Explains LSC fallback mechanisms for CAPWAP authentication, provides methods to identify APs in fallback state, guides troubleshooting and syslog analysis, and details recovery commands to restore normal LSC functionality.

LSC fallback APs

LSC fallback is a state that

occurs when an AP configured with LSC for CAPWAP fails to establish DTLS connection after reaching the maximum number of retry attempts
causes the AP to revert to its default certificate (MIC) for CAPWAP authentication, and
provides a backup authentication method when LSC-based CAPWAP connection attempts fail.

LSC fallback process

When you configure an AP with LSC for CAPWAP but it fails to establish a DTLS connection, the AP reboots. The AP then retries for a certain number of times. For information on how to configure an AP with LSC, see Configure AP join attempts with LSC certificate (CLI).

The AP falls back to its default certificate (MIC) for CAPWAP after maximum number of failures. The AP fallback state is referred to as the LSC fallback.

Note

MIC is also known as SUDI certificate.

Troubleshoot LSC fallback state

This task enables you to identify access points in LSC fallback state and understand the recovery process when APs fail to establish proper LSC connections with the controller.

When an AP in LSC fallback state joins the controller, it generates specific syslog messages and is held in a misconfigured state. The AP does not broadcast WLAN or SSID configurations in this state, which permits the admin to examine the reason for previous failures and recover APs.

Procedure

Identify the syslog message generated when an AP in LSC fallback state joins the controller.

Example:

Jun 15 23:24:14.836: %APMGR_TRACE_MESSAGE-3-WLC_GEN_ERR: Chassis 1 R0/0: wncd: Error 
in AP: 'AP2c5a.0f70.84dc' with address 70db.9888.cc20 is joined with MIC, while configuration 
requires LSC. No WLANs will be pushed.

The controller allows such an AP to be joined with MIC (when AP certificate policy allows it) and AP is held in misconfigured state.

Note

The AP does not broadcast WLAN or SSID configurations in such state. This permits the admin to examine the reason for previous failures and recover APs.

Use show wireless summary to identify LSC fallback APs.

Example:


Device# show wireless summary
…
Access Point Summary
… 
DTLS LSC fallback APs     20 (No WLANs will be pushed to these APs)
…
For more information on DTLS LSC fallback APs,
    execute 'wireless config validate' and look for reported errors in
    'show wireless config validation status' CLI output.
 
Use 'show ap config general | inc AP Name | LSC fallback' to list DTLS LSC fallback APs.
Examine LSC fallback reasons / DTLS handshake failures with LSC then
    issue 'ap lsc dtls-fallback clear-certificate / clear-flag' to recover APs

You have successfully identified LSC fallback APs and understand the commands available for further investigation and recovery.

Recover from LSC fallback

Recover APs from LSC fallback state and restore normal LSC functionality for CAPWAP DTLS connections.

When LSC fallback occurs, APs may require recovery actions to restore normal operation. Recovery options depend on whether you want to retain the LSC certificate or clear it completely.

Procedure

Choose one of the following recovery methods based on your requirements:

To clear the LSC fallback flag and retain the LSC certificate, use the ap lsc dtls-fallback clear-flag command to instruct the AP to reload.

Note

The AP reuses the LSC for CAPWAP DTLS connection post the reload.
To clear the LSC certificate completely, use the ap lsc dtls-fallback clear-certificate command to clear LSC and instruct the AP to reload.

Note

The AP uses MIC for CAPWAP-DTLS post the reload. If LSC is used for Dot1x port authentication then further recovery is needed on switch port for AP authentication.

Note

The ap lsc dtls-fallback clear-flag command is sufficient to retain LSC on AP. Both ap lsc dtls-fallback clear-flag and ap lsc dtls-fallback clear-certificate commands are not required at the same time.

APs must be in connected state when issuing the recovery command. You will need to reissue the command, if any LSC fallback AP joins afterwards.

The access point reloads and recovers from the LSC fallback state according to the selected recovery method.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.