Release Notes for Cisco Catalyst 9800 Series Wireless Controller, Cisco IOS XE Gibraltar 16.12.x
Introduction to Cisco Catalyst 9800 Series Wireless Controllers
The Cisco Catalyst 9800 Series Wireless Controllers comprise next-generation wireless controllers (referred to as controller in this document) built for intent-based networking. The Catalyst 9800 Series Wireless Controllers are Cisco IOS XE based and integrate the radio frequency (RF) capabilities from Cisco Aironet with the intent-based networking capabilities of Cisco IOS XE to create a best-in-class wireless experience for your organization.
The Catalyst 9800 controllers are enterprise ready to power your business-critical operations and transform end-customer experiences:
-
The controllers come with high availability (HA) and seamless software updates that are enabled by hot and cold patching. This keeps your clients and services up and running always, both during planned and unplanned events.
-
The controllers come with built-in security, including secure boot, run-time defenses, image signing, integrity verification, and hardware authenticity.
-
The controllers can be deployed anywhere to enable wireless connectivity, for example, on an on-premise device, on cloud (public or private), or embedded on a Cisco Catalyst switch (for SDA deployments) or a Cisco Catalyst access point (AP).
-
The controllers can be managed using Cisco Digital Network Architecture (DNA) Center, programmability interfaces, for example, NETCONF and YANG, or web-based GUI or CLI.
-
The controllers are built on a modular operating system. Open and programmable APIs enable the automation of your day zero to day n network operations. Model-driven streaming telemetry provides deep insights into your network and client health.
The Catalyst 9800 Series controllers are available in multiple form factors to cater to your deployment options:
-
Catalyst 9800 Series Wireless Controller Appliance
-
Catalyst 9800 Series Wireless Controller for Cloud
-
Catalyst 9800 Embedded Wireless Controller for a Cisco switch
 Note |
All the Cisco IOS-XE programmability-related topics on the Cisco Catalyst 9800 controllers are supported by DevNet, either through community-based support or through DevNet developer support. For more information, go to https://developer.cisco.com. |
What's New in Cisco IOS XE Gibraltar 16.12.8
There are no new features in this release.
What's New in Cisco IOS XE Gibraltar 16.12.7
There are no new features in this release.
What's New in Cisco IOS XE Gibraltar 16.12.6a
There are no new features in this release.
What's New in Cisco IOS XE Gibraltar 16.12.5
There are no new features in this release.
What's New in Cisco IOS XE Gibraltar 16.12.4a
There are no new features in this release.
What's New in Cisco IOS XE Gibraltar 16.12.3
There are no new features in this release.
In Cisco IOS XE Gibraltar 16.12.3, the semantic version number for the YANG models is not updated and is therefore not accurate. However, this limitation does not impact the functionality of the YANG models.
Unsupported SFPs:
From this release, only supported SFPs will work. If you use a nonsupported SFP, the port will not function.
What's New in Cisco IOS XE Gibraltar 16.12.2s
Behavior Change in WLAN Mapping to default-policy-profile
From Cisco IOS XE Gibraltar 16.12.2s, automatic WLAN mapping to the default policy profile under the default policy tag has been removed. If you are upgrading from a release earlier than Cisco IOS XE Gibraltar 16.12.2s, and if your wireless network uses default policy tag, it will go down due to the default mapping change. To restore the network operation, add the required WLAN to policy mappings under the default policy tag.
MIB
To download MIBs for Cisco IOS XE Gibraltar 16.12.2s release, use the following link.
https://software.cisco.com/download/home/286321396/type/280775088/release/16.12.2s
In this release, support is introduced for the following new access points:
Cisco Catalyst 9120 Access Points
-
Cisco Catalyst 9120E Access Points (C9120AX-e)
-
Cisco Catalyst 9120P Access Points (C9120AX-p)
Cisco Catalyst 9120 Access Points provide a seamless wireless experience anywhere and goes beyond the Wi-Fi 6 (802.11ax) standard. The access points provide integrated security, resiliency, and operational flexibility as well as increased network intelligence.
In the Cisco’s intent-based networks of all sizes, the Cisco Catalyst 9120 APs scale to the growing demands of IoT devices while fully supporting the latest innovations and new technologies.
For more information about Cisco Catalyst 9120 APs, see:
Cisco Catalyst 9130 Access Points (C9130AX-i)
Extending Cisco’s intent-based network and perfect for networks of all sizes, the Cisco Catalyst 9130 Series scales to meet the growing demands of IoT while fully supporting the latest innovations and new technologies. The 9130 Series is also a leader in performance, security, and analytics.
For more information about Cisco Catalyst 9130 APs, see:
What's New in Cisco IOS XE Gibraltar 16.12.1t
There are no new features in this release.
The following Cisco Catalyst APs are not allowed to join unsupported controller versions. If you have the following APs in your network and you want downgrade to an earlier version, we recommend that you use only Cisco IOS XE Gibraltar 16.12.1t. Do not downgrade to Cisco IOS XE Gibraltar 16.12.1s.
-
Cisco Catalyst 9120E AP
-
Cisco Catalyst 9120I AP
-
Cisco Catalyst 9120P AP
To view the open and resolved caveats applicable to this release, see Caveats section.
What's New in Cisco IOS XE Gibraltar 16.12.1s
There are no new features in this release.
This release is bundled with the latest 802.11ax software version.
We recommend that you use Cisco DNA Center version 1.3.1 for this release.
What's New in Cisco IOS XE Gibraltar 16.12.1
This section provides a brief introduction to the new features and enhancements that are introduced in this release.
Wi-Fi 6 features
OFDMA Support for 11ax APs: The 802.11ax APs support transmission to or reception of more than one client simultaneously using Orthogonal Frequency Division Multiplexing (OFDMA). The IEEE 802.11ax protocol offers two options to create wide channels - 160-MHz channels. For more information, see the OFDMA Support for 11ax APs chapter.
Software Features
Air Time Fairness on Mesh: The Air Time Fairness (ATF) on Mesh feature is conceptually similar to the ATF feature for local APs. ATF is a form of wireless QoS that regulates downlink airtime (as opposed to egress bandwidth). For more information, see the Air Time Fairness on Mesh chapter.
Best Practices for Cisco Catalyst 9800 Series Wireless Controller: The Best Practices monitoring window reports the status of the best practices and provides a one-click Fix It or Manual Configuration option to enable (or roll back) the practices. For more information, see Best Practices chapter or click Online Help on the web UI.
Custom IPv6 Pre-auth ACL support for EWA and LWA: Support for Fabric mode is added for FlexConnnect Client IPv6 Support with WebAuth Pre and Post ACL.
Deny Wireless Client Session Establishment Using Calendar Profiles: This feature allows the controller to stop the client session establishment of a client at a particular time. This helps control the network in an efficient and controlled manner without any manual intervention.
In a Cisco Catalyst 9800 Series Wireless Controller, you can deny the establishment of a wireless client session based on the following recurrences:
-
Daily
-
Weekly
-
Monthly
For more information, see the Deny Wireless Client Session Establishment Using Calendar Profiles chapter.
Enhanced Support for Public Cloud: A public cloud supports 6000 Cisco APs and 64000 clients for flex local switching. For more information, see the Deployment guide for Cisco Catalyst 9800 Wireless Controller for Cloud (C9800-CL) on Amazon Web Services (AWS).
Hotspot 2.0: The Hotspot 2.0 feature, also known as HS2 and Wi-Fi Certified Passpoint, is based on the IEEE 802.11u and Wi-Fi Alliance Hotspot 2.0 standards. It provides a better bandwidth and services-on-demand to end users. The Hotspot 2.0 feature allows mobile devices to join the Wi-Fi network automatically and also during roaming, when the devices enter a Hotspot 2.0 area. For more information, see the Hotspot 2.0 chapter.
IPv6 Multicast-to-Unicast: Support for IPv6 Multicast-to-Unicast was added from Cisco IOS XE Gibraltar 16.12.1. You can use IPv6 multicast addresses in place of IPv4 multicast addresses to enable media stream on the IPv6 networks. For more information, see the IPv6 Multicast-to-Unicast chapter.
IPv6 PI support for Cisco Catalyst 9800 Wireless Controllers: Support for Cisco Prime Infrastructure is added for IPv6-enabled Cisco Catalyst 9800 Series Wireless Controllers. You should configure static IPv6 on the Cisco Prime Infrastructure device, if IPv6- enabled Wireless Controllers are added to Cisco Prime Infrastructure.
Management Frame Protection: Management Frame Protection (MFP) provides security for the management messages passed between access points and clients. MFP provides both infrastructure and client support. For more information, see the Management Frame Protection chapter.
Security-Enhanced (SE) Linux Permissive Mode: This mode makes the practical implementation of the “principle of least privilege” possible by enforcing Mandatory Access Control (MAC) on the Cisco IOS-XE platform. SE Linux provides the capability to define policies to control the access from an application process to a resource object, thereby allowing clear definition and confinement of process behavior.
An operation in permissive mode is available with the intent of confining specific components (process or application) of the Cisco IOS-XE platform. In the permissive mode, access violation events are detected and system logs are generated, but the event or operation itself is not blocked. The solution operates mainly in an access violation detection mode.
In the enforcement mode, the loaded policy is enforced, and if a policy violation is detected, the event or operation is blocked in Cisco IOSd.
Note that no user configuration is required to enable this feature.
To display the SE Linux audit logs, use the show platform software audit command in privileged EXEC mode. For more information about this command, see the Cisco Catalyst 9800 Series Wireless Controller Command Reference.
Sensor support for TLS1.2 EAP PEAP and EAP TLS: The Cisco Aironet 1800 Series Access Points sensor supports TLS1.2 EAP PEAP and EAP TLS from this release onwards.
Support for –P Domain: The Cisco Catalyst 9800 Series Wireless Controller supports –P domain for Japan.
The following are the –P domain-compliant Cisco APs in this release:
-
AP3802P
-
AP1562E
For current approvals and regulatory domain information, see: https://www.cisco.com/c/dam/assets/prod/wireless/wireless-compliance-tool/index.html.
Support for IPv6-enabled Cisco Catalyst 9800 Series Wireless Controller added to Cisco Prime Infrastructure: When an IPv6 enabled controller is added to Cisco Prime Infrastructure, you should configure a static IPv6 on Cisco Prime Infrastructure.
Support for Installing Cisco Catalyst 9800 Wireless Controller for Cloud on Google Cloud Platform (GCP): Support for installing Cisco Catalyst 9800 Wireless Controller for Cloud on GCP was introduced from this release. For more information, see the Cisco Catalyst 9800-CL Cloud Wireless Controller Installation Guide.
Wi-Fi Protected Access 3: WPA3 is the latest version of Wi-Fi Protected Access (WPA), which is a suite of protocols and technologies that provide authentication and encryption for Wi-Fi networks. For more information, see Wi-Fi Protected Access 3 chapter.
Wi-Fi Alliance Agile Multiband: The Wi-Fi Alliance Agile Multiband (MBO) feature enables better use of Wi-Fi network resources. This feature is built on the fundamental premise that both WiFi network and client devices have information that can aid in making roaming decisions and improve the overall performance of the WiFi network and user experience. For more information, see WiFi Alliance Agile Multiband (MBO) chapter.
Wired Guest: The Wired Guest Access feature enables guest users of an enterprise network that supports both wired and wireless access to connect to the guest access network from a wired Ethernet connection. For more information, see Wired Guest chapter.
Hardware Features
Cisco Catalyst 9800-L Wireless Controller: The Cisco Catalyst 9800-L Wireless Controller is the first low-end controller that provides a significant boost in performance and features from the Cisco 3504 Wireless Controller.
The following are the two variations of the controller:
-
Cisco Catalyst 9800-L Copper Series Wireless Controller (9800-L-C RJ45)
-
Cisco Catalyst 9800-L Fiber Series Wireless Controller (9800-L-F SFP)
For more information, see the Cisco Catalyst 9800-L Wireless Controller Hardware Installation Guide.
Complete List of Supported Features
For the complete list of features supported on a platform, see the Cisco Feature Navigator at: https://www.cisco.com/go/cfn
When you search for the list of features by platform, select:
-
9800-40: To view all the features supported on the Cisco Catalyst 9800-40 Wireless Controller models.
-
9800-80: To view all the features supported on the Cisco Catalyst 9800-80 Wireless Controller models.
-
9800-CL: To view all the features supported on the Cisco Catalyst 9800 Wireless Controller for Cloud models.
-
9800-L: To view all the features supported on the Cisco Catalyst 9800-L Wireless Controller models.
YANG Data Models
For the complete list of Cisco IOS XE YANG models available with this release, navigate to https://github.com/YangModels/yang/tree/master/vendor/cisco/xe/16121. Revision statements that are embedded in the YANG files indicate if there has been a model revision. The README.md file in the same GitHub location highlights the changes that have been made in this release.
Interactive Help
The Cisco Catalyst 9800 Series Wireless Controller GUI features an interactive help that walks you through the GUI and guides you through complex configurations.
You can start the interactive help in the following ways:
-
By hovering your cursor over the blue flap at the right-hand corner of a window in the GUI and clicking Interactive Help.
-
By clicking Walk-me Thru in the left pane of a window in the GUI.
-
By clicking Show me How displayed in the GUI. Clicking Show me How triggers a specific interactive help that is relevant to the context you are in.
For instance, Show me How in Configure > AAA walks you through the various steps for configuring a RADIUS server. Choose Configuration> Wireless Setup > Advanced and click Show me How to trigger the interactive help that walks you through the steps relating to various kinds of authentication.
The following features have an associated interactive help:
-
Configuring AAA
-
Configuring FlexConnect Authentication
-
Configuring 802.1x Authentication
-
Configuring Local Web Authentication
-
Configuring OpenRoaming
-
Configuring Mesh APs
Note |
If the WalkMe launcher is unavailable on Safari, modify the settings as follows:
|
Important Notes
-
The Cisco Catalyst 9800-L Wireless Controller may fail to respond to BREAK signals received on its console port during boot time preventing the user from getting to the ROMMON. This problem is observed on the controllers manufactured till November 2019, with the default config-register setting of 0x2102. This problem can be avoided if you set the config-register to 0x2002. This problem is fixed in the 16.12(3r) ROMMON for Cisco Catalyst 9800-L Wireless Controller. For steps on how to upgrade the ROMMON, see the Upgrading ROMMON for Cisco Catalyst 9800-L Wireless Controllers section of Upgrading Field Programmable Hardware Devices for Cisco Catalyst 9800 Series Wireless Controllers.
-
By default, the controller uses a TFTP block size value of 512, which is the lowest possible value. This default setting is used to ensure interoperability with legacy TFTP servers. However, you can manually change the block size value to 8192 K using the ip tftp blocksize command in global configuration mode to speed up the transfer process.
-
We recommend that you configure the password encryption aes and the key config-key password-encrypt key commands to encrypt your password.
-
The features and functions that work on IPv4 networks with IPv4 addresses also works on IPv6 networks with IPv6 addresses. For a list of unsupported features, see the Unsupported Features section of the Native IPv6 feature.
-
High-Availability pairing using different SKUs of the Cisco Catalyst 9800-L Series Wireless Controller isn’t supported, for example, C9800-L-F-K9 and C9800-L-C-K9. HA pairing should be done only with the same SKUs, for example, C9800-L-F-K9 and C9800-L-F-K9 or C9800-L-C-K9 and C9800-L-C-K9.
-
If you encounter ERR_SSL_VERSION_OR_CIPHER_MISMATCH error from the GUI after a reboot or system crash, we recommend that you regenerate the trustpoint certificate.
The procedure to generate a new self signed trustpoint is as follows:
configure terminal no crypto pki trustpoint <trustpoint_name> no ip http server no ip http secure-server ip http server ip http secure-server ip http authentication <local/aaa> ! use local or aaa as applicable. -
SNMPv3 user configuration is not reflected in the running configuration. Only SNMPv3 group configuration is visible.
-
The Cisco Catalyst 9800 Series Wireless Controller has a service port, which is referred to as GigabitEthernet 0 port. You cannot use this port for RADIUS, SNMP, DNAC Telemetry, and other communications.
The service port only supports the following IP protocols:
-
HTTP
-
HTTPS
-
SSH
-
Licensing for Smart Licensing feature to communicate with CSSM
-
-
Configuring EoGRE using GUI is not supported in this release; use the CLI option.
-
Cisco Prime Infrastructure release version 3.8 does not support Cisco Catalyst Wireless Controller versions 16.12 and 17.1
-
To migrate public IP address from 16.12.x to 17.x. ensure that you configure the service internal command. Failing to do so will not carry forward the IP address.
Supported Hardware
The following table lists the supported virtual and hardware platforms. (See Table 3 for the list of supported modules.)
|
Platform |
Description |
|---|---|
|
Cisco Catalyst 9800-80 Wireless Controller |
A modular wireless controller with up to 100-GE modular uplinks and seamless software updates. The controller occupies 2-rack unit space and supports multiple module uplinks. |
|
Cisco Catalyst 9800-40 Wireless Controller |
A fixed wireless controller with seamless software updates for mid-size to large enterprises. The controller occupies 1-rack unit space and provides four 1-GE or 10-GE uplink ports. |
|
Cisco Catalyst 9800 Wireless Controller for Cloud |
A virtual form factor of the Catalyst 9800 Wireless Controller that can be deployed in a private cloud (supports ESXi, KVM, and NFVIS on ENCS hypervisors), or in the public cloud as Infrastructure as a Service (IaaS) in Amazon Web Services (AWS) and Google Cloud Platform (GCP) marketplace. |
|
Cisco Catalyst 9800 Embedded Wireless Controller for Switch |
The Catalyst 9800 Wireless Controller software for the Cisco Catalyst 9000 switches bring the wired and wireless infrastructure together with consistent policy and management. This deployment model supports only SD Access, which is a highly secure solution for small campuses and distributed branches. |
|
Cisco Catalyst 9800-L Wireless Controller |
The Cisco Catalyst 9800-L Wireless Controller is the first low-end controller that provides a significant boost in performance and features. |
|
Cisco Embedded Wireless Controller on Catalyst Access Points |
The Cisco Embedded Wireless Controller on Catalyst Access Points is a virtualised version of the Cisco IOS XE-based controller software on Catalyst access points. |
The following table lists the host environments supported for private and public cloud.
|
Host Environment |
Software Version |
|---|---|
|
VMware ESXi |
|
|
KVM |
|
|
AWS |
AWS EC2 platform |
|
NFVIS |
ENCS 3.8.1 and 3.9.1 |
|
GCP |
GCP marketplace |
The following table lists the supported Cisco Catalyst 9800 Series Wireless Controller hardware models.
The Base PIDs are the model numbers of the controller.
The Bundled PIDs indicate the orderable part numbers for the Base PIDs that are bundled with a particular network module. Running the show version , show module or show inventory command on such a controller (bundled PID) displays its Base PID.
Note that unsupported SFPs will bring down a port. Only Cisco-supported SFPs (GLC-LH-SMD and GLC-SX-MMD) should be used on the RP port of C9800-80-K9 and C9800-40-K9.
|
Controller Model |
Description |
|---|---|
|
C9800-CL-K9 |
Cisco Catalyst Wireless Controller as an infrastructure for Cloud. |
|
C9800-80-K9 |
Eight 1/10-Gigabit Ethernet SFP or SFP+ ports and two power supply slots. The following SFPs are supported:
|
|
The following enhanced SFPs are supported:
|
|
|
The following QSFP+s are supported:
|
|
|
C9800-40-K9 |
Four 1/10-Gigabit Ethernet SFP or SFP+ ports and two power supply slots The following SFPs are supported:
|
|
The following enhanced SFPs are supported:
|
|
|
C9800-L-C-K9 |
The following SFPs are supported:
|
|
C9800-L-F-K9 |
The following SFPs are supported:
|
Optics Modules
Cisco Catalyst 9800 Series Wireless Controller supports a wide range of optics. The list of supported optics is updated on a regular basis. See the tables at the following location for the latest transceiver module compatibility information:
https://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html
Compatibility Matrix
The following table provides software compatibility information.
|
Cisco Catalyst 9800 Series Wireless Controller Software |
Cisco Identity Services Engine |
Cisco Prime Infrastructure |
Cisco AireOS-IRCM Interoperability |
Cisco Catalyst Center |
Cisco Spaces: Connector |
Cisco CMX |
|---|---|---|---|---|---|---|
|
Gibraltar 16.12.8 |
2.6 2.4 2.3 |
3.7.1 |
8.10.171.0 8.10.162.0 8.10.151.0 8.10.142.0 8.10.130.0 8.8.130.0 8.8.125.0 8.5.176.0 8.5.164.0 |
— |
10.6.3 10.6.2 |
|
|
Gibraltar 16.12.7 |
2.6 2.4 2.3 |
3.7.1 |
8.10.171.0 8.10.162.0 8.10.151.0 8.10.142.0 8.10.130.0 8.8.130.0 8.8.125.0 8.5.176.0 8.5.164.0 |
— |
10.6.3 10.6.2 |
|
|
Gibraltar 16.12.6a |
2.6 2.4 2.3 |
3.7.1 |
8.10.171.0 8.10.162.0 8.10.151.0 8.10.142.0 8.10.130.0 8.8.130.0 8.8.125.0 8.5.176.0 8.5.164.0 |
— |
10.6.3 10.6.2 |
|
|
Gibraltar 16.12.5 |
2.6 2.4 2.3 |
3.7.1 |
8.10.171.0 8.10.162.0 8.10.151.0 8.10.142.0 8.10.130.0 8.8.130.0 8.8.125.0 8.5.164.0 |
— |
10.6.3 10.6.2 |
|
|
Gibraltar 16.12.4a |
2.6 2.4 2.3 |
3.7 |
8.10.171.0 8.10.162.0 8.10.142.0 8.10.130.0 8.10.122.0 8.10.121.0 8.10.113.0 8.10.112.0 8.10.105.0 8.9.111.0 8.9.100.0 8.8.125.0 8.8.120.0 8.8.111.0 8.5.164.0 |
— |
10.6.2 10.6 10.5.1 |
|
|
Gibraltar 16.12.3 |
2.6 2.4 2.3 |
3.7 |
8.10.171.0 8.10.162.0 8.10.113.0 8.10.112.0 8.10.105.0 8.9.111.0 8.9.100.0 8.8.125.0 8.8.120.0 8.8.111.0 8.5.164.0 |
— |
10.6.2 10.6 10.5.1 |
|
|
Gibraltar 16.12.2s |
2.6 2.4 2.3 |
3.7 |
8.10.171.0 8.10.162.0 8.9.111.0 8.9.100.0 8.8.125.0 8.8.120.0 8.8.111.0 8.5.164.0 |
— |
10.6.2 10.6 10.5.1 |
|
|
Gibraltar 16.12.1s Gibraltar 16.12.1t |
2.6 2.4 2.3 |
3.7 |
8.10.171.0 8.10.162.0 8.9.111.0 8.9.100.0 8.8.125.0 8.8.120.0 8.8.111.0 8.5.164.0 |
— |
10.6.2 10.6 10.5.1 |
|
|
Gibraltar 16.12.1 |
2.6 2.4 2.3 |
3.7 |
8.10.171.0 8.10.162.0 8.9.111.0 8.9.100.0 8.8.125.0 8.8.120.0 8.8.111.0 8.5.164.0 |
— |
10.6.2 10.6 10.5.1 |
GUI System Requirements
The following subsections list the hardware and software required to access the Cisco Catalyst 9800 Controller GUI.
|
Processor Speed |
DRAM |
Number of Colors |
Resolution |
Font Size |
|---|---|---|---|---|
|
233 MHz minimum1 |
512 MB2 |
256 |
1280 x 800 or higher |
Small |
Software Requirements
Operating Systems:
-
Windows 7 or later
-
Mac OS X 10.11 or later
Browsers:
-
Google Chrome: Version 59 or later (on Windows and Mac)
-
Microsoft Edge: Version 40 or later (on Windows)
-
Safari: Version 10 or later (on Mac)
-
Mozilla Firefox: Version 60 or later (on Windows and Mac)
Note |
Firefox Version 63.x is not supported. |
The controller GUI uses Virtual Terminal (VTY) lines for processing HTTP requests. At times, when multiple connections are open, the default number of VTY lines of 15 set by the device might get exhausted. Therefore, we recommend that you increase the number of VTY lines to 50.
To increase the VTY lines in a device, run the following commands in the following order:
-
device# configure terminal
-
device(config)# line vty 50
A best practice is to configure the service tcp-keepalives to monitor the TCP connection to the device.
-
device(config)# service tcp-keepalives-in
-
device(config)# service tcp-keepalives-out
Supported Cisco Access Point Platforms
The following Cisco AP platforms are supported in this release:
Indoor Access Points
-
Cisco Aironet 1700 Series Access Points
-
Cisco Aironet 1800 Series Access Points
-
Cisco Aironet 2700 Series Access Points
-
Cisco Aironet 2800 Series Access Points
-
Cisco Aironet 3700 Series Access Points
-
Cisco Aironet 3800 Series Access Points
-
Cisco Aironet 4800 Series Access Points
-
Cisco Catalyst 9115AX Access Points
-
Cisco Catalyst 9117AX Access Points
-
Cisco Catalyst 9120AX-i Access Points (VID 06 or earlier)
-
Cisco Catalyst 9120AX-e Access Points (VID 06 or earlier)- supported from 16.12.2s
-
Cisco Catalyst 9120AX-p Access Points- supported from 16.12.2s
-
Cisco Catalyst 9130AX-i Access Points (VID 02 or earlier)- supported from 16.12.2s
For information about Cisco Catalyst 9120 or 9130 Access Points support, see the Field Notice 72424.
Outdoor Access Points
-
Cisco Aironet 1542 Access Points
-
Cisco Aironet 1560 Series Access Points
-
Cisco Aironet 1570 Series Access Points
-
Cisco Industrial Wireless 3700 Series Access Points
Integrated Access Points
-
Integrated Access Point on Cisco 1100 ISR
Network Sensor
-
Cisco Aironet 1800s Active Sensor
For information about Cisco Wireless software releases that support specific Cisco AP modules, see the "Software Release Support for Specific Access Point Modules" section in the Cisco Wireless Solutions Software Compatibility Matrix document.
Upgrading the Controller Software
This section describes the various aspects of upgrading the controller software.
Finding the Software Version
The package files for the Cisco IOS XE software are stored in the system board flash device (flash:).
Use the show version privileged EXEC command to see the software version that is running on your controller.
Note |
Although the show version output always shows the software image running on the controller, the model name shown at the end of the output is the factory configuration, and does not change if you upgrade the software license. |
Use the show install summary privileged EXEC command to see the information about the active package.
Use the dir filesystem: privileged EXEC command to see the directory names of other software images that you have stored in flash memory.
Software Images
-
Release: Cisco IOS XE Gibraltar 16.12.x
-
Image: Universal
-
File Name: C9800-universalk9_wlc.16.12.x.SPA.bin
Software Installation Commands
|
Cisco IOS XE Gibraltar 16.12.x |
|||
|---|---|---|---|
|
To install and activate a specified file, and to commit changes to be persistent across reloads, run the following command: device# install add file filename [activate |commit] To separately install, activate, commit, end, or remove the installation file, run the following command: device# install ?
|
|||
|
add file tftp: filename |
Copies the install file package from a remote location to a device, and performs a compatibility check for the platform and image versions. |
||
|
activateauto-abort-timer] |
Activates the file and reloads the device. The auto-abort-timer keyword automatically rolls back image activation. |
||
|
commit |
Makes changes that are persistent over reloads. |
||
|
rollback to committed |
Rolls back the update to the last committed version. |
||
|
abort |
Cancels file activation, and rolls back to the version that was running before the current installation procedure started. |
||
|
remove |
Deletes all unused and inactive software installation files. |
||
Licensing
This section provides information about the licensing packages for the features that are available in the Cisco Catalyst 9800 Series Wireless Controller.
The software features that are available on the controller fall under these license categories:
-
AIR DNA Essentials (AIR-DNA-E)
-
AIR DNA Advantage (AIR-DNA-A) (Includes the features that are available with the Cisco DNA Essentials license and more.)
Note
The controller starts with AIR-DNA-A as the default. Any change in the license level requires a reboot.
Note |
After adding new license in the Cisco Smart Software Manager (CSSM) for customer virtual account, run the license smart renew auth command on the controller to get the license status changed from Out OF Compliance to Authorized. |
Base Licenses
Base licenses are perpetual licenses and can be used even after the expiry of Air-DNA-A and AIR-DNA-E. Base licenses include:
-
AIR Network Essentials (AIR-NE)
-
AIR Network Advantage (AIR-NA) (Includes the features that are available in the Network Essentials license.)
License Term
The licenses are available for a three, five, or seven-year periods.
For a more detailed overview on Cisco Licensing, go to cisco.com/go/licensingguide.
Guidelines and Restrictions
Software
-
Do not use more than 31 characters for AP names. If the AP name is 32 characters or more, it may lead to a controller crash.
-
Do not deploy OVA files directly to VMware ESXi 6.5. We recommend that you use an OVF tool to deploy the OVA files.
-
Mobility NAT is not supported when the following conditions are met:
-
Data DTLS is turned on.
-
Packets sent from the controller are bigger than minimum Path MTU packets (576B in case of IPv4) with network PMTU >= 1485.
-
PAT is configured on the router or firewall.
Note
This restriction is not applicable from Cisco IOS XE Gibraltar 16.12.2s onwards.
-
-
Firefox Version 63.x is not supported.
-
Ensure that you remove the controller from Cisco Prime before disabling or enabling Netconf-YANG. Otherwise, the system may reload unexpectedly.
-
Unidirectional Link Detection (UDLD) protocol is not supported.
-
SIP media session snooping is not supported on Flexconnect local switching deployments.
-
The Cisco Catalyst 9800 Series Wireless Controllers (C9800-CL, C9800-L, C9800-40, and C9800-80) support a maximum of 14,000 leases with internal DHCP scope.
-
Configuring mobility MAC address (wireless mobility mac-address) is mandatory for both High-Availability and 802.11r.
-
When you configure the Cisco Catalyst 9800 Series Wireless controllers with Cisco Aironet 3700 Series Access Points, through IPv6, and then connect IPv6 capable clients, the IP addresses of all the IPv6 clients are not updated on the controller.
-
If you are upgrading from Cisco IOS XE Gibraltar 16.12.2 or an earlier release, ensure that you unconfigure the advipservices boot level licenses on both the active and standby controllers using the no license boot level advipservices command before the upgrade. Note that this command is not available on the Cisco Catalyst 9800 Wireless Controller for Cloud (9800-CL).
Interoperability with Clients
This section describes the interoperability of the controller software with client devices.
The following table lists the configurations used for testing client devices.
|
Hardware or Software Parameter |
Hardware or Software Type |
|---|---|
|
Release |
Cisco IOS XE Gibraltar 16.12.x |
|
Cisco Wireless Controller |
See Supported Hardware. |
|
Access Points |
|
|
Radio |
|
|
Security |
Open, PSK (WPA2-AES), 802.1X (WPA2-AES) (EAP-FAST, EAP-TLS) 802.11ax |
|
RADIUS |
|
|
Types of tests |
Connectivity, traffic (ICMP), and roaming between two APs |
The following table lists the client types on which the tests were conducted. Client types included laptops, hand-held devices, phones, and printers.
|
Client Type and Name |
Driver or Software Version |
||
|---|---|---|---|
|
Wi-Fi 6 Devices (Mobile Phone and Laptop) |
|||
| Apple iPhone 11 | iOS 14.1 | ||
|
Apple iPhone SE 2020 |
iOS 14.1 | ||
| Dell Intel AX1650w | Windows 10 ( 21.90.2.1) | ||
| Dell Latitude 5491 (Intel AX200) | Windows 10 Pro (21.40.2) | ||
| Samsung S20 | Android 10 | ||
| Samsung S10 (SM-G973U1) | Android 9.0 (One UI 1.1) | ||
| Samsung S10e (SM-G970U1) | Android 9.0 (One UI 1.1) | ||
| Samsung Galaxy S10+ | Android 9.0 | ||
|
Samsung Galaxy Fold 2 |
Android 10 | ||
|
Samsung Galaxy Flip Z |
Android 10 | ||
|
Samsung Note 20 |
Android 10 | ||
|
Laptops |
|||
| Acer Aspire E 15 E5-573-3870 (Qualcomm Atheros QCA9377) | Windows 10 Pro (12.0.0.832) | ||
| Apple Macbook Air 11 inch | OS Sierra 10.12.6 | ||
| Apple Macbook Air 13 inch | OS Catalina 10.15.4 | ||
| Apple Macbook Air 13 inch | OS High Sierra 10.13.4 | ||
| Macbook Pro Retina | OS Mojave 10.14.3 | ||
| Macbook Pro Retina 13 inch early 2015 | OS Mojave 10.14.3 | ||
|
Dell Inspiron 2020 Chromebook |
Chrome OS 75.0.3770.129 |
||
|
Google Pixelbook Go |
Chrome OS 84.0.4147.136 |
||
|
HP chromebook 11a |
Chrome OS 76.0.3809.136 |
||
|
Samsung Chromebook 4+ |
Chrome OS 77.0.3865.105 |
||
| Dell Latitude 3480 (Qualcomm DELL wireless 1820) | Win 10 Pro (12.0.0.242) | ||
| Dell Inspiron 15-7569 (Intel Dual Band Wireless-AC 3165) | Windows 10 Home (18.32.0.5) | ||
| Dell Latitude E5540 (Intel Dual Band Wireless AC7260) | Windows 7 Professional (21.10.1) | ||
| Dell XPS 12 v9250 (Intel Dual Band Wireless AC 8260 ) | Windows 10 (19.50.1.6) | ||
| Dell Latitude 5491 (Intel AX200) | Windows 10 Pro (21.40.2) | ||
| Dell XPS Latitude12 9250 (Intel Dual Band Wireless AC 8260) | Windows 10 Home (21.40.0) | ||
|
Lenovo Yoga C630 Snapdragon 850 (Qualcomm AC 2x2 Svc) |
Windows 10 (1.0.10440.0) |
||
| Lenovo Thinkpad Yoga 460 (Intel Dual Band Wireless-AC 9260) | Windows 10 Pro ( 21.40.0) | ||
|
|||
|
Tablets |
|||
| Apple iPad Pro | iOS 13.5 | ||
| Apple iPad Air2 MGLW2LL/A | iOS 12.4.1 | ||
| Apple iPad Mini 4 9.0.1 MK872LL/A | iOS 11.4.1 | ||
| Apple iPad Mini 2 ME279LL/A | iOS 12.0 | ||
| Microsoft Surface Pro 3 – 11ac | Qualcomm Atheros QCA61x4A | ||
| Microsoft Surface Pro 3 – 11ax | Intel AX201 chipset. Driver v21.40.1.3 | ||
| Microsoft Surface Pro 7 – 11ax | Intel Wi-Fi chip (HarrisonPeak AX201) (11ax, WPA3) | ||
| Microsoft Surface Pro X – 11ac & WPA3 | WCN3998 Wi-Fi Chip (11ac, WPA3) | ||
|
Mobile Phones |
|||
| Apple iPhone 5 | iOS 12.4.1 | ||
| Apple iPhone 6s | iOS 13.5 | ||
| Apple iPhone 8 | iOS 13.5 | ||
| Apple iPhone X MQA52LL/A | iOS 13.5 | ||
| Apple iPhone 11 | iOS 14.1 | ||
| Apple iPhone SE MLY12LL/A | iOS 11.3 | ||
| ASCOM SH1 Myco2 | Build 2.1 | ||
| ASCOM SH1 Myco2 | Build 4.5 | ||
| ASCOM Myco 3 v1.2.3 | Android 8.1 | ||
| Drager Delta | VG9.0.2 | ||
| Drager M300.3 | VG2.4 | ||
| Drager M300.4 | VG2.4 | ||
| Drager M540 | DG6.0.2 (1.2.6) | ||
| Google Pixel 2 | Android 10 | ||
| Google Pixel 3 | Android 11 | ||
|
Google Pixel 3a |
Android 11 |
||
| Google Pixel 4 | Android 11 | ||
| Huawei Mate 20 pro | Android 9.0 | ||
| Huawei P20 Pro | Android 9.0 | ||
|
Huawei P40 |
Android 10 |
||
| LG v40 ThinQ | Android 9.0 | ||
|
One Plus 8 |
Android 10 |
||
|
Oppo Find X2 |
Android 10 |
||
|
Redmi K20 Pro |
Android 10 |
||
| Samsung Galaxy S7 | Andriod 6.0.1 | ||
| Samsung Galaxy S7 SM - G930F | Android 8.0 | ||
| Samsung Galaxy S8 | Android 8.0 | ||
| Samsung Galaxy S9+ - G965U1 | Android 9.0 | ||
| Samsung Galaxy SM - G950U | Android 7.0 | ||
|
Sony Experia 1 ii |
Android 10 |
||
| Sony Experia xz3 | Android 9.0 | ||
|
Xiaomi Mi10 |
Android 10 |
||
| Spectralink 8744 | Android 5.1.1 | ||
| Spectralink Versity Phones 9540 | Android 8.1 | ||
| Vocera Badges B3000n | 4.3.2.5 | ||
| Vocera Smart Badges V5000 | 5.0.4.30 | ||
| Zebra MC40 | Android 5.0 | ||
| Zebra MC40N0 | Android 4.1.1 | ||
| Zebra MC92N0 | Android 4.4.4 | ||
| Zebra TC51 | Android 7.1.2 | ||
| Zebra TC52 | Android 8.1.0 | ||
| Zebra TC55 | Android 8.1.0 | ||
| Zebra TC57 | Android 8.1.0 | ||
| Zebra TC70 | Android 6.1 | ||
| Zebra TC75 | Android 6.1.1 | ||
| Printers | |||
| Zebra QLn320 Printer | LINK OS 6.3 | ||
| Zebra ZT230 Printer | LINK OS 6.3 | ||
| Zebra ZQ310 Printer | LINK OS 6.3 | ||
| Zebra ZD410 Printer | LINK OS 6.3 | ||
| Zebra ZT410 Printer | LINK OS 6.3 | ||
| Zebra ZQ610 Printer | LINK OS 6.3 | ||
| Zebra ZQ620 Printer | LINK OS 6.3 | ||
|
Wireless Module |
|||
|
Intel 11ax 200 |
Driver v22.20.0 | ||
|
Intel AC 9260 |
Driver v21.40.0 | ||
|
Intel Dual Band Wireless AC 8260 |
Driver v19.50.1.6 |
||
Caveats
Caveats describe unexpected behavior in Cisco IOS releases in a product. Caveats that are listed as Open in a prior release are carried forward to the next release as either Open or Resolved.
Note |
All incremental releases contain fixes from the current release. |
Cisco Bug Search Tool
The Cisco Bug Search Tool (BST) allows partners and customers to search for software bugs based on product, release, and keyword, and aggregates key data such as bug details, product, and version. The BST is designed to improve the effectiveness in network risk management and device troubleshooting. The tool has a provision to filter bugs based on credentials to provide external and internal bug views for the search input.
To view the details of a caveat, click the corresponding identifier.
Open Caveats for Cisco IOS XE Gibraltar 16.12.8
There are no open caveats.
Open Caveats for Cisco IOS XE Gibraltar 16.12.7
There are no open caveats.
Open Caveats for Cisco IOS XE Gibraltar 16.12.6a
|
Caveat ID |
Description |
|---|---|
|
The client connected to a local port of OEAP cannot access the local configuration GUI. |
|
|
Cisco C9120AX APs disconnect from the controller with 1025 or more configured exclusion-list entries. |
|
|
The RFID entries are not updated in the Cisco Catalyst 9800-40 Wireless Controller. |
|
|
The Dynamic Channel Assignment (DCA) fails when the outdoor AP is on channel 100. |
|
|
The controller doesn’t sort the received RFID RSSI from APs before sending 16 APs to the connector. |
|
|
The "Call Home EEM cb" process causes high CPU two days after increasing the logging buffer size. |
|
|
Cisco Aironet 1852 AP console displays "spectral_process_phyerr(ln767)”. |
|
|
Cisco Catalyst 9115 AP participates in Air Quality report unexpectedly. |
|
|
Controller console displays error messages and traceback when webauth WLAN with URL filter is in use. |
|
|
The new AP filter name does not reflect the filter name changes for the same tags. |
|
|
The AP primary, secondary, or tertiary name configuration fails in the command line and SNMP. |
|
|
The USB port on AP in the AP default-group needs to be disabled by default. |
Open Caveats for Cisco IOS XE Gibraltar 16.12.5
|
Caveat ID |
Description |
|---|---|
|
APs cause BAD_ADDRESS in the Windows DHCP server when AP or Controller is rebooted. |
|
|
Clients get deleted due to the CO_CLIENT_DELETE_REASON_MOBILITY_FAILURE reason. |
|
|
Cisco Catalyst 9120AXI AP reloads with watchdog grpc_server tainted PC. |
|
|
MAC address flap messages observed on uplink switch when client roams from Cisco Catalyst 9800 Series Wireless Controller to AireOS. |
|
|
Cisco Catalyst 9130 APs do not utilize NDP packets properly resulting in RRM configuration failure. |
|
|
The show ap auto-rf 5ghz and dual-band commands throw an error with no output. |
|
|
Cisco Catalyst 9120 AP: DHCP packets to be sent to the clients are dropped by the AP |
|
|
Cisco Catalyst 9120 AP may reset due to kernel panic after one or two days of uptime. |
|
|
Cisco Catalyst 9130 AP: OEAP GUI is not accessible. |
|
|
Cisco 9800-80 controller sometimes reloads due to WNCD process helddown when more than 5K APs join. |
|
|
Apple clients unable to pass IPv6 traffic when maximum IPv6 address limit is reached. |
|
|
Cisco Catalyst 9800 Series Wireless Controller: Client is able to pass IPv6 traffic in CWA - webauth-pending state. |
|
|
With CAPWAP multicast enabled controller, clients unable to get IPv6 address when Cisco Aironet 4800 Series Access Point is deployed. |
|
|
Cisco Aironet 3800 Series Access Point FlexConnect local switching randomly stops forwarding frames after dot1x session-timeout. |
|
|
The controller is unable to push SSIDs while doing a configuration change on the policy profile. |
|
|
Chrome OS using Intel AX201 unable to connect to 11AX APs in local mode. |
|
|
The controller crashes due to Critical process rrm fault on rp_0_0 (rc=139) |
|
|
Cisco Catalyst 9800-80 controller crashes frequently with signal SIGSEGV and Segmentation fault. |
|
|
The controller reloads due to wncd process crash, when AP sends corrupted CDP information. |
|
|
The controller reloads due to qcp-ucode crash, when the NBAR engine receives invalid packet length |
|
|
Cisco Catalyst 9800 Series Wireless Controller-L: RRM HA configuration tables not yet synced message, without any wireless configuration. |
|
|
FlexConnect peer connectivity breaks after AVC enabled roam. |
|
|
Client not deauthenticated from controller after the SNMP query is run. Client record still appears. |
|
|
Cisco Aironet 4800 Series Access Point crashes on Cisco IT with AP 17.1.1.9. |
|
|
Fabric SDA: Static IP address on Fabric APs through controller GUI/CLI or on AP directly, may fail. |
|
|
Inconsistent configuration options to enable 5 GHz single-band antennas on external antenna APs. |
|
|
The console logs of the controller show error messages and tracebacks. |
|
|
Mobility AP list is not updated on the controller when using IRCM code on AireOS wireless controller. |
|
|
The controller shows authentication failed (Timeout) logs every 90 seconds for clients that are not connected. |
|
|
The debug wireless command failed to execute decode, when exec prompt timestamp is configured. |
|
|
All Cisco Catalyst 9800 Series Wireless Controller WebUI errors to be logged in the syslogs. |
|
|
Output of the show monitor capture command to be included in the show tech wireless command. |
|
|
Add the output of the show wireless dhcp statistics command in the show tech wireless command. |
|
|
Add the output of the show cdp neighbors command in the show tech wireless command. |
|
|
In FlexConnect, clients behind third-party WGB are not able to obtain IP address through DHCP |
|
|
SNMP objects missing for AP neighbor; and radio stats information missing on the controller. |
|
|
No option available to configure Conditional Web Redirect WLANs on the controller. |
|
|
AP must honor EAPOL start from client and forward it to the controller, instead of deleting it. |
|
|
GUI and CLI: Warn users of configuration not applied correctly and the remediation steps to perform. |
Open Caveats for Cisco IOS XE Gibraltar 16.12.4a
|
Caveat ID |
Description |
|---|---|
|
APs are randomly taking longer time for off-channel scanning. |
|
|
Cisco Aironet 3802 AP is not able to acknowledge EAP frames (EAP-TLS). |
|
|
Cisco Catalyst 9120 AP reloads unexpectedly after few days of uptime. |
|
|
Cisco Catalyst 9130 AP: OEAP GUI is not accessible. |
|
|
Clients associated to Wave 2 AP having local switching WLAN with native VLAN is not able to resolve ARP. |
|
|
Controller crashes while changing the password for an existing user. |
|
|
Cisco Catalyst 9117 AP: Dot1x authentication is not working for clients. |
|
|
Memory leak is observed under wncd_x due to CAPWAP messaging. |
|
|
Cisco Catalyst 9120 AP reloads unexpectedly with watchdog_last.status reason:14. |
|
|
Controller is not showing correct antenna mode. |
|
|
Client goes into exclusionlist even when client exclusion is disabled. |
|
|
Cisco Aironet 3802 AP: No Rx packets are seen for 5-GHz radio. |
|
|
RFID OIDs are failing when AIRESPACE-WIRELESS-MIB RFID MIBs are used. |
|
|
Cisco Catalyst 9120 AP: Kernel panic crash is observed due to sockets_in_use. |
|
|
Cisco Catalyst 9130 AP is not discovering controller using the IP address returned in DHCP option 43 or DNS. |
|
|
Cisco DNA Center 1.3.3.4: Default RF profile channel is configured as Best in Fabric-In-A-Box installation. |
|
|
AP uses non-allowed channel on dual radio when setting is changed to 5Ghz. |
|
|
Deletion and creation of second Control Plane IP is failing due to RPC ordering. |
|
|
Cisco Catalyst 9130 AP is not sending DHCP messages over the air. |
|
|
Cisco Catalyst 9100 Series AP: AXI-H AP models have 5Ghz radio operationally down with regulatory domain not supported for -H. |
|
|
Cisco Catalyst 9800-80 controller crashes with SIGSEGV while removing timer RB tree color. |
|
|
Cisco Catalyst 9800-80 controller is sending client traffic out of AP manager interface. |
|
|
Cisco Catalyst 9115 AP: Syslog is only seen when using \"Kern\" facility value in AP join profile. |
|
|
wncd crash is observed on Cisco IOS XE 16.12.3ES3. |
|
|
RADIUS attribute [80] Message-Authenticator is not included for AP authorization. |
|
|
Controller reloads unexpectedly due to double-linked list corruption. |
|
|
AP disjoins after a client connects to SSID using LDAP with mode secure. |
Open Caveats for Cisco IOS XE Gibraltar 16.12.3
|
Caveat ID |
Description |
|---|---|
|
The show ap dot11 {24ghz | 5ghz} cleanair air-quality summary command is displaying empty AP names. |
|
|
DCA anchor time setting is not considering the timezone. |
|
|
The dhcp-tlv-caching enables DHCP required on the AP. However, this prevents the AP from not forwarding the traffic. |
|
|
The following message is displayed during ISSU flow:
|
|
|
High Availability fails to initialize NVRAM after multiple power cycles. |
|
|
Cisco Aironet 3800 AP is failing to send NDP Tx on 5GHz. |
|
|
DNS resolution for RADIUS and TACACS is getting delayed for scale after a power cycle. |
|
|
Cisco AP with SHA2 MIC certificate fails to join the controller configured with config ap cert-expiry-ignore mic enable command. |
|
|
Controller is not sending SNMP traps when AP is reset using GUI or CLI. |
|
|
AP Link Latency Feature is not working on the controller. |
|
|
Unable to enter a valid URL in the urlfilter. |
|
|
Cisco Catalyst 9800 Wireless Controller for Cloud is displaying wrong AVC data on the web UI page. |
|
|
Cisco Aironet 3700 AP reloads unexpectedly. |
|
|
IPv6 dual stack is not working on the controller. |
|
|
Client count is shown as zero on the show ap dot11 {24ghz | 5ghz} load-info command output when Coverage Hole Detection (CHD) is disabled. |
|
|
Global AP pre-image download is not working. |
|
|
Cisco Discovery Protocol (CDP) entries are not displayed on the controller. |
|
|
The AP Policy, RF, and Site tags are set to UNKNOWN. |
|
|
Controller control packets are not honoring mobility PMTU. |
|
|
Lobby Admin with external Radius Authentication is not working. |
|
|
Controller restart: WNCd process is down due to assert for BSSID magic check. |
|
|
The AP mode count in the show wireless summary output is incorrect. |
|
|
QoS rate limiting input under QoS policy should be in Kilobytes and not in Kilobits. |
|
|
Client gets excluded after VLAN change following machine and user authentication. |
|
|
License goes to Unregistered/Evaluation after multiple switchover. |
Open Caveats for Cisco IOS XE Gibraltar 16.12.2s
|
Caveat ID |
Description |
|---|---|
|
The kernel USB driver shows error logs after disabling unused USB 2.0. |
|
|
The severity level of the logs generated by smart-agent is not correct. |
|
|
The iPSK/MAC filtering configuration should not be pushed to the flex mode. |
|
|
Move Away Table allocation to software (instead of TCAM). |
|
|
Client is not able to associate or authenticate while validating DHCP option-82 feature on the Cisco Catalyst 9800-40 and 9800-80 Series Controllers. |
|
|
ESXI 6.5 OVA: Failing to deploy an ova "deploy type" above "small". |
|
|
After unmapping the policy tag ap, IOS APs are not joining the controller. |
|
|
WLAN local switching (central-auth) fails for Apple clients (Macbook, iphone, and so on). |
|
|
PUBD memory leak is observed on the controller. |
|
|
The show wireless summary command output shows negative radio count and monitor count. |
|
|
Wave 1 APs are observing a loss of network communication and is not be able to join the controller. |
|
|
Unable to update openconfig access points, if manually configured WLANs exist on the system. |
|
|
Controller is not sending redirect URL for webauth clients. |
|
|
Regulatory domain for slot 0/2.4Ghz radio is read as unknown on the web UI. |
|
|
AP Link Latency Feature is not working on the controller. |
|
|
Cisco Aironet 1815w AP reloads unexpectedly with radio0FW coredumps. |
|
|
Client dashboard is not loading on the web UI. |
|
|
Unable to edit a site-tag with more than 4000 APs. |
|
|
IPv6 dual stack is not working on the controller. |
|
|
Cisco Catalyst 9800-40 Series Controller excludes spectralink clients due to "Wrong PSK" or "Excluded by Mobility Peer". |
|
|
WLC-AP Primary Controller name and IP address mismatch. |
|
|
Cisco Catalyst 9800-CL Controller reloads after running the show redundancy trace main command. |
|
|
Global AP pre-image download is not working. |
|
|
iOS clients are experiencing unstable wireless connection when both WPA2 and WPA3 are enabled on the Wave 2 AP. |
|
|
Frequent channel change occurs on the Cisco Aironet 4800 AP on slot 0 radio using 5Ghz. |
|
|
Default config register on the controller disables breaking into ROMMON thus preventing password recovery. |
|
|
Upgrading to Cisco IOS XE 16.12.2s release deletes WLAN to policy profile mapping under the default-policy-tag. |
|
|
Cisco Catalyst 9120 APs are unable to see neighboring APs on the controller when FIPS is enabled. |
|
|
Cisco Aironet 2802 AP unexpectedly crashes. |
|
|
Web UI pages are not responding when huge files are being downloaded. |
|
|
Client VLAN missing is from client properties on the web UI. |
|
|
Data DTLS is tearing down when port randomization is enabled on the firewall and client. |
|
|
The show wireless interface summary command is not showing NAT public IP. |
|
|
Android clients (having OS version below 8) are not able to join WPA2 802.1x WLAN when PMF is set as optional. |
|
|
AP is broadcasting the wrong SSID after configuring new WLAN. |
|
|
New active pubd reloads unexpectedly on Cisco 9800-40 series controller (after user induced switchover). |
|
|
Clients are not able to join the Cisco 802.11AX AP. |
|
|
Channel and Interference radio statistics graphs are not populated. |
|
|
It is possible to configure more than 5 flow-exporters. |
|
|
Cisco Trustpoint is not configured using Day0 in an instance launched in Google Cloud Platform (GCP). |
Open Caveats for Cisco IOS XE Gibraltar 16.12.1, 16.12.1s, and 16.12.1t
|
Caveat ID |
Description |
|---|---|
|
The kernel USB driver shows error logs after disabling unused USB 2.0. |
|
|
The severity level of the logs generated by smart-agent is not correct. |
|
|
The iPSK/MAC filtering configuration should not be pushed to the flex mode. |
|
|
Move Away Table allocation to software (instead of TCAM). |
|
|
Client is not able to associate or authenticate while validating DHCP option-82 feature on the Cisco Catalyst 9800-40 and 9800-80 Series Controllers. |
|
|
Esxi 6.5 ova: Failing to deploy an ova "deploy type" above "small". |
|
|
After unmapping the policy tag ap, IOS APs are not joining the controller. |
|
|
Web UI pages are not responding when huge files are being downloaded. |
|
|
Client VLAN missing is from client properties on the web UI. |
|
|
KERNEL crash is observed during a system reboot on Cisco 9115 AP. |
|
|
Data DTLS is tearing down when port randomization is enabled on the firewall and client. |
|
|
qfp crash @ epoll_wait after running show idb command on the console. |
|
|
The show wireless interface summary command is not showing NAT public IP. |
|
|
Multiple client entries are observed in a single client RA. |
|
|
The Method field shows blank for some of the client entries in the show wireless client summary output. |
|
|
Controller is not sending public IP in the discovery response. |
|
|
RLAN AP disjoins when the RLAN client joins and further client join is not happening. |
|
|
Controller console logs are flooding with "%CPPOSLIB-3-ERROR_NOTIFY" tracebacks. |
|
|
Android clients (having OS version below 8) are not able to join WPA2 802.1x WLAN when PMF is set as optional. |
|
|
AP is broadcasting the wrong SSID after configuring new WLAN. |
|
|
New active pubd reloads unexpectedly on Cisco 9800-40 series controller (after user induced switchover). |
|
|
Memory leak is observed on the Cisco 9800-L series controller. |
|
|
Clients are not able to join the Cisco 802.11AX AP. |
|
|
Channel and Interference radio statistics graphs are not populated. |
|
|
It is possible to configure more than 5 flow-exporters. |
|
|
Cisco Trustpoint is not configured using Day0 in an instance launched in Google Cloud Platform (GCP). |
Resolved Caveats for Cisco IOS XE Gibraltar 16.12.8
|
Caveat ID |
Description |
|---|---|
|
Controller crashes due to leak in mobilityd causing invalid ID when the controller runs out of IDs. |
Resolved Caveats for Cisco IOS XE Gibraltar 16.12.7
|
Caveat ID |
Description |
|---|---|
|
Controller is unable to use the wireless broadcast vlan command. |
Resolved Caveats for Cisco IOS XE Gibraltar 16.12.6a
|
Caveat ID |
Description |
|---|---|
|
LAP template fails with "object not found in device" error when PI 3.9 manages the IOS-XE 17.3.2. |
|
|
The OBSS-PD configuration from WebUI does not get pushed to APs mapped to the RF profile. |
|
|
Chromebook or Linux with Intel 11ax adapter does not connect to 11ax APs in local mode. |
|
|
The controller crashes due to critical process RRM fault on rp_0_0 (rc=139). |
|
|
Controller reloads when AP sends frequent CDP updates and WNCD process ends abnormally. |
|
|
The controller reloads due to qcp-ucode crash when the NBAR engine receives invalid packet length. |
|
|
CMX in Non-FIPS mode cannot connect to the controller in FIPS mode. Certificate Validation Error. |
|
|
Apple iPhone iOS 14.4 PSK to SAE switch fails occasionally and AP doesn’t respond to client commit 1. |
|
|
RRM ends abnormally while executing the Grouping Flush pending list. |
|
|
An IOS XE device might crash at DoubleExceptionVector. |
|
|
WNCD ends abnormally at rrm_client_coverage_hole_algorithm. |
|
|
C9800-80 controller goes to rommon after multiple failovers due to power cycling. |
|
|
SAE iPSK uses the WLAN passphrase when there is no client specific passphrase recv from AAA. |
|
|
Client gets stuck at Authenticating state while connecting to SAE IPSK + LWA. |
|
|
Wireless controller is unable to use the wireless broadcast vlan X command. |
|
|
Controller issue with IsBroadcastEnable, webUI shows Enabled instead of Disabled and vice-versa. |
|
|
Client gets stuck at IPLEARN_PENDING state on controller or AP after flex 11r local auth roam. |
|
|
Frame ID mismatch and FW radio 0 crash results in packet drops. |
|
|
Throughput degradation is observed in Wave 2 APs with Flex Local Switching EoGRE tunnel to Benu WAG. |
|
|
The WNM-notification bit in the Beacon frame is displayed incorrectly in the C9120 AP (Local mode). |
|
|
The WNM-notification bit in Beacon frame is displayed incorrectly in C9120 AP (Flex Connect mode). |
|
|
Cisco Catalyst 9115 or 9120 AP crashes continuously. |
|
|
Cisco Aironet 1852 AP radio hangs causing packets drops. |
|
|
Probe suppression on macro cell does not work in Cisco Catalyst 9120 Series AP. |
|
|
Broadcom AP frames randomly gets stuck in buffer when U-APSD is enabled in the controller. |
|
|
Kernel panic with PC occurs at rb_erase+0x220/0x33c while running overnight longevity. |
|
|
Cisco Catalyst 9117AX AP skips concurrent FW coredump to avoid corruption. |
|
|
Transmission power discrepancies are observed in Cisco Catalyst 9130AX and 9117AX Series APs. |
|
|
Cisco Aironet 2802 Series Access Point suddenly drops in transmission power level. |
|
|
Clients get incorrect AP VLAN IP with Cisco Aironet 2800 AP in flex mode. |
|
|
Cisco Aironet 1852 AP stops detecting rogue APs after few hours. |
|
|
Cisco Catalyst 9105, 9115, or 9120 Series APs display 100% channel utilization. |
|
|
Local mode AP deletes client if there is no response to EAP request within 30 seconds. |
|
|
Cisco Catalyst 9120 and 9105 APs reload unexpectedly during regular operation due to kernel panic. |
|
|
Mesh-Milos MAP do not join the controller. |
Resolved Caveats for Cisco IOS XE Gibraltar 16.12.5
|
Caveat ID |
Description |
|---|---|
|
Traceback is observed in GUI while monitoring client page if QoS policies are applied. |
|
|
WNCD reloads unexpectedly when fabric clients roam for long duration. |
|
|
DNAC reports incorrect client RX packets. |
|
|
CAPWAPv6 AP does not send AP name and updates load balancer with the default policy tag. |
|
|
Client is assigned to native VLAN defined in Flex profile instead of vlan-id 1. |
|
|
Tag assignment using filters work till 102 filters, newer filters cause the previous ones to fail. |
|
|
Provisioning with deletion and creation of the second control plane IP fails due to RPC ordering. |
|
|
The Cisco Catalyst 9800-80 Wireless Controller crashes while removing the timer RB tree color. |
|
|
WNCD crash due to assertion in BSSID manager code. |
|
|
Cisco Aironet 2800 AP drops from the controller (16.12.3) due to malformed payload. |
|
|
Observed WNCD crash due to “rrm_client_chd” process assertion failure. |
|
|
EAP does not start after client switches from 802.11r to 802.1x. |
|
|
Clients remain in continuous association loop and unable to recover in FlexConnect mode. |
|
|
Clients fail to associate while moving from 802.11i to 802.11r security method. |
|
|
The Cisco Catalyst 9800 Series Wireless Controller crashes when CPP threads get stuck. |
|
| pass
Client remains in IP learn state and observes continuous CPP tracebacks. |
|
|
When a client switches from 802.11i to 802.11r, the controller fails with an invalid PMKID. |
|
|
Mobility process crashes on Cisco Catalyst 9800 Series Wireless Controller (16.12.4a image). |
|
|
When -E domain APs join the controller with Country Code QA, the 5GHz radio is operationally down. |
|
|
Cisco Catalyst 9800 Series Wireless Controller crashes unexpectedly in the CPP-MCPLO-UCODE process. |
|
|
When Cisco Aironet 1562-M AP joins the controller, the 5GHz radio goes down with country Emirates. |
|
|
The “show tech-support wireless” command enables “service password-encryption”. |
|
|
Stale client entry leads to client disconnects and association problems. |
|
|
Memory leak occurs when IGMP join is sent from the client. |
|
|
WNCD core is displayed when a client gets the blacklisting flag from WLAN policy. |
|
|
Tracebacks are thrown on the controller after upgrading from 17.1 to 17.3.1 |
|
|
WNCD crashes when client subscribes or unsubscribes to the multiple multicast streams and roams across WNCD instances. |
|
|
The controller GUI displays 184-196 channels for Japan regulatory domain related DCA channel list . |
|
|
A print warning message is displayed when SWPortMacConflict drop is seen. |
|
|
Traceback with error message found during HTTP proxy configuration. |
|
|
CleanAir summary wrongly displays the Spectrum Oper State as Down. |
|
|
Remove all commands that display client list on "show tech-support wireless" command. |
|
|
CAPWAP IDB creation (queue) failed after an HA switchover. |
|
|
[AireOS to IOS-XE parity] All client DSCP packets are remarked to zero when voice CAC is configured. |
|
|
Max clients configured in RF profile does not work as more clients are able to join per AP radio. |
|
|
The "sh ap name <ap_name> tag detail" command output does not display WLAN Profile Name. |
|
|
802.11n and 802.11ac are forced to enable even when the controller is disabled and reloaded. |
|
|
GUI depicts incorrect Tx-power of AP while custom RF profile is configured. |
|
|
Memory leak observed in wncd_x processes due to CAPWAP messaging. |
|
|
Client moves to “Exclusionlist” when WPS and WLAN policy “Client Exclusion Policy” are disabled. |
|
|
DNA Center reports AP coverage hole with zero clients but the underlying issue is on the controller. |
|
|
AP uses non-allowed channel on dual-radio when changing settings to 5 GHz. |
|
|
License level does not show up in the prompt level. |
|
|
Cisco Catalyst 9800-80 Wireless Controller leaks client traffic to the AP manager interface. |
|
|
Cisco Catalyst 9800 Series Wireless Controller displays incorrect AP CDP information. |
|
|
Few clients are assigned to an excluded VLAN when configuring VLAN group with two VLAN ranges. |
|
|
Wireless clients cannot connect due to DHCP failure. |
|
|
The “cLApEntPhysicalIndex” object always equals to 1 for all APs registered to the controller. |
|
|
Site tag name is not sent in remote ID (rid) when EoGRE DHCP Option 82 is configured with rid. |
|
|
“show running-config” command does not display the mandatory data rates set on the controller. |
|
|
No SIA antenna ID from Cisco Catalyst 9130AX Series Access Point running 17.3.1. |
|
|
XOR radio slot 0 operates on same channels as that of slot 1 on 5GHz band. |
|
|
The controller loses VNID details when a client does 11r fast roam. |
|
|
DHCP packets are dropped by SISF when option 82 is configured but not present. |
|
|
iPhone or iPad fails to get neighbor report when 11k is enabled. |
|
|
All Cisco Catalyst 9800 platforms truncate the AP location string during join. |
|
|
The puny-policer configuration displays some wrong default values in “show run all”. |
|
|
Controller reports the policy drop packet errors while receiving high amount of IPv6 messages. |
|
|
802.11 parse failure error is seen during client probe request parsing. |
|
|
IOS APs fail to join the Cisco Catalyst 9800 Wireless Controller due to Connect, no AP name. |
|
|
README file is missing some AP models for several AP images. |
|
|
Small amount of memory leak happens when all clients on a given VLAN disconnects. |
|
|
Client does not pass traffic when local switching, central DHCP, and NAT-PAT are disabled. |
|
|
ARP messages are not flooded on upstream VLAN with P2P action - forward up. |
|
|
Memory leaks observed at REPM process when "wireless wps mfp" is enabled . |
|
|
CPP tracebacks are found when clients remain in authenticating state at scale condition. |
|
|
BLE Beacon reported as Persistent Interference Devices by Cisco Catalyst 9120 AP in Auto-RF command. |
|
|
Webauth clients move to RUN state and send traffic when local switching is enabled. |
|
|
Clients may not reconnect in FlexConnect standalone mode when FT is enabled in mixed mode. |
|
|
AP access tunnel goes down when you add or remove an inherited VN to another embedded wireless site. |
|
|
Clients are unable to connect when mixed mode combination (psk and psk-sha256) is available in WLAN. |
|
|
APs do not join the controller because MIC certificate is lost after the controller reloads. |
|
|
AAA session timeout does not take precedence after AP moves from standalone to connected. |
|
|
Memory leak observed on WNCD with 16.12.4/17.3/17.4 of around 100MB to 200MB per day. |
|
|
Cisco Catalyst 3702 Series AP starts beaconing on DFS channel when CAC timer runs for 60 seconds. |
|
|
Client delete initiated message appears after associating a client to WLAN. |
|
|
Old PMKID is used for handshake when a client moves from WPA2 wlan to IPSK wlan. |
|
|
WNCD process crashes when modifying CCKM or 802.11r configuration in WLAN. |
|
|
Memory leaks observed on WNCD process due to ARP message failure. |
|
|
LISP ethernet entries are not deleted from map server even after the client is deleted. |
|
|
The controller reloads due to WNCD process crash during unconfigure and reconfigure of URL filter. |
|
|
Mobilityd process crash observed when connected to a peer Cisco Catalyst 9800 Wireless Controller. |
|
|
Cisco Catalyst 9800 Series Wireless Controller crashes during WGB association. |
|
|
New active controller crashes after SSO when client has a maximum of 16 MGIDs simultaneously. |
Resolved Caveats for Cisco IOS XE Gibraltar 16.12.4a
|
Caveat ID |
Description |
|---|---|
| Self-signed certificates cannot be created after the time expires. | |
| Cisco 9120AX AP: AP does not use the correct data rates. | |
| CSCvt51865 |
Unable to restrict the Guest User account to a specific SSID. |
|
Cisco Catalyst 9800-80 Controller crashes frequently with corrupted stack ending in Sanet function. |
|
|
Lobby admin with external RADIUS authentication is not working. |
|
|
New AP joins an anchor controller with a different mobility group name. |
|
|
Slow memory leak due to WNCD kernel process. |
|
|
Cisco Aironet 3700 AP with HALO experiences unexpected reloads. |
|
|
Client gets excluded after VLAN changes post machine and user authentication. |
|
|
Client is unable to associate due to DOT11_STATUS_DENIED_RATES when extended rates are used. |
|
|
Current Tx rate for 802.11AX clients are displayed incorrectly. |
|
|
Authentication fails in Zebra clients, when local authentication is configured in the policy profile. |
|
|
Client is getting deleted due to DOT11_STATUS_DENIED_RATES. |
|
|
Roaming is not successful when NAC is enabled in the policy profile. |
|
|
Cisco Catalyst 9800-CL Controller running IOS XE Gibraltar 16.12.2s wncd crashes due to CPU HOG. |
|
|
Controller does not send the discovery response with its public IP after reboot. |
|
|
Controller does not populate AP load information in the discovery response. |
|
|
AP Link Latency feature is not working. |
|
|
Frequent AP channel changes are observed on 5GHz band radio. |
|
|
XOR channel changes frequently when band configuration is static. |
|
|
Values of client retries and Rx packets on Cisco DNA-C are different from the values seen on the AP. |
|
|
Controller shows incorrect number of interferers. |
|
|
WNCd process down due to assert for BSSID magic check. |
|
|
Cisco Catalyst 9800-80 Controller HA running 'wncd' crashes frequently. |
|
|
Do not present "host mode" configuration options when the RLAN profile is set to open. |
|
|
The WebUI is not showing 2.4GHz channels 12, 13, or 14 for radios in country's that support these channels. |
|
|
Optimize SVI/VLAN page loading. |
|
|
Controller GUI: AP page is stuck in buffering mode (refresh to recover the page) when filters are applied. |
|
|
AP mode count is incorrect in the show wireless summary output. |
|
|
Observed wncd crash@ewlc_dgram_msg_and_msgbuf_free with ISSU flow in scale. |
|
|
Traceback: When AP's interface operational status goes down, SNMP trap triggers, and device reloads. |
|
|
FlexConnect local-sw client is not assigned to VLAN1 when VLAN assignment is done through AAA. |
|
|
Controller does not honour timezone when configuring DCA anchortime. |
|
|
Frequent channel changes on the Cisco AP Aironet 4800 AP slot 0 radio using 5GHz. |
|
|
Control packets not honoring Mobility PMTU. |
|
|
Controller GUI: SNMPv3 privilege and authentication credentials are swapped when adding a user. |
|
|
SNMP v3: Users page on the GUI does not allow configuration of passwords with special characters. |
|
|
Guest anchor fails to load balance clients across anchors. |
|
|
AP CAC GUI parameter displays incorrect unit. Displays bytes instead of "medium time". |
|
|
AAA page does not load after upgrading to IOS XE Gibraltar 16.12.2s. |
|
|
FT gets enabled during static WEP WLAN creation - WLAN modification throws error. |
|
|
Unable to configure SNMP settings through the GUI in Japanase mode. |
|
|
Unable to delete or deauthenticate excluded clients through the GUI. |
|
|
Deleting a policy profile that is mapped under a policy tag should display a warning. |
|
|
Tri Radio: Controller GUI does not display slot-2 details in the 360 degree view. |
|
|
Client count shows zero in the show ap dot11 5ghz/2.4ghz load-info command output while CHD is disabled. |
|
|
Controller displays that 802.11ac is not supported on XOR radios of APs. |
|
|
Cisco Catalyst 9800-40 Controller: Stale FMAP-FP/CPP tunnel issue. |
|
|
Controller may reload as WNCD process is held down with scaled clients. |
|
|
Data rates need to be updated when the client is moving from one AP to another. |
|
|
CAPWAP DTLS session is closed for AP, because of the DTLS server session shutdown. |
|
|
AP sends lower bytes of packets while performing PMTU negotiations. |
|
|
DTLS teardown is observed on 9120, 9115, and 9105 series of APs. |
|
|
Controller-AP: Primary controller name and IP address mismatch. |
|
|
AP Policy/RF/Site tags set to UNKNOWN unless tag-config is explicitly written from the controller. |
|
|
IPv6 dual stack does not work. |
|
|
HA failed to initialize NVRAM after multiple power cycles. |
|
|
Client stuck in IP learn state with FlexConnect local switching + central DHCP + DHCP required. |
|
|
When the power box is reset, DNS resolution for Radius and TACACS is delayed for scale. |
|
|
Controller loses smart licensing registration if integrated with DNA spaces after a reboot. |
|
|
Cisco Aironet 1570 series AP crashes if WLAN with ID >= 17 is configured in the policy tag. |
|
|
Multicast replicates over CAPWAP with global multicast disabled |
|
|
Controller goes down and reloads when AVC is enabled. |
|
|
Cisco 9800 running IOS XE Gibraltar 16.12.3 does not send RSSI messages over NMSP. |
|
|
CWA GA scenario client removed after export anchor response received from WLC due profile plumb. |
|
|
Controller is assigned to native VLAN instead of client VLAN. |
|
|
Controller crashes on WMM action, while roaming. |
|
|
APs do not apply client QoS policy in FlexConnect local-sw and local-auth. |
|
|
Global AP pre-image download is not working. |
|
|
CDP entries are not showing up on the controller. |
|
|
Cannot remove AdvIPServices license. |
|
|
Critical Syslog notification support required when unsupported SFPs are connected. |
|
|
9800-40/80 UDP Port 5246 based ACL filter fails to select DTLS encrypted CAPWAP control packets. |
|
|
Controller crashed with the following reason "Critical process cpp_cp_svr fault on fp_0_0 (rc=134)". |
|
|
Controller reloads when processing AVC or FNF. |
|
|
Controller is unable to downgrade license: Device is not authorized to use the given license level. |
|
|
Cisco Aironet 3700 APs are unable to join controller as the VLAN interface name exceeds character limit in flex profile. |
|
|
Require MAB username delimiter with single hypen. |
|
|
Client is deleted due to the CO_CLIENT_DELETE_REASON_NOOP reason code. |
|
|
ARP request comes from a formerly active controller on HA with split brain scenario. |
|
|
Controller may crash when an AP joins and does not report the correct radios. |
|
|
Cisco Aironet 2800 AP - XOR in 5g: Clients unable to join, AP deauth reason "Invalid group cipher (0x0012)?". |
|
|
Invalid values for AP performance profile. |
|
|
Pubd crash observed just after SSO. |
|
|
RRM AP transmit power is not moving into the maximum or minimum configured power. |
|
|
CWA ACL is removed from the existing flex AP, when a new flex profile is created with same ACL. |
|
|
Cisco Wave1 AP: Client traffic is stuck after client is in RUN state for CWA/LWA. |
|
|
Radius server password field shows no value (blank) in the GUI. |
|
|
Controller GUI has no option to configure AP LED state for IOS APs. |
|
|
Unable to map the attribute map to a user through the GUI. |
|
|
CleanAir Admin Status is displayed as DISABLED on controller Japanese GUI. |
|
|
Basic Wireless setup error, "Use of default ACL preauth v4 is not permitted". |
|
|
Cisco Catalyst 9800-CL Controller is unable to display medium power when AP sends 25W POE message. |
|
|
Cisco Aironet AP 2800/3800/4800/1560 and Cisco IW 6300 AP gets into a loop after attempting to join controller with FIPS enabled. |
|
|
Cisco Wave 1 AP console displays 'DTX DUMP' logs. |
|
|
Cisco Aironet 2800/3800/4800/1560 APs unexpectedly reloads. |
|
|
Cisco Aironet 2800 and 3800 APs exhibit choppiness during the multicast voice call. |
|
|
FlexConnect AP in standalone mode gets stranded and does not send CAPWAP discovery. |
|
|
Cisco Wave 1 APs reload unexpectedly with 'Unexpected exception to CPU' in logs. |
|
|
Kernel panic is observed. |
|
|
Cisco Wave 1 AP: Radio is reset with code 44. |
|
|
Cisco Aironet 1572 AP: Radio is reset due to pak count mismatch, false detection. |
|
|
Cisco Aironet 2800 AP reloads unexpectedly on Sxpd process. |
|
|
Cisco Wave 1 AP: Radio is reset with code 44. |
|
|
Cisco Wave 2 APs: Workgroup bridge (WGB) does not send Internet Access Point Protocol (IAPP) message in static IP config. |
|
|
Cisco FlexConnect AP drops UDP packet (port 2598). |
|
|
Cisco Aironet 3800 AP: Kernel panic crash is observed. |
|
|
Cisco Wave 1 AP: Clients are losing connectivity while roaming. |
|
|
Decipher radio reset code 44 to more specific reason codes. |
|
|
Cisco Aironet 2800/3800/4800/1560 series AP stops sending broadcast address resolution protocol (ARP) to wireless. |
|
|
VLAN bridging problem on Cisco Aironet 1810W AP with Remote LAN (RLAN). |
|
|
Root Access Point (RAP) drops radio connection, causing the Mesh Access Point (MAP) to drop. After restoring the connection, switches are not able to pass traffic. |
|
|
Cisco Aironet 3800 AP is failing to send Neighbor Discovery Protocol (NDP) Tx on 5GHz. |
|
|
Beacon is stuck followed by firmware assert. The AP radio is on channel 36 while controller thinks it's on different channel. |
|
|
Cisco Aironet 3802 AP crash on watchdog reset (wcpd). |
|
|
Authentication failure Extensible Authentication Protocol (EAP) timeout on a Cisco Aironet 1852 AP with data Datagram Transport Layer Security (DTLS) encryption isenabled. |
|
|
Cisco AP with SHA2 message integrity check (MIC) certificate fails to join controller. |
|
|
Low Received Signal Strength Indicator (RSSI) on 2.4GHz for Cisco Catalyst 9120AX-E AP as compared Cisco Aironet 2800 AP. |
|
|
Cisco Aironet 3702 AP reloads unexpectedly. |
|
|
Cisco Catalyst 9800-CL Controller is displaying wrong Application Visibility and Control (AVC) data on the GUI page. |
|
|
Cisco Wave 1 AP reloads unexpectedly which relates to fast roaming state machine. |
|
|
Cisco Catalyst 9130E AP: NSS reloads unexpectedly causing AP to be stuck in continuous loop. |
|
|
AP crash is observed due to kernel panic triggered by Dynamic Frequency Selection (DFS) channel use. |
|
|
Flex standalone with 11r Fallback FT Auth response code change to 53. |
|
|
Client ARP and DHCP failures are observed after roaming among Cisco Wave 1 APs. |
|
|
Cisco Aironet 3602 AP image corruption issue. |
|
|
Frequent radio resets are observed during continuous roam (11r-OTA). |
|
|
Cisco Catalyst 9120 AP: All clients are loosing connectivity on flex standalone. |
|
|
AVC status is getting disabled while configuring service-policy input from DNA. |
|
|
Intel clients are experiencing latency or drops when connected to Cisco Catalyst 9120 APs. |
|
|
Cisco Catalyst 9120 AP: Flex connected to standalone; clients are loosing data. |
|
|
Cisco Aironet 3700 AP: FlexConnect deauth status code is changed from 28 to 53 if 11r Pairwise Master Key (PMK) is not present. |
|
|
Flex connected mode: Incorrect PMK ID causes delay in client association (Local Switch, Central Auth). |
|
|
Flex connected mode: After continuous roam, client takes a longer time to reconnect. |
|
|
Cisco Aironet 2700 AP: In flex standalone mode, the AP send identity request only once; need to send more. |
|
|
Cisco Aironet 2800/3800/4800/1560 APs are not transmitting data frames over the air. |
|
|
Clients cannot connect to Cisco Wave 1 APs with dot1x-sha256 received assoc-resp 20. |
|
|
Rate limiting is not working for downstream traffic when ACL is pushed from ISE. |
|
|
EAP-PEAP flex authentication fails occasionally because of low eap-timeout. |
|
|
Clients connected to 2 different autonomous APs with ISE VLAN override cannot ping in 5GHz radio. |
|
|
Cisco Aironet 2800 AP: Dual-Band (XOR) radio does not beacon after few iterations of moving from AUTO to 5G. |
|
|
CPU exceeds 90 % with high volume traffic. |
|
|
Cisco Wave 1 AP reports itself as a threat and logs \"AP Impersonation\" alerts. |
|
|
Cisco Aironet 1800 AP unexpectedly reloads. |
|
|
Cisco Wave 1 APs are not sending deauth rc 7 after rx frame from non assoc client. |
|
|
Cisco Aironet 1832 AP kernel panic crash. |
|
|
Cisco Aironet 2700 and 3800 APs are dropping ARP_REPLY packets. |
|
|
Cisco Aironet 1532 AP: Ethernet interface is loosing packets. |
|
|
Memory leak is observed under process SACRcvWQWrk2 when Smart Licensing is enabled. |
|
|
Cisco Catalyst 9115AXI AP reloads unexpectedly with a kernel panic. |
|
|
Cisco Aironet 2800 AP is dropping from the controller. |
|
|
Cisco Aironet 2700 AP PCI0 reloads unexpectedly when Cisco CleanAir is enabled. |
|
|
Traceroute fails: /bin/sh: /usr/bin/traceroute: not found. |
|
|
Cisco Aironet 1815T AP is leaking client MAC from LAN3 to WAN port. |
|
|
Wave 2 APs in FlexConnect mode are sending Auth Request to AAA without Local Auth Enabled. |
|
|
Cisco Aironet 2800 APs are using 802.11n rates with WPA+TKIP only WLAN. |
|
|
WLC 8540 OID returns small number than actual traffic size. |
|
|
MAPs failing mesh_sec_auth and excluding Parent upon RAP failure. |
|
|
Cisco Aironet 1562 AP in UWGB mode is unable to associate when powered up outside wireless coverage area. |
|
|
WGB wired client is not getting IP when associating to Cisco Catalyst 9130 AP. |
|
|
Clients connected to same SSID using different autonomous Cisco 2702 APs can not ping each other. |
|
|
Cisco AP is not handling EXPIRE_MIC_PAYLOAD message. |
|
|
Trustpoint configuration fails on Wave 2 APs in WGB. |
|
|
802.11v Directed Multicast Service (DMS) is not shown as supported within beacon of Cisco Aironet 1852 AP. |
|
|
Cisco Aironet 4800/3800/2800/1562 APs are stuck in "BootROM: Image checksum verification FAILED". |
|
|
Cisco Catalyst 9130I and Cisco Aironet 1852 APs \"{watchdogd} Process syslogd gone for 60s\" & \" can't open '3410/maps'\". |
|
|
Cisco APs acting as MAPs are not able to see RAPs. |
|
|
Cisco AP fails to attach the VLAN tag when client user ID changes from central to local switching. |
|
|
Cisco IW3702 AP: Samsung S10 client fails to associate on flex:local auth+local switch in 11r security. |
|
|
Cisco Wave 2 AP beacons disabled SSID. |
|
|
Dual-band static channel configuration switches to DCA after AP rejoin. |
|
|
Cisco Catalyst 9130 AP: Kernel panic at cisco_wlan_crypto_decap. |
|
|
Clients cannot connect to Cisco Aironet 1800 AP with 2.4 GHz with hidden SSID. |
|
|
Cisco Aironet 4800 APs stopped supporting European weather band 5600-5650MHz- channels 120,124, and 128. |
|
|
Cisco Aironet 1850AP: Clients are unable to connect to the AP. |
|
|
Flexconnect reap count for current users not getting decremented causing new Wi-Fi client disconnect. |
|
|
EWC conversion fails for Cisco Catalyst 9115AX AP with -T domain. |
|
|
Cisco Catalyst 9120 power is lower than Cisco Aironet 2800/3800 APs with CCK rates disabled(2.4GHz). |
|
|
Cisco OfficeExtend access point (OEAP) configuration doesn't get saved to AP flash. |
|
|
Cisco Catalyst 9120 AP is not applying trust-dscp-upstream and CAPWAP traffic marked with UP to DSCP. |
|
|
2.4GHz throughput does not change based on the number of streams. |
|
|
Mesh AP: With ACL blocks ping to gateway, AP can't join controller if it doesn't complete within 45sec. |
|
|
Cisco Wave 2 APs silver UP 00 to DSCP upstream mapping not capped by bronze profile. |
|
|
Various models of Android 10 devices fail to associate. |
|
|
AIR-AP2802I-H-K9 WCPd crash: AP is failing to decode discovery response and reboot with flash core. |
|
|
The factory-reset all command has to avoid removing actual image when controller is in install mode. |
Resolved Caveats for Cisco IOS XE Gibraltar 16.12.3
|
Caveat ID |
Description |
|---|---|
|
Cisco AP reloads unexpectedly. |
|
|
Cisco Wave 2 APs are dropping CAPWAP keepalive messages and are unable to join the controller. |
|
|
Controller does not accept RADIUS attribute for VNID overwrite in Fabric mode. |
|
|
Cisco Catalyst 9115AX and 9120AX APs: When non-broadcasted SSID is configured, beacons are corrupted. |
|
|
Cisco Catalyst 9117 AP: Invalid radar detection on the non-serving channel. |
|
|
Cisco Aironet 2700 and 3700 APs: In Flex Profile, Native VLAN 1 and VLAN mapping to 1 causes loss of network connectivity. |
|
|
Samsung s10 client is not able to connect to the WPA2+WPA3-SAE+PSK+FT PSK+PSK-SHA2 mixed mode. |
|
|
Cisco AP unexpectedly reloads with watchdog reset(wcpd). |
|
|
Cisco Catalyst 9130 AP does not send disassociate message when CAPWAP resets. |
|
|
Cisco Aironet 3702 AP is adding C0 to the association ID in assoc-resp when configured as FlexConnect central association. |
|
|
Wncd unexpected reboot. |
|
|
After AES encryption is enabled, entering plain aaa dynamic-author keys corrupts key. |
|
|
Cisco AP is sending invalid association ID. |
|
|
When attempting to broadcast the same exact SSID on the controller and on the Cisco Catalyst 9120-AX AP, the controller sees CPUHOG alerts for EPM and crashes. |
|
|
Cisco Catalyst 9120 AP PSM TX-STUCK detection fired continuously in a loop. |
|
|
Cisco Aironet 2802 AP: Association ID allocation failed for slot 0. |
|
|
Controller is not sending redirect URL for webauth clients. |
|
|
Cisco Aironet 1832 AP has zero Rx neighbors. |
|
|
Cisco Aironet 3800 APs: MIC errors are observed for CCKM roams in FlexConnect local switch mode. |
|
|
Cisco Wave 2 APs with FT standalone mode: Roam traffic is blackholed when PMK is present. |
|
|
In Cisco Catalyst 9130 AP tri-radio slot 1 and 2, the maximum client count is limited to 255. |
|
|
Cisco Wave 2 APs are sending the EAP identity request with incorrect BSSID. |
|
|
Wireless client is unable to get ipv6 address when associated to Cisco Catalyst 9130ax AP. |
|
|
HA: When switchover occurs, first 11r client roam fails to authenticate. |
|
|
btman process is stuck at 100% while running show tech command. |
|
|
Wcnd reboots unexpectedly after association failure. |
|
|
Cisco Aironet 3802-P-k9 AP Transmit Power Adjustment with AIR-ANT2513P4M-N (13dBi) W52 Japan Outdoor. |
|
|
Cisco Catalyst 9115AX AP: Rogue containment is not working if AP is in monitor mode. |
|
|
Flex AP is sending RADIUS packets to AAA server when in local-auth mode. |
|
|
-Q domain APs in Japan advertise J4 as the country in beacon instead of JP. |
|
|
Cisco Catalyst 9800-40 Wireless Controller crashes on receiving invalid username with 246 characters. |
|
|
Cisco Catalyst 9115 APs: Rogue containment in monitor mode is not working as expected. |
|
|
Controller is unable to send proper sequence number and burst rate upstream breaking RFID. |
|
|
AP must send status 53 when PMKID is not found during FT-AUTH processing. |
|
|
Controller running Cisco IOS XE 16.12.2s is not showing any clients in CMX when filtered by associated clients. |
Resolved Caveats for Cisco IOS XE Gibraltar 16.12.2s
|
Caveat ID |
Description |
|---|---|
|
Add clear install state command. |
|
|
The packet callbacks are not cleared for the transmission scan frames. |
|
|
The CleanAir sensor is down. |
|
|
Cisco Aironet 2800, 3800, and 4800 series APs are doing Channel Availability Check (CAC) after radio reset in the Dynamic Frequency Selection (DFS) channel. |
|
|
Cisco Catalyst 9120 AP crashes unexpectedly. |
|
|
Cisco Catalyst 9115 and 9120 APs: Duplex mismatch is discovered on the AP connected port. |
|
|
AP loses data Datagram Transport Layer Security (DTLS) tunnel when port randomization is enabled on the firewall and a client connects to the AP. |
|
|
Wireless clients are unable to connect to SSIDs on the Cisco Catalyst 9117 AP after 24 hours. |
|
|
POE power request from Cisco Aironet 1815m and 1542 APs are different from the AP data sheet. |
|
|
AWS NAT: Controller is not sending public IP in the discovery response. |
|
|
RLAN AP disjoins when the RLAN client joins and further client join is not happening. |
|
|
Controller console logs are flooded with "%CPPOSLIB-3-ERROR_NOTIFY" tracebacks. |
|
|
Cisco DNA Centre: Web authentication client traffic stops working after an intra-controller roaming. |
|
|
Memory leak is observed in the Cisco Catalyst 9800-L Series Wireless Controller. |
|
|
Cisco Catalyst 9120 AP crashes due to kernel panic. |
|
|
MESH adjacency SNR reports 252dB. |
|
|
Controller and AP provisioning fails while using the do ap name <ap-name> location command. |
|
|
Cisco Catalyst 9800 Series Wireless Controller for Cloud is unable to save the configuration. |
|
|
Wncd crash is observed after switchover in Cisco Catalyst 9800-L Series Wireless Controller. |
|
|
A Wave 2 AP that is behind a NAT device doing NAT and PAT drops the controller when Data DTLS is enabled. |
|
|
APs are experiencing radio 0 FW crash. |
|
|
Switch with an embedded wireless controller reloads unexpectedly. |
|
|
Cisco Catalyst 9130 AP reloads unexpectedly in a loop. |
|
|
Controller is sending 5 GHz band as 2.4 GHz band for an associated client to Cisco CMX. |
|
|
Wncd process is crashing on the newly active controller immediately after the switchover. |
|
|
APs are not joining after configuring LAG. |
|
|
GC is stuck because of NMSPD spectrum and is not moving to read the cursor. |
|
|
5 GHz radios are going down when the country code is changed to MK. |
|
|
Cisco Catalyst 9800-L Series Wireless Controller in HA mode is crashing continuously. |
|
|
Client is showing a health score of four even after getting deleted from the controller. |
|
|
Anyconnect 4.7 clients are sending IPv6 RS with FE00 address causing clients to disconnect due to IP theft. |
|
|
Cisco Catalyst 9120 AP: Coverage hole problem is causing client connectivity issues. |
|
|
Cisco Catalyst 9120 AP: Configuration to change beamforming is not working from the controller. |
|
|
System reloads unexpectedly and loses partial configuration due to wncd and cpp-mcplo failure. |
|
|
Clients are getting disconnected due to the stale association IDs on the Cisco Catalyst 9130ax AP. |
|
|
Cisco Catalyst 9130 AP reloads unexpectedly on softlockup. |
|
|
The show ap config slots command output is showing Modulation and Coding Scheme (MCS) rates as disabled on the AP. |
|
|
Export log feature is not working, if the directory name does not have a terminating forward slash. |
|
|
The show tech wireless command displays the list of clients connected to the controller. |
|
|
User is unable to edit default policy tag. |
|
|
The show client summary detail command output requires 802.11k/v/w/u/WMM details. |
|
|
Add show wireless client summary detail {ipv4 | ipv6} command. |
|
|
RA collected for a specific client is showing logs for other clients as well. |
|
|
The method field is empty for few clients in the show wireless client summary command output. |
|
|
During roaming, the APs are sending deauthentication message after sending reassociation request, when FT is set to enable or adaptive. |
|
|
OFDM parameters are shown as automatic even after manual allocation. |
|
|
Controller web UI is not allowing to configure the Antenna Gain field. |
|
|
The show wireless country channels command output is not showing channels greater than or equal to 100. |
|
|
Add last SSID to the parent structure st_rogue_data. |
|
|
Add MAC address theft as a reason for client exclusion. |
|
|
Flexconnect WLAN-VLAN tag is not working for VLAN names created without numbers. |
|
|
The show ap name <ap-name> config slot command output displays inconsistent MCS data. |
|
|
CWDB sync is missing when tx power is changed by Tx Power Control (TPC). |
Resolved Caveats for Cisco IOS XE Gibraltar 16.12.1t
|
Caveat ID |
Description |
|---|---|
|
Remove support for Cisco Catalyst 9120 and 9130 series APs. |
Note |
All the caveats listed in Resolved Caveats for Cisco IOS XE Gibraltar 16.12.1s section are applicable for Cisco IOS XE Gibraltar 16.12.1t release as well, in addition to the caveat given above. |
Resolved Caveats for Cisco IOS XE Gibraltar 16.12.1s
|
Caveat ID |
Description |
|---|---|
|
Cisco DNA Center is showing four-way key timeout text descriptions for mic error and RC mismatch. |
|
|
Radio utilization is not reported accurately for the wireless clients. |
|
|
STA Denied Rate Events are not incrementing on the AP for anomaly rate-mismatch. |
|
|
Pubd process reloads unexpectedly after connecting to Cisco Prime Infrastructure. |
|
|
AP drops data packets due to stale AP entries. |
|
|
During roaming, the APs are sending deauthentication message after sending reassociation request, when FT is set to enable or adaptive. |
|
|
Cisco Trustpoint is not configured via Day0 configuration in an instance that is launched in GCP. |
|
|
Regulatory domain channels mismatch for the Japan domain (J4). |
|
|
Cisco DNA Center: AP reachability status is not getting updated. |
|
|
Controller is not sending the correct reason code to Cisco DNA Center when triggering an invalid RSNIE during the association request. |
|
|
APs are continuously flapping after the second switch over. |
|
|
Inter-wncd fast-roam re-association response is not going out. |
|
|
Multicast IPv6 packets that are received from the clients are causing a loop, which results in a major uplink bandwidth utilization issue. |
|
|
APs are unable to form a tunnel due to Interprocessor Communication (IPC) channel back pressure. |
Troubleshooting
For the most up-to-date, detailed troubleshooting information, visit the Cisco TAC website at:
Go to Product Support and select your product from the list or enter the name of your product. Look under Troubleshoot and Alerts to find information about the problem that you are experiencing.
Related Documentation
Information about Cisco IOS XE is available at:
https://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-xe/index.html
Cisco Validated Design documents are available at:
https://www.cisco.com/go/designzone
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use the Cisco MIB Locator at:
Cisco Wireless Controller
For more information about the Cisco wireless controller, lightweight APs, and mesh APs, see these documents:
-
Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide
-
Cisco Catalyst 9800 Series Wireless Controller Command Reference
-
Upgrading Field Programmable Hardware Devices for Cisco Catalyst 9800 Series Wireless Controllers
The installation guide for your controller is available at:
For all Cisco Wireless Controller software-related documentation, see:
Cisco Catalyst 9800 Wireless Controller Data Sheets
-
Cisco Catalyst 9800-CL Wireless Controller: https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-cl-wireless-controller-cloud/nb-06-cat9800-cl-cloud-wirel-data-sheet-ctp-en.html
-
Cisco Catalyst 9800-80 Wireless Controller: https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/nb-06-cat9800-80-wirel-mod-data-sheet-ctp-en.html
-
Cisco Catalyst 9800-40 Wireless Controller: https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/nb-06-cat9800-wirel-cont-data-sheet-ctp-en.html
-
Cisco Catalyst 9800-L Wireless Controller: https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/datasheet-c78-742434.html
Cisco Embedded Wireless Controller on Catalyst Access Points
For more information about the Cisco Embedded Wireless Controller on Catalyst Access Points, see:
Wireless Products Comparison
-
Use this tool to compare the specifications of Cisco wireless APs and controllers:
https://www.cisco.com/c/en/us/products/wireless/wireless-lan-controller/product-comparison.html
-
Wireless LAN Compliance Lookup:
https://www.cisco.com/c/dam/assets/prod/wireless/wireless-compliance-tool/index.html
-
Cisco AireOS to Cisco Catalyst 9800 Wireless Controller Feature Comparison Matrix:
Cisco Prime Infrastructure
Cisco Connected Mobile Experiences
Cisco Catalyst Center
Communications, Services, and Additional Information
-
To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager.
-
To get the business impact you’re looking for with the technologies that matter, visit Cisco Services.
-
To submit a service request, visit Cisco Support.
-
To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit Cisco Marketplace.
-
To obtain general networking, training, and certification titles, visit Cisco Press.
-
To find warranty information for a specific product or product family, access Cisco Warranty Finder.
Feedback