Cisco Virtual Wireless Controller cannot see access points

jyoung1974 used Ask the Experts™
I just upgrade from ESX 4.5 to 6.7 and the controller can not longer see the access points. There have been some changes in ESX for the interfaces, but for some reason it is not working. (I can see one new difference is that the switch and the port can be configured for Promiscuous mode, I tried both but neither work)

Virtual Switch:
1. Allow promiscuous mode Yes
2. Allow forged transmits Yes
3. Allow MAC changes      Yes

Data Port:
1. VLAN ID: 4095
2. Allow promiscuous mode Yes
3. Allow forged transmits Yes
4. Allow MAC changes Yes

Service Port
1. VLAN ID: 0
2. Allow promiscuous mode No
3. Allow forged transmits No
4. Allow MAC changes No

Switch Config:
interface GigabitEthernet0/1
 description trunked port
 switchport trunk native vlan 30
 switchport trunk allowed vlan 21,30,31,40,41
 switchport mode trunk
 spanning-tree bpdufilter enable
 ip dhcp snooping trust
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017

How did you upgrade from 4.5 to 6.7, because there is no direct upgrade path ?

Are you sure it was 4.5 ? Maybe this is a typo ?

A few comments do you need to use promiscuous mode and VLAN 4095, and VLAN 0 ?

What is the data port virtual machine portgroup and what VLAN should it use ?

same with Service port ?

You have VLAN 21,30,31,409,41 coming into the switch ?
Top Expert 2014

Can you see the WLC's GUI/CLI? If not, can you post the output from:

show interface summary the WLC CLI?

Which VLAN is the WLC management on?
Which VLAN are the APs on?


1. Yes, it was upgraded directly from 4.5 to 6.7.0 Update 3 (Build 15160138)  using the HP custom image for a Gen 9
2. All VLAN settings were done according to Cisco Deployment guide:
3. The VLANs were also set this way on the older ESX system (I have around 10 of these in use on older version of ESX with no issues)
4. The data port VLAN is set to 4095 because it is a trunked port on the Cisco device.
5. The Service Port is set to no VLAN or 0 Per Cisco documentation
6. It still reports the image of the system as "ESX/ESXi 4.x virtual machine"
7. The Access Points are in VLAN 31, they receive IP addresses via DHCP and can ping the controller.
8. The controller can ping the access points as well.
9. The only port specific configuration for this scenario is having the native VLAN 30 assigned to the port for communications to the Service Port that is set to VLAN 0
10. There are no connectivity problems to the CLI or GUI

(Cisco Controller) >show interface summary

 Number of Interfaces.......................... 4

Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest
-------------------------------- ---- -------- --------------- ------- ------ -----
inf_cl_wlan                               1    21            xxxxxx      Dynamic No     N/A
management                          1    31             xxxxxx      Static  Yes    N/A
service-port                             N/A  N/A        xxxxxx       Static  No     N/A
virtual                                       N/A  N/A         Static  No     N/A

Access Point at boot: It seems to hang after entering promiscuous mode

*Mar  1 00:01:03.731: AUTOINSTALL: GigabitEthernet0 is assigned xxxxxxxxx
*Mar  1 00:01:40.751: %SYS-4-CONFIG_RESOLVE_FAILURE: System config parse from (tftp:// failed
*Mar  1 00:02:18.823: %SYS-4-CONFIG_RESOLVE_FAILURE: System config parse from (tftp:// failed
*Mar  1 00:43:00.000: *** not invoke
*Mar  1 00:43:01.591: Starting Ethernet promiscuous mode

Andrew Hancock (VMware vExpert / EE Fellow)VMware and Virtualization Consultant
Fellow 2018
Expert of the Year 2017

4095 is a special VLAN, which effectively means that the virtual machine will receive ALL traffic, and the VM will need to untag/tag the traffic on it's internal nic, e.g. Guest VLAN Tagging.

Does this happen in the VM?
It started working, I upgraded the IOS version that was running on the APs and that was the trick. The only difference that I noticed in the newer version of ESX is that I had to set promiscuous mode to both the port and virtual switch while explicitly rejecting it on the management port.
Top Expert 2014

You shouldn't have to upgrade the code on the APs for the WLC to see them. That's the job of the WLC. When an AP joins a WLC with a different software version, the AP will download the correct version from the WLC.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial