Cisco AP1041 as WiFi Bridge

Brian_B

2[H]4U
Joined
Mar 23, 2012
Messages
3,354
Ok, just moved into a new house.

I plan on running hardline ethernet one of these days, I promise. But that isn't today.

I have an older Netgear R7000 Router that I have been using for a while. It still works ok, the entire house gets WiFi adequately, no real issues with this particular piece of equipment at this time.

I have 12Mb DSL. Yeah.... fastest I've ever had - b/c rural. That's ok.

My phone jack and DSL modem are on one end of the house. So is my router. My home office is in the middle of the house. My office has all my gear on 1GB switch and CAT6. In the past, I just used Powerline adapters and bridged the ISP over to my home office, and it worked out ok. Nothing blazing fast, but when your internet is a dinosaur, you don't need blazing fast to the router, all my big data is local on the faster network anyway.

In the new home, Powerline doesn't work so well - different circuit and all. So, I have this old AP1041 from work that was sitting in a networking closet. I know it only does up to .11-N, which is still fine for me. Reading up on it at work today, seems like it should be able to go into Bridge mode and replace my Powerline adapters.

Getting it home and working with it for a few hours, I can't get the damn thing to authenticate to my existing WiFi network. It seems ~mostly~ straight forward on the Cisco side (as straightforward as that gets anyway). On the AP, setting it to Workgroup Bridge is no issue. I can enter the SSID, update the Infrastructure SSID, and update the Security requirements to TKIP + AES, TKIP, or AES. But playing with the settings, I can't get the settings to associate. I either get Cannot Associate - No Response, or Cannot Associate - Associating, or Cannot Associate - WPAIE Not Found. Flipping between WPA, WPAv1, and WPAv2 doesn't seem to do anything.

I tried changed my WiFi security from WPA2 to WPA+WPA2 (my only other option is None, which isn't an option, or Enterprise, which needs a RADIUS server that I don't have set up at the moment). I haven't tried WEP yet, which I can select if I adjust a lot of the settings on the router, but that isn't really any different than None and breaks my existing SSID on every single other device.

Any tricks here? I know it's an older piece of gear, it may just be time to chuck it. I could just buy another cheapy bridge for like $30 until I can run the wire, or pony up for a UniFi at $100 and run it bridged until I get the wire run, then turn it into my AP. But if i can get this to work in the interim, it would feel like a victory to me in more than just the saving money front. It's become a bit personal.
 
Yup.

Code:
ap#sh ip int br
Interface                  IP-Address      OK? Method Status                Protocol
BVI1                       192.168.1.5     YES NVRAM  up                    up
Dot11Radio0                unassigned      YES NVRAM  reset                 down
GigabitEthernet0           unassigned      YES NVRAM  up                    up
ap#

Here's a log output when restart the AP and then re-enter the PSK in order to see if it will reconnect. This is with Encryption set to AES CCMP, The SSID set to Open Authentication, Mandatory Key Management WPAv2, and the Netgear router set to WPA2-PSK (AES) (which is the config I think should be working).

Code:
ap#sh log
Syslog logging: enabled (1 messages dropped, 9 messages rate-limited,
                0 flushes, 0 overruns, xml disabled, filtering disabled)
    Console logging: level debugging, 26 messages logged, xml disabled,
                     filtering disabled
    Monitor logging: level debugging, 0 messages logged, xml disabled,
                     filtering disabled
    Buffer logging: level debugging, 33 messages logged, xml disabled,
                    filtering disabled
    Logging Exception size (4096 bytes)
    Count and timestamp logging messages: disabled
    Trap logging: level informational, 34 message lines logged
Log Buffer (1048576 bytes):
*Mar  1 00:00:09.987: %SOAP_FIPS-2-SELF_TEST_IOS_SUCCESS: IOS crypto FIPS self test passed
*Mar  1 00:00:10.004: *** CRASH_LOG = YES
*Mar  1 00:00:10.304: Port 1 is not present
*Mar  1 00:00:11.018: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 0Base Ethernet MAC address: 00:07:7D:5F:15:B4
*Mar  1 00:00:13.285: %LINK-3-UPDOWN: Interface GigabitEthernet0, changed state to up
*Mar  1 00:00:13.970: %SYS-5-CONFIG_I: Configured from memory by console
*Mar  1 00:00:13.974: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C1040 Software (C1140-K9W7-M), Version 12.4(25d)JA, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2010 by Cisco Systems, Inc.
Compiled Thu 09-Dec-10 15:24 by prod_rel_team
*Mar  1 00:00:13.974: %SNMP-5-COLDSTART: SNMP agent on host ap is undergoing a cold start
*Mar 30 05:01:12.009: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset
*Mar 30 05:01:12.010: %CDP_PD-4-POWER_OK: Full power - AC_ADAPTOR inline power source
*Mar 30 05:01:12.297: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
*Mar 30 05:01:12.870: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Mar 30 05:01:13.009: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Mar 30 05:01:23.041: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: No Cisco parent
*Mar 30 05:03:48.051: %SYS-5-CONFIG_I: Configured from http by  on 192.168.1.124
*Mar 30 05:03:58.322: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: No Response
ap#
 
Last edited:
It looks like it's trying to peer with another Cisco AP that is designated as a station-role root. What is the full config of the AP?
 
I reset to factory, changed the password, set a static IP, set Workgroup Bridge, and tinkered with the Security settings to try to get the SSID to associate, here's the config:

Code:
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ap
!
logging rate-limit console 9
enable secret 5 -----
!
no aaa new-model
!
!
dot11 syslog
!
dot11 ssid MYSSID
   authentication open
   authentication key-management wpa version 2
   guest-mode
   infrastructure-ssid
   wpa-psk ascii 7 1356160006020D242125
   no ids mfp client
!
!
!
username Cisco password 7 -----
!
!
bridge irb
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption mode ciphers aes-ccm
 !
 ssid MYSSID
 !
 antenna gain 0
 station-role workgroup-bridge
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface GigabitEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 no keepalive
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface BVI1
 ip address 192.168.1.5 255.255.255.0
 no ip route-cache
!
ip default-gateway 192.168.1.1
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
no cdp run
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 login local
!
end
 
Back
Top