某局点AP注册不上的经验案例

AP跨公网注册

现场新采购的AC，型号WX2560H，部署后发现所有AP都无法上线，且AP都能够获取管理地址，能ping通AC;

1、经确认现场AC license充足；

2、查看现场AC版本为R5208P03，与现场AP配套；

3、在AC与AP上同时开启debug wlan capwap all，抓取ap注册的debug信息

AP debug:

*Jan  1 00:08:00:296 2014 H3C CWC/7/EVENT: Discovered AC by method of IPv4 dhcp option successfully.

*Jan  1 00:08:00:296 2014 H3C CWC/7/EVENT: AP selected AC IP 172.16.10.253 Priority 4 successfully.

*Jan  1 00:08:00:300 2014 H3C CWC/7/ERROR: Failed to load SSL certificates,uiAPID = 1.

*Jan  1 00:08:00:301 2014 H3C CWC/7/FSM: Enter Sulking state.

*Jan  1 00:08:02:296 2014 H3C CWC/7/TMR: Silent Interval timer expired.

*Jan  1 00:08:02:297 2014 H3C CWC/7/FSM: Enter Idle state.

AP注册初始阶段报错，提示加载SSL证书失败；CAPWAP隧道缺省不加密，检查AC配置

#

wlan ap-group 1f

 tunnel encryption enable

 provision auto-update enable

 ap ap1

 ap ap2

 ap ap3       

 ap ap4

 ap ap5

 ap ap6

 ap ap7

 ap ap8

 ap ap9

 vlan 1

 ap-model WA4320-ACN

  radio 1

   radio enable

   service-template 1 vlan 101

   rrm

    calibrate-channel self-decisive enable

    calibrate-power self-decisive enable

  radio 2

   radio enable

   service-template 1 vlan 101

   rrm

    calibrate-channel self-decisive enable

    calibrate-power self-decisive enable

  gigabitethernet 1

#

发现现场在AP group组视图下开启了 tunnel encryption enable（隧道加密功能），将隧道加密功能关闭后，AP仍然无法上线；

4、再次采集debug信息，AP注册卡在下发配置阶段；

AC debug:

*Oct 15 09:27:55:895 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/FSM: Enter Join state.

*Oct 15 09:27:55:909 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/RCV_PKT: Received configuration request with SeqNum 2 from AP at 172.16.13.153:47495.

*Oct 15 09:27:55:909 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/RCV_PKT: Received configuration request from AP at 172.16.13.153:47495, Length=506.//收到AP的下发配置请求

*Oct 15 09:27:55:911 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/SND_PKT: Sent fragment1 of configuration response with SeqNum 2 to AP at 172.16.13.153:47495.//AC响应AP报文由于过大分3片发送

*Oct 15 09:27:55:911 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/SND_PKT: Sent fragment1 of configuration response to AP at 172.16.13.153:47495, Length=1448.//第一片

.

*Oct 15 09:27:55:912 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/SND_PKT: Sent fragment2 of configuration response with SeqNum 2 to AP at 172.16.13.153:47495.

*Oct 15 09:27:55:912 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/SND_PKT: Sent fragment2 of configuration response to AP at 172.16.13.153:47495, Length=1448.//第二片

.

*Oct 15 09:27:55:913 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/SND_PKT: Sent fragment3 of configuration response with SeqNum 2 to AP at 172.16.13.153:47495.

*Oct 15 09:27:55:913 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/SND_PKT: Sent fragment3 of configuration response to AP at 172.16.13.153:47495, Length=805.//第三片

*Oct 15 09:27:55:913 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/SND_PKT: Sent all fragments of configuration response with SeqNum 2 to AP at 172.16.13.153:47495.

*Oct 15 09:27:55:913 2018 Core-H3C-HBYZ-WX5560H-IRF CWS/7/FSM: Enter Config state.

AP debug:

*Oct 14 18:32:36:350 2018 H3C CWC/7/SND_PKT: Sent configuration request with SeqNum 2 to AC 172.16.218.1:5246.//发送给AC配置下发请求

*Oct 14 18:32:36:350 2018 H3C CWC/7/SND_PKT: Verbose info for configuration request sent to AC 172.16.218.1:5246, length=414.

.

*Oct 14 18:32:36:363 2018 H3C CWC/7/RCV_PKT: Received a fragment from AC at 172.16.218.1:5246.

*Oct 14 18:32:36:363 2018 H3C CWC/7/RCV_PKT: Verbose info for a fragment from AC 172.16.218.1:5246, length=805.//收到一个805长度的分片

.

*Oct 14 18:32:39:349 2018 H3C CWC/7/TMR: Retransmission Timer of TunnelId:1 expired. uiSeqNum = 0, uiIPCMsgType = 0x0, enPattern = 0.

*Oct 14 18:32:39:350 2018 H3C CWC/7/SND_PKT: Sent configuration request with SeqNum 2 to AC 172.16.218.1:5246.

*Oct 14 18:32:39:350 2018 H3C CWC/7/SND_PKT: Verbose info for configuration request sent to AC 172.16.218.1:5246, length=414.

.

*Oct 14 18:32:39:402 2018 H3C CWC/7/RCV_PKT: Received a fragment from AC at 172.16.218.1:5246.

*Oct 14 18:32:39:402 2018 H3C CWC/7/RCV_PKT: Verbose info for a fragment from AC 172.16.218.1:5246, length=805.//收到一个805长度的分片

.

*Oct 14 18:32:42:349 2018 H3C CWC/7/TMR: Retransmission Timer of TunnelId:1 expired. uiSeqNum = 0, uiIPCMsgType = 0x0, enPattern = 0.

*Oct 14 18:32:42:349 2018 H3C CWC/7/ERROR: Failed to retransmit configuration request and tore down the tunnel: Number of retransmissions exceeded the limit 3.//AP发送给AC的配置请求报文因重传3次达到上限而失败

从​AP与AC的debug信息可以看到，AC发送给AP的configuration response报文总共分3片，但AP侧只收到了805的分片，而2片1448的分片并没有收到；最后因重传次数达上限注册失败，由此断定前两片报文在中间链路被丢弃；

由于现场是跨公网注册,走的GRE VPN链路，猜测分片报文再封装一层GRE报文后过大导致在中间链路被丢弃，于是尝试将公网接口MTU值改大，AP成功上线；

1、关闭隧道加密功能  tunnel encryption disable

2、​确保AC与AP间能够正常通信，包括：

AP与AC间CAPWAP隧道的UDP 5246、5247端口号可达，LWAPP隧道的UDP 12222、12223端口号可达；

AP与AC间的报文正常交互，不会被中间链路阻断丢弃；