Convert Cisco AP

Hardware in lab

In this tutorial we will convert Cisco AIR-CAP3502P-E-K9 (ap3g1-k9w8-mx.152-2.JA) into AIR-SAP3502P-E-K9 (ap3g1-k9w7-mx.152-4.JA1).

Here below you can see the AP description which does not change after conversion as manufacture PID is burnt in motherboard. See show inventory:

NAME: "AP3500", DESCR: "Cisco Aironet 3500 Series (IEEE 802.11n) Access Point"
PID: AIR-CAP3502P-E-K9 , VID: V01, SN: FCZ*****0RU

Software needed

You can use it as a regular autonomous AP without restrictions. In order to convert you need to download this code and convert it from CAPWAP mode to Autonomous IOS:

ap3g1-k9w7-tar.124-25d.JA.tar (forum confirmed)

Description:	WIRELESS LAN
Release:	12.4.25d-JA1
Release Date:	15/Aug/2011
File Name:	ap3g1-k9w7-tar.124-25d.JA1.tar
Min Memory:	DRAM 64 MB Flash 32 MB
Size:	6.21 MB (6512640 bytes)
MD5 Checksum:	d412138813bb16ec4cdd28cb41d2b690

The newest images available for Cisco Aironet 1260 Access Point from Cisco website

Description:	WIRELESS LAN
Release:	15.2.4-JB3a
Release Date:	24/Dec/2013
File Name:	ap3g1-k9w7-tar.152-4.JB3a.tar
Min Memory:	DRAM 128 MB Flash 32 MB
Size:	12.74 MB (13363200 bytes)
MD5 Checksum:	9127c418912c42973b9bc9c0fdec463b

Description:	WIRELESS LAN
Release:	15.2.4-JA1
Release Date:	31/Jul/2013
File Name:	ap3g1-k9w7-tar.152-4.JA1.tar <- software used
Min Memory:	DRAM 64 MB Flash 32 MB
Size:	12.69 MB (13301760 bytes)
MD5 Checksum:	ff7c7728c5af167b564896d0b057fdc5

Description:	WIRELESS LAN
Release:	12.4.25d-JA2
Release Date:	14/Sep/2012
File Name:	ap3g1-k9w7-tar.124-25d.JA2.tar
Min Memory:	DRAM 64 MB Flash 32 MB
Size:	6.21 MB (6512640 bytes)
MD5 Checksum:	7e59bd74861944315bb084452f9541f4

Conversion

This method described below relays on uploading a new image via TFTP in a recovery mode.

1. Connect AP directly to your computer. The computer need to be setup with a static ip address, eg: 10.0.0.2/8 2. Power up AP by holding a reset button then release when a led change to red color 3. Setup TFTP

ap: set IP_ADDR 10.0.0.1
ap: set NETMASK 255.0.0.0
ap: set DEFAULT_ROUTER 10.0.0.2

4. Iniciate TFTP transfer

ap: tftp_init

5. Validate if tftp initialization triggered arp entry

ap: arp
    255.255.255.255  ff:ff:ff:ff:ff:ff  0  8

6. Copy and extract tar image from tftp to flash. Usage usage: tar <-table | -xtract> <tar file> <destination>

ap: tar -xtract tftp://10.0.0.2/ap3g1-k9w7-tar.152-4.JA1.tar flash:

extracting info (285 bytes)
ap3g1-k9w7-mx.152-4.JA1/ (directory) 0 (bytes)
extracting ap3g1-k9w7-mx.152-4.JA1/ap3g1-k9w7-mx.152-4.JA1 (121199 bytes)..........................
extracting ap3g1-k9w7-mx.152-4.JA1/ap3g1-boot-m_upg (393216 bytes).........................
extracting ap3g1-k9w7-mx.152-4.JA1/u-boot.bin (393216 bytes)..................
ap3g1-k9w7-mx.152-4.JA1/html/ (directory) 0 (bytes)
<-- output omitted --->
extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_stationview-client.shtml.gz (5554 bytes).
extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_contextmgr_ap.shtml.gz (4774 bytes).
extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_contextmgr_scm.shtml.gz (5294 bytes).
extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_contextmgr_scm-groups.shtml.gz (7587 bytes).
extracting ap3g1-k9w7-mx.152-4.JA1/html/level/15/ap_contextmgr_scm_summary.shtml.gz (5206 bytes).
extracting ap3g1-k9w7-mx.152-4.JA1/ap3g1-k9w7-xx.152-4.JA1 (10936046 bytes).............................
.......................................................................................
extracting ap3g1-k9w7-mx.152-4.JA1/8003.img (452107 bytes).............................
extracting ap3g1-k9w7-mx.152-4.JA1/D2.bin (11716 bytes)..
extracting ap3g1-k9w7-mx.152-4.JA1/D5.bin (788 bytes)
extracting ap3g1-k9w7-mx.152-4.JA1/Z2.bin (10504 bytes)..
extracting ap3g1-k9w7-mx.152-4.JA1/Z5.bin (602 bytes)
extracting ap3g1-k9w7-mx.152-4.JA1/G2.bin (7272 bytes).
extracting ap3g1-k9w7-mx.152-4.JA1/G5.bin (768 bytes)
extracting ap3g1-k9w7-mx.152-4.JA1/info (285 bytes)
extracting ap3g1-k9w7-mx.152-4.JA1/file_hashes (31879 bytes).......
extracting ap3g1-k9w7-mx.152-4.JA1/final_hash (141 bytes)
extracting ap3g1-k9w7-mx.152-4.JA1/img_sign_rel.cert (1375 bytes)
extracting ap3g1-k9w7-mx.152-4.JA1/img_sign_rel_sha2.cert (1371 bytes)
extracting info.ver (285 bytes)

7. Check new flash: directory structure

ap: dir flash:
Directory of flash:/

2    -rwx  285       <date>               info
3    -rwx  63405     <date>               event.log
4    -rwx  7192      <date>               private-multiple-fs
5    drwx  832       <date>               ap3g1-k9w8-mx.152-2.JA
43   drwx  0         <date>               configs
44   -rwx  168       <date>               env_vars
45   -rwx  64        <date>               sensord_CSPRNG0
46   -rwx  64        <date>               sensord_CSPRNG1
47   drwx  1088      <date>               ap3g1-k9w7-mx.152-4.JA1
11   drwx  128       <date>               ap3g1-rcvk9w8-mx
249  -rwx  285       <date>               info.ver

4840448 bytes available (26899456 bytes used)

8. Check the new image directory

ap: dir flash:/ap3g1-k9w7-mx.152-4.JA1
Directory of flash:/ap3g1-k9w7-mx.152-4.JA1/

48   -rwx  121199    <date>               ap3g1-k9w7-mx.152-4.JA1
49   -rwx  393216    <date>               ap3g1-boot-m_upg
50   -rwx  393216    <date>               u-boot.bin
51   drwx  64        <date>               html
236  -rwx  10936046  <date>               ap3g1-k9w7-xx.152-4.JA1
237  -rwx  452107    <date>               8003.img
238  -rwx  11716     <date>               D2.bin
239  -rwx  788       <date>               D5.bin
240  -rwx  10504     <date>               Z2.bin
241  -rwx  602       <date>               Z5.bin
242  -rwx  7272      <date>               G2.bin
243  -rwx  768       <date>               G5.bin
244  -rwx  285       <date>               info
245  -rwx  31879     <date>               file_hashes
246  -rwx  141       <date>               final_hash
247  -rwx  1375      <date>               img_sign_rel.cert
248  -rwx  1371      <date>               img_sign_rel_sha2.cert

4840448 bytes available (26899456 bytes used)

After conversion

ap#sh version
Cisco IOS Software, AP3G1 Software (AP3G1-K9W7-M), Version 15.2(4)JA1, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Tue 30-Jul-13 22:52 by prod_rel_team

ROM: Bootstrap program is AP3G1 boot loader
BOOTLDR: AP3G1 Boot Loader (AP3G1-BOOT-M), Version 15.2 [chayan-apn-0411 116]

ap uptime is 5 minutes
System returned to ROM by power-on
System image file is "flash:/ap3g1-k9w7-mx.152-4.JA1/ap3g1-k9w7-xx.152-4.JA1"
Last reload reason:

<-- output omitted -->

cisco AIR-SAP3502P-E-K9 (PowerPC460exr) processor (revision A0) with 98294K/32768K bytes of memory.
Processor board ID FCZ1623Z0RU
PowerPC460exr CPU at 666Mhz, revision number 0x18A8
Last reset from power-on
1 Gigabit Ethernet interface
2 802.11 Radios

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: A4:4C:11:22:33:4D
Part Number                          : 73-12175-05
PCA Assembly Number                  : 800-32268-05
PCA Revision Number                  : A0
PCB Serial Number                    : FOC*****BMP
Top Assembly Part Number             : 800-32904-01
Top Assembly Serial Number           : FCZ*****0RU
Top Revision Number                  : A0
Product/Model Number                 : AIR-CAP3502P-E-K9

Configuration register is 0xF

AP3500/AP1260 - Boot Issues

The fix for this issue is now publicly available. Go to www.cisco.com to obtain Access Point (AP) IOS code version: 15.2(2)JA or later and/or WLC software version: 7.0.235.3 (or later 7.0 release), 7.2.111.3 (or later 7.2 release) or 7.3.101.0 (or later 7.3 release). As of June 2012, new AP3500 and AP1260 products with version ID (VID) V02 are free of this issue.

Reference

• Surveying with a 3502 (followup post) samswireless
• Surveying with a 3502 (followup post)sc-wifi.com
• Field Notice: FN - 63537 - AP3500/AP1260 - Boot Issues - Upgrade RequiredRevised September 25, 2012