Contents

Introduction

Problem

Solution

Step 1. Prepare a TFTP-Server that has an AP-Image Available.

Step 2. Ensure that the AP can Reach the TFTP-Server.

Step 3. Connect to the Console of the AP and Initialize for TFTP Copy.

Step 4. Initiate the Copy and Extract of the Image.

Step 5. Boot the Copied and Extracted Image.

Introduction

This document describes how to recover the embedded access point of the IR829 when it is stuck in the bootloader/rommon.

Problem

The IR829 has an embedded Access Point, AP803. This AP is running a separate uboot, bootloader (rommon) and IOS AP image.

In some cases, for example, when the AP IOS image is corrupt or accidentally removed, you need to be able to recover and copy a fresh image to the AP-part of the IR829.

There is no easy possibility to copy files from the flash: that is accessible on the IR829's IOS to the flash: accessible by the embedded AP803.

Solution

First, make sure that the AP IOS image was not booted and the device ended in rommon.

The easiest way to see this is by looking at the prompt presented after connecting to the AP803 console from the IR829's IOS:

To connect to the console of the AP803, first make sure you have an IP-address configured on the wlan-ap0 interface, then issue the following command:

IR829#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

IR829(config)#int wlan-ap0

The wlan-ap 0 interface is used for managing the embedded AP.

Please use the "service-module wlan-ap 0 session" command to console into the embedded AP

IR829(config-if)#ip addr 192.168.100.1 255.255.255.0

IR829(config-if)#end

IR829#service-module wlan-ap 0 session

Trying 192.168.100.1, 2004 ... Open

Connecting to AP console, enter Ctrl-^ followed by x,

then "disconnect" to return to router prompt

You are presented with one of these:

When the AP has the Unified image loaded.

AP2c5a.0f08.a4a8>

When the AP has the Autonomous image loaded.

ap>

When the AP is in rommon.

ap:

In the first two cases, the image on the AP is loaded and you can use the CLI to switch to another version if needed. More info can be found here: https://www.cisco.com/c/en/us/td/docs/routers/access/800/829/software/configuration/guide/b_IR800config/b_ap803.html

In the third case, the bootloader or rommon is not able to boot a suitable image on the AP.

When this is the case, you can copy a working image to the AP through Trivial File Transfer Protocol (TFTP) with these steps.

Step 1. Prepare a TFTP-Server that has an AP-Image Available.

You can download AP-images from this location: https://software.cisco.com/download/home/286289725/type

- For Autonomous images: https://software.cisco.com/download/home/286289725/type/284180979/

- For Unified images: https://software.cisco.com/download/home/286289725/type/280775090

Step 2. Ensure that the AP can Reach the TFTP-Server.

For this document, TFTP-server is 192.168.99.1 and it runs on a PC that is directly connected to GigabitEthernet 1 of the IR829.

GigabitEthernet0 on the AP-side is connected to interface Wlan-GigabitEthernet0 on IR829 router side. This is also the interface over which the TFTP-download happens.

Wlan-GigabitEthernet0 is a L2-interface, same as GigabitEthernet1-4 on the physical IR829 so you can just assign them to the same VLAN.

In IOS, configure this:

IR829#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

IR829(config)#interface GigabitEthernet1

IR829(config-if)# switchport access vlan 99

IR829(config-if)#interface Vlan99

IR829(config-if)# ip address 192.168.99.2 255.255.255.0

IR829(config-if)#interface Wlan-GigabitEthernet0

IR829(config-if)# switchport access vlan 99

IR829(config-if)# no ip address

IR829(config-if)#end

The above assigns GigabitEthernet1, physically on the IR829 to VLAN 99, then assigns IP-address 192.168.99.2 to the VLAN interface and finally, you also assign Wlan-GigabitEthernet0 to the same VLAN 99.

Step 3. Connect to the Console of the AP and Initialize for TFTP Copy.

ap: set IP_ADDR 192.168.99.3

ap: set NETMASK 255.255.255.0

ap: tftp_init

ap: ether_init

ap: flash_init

Initializing Flash...

mifs[0]: 7 files, 2 directories

mifs[0]: Total bytes     :  131334144

mifs[0]: Bytes used      :      55296

mifs[0]: Bytes available :  131278848

mifs[0]: mifs fsck took 0 seconds.

...done Initializing Flash.

Optionally, if the first attempt fails due to a corrupt flash: file system, you can run this command:

ap: format flash:

Are you sure you want to format "flash:" (all data will be lost) (y/n)?y

mifs[0]: 0 files, 1 directories

mifs[0]: Total bytes     :  131334144

mifs[0]: Bytes used      :       4096

mifs[0]: Bytes available :  131330048

mifs[0]: mifs fsck took 0 seconds.

Filesystem "flash:" formatted

In case you need a default-GW to reach another subnet, you can use this:

ap: set DEFAULT_ROUTER <ip>

Step 4. Initiate the Copy and Extract of the Image.

At this point, you copy the file from the TFTP-server and extract it to the flash of the AP803:

ap: tar -xtract tftp://192.168.99.1/ap1g3-k9w7-tar.153-3.JI1.tar flash:

extracting info (282 bytes)

ap1g3-k9w7-mx.153-3.JI1/ (directory) 0 (bytes)

ap1g3-k9w7-mx.153-3.JI1/html/ (directory) 0 (bytes)

...

extracting ap1g3-k9w7-mx.153-3.JI1/img_sign_rel_sha2.cert (1371 bytes)

extracting info.ver (282 bytes)

ap:

If all went well, you should now have a directory in flash: with the name of the image and the image in there:

ap: dir flash:

Directory of flash:/

2    -rwx  282       <date>               info

3    drwx  2048      <date>               ap1g3-k9w7-mx.153-3.JI1

208  -rwx  282       <date>               info.ver

116649984 bytes available (14684160 bytes used)

ap: dir flash:/ap1g3-k9w7-mx.153-3.JI1

Directory of flash:/ap1g3-k9w7-mx.153-3.JI1/

4    drwx  2048      <date>               html

195  -rwx  13028126  <date>               ap1g3-k9w7-mx.153-3.JI1

196  -rwx  1136      <date>               CO2.bin

197  -rwx  2594      <date>               CO5.bin

198  -rwx  5024      <date>               RO2.bin

199  -rwx  9884      <date>               RO5.bin

200  -rwx  12962     <date>               CA2.bin

201  -rwx  12962     <date>               CA5.bin

202  -rwx  282       <date>               info

203  -rwx  32004     <date>               file_hashes

204  -rwx  141       <date>               final_hash

205  -rwx  512       <date>               final_hash.sig

206  -rwx  1375      <date>               img_sign_rel.cert

207  -rwx  1371      <date>               img_sign_rel_sha2.cert

116649984 bytes available (14684160 bytes used)

Step 5. Boot the Copied and Extracted Image.

The final step is to let the AP boot the freshly copied image:

ap: boot flash:/ap1g3-k9w7-mx.153-3.JI1/ap1g3-k9w7-mx.153-3.JI1

Loading "flash:/ap1g3-k9w7-mx.153-3.JI1/ap1g3-k9w7-mx.153-3.JI1"...######...#######

File "flash:/ap1g3-k9w7-mx.153-3.JI1/ap1g3-k9w7-mx.153-3.JI1" uncompressed and installed, entry point: 0x60080000

executing...

Stop MAC.

Starting IOS...

...

At this point, the image should be started and after some time you are presented with the prompt of the image of your choice.

The bootloader/rommon uses this image, depending on the configuration from IOS regarding image type, from now on.