Hardware in lab
In the part one I will show how to convert Wireless Controller Based Cisco access point into Autonomous mode. Then in the second part I will use it as a site survey device utilizing 10KHz spectrum analyser sensor.
In this tutorial we will convert Cisco AIR-CAP3502P-E-K9 (ap3g1-k9w8-mx.152-2.JA) into AIR-SAP3502P-E-K9 (ap3g1-k9w7-mx.152-4.JA1).
Here below you can see the AP description which does not change after conversion as manufacture PID is burnt in motherboard. See show inventory
:
NAME: "AP3500", DESCR: "Cisco Aironet 3500 Series (IEEE 802.11n) Access Point" PID: AIR-CAP3502P-E-K9 , VID: V01, SN: FCZ*****0RU
Software needed
You can use it as a regular autonomous AP without restrictions. In order to convert you need to download this code and convert it from CAPWAP mode to Autonomous IOS:
ap3g1-k9w7-tar.124-25d.JA.tar (forum confirmed)
Description: WIRELESS LAN Release: 12.4.25d-JA1 Release Date: 15/Aug/2011 File Name: ap3g1-k9w7-tar.124-25d.JA1.tar Min Memory: DRAM 64 MB Flash 32 MB Size: 6.21 MB (6512640 bytes) MD5 Checksum: d412138813bb16ec4cdd28cb41d2b690
The newest images available for Cisco Aironet 1260 Access Point from Cisco website
Description: WIRELESS LAN Release: 15.2.4-JB3a Release Date: 24/Dec/2013 File Name: ap3g1-k9w7-tar.152-4.JB3a.tar Min Memory: DRAM 128 MB Flash 32 MB Size: 12.74 MB (13363200 bytes) MD5 Checksum: 9127c418912c42973b9bc9c0fdec463b
Description: WIRELESS LAN Release: 15.2.4-JA1 Release Date: 31/Jul/2013 File Name: ap3g1-k9w7-tar.152-4.JA1.tar <- software used Min Memory: DRAM 64 MB Flash 32 MB Size: 12.69 MB (13301760 bytes) MD5 Checksum: ff7c7728c5af167b564896d0b057fdc5
Description: WIRELESS LAN Release: 12.4.25d-JA2 Release Date: 14/Sep/2012 File Name: ap3g1-k9w7-tar.124-25d.JA2.tar Min Memory: DRAM 64 MB Flash 32 MB Size: 6.21 MB (6512640 bytes) MD5 Checksum: 7e59bd74861944315bb084452f9541f4
Conversion
This method described below relays on uploading a new image via TFTP in a recovery mode.
1. Connect AP directly to your computer. The computer need to be setup with a static ip address, eg: 10.0.0.2/8 2. Power up AP by holding a reset button then release when a led change to red color 3. Setup TFTP
ap: set IP_ADDR 10.0.0.1 ap: set NETMASK 255.0.0.0 ap: set DEFAULT_ROUTER 10.0.0.2
4. Iniciate TFTP transfer
ap: tftp_init
5. Validate if tftp initialization triggered arp entry
ap: arp 255.255.255.255 ff:ff:ff:ff:ff:ff 0 8
6. Copy and extract tar image from tftp to flash. Usage usage: tar <-table | -xtract> <tar file> <destination>
ap: tar -xtract tftp://10.0.0.2/ap3g1-k9w7-tar.152-4.JA1.tar flash: extracting info (285 bytes) ap3g1-k9w7-mx.152-4.JA1/ (directory) 0 (bytes) extracting ap3g1-k9w7-mx.152-4.JA1/ap3g1-k9w7-mx.152-4.JA1 (121199 bytes).......................... extracting ap3g1-k9w7-mx.152-4.JA1/ap3g1-boot-m_upg (393216 bytes)......................... extracting ap3g1-k9w7-mx.152-4.JA1/u-boot.bin (393216 bytes).................. ap3g1-k9w7-mx.152-4.JA1/html/ (directory) 0 (bytes) <-- output omitted ---> extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_stationview-client.shtml.gz (5554 bytes). extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_contextmgr_ap.shtml.gz (4774 bytes). extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_contextmgr_scm.shtml.gz (5294 bytes). extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_contextmgr_scm-groups.shtml.gz (7587 bytes). extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_contextmgr_scm_summary.shtml.gz (5206 bytes). extracting ap3g1-k9w7-mx.152-4.JA1/ap3g1-k9w7-xx.152-4.JA1 (10936046 bytes)............................. ....................................................................................... extracting ap3g1-k9w7-mx.152-4.JA1/8003.img (452107 bytes)............................. extracting ap3g1-k9w7-mx.152-4.JA1/D2.bin (11716 bytes).. extracting ap3g1-k9w7-mx.152-4.JA1/D5.bin (788 bytes) extracting ap3g1-k9w7-mx.152-4.JA1/Z2.bin (10504 bytes).. extracting ap3g1-k9w7-mx.152-4.JA1/Z5.bin (602 bytes) extracting ap3g1-k9w7-mx.152-4.JA1/G2.bin (7272 bytes). extracting ap3g1-k9w7-mx.152-4.JA1/G5.bin (768 bytes) extracting ap3g1-k9w7-mx.152-4.JA1/info (285 bytes) extracting ap3g1-k9w7-mx.152-4.JA1/file_hashes (31879 bytes)....... extracting ap3g1-k9w7-mx.152-4.JA1/final_hash (141 bytes) extracting ap3g1-k9w7-mx.152-4.JA1/img_sign_rel.cert (1375 bytes) extracting ap3g1-k9w7-mx.152-4.JA1/img_sign_rel_sha2.cert (1371 bytes) extracting info.ver (285 bytes)
7. Check new flash: directory structure
ap: dir flash: Directory of flash:/ 2 -rwx 285 <date> info 3 -rwx 63405 <date> event.log 4 -rwx 7192 <date> private-multiple-fs 5 drwx 832 <date> ap3g1-k9w8-mx.152-2.JA 43 drwx 0 <date> configs 44 -rwx 168 <date> env_vars 45 -rwx 64 <date> sensord_CSPRNG0 46 -rwx 64 <date> sensord_CSPRNG1 47 drwx 1088 <date> ap3g1-k9w7-mx.152-4.JA1 11 drwx 128 <date> ap3g1-rcvk9w8-mx 249 -rwx 285 <date> info.ver 4840448 bytes available (26899456 bytes used)
8. Check the new image directory
ap: dir flash:/ap3g1-k9w7-mx.152-4.JA1 Directory of flash:/ap3g1-k9w7-mx.152-4.JA1/ 48 -rwx 121199 <date> ap3g1-k9w7-mx.152-4.JA1 49 -rwx 393216 <date> ap3g1-boot-m_upg 50 -rwx 393216 <date> u-boot.bin 51 drwx 64 <date> html 236 -rwx 10936046 <date> ap3g1-k9w7-xx.152-4.JA1 237 -rwx 452107 <date> 8003.img 238 -rwx 11716 <date> D2.bin 239 -rwx 788 <date> D5.bin 240 -rwx 10504 <date> Z2.bin 241 -rwx 602 <date> Z5.bin 242 -rwx 7272 <date> G2.bin 243 -rwx 768 <date> G5.bin 244 -rwx 285 <date> info 245 -rwx 31879 <date> file_hashes 246 -rwx 141 <date> final_hash 247 -rwx 1375 <date> img_sign_rel.cert 248 -rwx 1371 <date> img_sign_rel_sha2.cert 4840448 bytes available (26899456 bytes used)
After conversion
ap#sh version Cisco IOS Software, AP3G1 Software (AP3G1-K9W7-M), Version 15.2(4)JA1, RELEASE SOFTWARE (fc2) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. Compiled Tue 30-Jul-13 22:52 by prod_rel_team ROM: Bootstrap program is AP3G1 boot loader BOOTLDR: AP3G1 Boot Loader (AP3G1-BOOT-M), Version 15.2 [chayan-apn-0411 116] ap uptime is 5 minutes System returned to ROM by power-on System image file is "flash:/ap3g1-k9w7-mx.152-4.JA1/ap3g1-k9w7-xx.152-4.JA1" Last reload reason: <-- output omitted --> cisco AIR-SAP3502P-E-K9 (PowerPC460exr) processor (revision A0) with 98294K/32768K bytes of memory. Processor board ID FCZ1623Z0RU PowerPC460exr CPU at 666Mhz, revision number 0x18A8 Last reset from power-on 1 Gigabit Ethernet interface 2 802.11 Radios 32K bytes of flash-simulated non-volatile configuration memory. Base ethernet MAC Address: A4:4C:11:22:33:4D Part Number : 73-12175-05 PCA Assembly Number : 800-32268-05 PCA Revision Number : A0 PCB Serial Number : FOC*****BMP Top Assembly Part Number : 800-32904-01 Top Assembly Serial Number : FCZ*****0RU Top Revision Number : A0 Product/Model Number : AIR-CAP3502P-E-K9 Configuration register is 0xF
AP3500/AP1260 – Boot Issues
The fix for this issue is now publicly available. Go to www.cisco.com to obtain Access Point (AP) IOS code version: 15.2(2)JA or later and/or WLC software version: 7.0.235.3 (or later 7.0 release), 7.2.111.3 (or later 7.2 release) or 7.3.101.0 (or later 7.3 release). As of June 2012, new AP3500 and AP1260 products with version ID (VID) V02 are free of this issue.