Here are the common reasons Access Points may not join Sensor Connect after onboarding the Cisco Catalyst 9800 Wireless Controller:

1. Reachability: The access point's subnet cannot reach the Sensor Connect's subnet. Use these steps to troubleshoot:

   • Verify ping connectivity between the AP and Sensor Connect.

   • Ensure no filtering rules exist in routing devices between APs and Sensor Connect. Open TCP ports 50221 and 43626 for discovery and communication in firewalls between APs and Sensor Connect.

2. AP Profiles: Sensor Connect automatically enables GRPC only in the default-ap-profile. APs using a profile other than the default-ap-profile must manually configure GRPC on those profiles. Add the configuration line cisco-dna grpc to each ap-profile.

3. Spaces Connector interaction with Sensor Connect: Cisco Spaces Connector cannot be configured at the same time as Sensor Connect. Disable IoT Services on the Cisco Spaces Connector before deploying Sensor Connect. Follow these steps if this was not done:

   1. Disable IoT Services within Cisco Spaces Connector.

   2. In Sensor Connect, go to the Administrator section, then select 9800 Wireless Controller configuration. Redeploy the username and password to ensure the correct JWT token is pushed to the Cisco Catalyst 9800 Wireless Controller, prompting APs to re-join Sensor Connect.

Here are the common reasons why the Sensor Connect UI cannot be accessed from a laptop or computer:

1. Initial Wait Time: After installing Sensor Connect, wait until it reaches the Running state in the Configuration > Services > IoT Services page on the Cisco Catalyst 9800 Wireless Controller UI. The system takes 1-2 minutes to detect the deployment type (standalone or SSO). If needed, it syncs databases with the standby controller. During this period, the access to the Sensor Connect UI is unavailable.

2. Reachability: Use the ping command to verify that Sensor Connect can be reached from your laptop or computer. If necessary, adjust the routing configuration in your network to ensure your PC or laptop can reach Sensor Connect. If routing changes are not possible, consider configuring NAT. For information, refer to the NAT Configuration.

Follow these steps to troubleshoot connectivity issues related to NAT configuration on the Cisco Catalyst 9800 Wireless Controller.

1. Ensure that the ports on your outside interface are not currently in use by another application on the Cisco Catalyst 9800 Wireless Controller.

   1. Remove the NAT configuration from the outside interface on the Cisco Catalyst 9800 Wireless Controller.

   2. Run these commands to verify that each TCP port used for NAT is not in conflict:

      
      Device# show tcp brief | include <tcp port>
      Device# show platform software tcpudpport | include <tcp port>

      Note	Ensure these commands return no conflicts for the ports configured for NAT.

2. Examine the NAT entries in the NAT table to ensure the inside IP address matches the IP address of Sensor Connect. Also, confirm that the TCP ports listed are correct.

   
   Device# show platform software nat chassis active F0 translation 
   Pro  Inside global         Inside local          Outside local         Outside global 
   tcp  172.18.29.7:9433      192.168.1.1:443       ---                   --- 
   tcp  192.168.2:50221       192.168.1.1:50221     ---                   --- 
   tcp  192.168.2:43626       192.168.1.1:43626     ---                   --- 
   Total number of translations: 3
   

3. Verify that the IP addresses used for NAT are among those configured in the Cisco Catalyst 9800 Wireless Controller. These must be identical, as different IP addresses within the same subnet are not supported. For more information, refer to CSCwn12646.

If the admin user's password is lost, follow the Password Recovery process outlined below:

1. Log in to the Cisco Catalyst 9800 Wireless Controller using the ssh connection.

2. Log in to the Sensor Connect shell:

   
   Device# app-hosting connect appid IoT_Orchestrator session bash
   root@96e268c7acb8:/#
   

3. Touch this file in shell:

   root@96e268c7acb8:/#touch /iox_data/recovery/passwordRecovery

4. Open a new browser window and open a connection to the Sensor Connect GUI.

   The Day 0 banner is displayed. Read the terms and conditions and click I Accept.

   The Sensor Connect login page is displayed.

5. Enter admin for username and password for password (default credentials).

6. Log in with the new username.

   Note	This process deletes all users created in Sensor Connect database and returns the login to the Day 0 credentials.

Here are the common issues encountered during the installation of Sensor Connect:

1. Application Configuration Failed: During Day 0 installation, there is some configuration that is done on the Cisco Catalyst 9800 Wireless Controller. This means the IP addresses chosen for Sensor Connect were incorrect, as they were already used by the Cisco Catalyst 9800 Wireless Controller. Ensure that you use a unique IP subnet for Sensor Connect.

2. Installation of Sensor Connect failed: After the failure, syslog messages are displayed on the Cisco Catalyst 9800 Wireless Controller console, such as:

   %IOXCAF-6-INSTALL_MSG: Chassis 2 R0/0: wncloudm: app-hosting: Failed to install IoT_Orchestrator: app-hosting infrastructure is busy! Try again later

   If Sensor Connect fails to install for any reason, it automatically reverts any changes made to the configuration (for instance, VirtualPortGroup configuration) and return to the Day 0 page. The fields for entering the IP address, subnet mask, default gateway, and NAT IP address are prepopulated with previous values. Some of the most common causes include:

   1. The IP address selected for Sensor Connect and default gateway are not in the same subnet (according to the subnet mask provided).

   2. If the tar file is extracted, modified, and repacked, the Sensor Connect image signed by Cisco root CA is verified during installation by the Cisco Catalyst 9800 Wireless Controller. If you modify the tar file, the installation fails.

   3. Another IOx application is installed on the Cisco Catalyst 9800 Wireless Controller. Sensor Connect must run as the only IOx application on the C9800 Wireless Controller. If another application, such as GuestShell, is running, the installation fails, reporting that not enough resources are available. For more information, refer to CSCwo66172.

Using app-hosting control commands with Sensor Connect is not supported, and this causes the IoT Services webpage to become unresponsive. If the Sensor Connect application has been altered using an app-hosting command, apply the appropriate app-hosting CLI to revert the changes.

If the IoT Services UI page remains unresponsive, you can perform these actions:

• Restart HTTP server on Cisco Catalyst 9800 Wireless Controller, by executing these commands from its console:

  
  Device(config)#no ip http server
  Device(config)#ip http server
  

• Reload the Cisco Catalyst 9800 Wireless Controller during a maintenance window.

• Open a case with Cisco TAC.