12 of 93 Access Points (all MSM310) stuck on 'Establishing tunnel' since today

[svhelden]

We have an MSM760 (Firmware 6.3.0.0) with 93 Access Points. Everything worked until yesterday, and there were no changes in our network.

Now, suddenly, 12 of the Access Points cannot connect anymore. They are in a constant loop:

• get DHCP address
• contact MSM760 controller
• "Establishing tunnel"
• reboot

All affected Access Points are MSM310. But also have lots of MSM310s that are working.

I could also not find any useful information from the logs. Of course I rebooted the Access Controller and one of the Access Points, but it did not help. Also it's not a license issue (we have 120 licenses).

Do others also have the same problem? Is it a known issue, maybe due certificate expiry? Or is there any special log that I could check?

[svhelden]

We worked around the issue by setting the date on the controller a month back. Seems that some certificate has expired (which is not visible in the controller's certificate list). Now working with HP to find a permanent solution.

[Adam_Brown]

Hi!

Wondering if HP ever came up with a permanent solution to this one. We're experiencing the exact same thing here. I set the date back (thanks for posting that!) and we're working for now, but I'm curious if there's been a permanent fix.

Thanks!

Adam Brown

Systems Manager II, Technological Services

Visalia Unified School District

[hoganwillig]

Had the same issue today with a MSM710.  Changing the date back 2 months got everything back up.  Thanks for the info!!

[ToeLei]

I had the exact same issue today at one of my customer. Setting back the date 1 year got the AP's working again.

Did anyone find a permanent solution for this?

I've been unable to find any info about this from HP official documentation.

/tobias

[Arimo]

Hi all

If setting the date on the controller back resolves the issue, then it seems clear that it's a question of expired certificates. The solution is simply to upload new certificates and you're good to go. How to is described in the Config guide section 16 Security, "Managing certificates".

[ToeLei]

The problem is that I can't find any certificate that has expired so I don't know what kind of certificate to upload.

See attached image.

Earlier in the thread it was stated that the expired certificate wasn't visible in their list either and that they were working with HP to find a solution. It would be intresting to hear from them what kind of solution they got.

/Tob

[JeremyHout]

Has there been any update on this topic from HP?

[svhelden]

Oh, did I forget to update this topic?

HP could not explain how it came to the situation, likely it was a bug in some older firmware.

Reason was to factory reset all affected Access Points:

1) set controller date back

2) wait until APs connect

then for each affected AP

3) perform factory reset

4) delete from controller before AP completes reboot

then

5) set controller date back to correct one

[TomAtWorkI]

Hello,

If you using the colubris flag and using layer 3 communication it could be an MTU problem.

Got to "Maintenance" and backup your config.

Open the file with an usefull editor (e.g. N++)

Find the interface/port where the access points are located:

 <INTERFACE-1>
    interface = br0
    hwaddr = ""
    afname = inet
    address = 10.11.12.13
    broadcast = 10.11.12.255
    netmask = 255.255.255.0
    dstaddress = ""
    flags = "UP BCST RUN MULTCST "
    mtu = 1300
    metric = 1
    txqlen = 1000

Change the MTU size to a value below 1500. For VPN Tunnels to branch offices 1300 is a good value.

Restore the configuration file.