Understanding Cisco CW9172 Day-0 Workflow, Persona Selection, and Fast Offline Migration (FOM)

Reference: https://www.cisco.com/c/en/us/td/docs/wireless/access_point/technical-reference/cw9172-dg.html

The Cisco Catalyst 9172I Access Point supports FOM (Fast Offline Migration), a Cisco mechanism designed for the new Wi-Fi 7 AP family (CW917x series) to accelerate migration from Meraki cloud mode to Catalyst controller mode.

What Problem FOM Solves

The CW917x APs are “hybrid” APs capable of operating in:

Meraki cloud-managed mode
Cisco Catalyst controller-based mode

By default, when a new CW917x AP boots, it first attempts to reach the Meraki cloud. If cloud connectivity fails, the AP waits approximately 8 minutes before falling back to Catalyst discovery methods.

That delay becomes a problem during:

brownfield migrations
staging
isolated networks
environments without Internet access

FOM bypasses that delay.

What FOM Actually Does

FOM introduces new DHCP/DNS discovery options that tell the AP:

“Do not attempt Meraki cloud onboarding. Immediately join a Catalyst WLC.”

Instead of waiting for cloud timeout behavior, the AP immediately begins CAPWAP discovery toward the Catalyst controller.

DHCP Option 43 Difference

Traditional Catalyst AP discovery:

f1 <length> <WLC-IP>

FOM discovery:

f3 <length> <WLC-IP> <mode>

Where:

f1 = legacy AP discovery
f3 = Fast Offline Migration
Mode:
- 01 = Meraki
- 02 = Catalyst

For Cisco FOM DHCP Option 43, the WLC math logic is:

Length = (# of WLC IPs × 4) + 1

Why:

Each IPv4 address = 4 bytes
Mode field = 1 byte
Total = all controller bytes + mode byte

Examples:

WLC Count	Math	Decimal	Hex Length
1	(1×4)+1	5	05
2	(2×4)+1	9	09
3	(3×4)+1	13	0D
4	(4×4)+1	17	11

Example — 2 WLCs:

172.16.1.24
172.16.1.25

Convert to hex:

ac100118
ac100119

Math:

L=(2×4)+1=9

Decimal 9 → Hex 09

Final FOM string:

f309ac100118ac10011902

Breakdown:

Portion	Meaning
f3	FOM option
09	length
ac100118	WLC1
ac100119	WLC2
02	Catalyst mode

Meraki mode would end with:

Catalyst mode ends with:

Cisco Switch – DHCP Example

ip dhcp pool Cisco-WIFI-7-DHCP-OPTIONS
network 10.0.210.0 255.255.255.192
default-router 10.0.210.1
option 43 hex f305.0a00.cf11.02
dns-server 10.0.206.21

[*08/04/2025 00:00:48.3464] ethernet_port wired0, ip 10.0.210.31, netmask 255.255.255.192, gw 10.0.210.1, mtu 1500, bcast 10.0.210.63, dns1 10.0.206.21, vid 0, static_ip_failover false, dhcp_vlan_failover false

[*08/04/2025 00:01:44.3580] Wait for 60 seconds for PNP

[*08/04/2025 00:01:44.3580] 

[*08/04/2025 00:01:45.5558] touch /tmp/geo_loc_gnss_fix

[*08/04/2025 00:01:49.3842] PNP:Server not reachable, Start CAPWAP Discovery

[*08/04/2025 00:01:49.3978] 

[*08/04/2025 00:01:49.3978] CAPWAP State: Discovery

[*08/04/2025 00:01:49.3993] Got WLC address 10.0.207.17 from DHCP.

[*08/04/2025 00:01:49.4166] Discovery Request sent to 10.0.207.17, discovery type DHCP(2)

[*08/04/2025 00:01:49.4318] Discovery Response from 10.0.207.17

[*08/04/2025 00:01:49.4322] Discovery Request sent to 255.255.255.255, discovery type UNKNOWN(0)

[*08/04/2025 00:01:49.4509] CAPWAP State: Discovery

[*05/11/2026 13:07:54.0000] Started wait dtls timer (60 sec)

[*05/11/2026 13:07:54.0107] CAPWAP State: DTLS Setup

[*05/11/2026 13:07:54.0999] First connect to vWLC, accept vWLC by default

[*05/11/2026 13:07:54.1028] dtls_verify_server_cert: vWLC is using SSC, returning 1

[*05/11/2026 13:07:54.8265] CAPWAP State: Join

[*05/11/2026 13:07:54.8401] shared_setenv PART_BOOTCNT 0 &> /dev/null

[*05/11/2026 13:07:55.7999] Sending Join request to 10.0.207.17 through port 5264, packet size 1376

[*05/11/2026 13:07:55.8096] Join Response from 10.0.207.17, packet size 1397

[*05/11/2026 13:07:55.8097] AC accepted previous sent request with result code: 0

[*05/11/2026 13:07:55.8098] Received wlcType 0, timer 30

[*05/11/2026 13:07:56.0166] CAPWAP State: Image Data

[*05/11/2026 13:07:56.0174] AP image version 17.15.3.28 backup 17.15.3.28, Controller 17.15.5.201

[*05/11/2026 13:07:56.0175] Version does not match.

[*05/11/2026 13:07:56.0175] Request to close the file..

[*05/11/2026 13:07:56.0175] wtpOpenImgFile: image file closed, dcb->fd set to -1.

[*05/11/2026 13:07:56.1995] status 'upgrade.sh: Script called with args:[PRECHECK]'

[*05/11/2026 13:07:56.2475] do PRECHECK, part1 is active part

[*05/11/2026 13:07:56.2844] status 'upgrade.sh: Cleanup tmp files ...'

[*05/11/2026 13:07:56.3253] Directory /tmp/ntevents not found.

[*05/11/2026 13:07:56.3362] status 'upgrade.sh: /tmp space: OK available 120372, required 102400 '

[*05/11/2026 13:07:56.3368] wtpOpenImgFile: request ap1g9, local /tmp/part.tar

[*05/11/2026 13:07:56.3370] wtpOpenImgFile: open (/tmp/part.tar) image file success

[*05/11/2026 13:07:56.3370] Using fd(367191890944) for image writing to file(/tmp/part.tar)

[*05/11/2026 13:07:56.3412] Image Data Request sent to 10.0.207.17, fileName [ap1g9], replicaStatus 1

[*05/11/2026 13:07:56.3429] Image Data Response from 10.0.207.17

[*05/11/2026 13:07:56.3429] AC accepted previous sent request with result code: 0

[*05/11/2026 13:07:56.3645] <.................Discarding msg CAPWAP_WTP_EVENT_REQUEST(type 9) in CAPWAP state: Image Data(10).

[*05/11/2026 13:08:01.4169] ........Discarding msg CAPWAP_WTP_EVENT_REQUEST(type 9) in CAPWAP state: Image Data(10).


[*05/11/2026 13:08:12.8803] ....DOT11_CFG[0]: poe_power_mode: low_pwr_mode=5, allowed_tx_ant=3, allowed_rx_ant=3

AP Reboots after successfully upgrading

[*05/11/2026 13:12:30.5929] Sending Join request to 10.0.207.17 through port 5248, packet size 1376

[*05/11/2026 13:12:30.6019] Join Response from 10.0.207.17, packet size 1397

[*05/11/2026 13:12:30.6019] AC accepted previous sent request with result code: 0

[*05/11/2026 13:12:30.6020] Received wlcType 0, timer 30

[*05/11/2026 13:12:30.7069] CAPWAP State: Image Data

[*05/11/2026 13:12:30.7077] AP image version 17.15.5.201 backup 17.15.3.28, Controller 17.15.5.201

[*05/11/2026 13:12:30.7079] Version is the same, do not need update.

[*05/11/2026 13:12:30.8916] status 'upgrade.sh: Script called with args:[NO_UPGRADE]'

[*05/11/2026 13:12:30.9365] do NO_UPGRADE, part2 is active part

[*05/11/2026 13:12:30.9594] CAPWAP State: Configure

[*05/11/2026 13:12:30.9625] Telnet is not supported by AP, should not encode this payload

[*05/11/2026 13:12:31.1269] Radio [2] Administrative state DISABLED  change to ENABLED 

[*05/11/2026 13:12:31.1455] DOT11_CFG[2]: 6GHz radio oper disabled. Will switch to single phy mode once the AP reboots.

[*05/11/2026 13:12:31.1470] DOT11_CFG[0]: Bringing up 2.4GHz radio in WW mode.

[*05/11/2026 13:12:31.1470] DOT11_CFG[0]: Starting radio 0

[*05/11/2026 13:12:31.1497] DOT11_DRV[0]: Start Radio0 - Begin

[*05/11/2026 13:12:31.1517] DOT11_DRV[0]: Start Radio0 - End

[*05/11/2026 13:12:31.1672] DOT11_CFG[2]: 6GHz radio oper disabled. Will switch to single phy mode once the AP reboots.

[*05/11/2026 13:12:31.1940] wlan: [0:E:ANY] mlme_ext_vap_up: VAP (mon0) is up, vdev_id:16 pdev_id:0 psoc_id:0

[*05/11/2026 13:12:31.3445] DOT11_CFG[2]: 6GHz radio oper disabled. Will switch to single phy mode once the AP reboots.

[*05/11/2026 13:12:31.4537] Radio Authority: no country code

[*05/11/2026 13:12:31.4580] KDUMP is not supported for this model AP

[*05/11/2026 13:12:31.4612] TLV_MLO_INFO_BASE_MAC_PAYLOAD_msg_enc_cb

[*05/11/2026 13:12:31.4612] Encoding TLV_MLO_INFO_BASE_MAC_PAYLAOD: ee:f4:0c:fa:ee:b0, length=6, tlv_data->sz_ap_mld_basemac=6

[*05/11/2026 13:12:31.6803] DOT11_CFG[2]: 6GHz radio oper disabled. Will switch to single phy mode once the AP reboots.

[*05/11/2026 13:12:31.7380] CAPWAP State: Run

[*05/11/2026 13:12:31.7393] capwap_run_notify:41 Country code not set

[*05/11/2026 13:12:31.9349] AP has joined controller NYC9800-1

[*05/11/2026 13:12:32.0381] DOT11_TXP[0]:Max Power table lookup error [Domain: UN, Chan: 1 reg_pwr: -99 Country: --]

[*05/11/2026 13:12:32.0813] DOT11_CFG[0]: Bringing up 2.4GHz radio in WW mode.

[*05/11/2026 13:12:32.1219] DOT11_DRV[0]: Stop Radio0 - Begin

[*05/11/2026 13:12:32.1226] wlan: [0:I:CMN_MLME] mlme_ext_vap_down: VAP (mon0) is down


[*05/11/2026 13:12:32.1999] Radio Authority: no country code

[*05/11/2026 13:12:32.2771] DOT11_CFG[2]: 6GHz radio oper disabled. Will switch to single phy mode once the AP reboots.

[*05/11/2026 13:12:32.3227] syslog level is being set to 70

[*05/11/2026 13:12:32.3227] 

[*05/11/2026 13:12:32.3428] Previous AP mode is 0, change to 0

[*05/11/2026 13:12:32.3581] Current session mode: ssh, Configured: Telnet-No, SSH-No, Console-Yes

[*05/11/2026 13:12:32.4342] Password from WLC looks to be MD5 encoded.. 

[*05/11/2026 13:12:32.4730] chpasswd: password for user changed

[*05/11/2026 13:12:32.5181] Same LSC mode, no action needed

[*05/11/2026 13:12:32.5313] KDUMP is not supported for this model AP

[*05/11/2026 13:12:32.5977] Same value is already set.

[*05/11/2026 13:12:32.6755] BLE admin config command. ignoring config command

[*05/11/2026 13:12:32.6756] BLE admin config command. ignoring config command

[*05/11/2026 13:12:32.6811] BLE Scan req config command. ignoring config command

[*05/11/2026 13:12:32.6927] Got WSA Server config TLVs

[*05/11/2026 13:12:33.1979] DOT11_CFG[1]: poe_power_mode: low_pwr_mode=5, allowed_tx_ant=15, allowed_rx_ant=15

[*05/11/2026 13:12:33.2038] USB Device Disconnected from the AP

[*05/11/2026 13:12:33.7648] DOT11_TXP[0]:Max Power table lookup error [Domain: UN, Chan: 1 reg_pwr: -99 Country: --A]

[*05/11/2026 13:12:34.2625] AP tag  change to default-policy-tag

[*05/11/2026 13:13:35.6201] Country Code US resolved through Proximity

[*05/11/2026 13:13:35.7234] Country US supports 6GHz band. Will switch to split phy mode after reboot.

[*05/11/2026 13:13:35.7670] AP Rebooting: Reset Reason - Country Code Changed

AP online and registered on the 9800 WLC

Client Connectivity

Understanding Cisco CW9172 Day-0 Workflow, Persona Selection, and Fast Offline Migration (FOM) – Part 2