Upgrading Autonomous Cisco Aironet Access Points to Lightweight Mode

Transcription

1 Upgrading Autonomous Cisco Aironet Access Points to Lightweight Mode April 24, 2008 This application note describes how to upgrade autonomous Cisco Aironet access points to lightweight mode so that they can communicate with wireless LAN controllers on your network. It contains these sections: Upgrade Process Overview, page 1 Solution Requirements, page 2 Important s, page 4 Preparing for the Upgrade, page 4 Upgrade Procedure, page 8 Post-Upgrade Tasks, page 16 Importing the Output of the Upgrade Tool into WCS, page 17 Caveats, page 20 Terms and Acronyms, page 21 Related Documents, page 22 Appendix A: Configuring DHCP Option 43 for Lightweight Cisco Aironet Access Points on Windows 2003 Enterprise DHCP Server, page 22 Appendix B: Configuring Access Points in Cisco LWAPP Mode for Easy Deployment, page 25 Upgrade Process Overview In the Cisco Centralized Wireless LAN Architecture, access points operate in lightweight mode. The access points associate to a Cisco wireless LAN controller. The controller manages the configuration, firmware, and control transactions such as 802.1x authentications. In addition, all wireless data traffic is tunneled through the controller. Americas Headquarters: Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA USA

2 Solution Requirements The Lightweight Access Point Protocol (LWAPP) is an IETF draft protocol that defines the control messaging for setup and path authentication and run-time operations. LWAPP also defines the tunneling mechanism for data traffic. A lightweight access point discovers a controller using LWAPP discovery mechanisms and then sends it an LWAPP join request. The controller sends the access point an LWAPP join response allowing the access point to join the controller. When the access point is joined to the controller, it downloads its software if the revisions on the access point and controller do not match. Subsequently, the access point is completely under the control of the controller. LWAPP secures the control communication between the access point and controller by means of a secure key distribution, requiring already provisioned X.509 certificates on both the access point and controller. Factory installed certificates are referenced by the term MIC, which is an acronym for Manufacturing Installed Certificate. Cisco Aironet access points shipped before July 18, 2005, do not have MIC, so these access points create a self-signed certificate when upgraded to operate in lightweight mode. Controllers are programmed to accept self-signed certificates for authentication of specific access points. The upgrade process is as follows. The user runs an upgrade utility that accepts an input file with a list of access points and their credentials. The utility telnets to the access points in the input file a series of IOS commands to prepare the access point for the upgrade, including the commands to create the self-signed certificates. Also, the utility telnets to the controller to program the device to allow authorization of specific self-signed certificate access points. It then loads Cisco IOS Release 12.3(11)JX1 onto the access point so that it can join the controller. After the access point joins the controller, it downloads a complete IOS version from it. The upgrade utility generates an output file that includes the list of access points and corresponding self-signed certificate key-hash values that can be imported into the WCS management software. The WCS can then send this information to other controllers on the network. After an access point joins a controller, you can reassign the access point to any controller on your network. Solution Requirements Migration from autonomous access point mode to lightweight mode is possible on these Cisco Aironet access point platforms: All 1121G access points All 1130AG access points All 1140 access points All 1240AG access points 2

3 Solution Requirements All 1250 series access points The Upgrade Utility version 3.2 does not support the conversion of 1140 and 1250 series autonomous access points to lightweight mode. To convert these autonomous access points to lightweight mode, telnet to the access point and issue the following command to upgrade the IOS: archive download-sw /overwrite /reload tftp: //location/image-name For more information, see Upgrading Cisco IOS on an Autonomous Access Point at the following URL: 09f0e94.shtml. For all IOS-based 1200 series modular access point (1200/1220 Cisco IOS Software Upgrade, 1210 and 1230 AP) platforms, it depends on the radio: if G, MP21G and MP31G are supported if A, RM21A and RM22A are supported The 1200 series access points can be upgraded with any combination of supported radios: G only, A only, or both G and A. For an access point that contains dual radios, if one of the two radios is an LWAPP-supported radio, the upgrade tool still performs the upgrade. The tool adds a warning message to the detailed log that indicates which radio is unsupported. All 1310 AG access points Cisco C3201 Wireless Mobile Interface Card (WMIC) The second-generation a radios contain two part numbers. Access points must be running Cisco IOS Release 12.3(7)JA or later before you can perform the upgrade. For Cisco C3201WMIC, access points must be running Cisco IOS Release 12.3(8)JK or later before you can perform the upgrade. These Cisco wireless LAN controllers support autonomous access points upgraded to lightweight mode: 2000 series controllers 4400 series controllers Cisco Wireless Services Modules (WiSMs) for Cisco Catalyst 6500 Series Switches Controller Network Modules within the Cisco 28/37/38xx Series Integrated Services Routers Catalyst 3750G Integrated Wireless LAN Controller Switches Cisco controllers must run a minimum of software version 3.1. Cisco Wireless Control System (WCS) must run a minimum of version 3.1. The upgrade utility is supported on the Windows 2000 and Windows XP platforms. 3

4 Important s Important s Before using this utility, consider the following important notes: Access points converted with this tool will not connect to 40xx, 41xx, or 3500 controllers. You cannot upgrade access points with b-only or first-generation a radios. If you want to retain the static IP address, netmask, hostname, and default gateway of access points after conversion and reboot, you must load one of the following autonomous images on the access points before you covert the access points to LWAPP: 12.3(7)JA, 12.3(7)JA1, 12.3(7)JA2, 12.3(7)JA3, 12.3(7)JA4, 12.3(8)JA, 12.3(8)JA1, 12.3(8)JA2, 12.3(8)JEA, 12.3(8)JEA1, 12.3(8)JEA2, 12.3(8)JEB, 12.3(8)JEB1, 12.4(3g) JA, 12.4(3g) JA1. If you upgrade access points to LWAPP from one of the following autonomous images, the converted access points do not retain their static IP address, netmask, hostname, and default gateway: 12.3(11)JA, 12.3(11)JA1, 12.3(11)JA2, 12.3(11)JA3. The LWAPP upgrade tool does not release Windows operating system memory resources when the upgrade process is complete. Memory resources are released only after you exit the upgrade tool. If you upgrade several batches of access points, you must exit the tool in between batches to release memory resources. If you do not exit the tool in between batches, performance of the upgrade station quickly degrades because of excessive memory consumption. Preparing for the Upgrade You must complete these tasks before beginning the upgrade from autonomous to lightweight mode: 1. Prepare the infrastructure so that the upgraded lightweight access point discovers a controller. 2. The autonomous access points must be running Cisco IOS Release 12.3(7)JA or later to perform the lightweight mode conversion. If necessary, upgrade the access point to Cisco IOS Release 12.3(7)JA or later. For C3201WMIC, upgrade to 12.3(8)JK or later. 3. Prepare the controller for the upgrade process. 4. Download the Autonomous to Lightweight Mode Upgrade Tool and the upgrade image file from Cisco.com (see the Obtaining the Upgrade Tool and Upgrade Image section on page 7). Preparing the Infrastructure No lightweight access point can operate independently from a WLC. Each lightweight access point must discover a WLC, issue an LWAPP join request, and if successful, receive a join response to become joined to a controller. The LWAPP discovery algorithm follows these steps: Step 1 Step 2 Initiates an IP subnet broadcast of an LWAPP controller discovery message. If the controller management interface is on the same IP subnet as the lightweight access point, this discovery mechanism is successful. Lists the previously joined controllers. This discovery mechanism requires prior success joining an access point and controller. 4

5 Preparing for the Upgrade Step 3 Step 4 Step 5 Establishes over-the-air provisioning (OTAP). If OTAP is turned on, access points advertise their controller(s) over the air. New access points discover the controller based on the OTAP messages. OTAP is turned off by default on the controllers. OTAP is not supported for controller discovery during the upgrade process from autonomous to lightweight access point. After an access point is fully migrated to the lightweight mode, OTAP is used to discover controllers. Uses DHCP option 43. This vendor-specific option can return one or more controller IP addresses to an access point in the DHCP offer message. The access point sends an LWAPP join message to the controller. Establishes DNS resolution of CISCO-LWAPP-CONTROLLER.localdomain. If the access point can resolve the name, it issues an LWAPP join message to the resolved IP address. Step 6 Reboots and repeats starting with Step 1. After an access point joins a controller, you can reassign the access point to any controller on your network. The upgrade tool loads the upgrade image (Cisco IOS Release 12.3(11)JX1) onto the access point for two purposes. First, it allows the upgraded access points to discover and join a controller. After joining a controller, the access point downloads a complete LWAPP IOS image from the controller. Secondly, the Cisco IOS Release 12.3(11)JX1 is stored in the access point flash memory to serve as an LWAPP recovery image in case the complete LWAPP IOS image becomes corrupted. An upgraded access point must find a controller it can join to complete the upgrade process. There are several potential issues to be aware of: Cisco IOS Release 12.3(11)JX1 does not support OTAP. An upgraded access point preserves its DNS name server parameter, so CISCO-LWAPP-CONTROLLER.localdomain can be used for controller discovery when the access point is not on the same subnet as the management IP address of the controller. The appropriate controller discovery mechanism should be in place before upgrading the autonomous access points to lightweight mode. You should follow these rules carefully: If the access point is on the same IP subnet as the controller, the discovery should use the IP subnet broadcast controller discovery. If the access point to be upgraded has a static IP address and is not on the same Layer-2 IP subnet as the controller, then DNS resolution of CISCO-LWAPP-CONTROLLER.localdomain is the only guaranteed controller discovery mechanism. The upgrade utility can configure a name server before loading Cisco IOS Release 12.3(11)JX1. Verify the name server can properly resolve CISCO-LWAPP-CONTROLLER.localdomain before beginning the upgrade procedures. If the access point to be upgraded gets an IP address via DHCP, then either option 43 or DNS resolution of CISCO-LWAPP-CONTROLLER.localdomain can be used to discover the controller. Verify IP connectivity for the following before beginning the upgrade process: between the access points to be upgraded and the controller Management Interface IP address between the PC that is hosting the upgrade tool and the access point between the PC that is hosting the upgrade tool and the controller Check for the presence of firewalls that block telnet access between the access point and the upgrade tool s TFTP server (whether an internal or an external server). 5

6 Preparing for the Upgrade Using DHCP Option 43 The IP address that should be configured as DHCP option 43 or be resolved from CISCO-LWAPP-CONTROLLER is the IP address of the controller Management IP address. Consult the specific documentation for the DHCP or DNS platform for details on configuring these parameters correctly. Cisco 1000 series access points use a string format for DHCP option 43, whereas Cisco Aironet access points use the type-length-value (TLV) format for DHCP option 43. DHCP servers must be programmed to return the option based on the access point s DHCP Vendor Class Identifier (VCI) string (DHCP option 60). The VCI strings for Cisco access points capable of operating in lightweight mode are: Table 1 VCI String Access Point VCI String Cisco Aironet 1000 series Airespace.AP1200 Cisco Aironet 1100 series Cisco AP c1100 Cisco Aironet 1130 series Cisco AP c1130 Cisco Aironet 1200 series Cisco AP c1200 Cisco Aironet 1240 series Cisco AP c1240 Cisco Aironet 1250 series Cisco AP c1250 Cisco Aironet 1300 series Cisco AP c1300 Cisco Aironet 1500 series Cisco AP c Cisco AP.OAP Cisco AP.LAP Cisco AP.LAP Cisco AP c1520 Airespace.AP Cisco 3201 Lightweight Access Point (LAP) Cisco AP C3201WMIC 1. Any 1500 Series AP that runs 4.1 software OAP AP that runs 4.0 software Model AP that runs 4.0 software Model AP that runs 4.0 software 5. Any 1500 Series AP that runs 3.2 software The format of the TLV block is: Type: 0xf1 (decimal 241) Length: Number of controller IP addresses * 4 Value: List of WLC management interfaces See the Appendix A: Configuring DHCP Option 43 for Lightweight Cisco Aironet Access Points on Windows 2003 Enterprise DHCP Server section on page 22 for details on configuring these options in combination with the appropriate VCI string. The appendix applies to Windows 2000 and 2003 DHCP servers. After the infrastructure is prepared for the upgrade process, IP connectivity between the access points to be upgraded and the WLC Management Interface IP address should be verified. 6

7 Preparing for the Upgrade Obtaining the Upgrade Tool and Upgrade Image The autonomous mode to lightweight mode access point upgrade process is only supported for access point running Cisco IOS Releases 12.3(7)JA and later. The access points must be upgraded to this version or a later version before they can be converted to lightweight mode. Consult the Cisco Aironet documentation on upgrade procedures for autonomous access points. You can find the upgrade tool and the upgrade image at the Download Software page on Cisco.com. You must register or be a registered user of Cisco.com to download software. To find the tool and the software image, follow these steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9 Step 10 Browse to the wireless downloads page: Click Wireless Software. Log into Cisco.com. Click Access Points. Click the type of access point that you want to upgrade (for example, Cisco Aironet 1240 AG Series). When you click the access point type, the access point folder expands. Click the access point that you want to upgrade in the expanded list. The Downloads page appears. For the upgrade tool, click the Autonomous to Lightweight Mode Upgrade Tool link. Click the latest tool release and follow the prompts to download the tool to your PC. For the recovery software upgrade image, click the Autonomous to Lightweight Mode Upgrage Image link. Click the latest upgrade image name and follow the prompts to download the upgrade image to your PC. t The recovery software image for the upgrade has rcv in the image name for example, c1200-rcvk9w8-tar jx1.tar. For Cisco C3201WMIC, use Cisco IOS Release 12.3(11)JA1, which is available in the Software Center tables on Cisco.com Preparing the Controller for the Upgrade Process There are several key tasks that must be completed to prepare the controller for the upgrade process: 1. Upgrading the controller to version 3.1 or later 2. Configuring the controller to accept telnet connections 3. Synchronizing the controller time with the machine that hosts the upgrade tool 7

8 Upgrade Procedure Consult the Cisco Wireless LAN Controller Configuration Guide for upgrade procedures for the controller. The controller can be configured to accept telnet connections through the controller console or the controller web-interface. To configure telnet on the controller through the controller console, attach a console to the controller, log into the CLI, and enter this command: config network telnet enable You must enable Telnet service on all access points and on the controller, Secure Shell (SSH) is not supported. The WLC time should be synchronized with the machine that hosts the upgrade utility. The upgrade utility configures the access point to generate a self-signed certificate with a validity interval, beginning with the machine time of the utility host or a time specified at run-time. If the WLC time is outside the validity interval of the SSC, the access point cannot join the controller. To configure the WLC time, use the WLC web-interface found by choosing Commands > Set Time (see Figure 1). Figure 1 Set Time Page The time can also be configured through the WLC CLI using the config time command. The WLC time should be set to account for any offset from GMT. Upgrade Procedure The upgrade from autonomous to lightweight mode is accomplished with the upgrade tool. The upgrade tool performs the basic tasks necessary to upgrade from autonomous to lightweight mode: 8

9 Upgrade Procedure Basic condition checking verifies whether the access point is a supported one, whether it is running a minimum software revision, and whether the radio types are supported. Preparation of the autonomous access point for conversion adds the PKI configuration and certificate hierarchy so access point authentication to the Cisco controllers can occur and self-signed certificates can be generated for the access point. Loads the upgrade image (Cisco IOS Release 12.3(11)JX1), which allows the access point to join a controller. On successful download, reboots the access point. Generates an output file consisting of access point MAC addresses, certificate type, and secure key-hash and automatically updates the controller. The output file can be imported into WCS and exported to other controllers. During the upgrade process, the dot11radio is shut down. To install and run the upgrade tool, you must satisfy these conditions: To install and run the upgrade tool, you must be logged in as the administrator of the PC. You must run the upgrade tool on a PC that is running Windows 2000 or Windows XP. You must use the upgrade tool with Cisco Aironet 1100, 1130, 1200, 1240, and 1310 series access points that are running Cisco IOS release 12.3(7)JA or later. All access points must be in AP mode. If you use the upgrade tool over a WAN link, the link speed must be greater than or equal to 128 Kbps. Check for the presence and configuration of firewalls on your network. Firewalls might prevent the downloading of images. You must enable Telnet service on all access points and on the controller. You must enable Telnet service on all access points and on the controller, Secure Shell (SSH) is not supported. You must ensure that the system time is configured properly on your controller and access points. You must provide the upgrade tool with a valid IP file that contains the following information for each access point that you want to upgrade: IP address Username Password Enable password (optional) For each access point, the IP address, username, password, and optional enable password should all be separated by commas. Ensure that the IP file does not contain multiple entries for the same access point. 9

10 Upgrade Procedure Installing the Upgrade Tool To install and run the upgrade tool, your system must meet these minimum requirements: Operating system Windows 2000 or Windows XP workstation only. Processor Pentium III or an equivalent Speed 1 GHz RAM 512 MB Free space on hard drive 20 MB To install the upgrade tool, follow these steps: Step 1 Run the executable file UpgradeToolv30.exe. The install shield guides you through the rest of the install procedure. If the upgrade tool is already installed on your system, a dialog box alerts you that the upgrade tool is already installed. Ensure that no upgrade tool window or readme file of an older version of the tool are open. Cisco recommends that you uninstall the previous version before installing the newer version. Click Yes if you want to replace the older version with the new version of upgrade tool. Step 2 Step 3 Step 4 Step 5 The minimum system requirements are displayed in the next dialog box. Then in the Welcome dialog box, basic information about the setup program is displayed. Click Next in the Welcome dialog box. The Choose Destination Location dialog box then appears. The default installation location appears in the Destination Folder field. If you do not want to change the default installation location, go to Step 4. If you want to change the installation location, follow these steps: a. Click Browse. The Choose Folder dialog box appears. The Path box contains the installation location. b. Change the installation location. You can either type the new location path in the Path box or use the Drives and Directories lists to select a new drive and directory. The installation location must be on a drive that is on the computer. c. After the correct path is in the Path box, click OK. The new installation location now appears under Destination Folder in the Choose Destination Location. Click Next. The Folder Selection window prompts you to select the program folder where icons are to be added by the setup process. You can choose the default folder, select from existing folders, or create a new folder. Click Next. A dialog asks if you want to view the Readme file. Click Yes to read the file. Click No to read the file later. If the installation was successful, a dialog box tells you that the installation was successful. 10

11 Upgrade Procedure Running the Upgrade Tool Figure 2 shows the upgrade tool window. Figure 2 Upgrade Tool Window Enter information in these entry fields and click Start to begin the upgrade: Step 1 The IP File field is the input file of access points to upgrade. Whether you have one or several access points to upgrade, create a flat text file in the following format: ap-ip-address,telnet-username,telnet-user-password,enable-password ap-ip-address,telnet-username,telnet-user-password,enable-password Each line in the text file lists the unit IP address, Telnet username and password, and a password that permits access to the access point CLI privileged EXEC mode. Use a comma to separate each item on a line. Save the text file on the same machine that hosts the upgrade tool. Click the... button to browse to and select the text file. 11

12 Upgrade Procedure Step 2 To specify the way in which autonomous APs are upgraded, set the parameters in the Upgrade Options section: a. Check the Use WAN Link check box to upgrade over a WAN link. The following are recommendations for upgrading over a WAN link: If you want to upgrade one AP each at different remote locations, place all APs in the same file that contains the list of AP IP addresses. However, if the APs that you want to upgrade are all at the same remote location, do not upgrade them concurrently to avoid problems with bandwidth constraints. Use a local TFTP server. Pushing the image over a WAN link increases the amount of time the upgrade takes. Telnet traffic does not compete with TFTP traffic for WAN bandwidth. b. The upgrade tool creates a file of environmental variables for each AP on the workstation. These environmental variables are the IP address, netmask, default gateway, and hostname of the AP as they are identified in the running configuration. During the upgrade, the tool checks this file for variable mismatches. The tool deletes this file at the end of the upgrade process. If you check the All APs to DHCP check box, all upgraded APs use a DHCP server to get IP addresses. This parameter is useful if you have a combination of static and DHCP-assigned IP addresses and want all upgraded APs to use DHCP. If you do not check the All APs to DHCP check box, configuration information that is present in the running configuration is updated in the file of environmental variables for each AP. If the running configuration contains an AP with a DHCP-assigned IP address, that AP will use a DHCP-assigned IP address. If an AP in the running configuration had static IP address, the environmental variables are updated with that particular static IP address. If a firewall or an access control list is enabled during the upgrade process, the upgrade tool might be prevented from copying the file that contains environmental variables from a workstation to an AP. If a firewall or access control list blocks the copy operation and you have selected the Use Upgrade Tool TFTP Server option (see Step 3 below), you cannot proceed with the upgrade because the tool cannot update the environmental variables and the image upload to the AP fails. Click OK and disable the firewall or access control list setting for the upgrade (see Figure 3). Figure 3 Upgrade Tool Window Firewall or Access Control List with Internal TFTP Server 12

13 Upgrade Procedure If a firewall or an access control list blocks the copy operation and you have selected the Use External TFTP Server option (see Step 3 below), you can proceed with the upgrade, but the tool will not update the environmental variables. Click Yes to proceed or No not to proceed (see Figure 4). Figure 4 Upgrade Tool Window Firewall or Access Control List with External TFTP Server Caution If you select the Use External TFTP Server option, the TFTP server must not be located on the same workstation as the upgrade tool. The message in Figure 4 applies only when the external TFTP server is located on a workstation that is different from the workstation on which the upgrade tool is located. If you are running the TFTP server on the same workstation as you are running the upgrade tool, the following message appears (see Figure 5). If you want to run the built-in upgrade tool TFTP server, you must stop the currently running TFTP server on the workstation. Then stop the tool by clicking the No button in Figure 5. Restart the tool to run the built-in upgrade tool TFTP server. If you click the Yes button in Figure 5, you must click the Use External TFTP Server radio button (see Step 3 below). With this option, the upgrade tool does not handle environmental mismatches because the built-in upgrade tool TFTP server is not running. Figure 5 Upgrade Tool Window TFTP Server Running on Same Workstation as Upgrade Tool 13

14 Upgrade Procedure Step 3 c. Check the Retain Hostname on APs check box so that the upgrade tool includes hostname that is present in the running configuration in the environmental variables. LWAPP looks for these environmental variables when an LWAPP private configuration file is not available. If you are upgrading an AP for the second time, make sure that there is no private configuration file present in the AP before upgrading again. The LWAPP hostname should be updated with the latest hostname that was configured in the environmental variables by the tool during the first upgrade. You can enter the clear lwapp private-config command when the AP is running an LWAPP recovery image or when the AP is running an LWAPP image but not joined to a controller. The LWAPP Recovery Image section refers to upgrade image file (Cisco IOS Release 12.3(11)JX1) loaded by the upgrade tool that allows the access point to join the controller. Perform the following steps to specify information about the recovery image: a. Click either the Use Upgrade Tool TFTP Server radio button or the Use External TFTP Server radio button to download the upgrade image into the access point. To use the tool s TFTP server, store the upgrade image file in the images sub-directory for the upgrade tool. For example, if the upgrade tool is installed in C:\Program Files\Cisco Systems\Upgrade Tool, the upgrade image file must be stored in C:\\Program Files\Cisco Systems\Upgrade Tool\images. If you use an external TFTP server, enter the TFTP server path, including the upgrade image filename, in the LWAPP Recovery Image field. Enter the external TFTP server IP address in the TFTP Server IP Addr field. For Cisco C3201WMIC, use the Cisco IOS Release 12.3(11)JA1 image file, which is available in the Software Center tables on Cisco.com Step 4 Step 5 b. Enter the IP address of the workstation on which you are running the upgrade tool in the System IP Addr field. Providing the workstation IP address ensures that the upgrade tool has the correct IP address in the case of a multi-homed workstation. Specifying the IP address ensures the correct transfer of the environmental variable file to APs and the correct transfer of the recovery image if you use an internal TFTP server. c. Select the number of access points from the drop-down menu in the Max. AP at a run field. The upgrade tool can handle up to 6 access points at one time. After you supply all necessary information in the other fields and start the tool, the tool enters the access point IP addresses that are in the IP file. (Optional) The Controller Details section contains the information that the upgrade tool uses to log into the controller and add the upgraded access point authorization information. In the IP Address field, enter the controller Management interface IP address. In the Username and Password fields, enter the username and password required to log into the controller Management interface. The System Time Details section provides the time setting that the upgrade tool uses to specify the start time and date of the self-signed certificates validity period. You have two options Use Controller Time or User Specified Time for selecting the time that is set on the access point: If you click the Use Controller Time radio button, the upgrade tool uses the controller time if you have provided information about the controller in the Controller Details fields. If you click this radio button but have not provided information about the controller, the upgrade tool uses the time in UTC format of the workstation on which you are running the upgrade tool. If the tool cannot find information about the controller, the following window appears. Click Yes to use the workstation time or No not to use the workstation time (see Figure 6). 14

15 Upgrade Procedure Figure 6 Upgrade Tool Window Using Workstation Time If the upgrade tool uses the workstation date and time, the workstation date and time must be June 12, 2005, 00 hours, 00 minutes, or after. Specifying a date and time before June 12, 2005, 00 hours, 00 minutes generates invalid certificates. The Use Controller Time option is recommended. If you click the User Specified Time radio button, you can specify a time in the provided fields. If you specify a date and time in the provided fields, you must enter a date and time that is June 12, 2005, 00 hours, 00 minutes, or after. Specifying a date and time before June 12, 2005, 00 hours, 00 minutes generates invalid certificates. If the date and time is before June 12, 2005, 00 hours, 00 minutes, this message appears (see Figure 7): Figure 7 Upgrade Tool Window Entering Date Before June 12, 2005 Step 6 Step 7 (Optional) You use the DNS Address field and Domain Name field to specify DNS parameters that the upgraded access point can use to resolve CISCO-LWAPP-CONTROLLER.localdomain when the access point is not on the same IP subnet as the controller Management interface. Use the Detailed Logging Level menu to set the logging level for the upgrade tool run. Cisco recommends that you select All for the logging level. The buttons at the bottom of the window control the tool operation: Start starts the upgrade process. When the upgrade process is running, you can click Stop to stop the upgrade tool. The upgrade tool stops after completing the upgrade in progress. Exit closes the tool window. Config launches a window that shows the information that is added to the controller access point authorization list. Each entry in the list includes an AP s Ethernet MAC address, certification type, and public key hash value. This information is stored in a CSV file with this format: Config_<date stamp>_<time stamp>.csv. At the end of the upgrade, the tool displays a reminder message about the CSV file (see Figure 8). 15

16 Post-Upgrade Tasks Figure 8 Upgrade Tool Window Upgrade Process Complete If you do not have a Wireless Control System (WCS), you can import an AP authorization list to the controller by following these steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Click on the Config button to generate a CSV file that contains a list of APs, their Ethernet MAC addresses, their certification type, and public key hash values. Go to the https interface of the controller. Click on SECURITY. Then click AAA and under that, AP Policies. Enable Accept Self Signed Certificate. Add the MAC address of each AP as it is listed in the CSV file. Select SSC as the Certificate Type. Enter the hash key for each AP from the CSV file. When you are finished, click on Add. If you prefer, you can add this information from the controller CLI by entering the config auth-list add ssc AP_MAC public_key_hash for each AP. If you do have a WCS, see the Importing the Output of the Upgrade Tool into WCS section on page 17. AP Config launches a window that lists successfully upgraded access points in this format: mac-address, ip-address, hostname, radio-type, interface, radio-channel, current-radio-power Summary Log launches a window that shows the final status for each of the upgraded access points. Detailed Log launches a window that shows a step-by-step status for each of the upgraded access points. Uninstalling the Upgrade Tool To uninstall the upgrade tool, use the Add/Remove Programs option in the Windows Control Panel. Post-Upgrade Tasks After the upgrade is complete, the autonomous access point is now completely under the control of the controller and the WCS. Typically, you need to complete these post-upgrade tasks: Assign access points to a specific controller 16

17 Importing the Output of the Upgrade Tool into WCS Add the new access points to a WCS map Push the access point authorization list from WCS to the other controllers in the network Consult the Cisco Airespace System Product Guide and for instructions on completing these tasks. Importing the Output of the Upgrade Tool into WCS To import the configuration file output of the upgrade tool into WCS, open the WCS web interface and navigate to Configure > Templates > Security > AP Authorization. Step 1 Select Add Template from the drop-down box in the upper right-hand side. Step 2 Click Go (see Figure 9). Figure 9 Adding a Template Step 3 Browse to the location of the CSV file output by the upgrade tool and click Save (see Figure 10). Figure 10 New Template Page 17

18 Importing the Output of the Upgrade Tool into WCS Step 4 If you want to push the imported entries to other WLCs in the network, choose SSC entries and then select Apply Templates. If you have multiple controllers in your environment, a best practice is to populate each controller with all known SSCs. To aid in populating multiple controllers, use the configuration file that is located here: installed_location/upgrade Tool/Config_date stamp_time stamp.csv. Step 5 Click Go (see Figure 11). Figure 11 Apply Templates Step 6 Choose a WLC device to add to the SSC entries and click OK (see Figure 12). Figure 12 Self-signed Certificate 18

19 Converting a Lightweight Access Point Back to Autonomous Mode Converting a Lightweight Access Point Back to Autonomous Mode You can convert an access point from lightweight mode back to autonomous mode by loading a Cisco IOS Release that supports autonomous mode. If the access point is associated to a controller, you can use the controller to load the Cisco IOS release. If the access point is not associated to a controller, you can load the Cisco IOS release using TFTP. In some LWAPP deployments, the LWAPP controller resides between the access points and the rest of the network. In this topology, all traffic must cross over the controller before communication with network resources, such as a TFTP server, can occur. When converting back to non-lwapp IOS with an access point that is no longer using the LWAPP protocol, traffic does not cross over the controller to reach the TFTP server. The lightweight 1300 series access points can only be converted back to autonomous mode using a wireless LAN controller. Using a Wireless LAN Controller to Return to a Previous Release Follow these steps to revert from LWAPP mode to autonomous mode using a wireless LAN controller: Step 1 Step 2 Log into the CLI on the controller to which the access point is associated. Enter this command: config ap tftp-downgrade tftp-server-ip-address filename access-point-name Using a TFTP Server to Return to a Previous Release This section does not apply to Cisco C3201WMIC and Cisco C3201LAP. Follow these steps to revert from LWAPP mode to autonomous mode by loading a Cisco IOS release using a TFTP server: Step 1 The static IP address of the PC on which your TFTP server software runs should be between and Step 2 Step 3 Step 4 Make sure that the PC contains the access point image file (such as c1200-k9w7-tar ja.tar for a 1200 series access point) in the TFTP server folder and that the TFTP server is activated. Set the timeout value on the TFTP server to 30 seconds. On the PC where the TFTP server is located, perform these steps: a. Disable any software firewall products, such as Windows firewall, ZoneAlarm firewall, McAffee firewall, or others. 19

20 Caveats b. Ensure all Windows files are visible. From Windows Explorer, click Tools > Folder Options > View; then uncheck the Hide extensions for known file types check box. Step 5 Rename the access point image file in the TFTP server folder to c1200-k9w7-tar.default for a 1200 series access point, c1130-k9w7-tar.default for an 1130 series access point, c1240-k9w7-tar.default for a 1240 series access point, and c1250-k9w7-tar.default for a 1250 series access point. Step 6 Step 7 Step 8 Step 9 Step 10 Step 11 Connect the PC to the access point using a Category 5 (CAT5) Ethernet cable. Disconnect power from the access point. Press and hold MODE while you reconnect power to the access point. Hold the MODE button until the status LED turns red (approximately 20 to 30 seconds) and then release. Wait until the access point reboots, as indicated by all LEDs turning green followed by the Status LED blinking green. After the access point reboots, reconfigure it using the GUI or the CLI. Caveats This section describes resolved caveats. Resolved Caveats in Release 3.4 CSCsl82267 Unable to load RCV image using upgrade tool in MIC access points When conversion of MIC access points (for example, the AP1240 and AP1130) is attempted, the recovery image is not loaded on the access points. CSCsm34792 Upgrade tool version 3.2 fails on unconfigured SNTP servers on AP The upgrade process fails for access points on which SNTP is configured. CSCsm55251 Upgrade tool times out if the initial upgrade attempt fails If an incorrect version of a recovery image is selected, the upgrade tool fails. If a correct version is then selected, the tool returns the message Tool timed-out before response from the device. CSCsm73407 Upgrade tool version 3.2 error message should be corrected The error message 192.x.x.x, Couldn't getthe result of file Copy success/failure should be Couldn't get the result of file copy success/failure. Resolved Caveats in Release 3.2 CSCsj40023 IOS-to-LWAPP upgrade tool SSC load failure After access points run through the IOS-to-LWAPP conversion process, the access points report successful installation of the required self-signed certificate (SSC). However, the SSC is not installed. The access points cannot join the controller. CSCsl32823 AP does not reboot after IOS-to-LWAPP conversion process Access points do not reboot after conversion with upgrade tool release Access points must be rebooted manually. 20

21 Terms and Acronyms Resolved Caveats in Release 3.0 CSCsh54459 LWAPP upgrade tool corrupts access points when converted with user-specified time When the user specifies a date and time before June :16:01 UTC, access points fail to join the controller. With Upgrade Tool 3.0, the upgrade tool performs a validation check of the date and time. With Upgrade Tool 3.0, the earliest date for generating valid certificates is June 12, CSCsh58663 The # sign in Cisco IOS access point hostname causes the LWAPP upgrade tool to fail The LWAPP upgrade tool used to stall when an access point hostname contains special characters. Upgrade Tool 3.0 handles such special characters and proceeds with the upgrade process. CSCsi59466 LWAPP Upgrade Tool upgrade options do not function When performing an upgrade with the LWAPP upgrade tool, the All APs on DHCP option and the Retain Hostname on APs option do not function when the Use External TFTP Server option is selectedbut the TFTP server is located on the same workstation as the upgrade tool. To avoid these issues, when the User External TFTP Server option is selected, the user must not use a TFTP server that is located on the same workstation as the upgrade tool. CSCsj10936 LWAPP upgrade tool rejects access points that have radios configured with the station-role fallback shutdown option The upgrade tool used to reject the upgrade and indicate that the station-role should be the root. Upgrade Tool 3.0 accepts this configuration. Terms and Acronyms This section lists key terms and acronyms used in this document. Lightweight access point An access point running software that makes the access point work with the controllers LWAPP Lightweight Access Point Protocol. An IETF draft protocol used in the Cisco Centralized WLAN Architecture implementations. LWAPP defines both control and data encapsulation formats used in the Cisco Centralized WLAN Architecture MIC Manufacturing Installed Certificate, required to secure communications between lightweight access points and controllers SSC Self-Signed Certificate. Access points that do not contain a MIC (such as autonomous access points upgraded to lightweight mode) automatically create a self-signed certificate. WCS Cisco Wireless Control System. Management software that manages the controllers and access points on your wireless LAN. Also provides advanced management features such as location-based services. 21

22 Related Documents Related Documents These documents provide more information WCS, controllers, and lightweight access points: Cisco Wireless LAN Controller Configuration Guide Cisco Wireless Control System Configuration Guide Release s for Cisco Aironet 1130AG, 1200, 1230AG, and 1240AG Series Access Points for Cisco IOS Release 12.3(11)JX1 Appendix A: Configuring DHCP Option 43 for Lightweight Cisco Aironet Access Points on Windows 2003 Enterprise DHCP Server This appendix contains an example of configuring DHCP Option 43 for Lightweight Cisco Aironet Access Points on Windows 2003 Enterprise DHCP Servers. Consult the product documentation for configuring DHCP Option 43 with other DHCP Server implementations. Step 1 Open the DHCP Server Administration Tool. Step 2 Right-click on DHCP root and choose Define Vendor Classes (see Figure 13). Figure 13 Define Vendor Class Step 3 On the DHCP Vendor Class pop-up window, select Add (see Figure 14). 22

23 Appendix A: Configuring DHCP Option 43 for Lightweight Cisco Aironet Access Points on Windows 2003 Enterprise Figure 14 DHCP Vendor Class Window Step 4 On the New Class pop-up window, enter a value for the Display Name field (such as Cisco Aironet 1130 AP) and an appropriate description. Step 5 In the ASCII section, enter the appropriate string value for the Vendor Class Identifier (in Table 1 on page 6). Remove the leading. s inserted by Microsoft Windows in the ASCII field (see Figure 15). Figure 15 ASCII Section Step 6 Step 7 Click OK. To configure the pre-defined options, right-click on the DHCP Server Root and choose Set Predefined Options (see Figure 16). 23

24 Appendix A: Configuring DHCP Option 43 for Lightweight Cisco Aironet Access Points on Windows 2003 Enterprise Figure 16 Set Predefined Options Step 8 Use the drop-down menu to choose the newly created vendor option class in the Option Class field. Step 9 Select Add. The Option Type window appears (see Figure 17). Figure 17 Option Type Window Step 10 In the Name field, enter a string value (such as Option 43). Step 11 Step 12 Step 13 Step 14 Step 15 Step 16 Step 17 Step 18 Use the drop-down menu to choose IP Address as the Data Type. Click to check the Array check box. In the Code field, enter the value 241 (0xf1). Enter a description if desired. Click OK. You will return to the Predefined Options and Values window. In the Predefined Options and Values window, click OK. Option 43 must now be configured as an appropriate DHCP scope option. Choose the appropriate DHCP scope. Right-click on Scope Options and choose Add Option. Step 19 Choose the Advanced Tab (see Figure 13). 24

25 Appendix B: Configuring Access Points in Cisco LWAPP Mode for Easy Deployment Figure 18 Advanced Tab Step 20 Step 21 Step 22 Step 23 Choose the vendor class previously defined. Click the check box to choose the 241 Option 43 value in the Available Options column. Enter each WLC management interface IP address. Click OK. Repeat these steps for each type of lightweight access point (such as Cisco Aironet 1130, Cisco Aironet 1200, Cisco Aironet 1240, etc.). Appendix B: Configuring Access Points in Cisco LWAPP Mode for Easy Deployment Access points in Cisco IOS LWAPP mode are managed by a Cisco wireless LAN controller. When you deploy an access point in a remote place, the access point connects to the controller through a WAN link. You can manually configure the access point so that it can register to a specified controller when a WAN link is slow and a DHCP server is not available. To register to a specified controller, you enter commands on the access point console to configure the access point static IP address and the netmask; the IP address of the controller; the access point hostname; and the default gateway IP address. These commands have been provided to make the deployment of access points easier. They can be entered in EXEC mode on the access point console. These commands are disabled by default in an access point in LWAPP mode. They are enabled by default when the access point is running a recovery IOS image. 25

26 Appendix B: Configuring Access Points in Cisco LWAPP Mode for Easy Deployment Obtaining a Password to Enter into EXEC mode on the AP Console An IOS LWAPP access point uses Cisco as the default enable password, but to enable these commands for easy deployment, you must first provide the access point with a new enable password. This new password enables you to enter into EXEC mode on the access point console. When you enter the following command from the controller console, the controller sends a username and a password to the access point: config ap username user-id password pass {AP-name all} If you enter a AP-name argument, the username and password is configured only for the specified access point. If you enter the all keyword, the username and password are sent to all access points that are registered to the controller. If you are relocating an access point that is using an LWAPP configuration file, you must clear the LWAPP configuration in the access point NVRAM and restore the access point factory default settings in order to enable the commands that specify the access point static IP address and the netmask; the IP address of the controller; the access point hostname; and the default gateway IP address. See the Deleting the LWAPP Configuration File to Redeploy the AP section on page 27 for information about deleting the LWAPP configuration and enabling these commands. Configuring Static Parameters to Register the Access Point to a Controller Using the password that the controller sent to the access point, enter into EXEC mode on the access point console. When the access point is running LWAPP or a recovery IOS image, you can configure the static IP address on the access point, the IP address on the controller, the access point hostname, and the default gateway IP address by entering these commands: lwapp ap ip address ip-addr subnet-mask lwapp ap controller ip address ip-addr lwapp ap hostname ap-hostname lwapp ap ip default-gateway ip-addr The access point with a recovery IOS image uses the static controller IP address to register to the specified controller and download the current LWAPP image. After the access point successfully registers to the controller, it receives configurations from the controller. The access point static hostname and the IP address of the controller are deleted from the access point configuration file. However, the access point static IP address and the netmask and the default gateway IP address are not deleted. When the access point is running a recovery IOS image, the commands to configure the static IP address on the access point, the IP address on the controller, the access point hostname, and the default gateway IP address are always enabled. These commands are disabled in the following cases: When the access point is running an LWAPP image. When the access point has an LWAPP configuration file in NVRAM. When the access point is in REGISTERED state with the controller. The access point console displays the following error message if you enter any of these commands when they are disabled: ERROR!!! Command is disabled. 26