Alcatel-Lucent AOS-W 6.5.3.x - Page 521

The switch is not running the correct image version
An AP can only be converted into a switch-based AP if the switch to which it connects is running AOS-W 6.5.2.0.
Switches that run a different version of AOS-W do not support the AP discovery logic and cannot convert the
AP to switch-based mode.
The AP is attempting to connect to a fake switch
If the AP fails to convert into a switch-based AP, the switch to which it attempted to connect may be fake.
Execute the show log provision command on the switch to check if the APfailed to connect after 10
attempts.
FTP or TFTP permission is denied on the switch
In order to download the AOS-W image from the switch, the AP must establish a File Transfer Protocol (FTP) or
Trivial File Transfer Protocol (TFTP) connection to the switch. If FTP or TFTP permission is denied on the switch,
the connection attempt is dropped, and the AP cannot download the AOS-W image.
Use one of the following methods to check if FTP or TFTP permission is denied on the switch:
n Execute the show log upgrade command on the AP. If FTP or TFTP permission is denied, the AP fails to
connect to the switch, and the following messages appear in the upgrade log:
l “Connecting to <controller IP address>… failed: Connection time out.”
l “Error: failed to retrieve image”
l “Info: try with tftp to download the image.”
n Access controls can be applied to a switch port to filter traffic between the switch and the APs. Traffic must
meet all criteria on the access control list (ACL) in order to reach the switch or AP. If it does not meet the
criteria, the connection is dropped.
l Execute the show interface fastethernet <port> access-group command to view the ACLs that
have been applied to the port.
l Execute the show ip access-list <string> command on the switch to view the detailed configuration
for the ACL that has been applied to the port.
l Execute the interface fastethernet|gigabitethernet} <port> ip access-group <name>
{in|out|session {vlan <vlanID>}} command to apply an ACL to a port.
l Execute the no interface {fastethernet|gigabitethernet} <port> ip access-group <name>
{in|out|session {vlan <vlanID>}} command to remove an ACL from a port.
l Execute the ip access-list extended {<number>|<name>} deny <protocol> command to reject
traffic for a specific protocol. If you reject traffic for the User Datagram Protocol (UDP), TFTP traffic is
dropped. If you reject traffic for the Transmission Control Protocol (TCP), FTP traffic is dropped.
l Execute the ip access-list extended {<number>|<name>} permit <protocol> command to allow
traffic for a specific protocol. If you allow traffic for the User Datagram Protocol (UDP), TFTP traffic can
reach the switch or AP. If you allow traffic for the Transmission Control Protocol (TCP), FTP traffic can
reach the switch or AP.
The AP is unable to upgrade to the Instant image
If the AP is marked as CAP-only, it cannot be upgraded to the Instant image. CAP-only APs can only be
upgraded to the AOS-W image.
Execute the show log provision command on the AP to check if your AP is CAP-only. If your AP is CAP-only,
the “CAP-only sku” message appears.
AOS-W 6.5.3.x | User Guide Access Points | 521