New access points are cabled only toward the Catalyst 9800 service port, which is the out-of-band management port. They never join. The wireless management interface is on a different network that the access points do not touch. What is wrong?
Select an answer to reveal the explanation.
Short Explanation
The service port is the side door for administrators, not the door access points join through. Your units are aimed at that side door and never see the wireless management interface. Point them at the interface that actually accepts the join.
Full Explanation
On a Catalyst 9800 the service port is out-of-band management. Access points join through the wireless management interface. Cabling them only toward the service port, on a network that never reaches wireless management, means discovery and join have no path to the interface that terminates CAPWAP. The fix is a path to that wireless management interface. Treating the service port as the CAPWAP join interface and shutting wireless management removes the real join target. Clients are not authenticated on the service port. It is not a WLAN interface, and leaving access points only there will not start client service. The beacon interval is an access-point radio timer after the access point is joined and serving. It is not configured on the service port as a join prerequisite. Exam caveat: the service port is still useful for administrators when the main network is broken. Do not uncable it. Just do not expect access points to join there. Operational check: put a test access point on a VLAN that can reach the wireless management address and confirm it joins, while one left only on the service-port network does not.