to exit compatibility mode, use the appropriate channel list, and enable its radios.

Default AP Join Profile

It is best practice to use different AP join profile for each Site so that you can set the right country code for all APs in a given site easily.

You can also see for each AP, in the Advanced tab, the specific country code of the AP. The dropdown box only shows you countries enabled globally on the WLC, but if you change the country code directly on the AP advanced page, it does not work if a country is already configured (and valid) in the AP join profile.

If you configure another country for an AP, the AP disjoins and rejoins the WLC, but joins back with the country code set in the AP join profile again. This setting is only useful in case you stay with no country code configured in the AP join profile (which is not recommended).

Verify Whether There is a Country Code Mismatch

The first thing is to enable globally all the countries that you are susceptible to need on your access points.

Navigate to Configuration > Wireless > Access Points. Enable all the countries you have APs in. For each country added, you see the domain letters being added as supported. For example, in this screenshot, adding Switzerland country code enables the -E domain. Enabling Canada on top would add -A domain support.

WLC Global Country Codes

When an AP joins your WLC, it takes a country code (from the ones you enabled globally) that matches the AP regulatory domain. When a new AP joins, it is assigned the default-site-tag to it. By default, the default-site-tag uses the default-ap-profile for AP configuration. The country selection for the AP sits in the AP (join) profile.

Navigate to Configuration > Tags and profiles > Tags > Site to optionally point the default-site-tag to another AP profile.

Navigate to Configuration > Tags and profiles > AP Join in order to define a country code in the AP join profile.

You can either use the default profiles (and set the country appropriately) or use named site tags and ap join profiles in case you have several sites in different locations.

You can assign this site tag to the AP of your choice by navigating to Configure > Wireless > Acesss point, clicking the specific AP, and assigning a site tag (that in turn assigns a specific AP join profile):

Assign Tags to the AP

Troubleshoot

Signs of Country Code Mismatches

Here is an example of country code mismatch syslog message thrown by a WLC when an AP joins a WLC where the right country code was not enabled:

 %APMGR_TRACE_MESSAGE-3-WLC_GEN_ERR: Chassis 1 R0/4: wncd: Error in AP: <MAC>: country code (GA) and regulatory domain (-A) mismatch for slot 1

In this specific example, Guatemala does belong to the -A domain so there is no misconfiguration. This is due to Cisco bug id CSCwh59048 where the Guatemala country code does not work at all.

-ROW Domain APs

If you configure a country code that does not belong to the -ROW domain (for example, France), a -ROW AP that joins the WLC and receives this AP join profile prints error messages and stays in unprovisioned mode (5ghz radio down and limited 2.4ghz radio capabilities).

An AP, once provisioned with a specific -ROW country keeps that country assigned until another valid -ROW country is assigned. If you try to assign non -ROW countries, the AP ignores and still uses the same last working country code.

You can verify the state of the AP country provisioning on the AP CLI with show controllers dot11Radio 1 to display the -ROW domain and the country to which the AP is assigned if any:

show cont dot11Radio 1
Dot11Radio1 Link encap:Ethernet HWaddr 4C:A6:4D:22:2F:C0
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:2699
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)


Radio Info Summary:
=======================
Radio: 5.0GHz
Carrier Set: (-RW) Argentina ( AR)

List of possible config mismatches:

• If no country is configured in the AP join profile, the AP is in config mismatched state.
• If the country configured in the AP join profile is not enabled in the global country list, the AP is in config mismatch state.
• If the country is configured in the AP join profile and the global country list, but the country is not part of the -ROW domain in that software version, the AP is in config mismatched state.
• If the country is configured in the AP join profile and global country list, and it is a country part of the -ROW domain, the AP gets properly provisioned.

You can check for misconfigured APs in the Configuration > Wireless > Access Points page:

Misconfigured APs Count