Aerohive AP121 - Installing OpenWRT

After more than 10 years in use and licensing issues we decided to replace our WiFi installation consisting of about 40 Aerohive AP121 newer models.

Because all APs are still able to work, we thought about the future use of our devices. As we already use a lot of open source software, we thought it would be nice if also our APs are running with Linux and this is actually possible with OpenWRT!

Concerning hardware the OpenWRT wiki says:

• a working Aerohive AP121
• Cisco Console Cable (RJ45 - DB9 Serial - NOTE: As most PC's don't have RS232 DB9 connectors anymore, we used a RJ45 - USB [via FTDI232RL+ZT213LEEA chips] Console cable.)
• 802.3af Gigabit PoE adapter (for powering the AP)
• Alternatively Centre Positive Barrel Jack 12v 2A DC Power Supply (The AP121 is Center Positive! I could not find this information anywhere, all of the “official” DC 12v Power Supplies for Aerohive had the Jack wiring label scratched off…) (The AP121 is rated for 1.1A - according to whats printed on the case, but I used 1A & 2A supply with no issues)
• RJ45 Network Cable
• PC/Laptop with USB and RJ45 Network Port (Cannot be done over Wi-Fi, ie netbooks)

Firstly confirm that the AP you want to flash OpenWRT on has one of the following firmware versions:

• v1.0.0.33
• v1.0.0.43 (supplied with HiveOS 6.2r1)
• v1.0.0.4f (supplied with HiveOS 6.5r4)
• v1.0.0.50 (supplied with HiveOS 6.5r3)
• v1.0.0.52 (supplied with HiveOS 6.5r8b)

You can either do this via the serial console which is also required later, or more easy within your old HiveManager.

Bootloader versions v1.0.0.25 and lower have been reported to fail!

To host the image for the AP we going to use a TFTP-Server: you can either use Pumpkin TFTP, TFTPD64 or SolarWind's TFTP-Server.

• klever.net - Pumpkin TFTP (recommended)
• github.io - TFTPD64
• solarwinds.com - Free TFTP-Server

We also need a serial console terminal: here PuTTY:

• putty.org

And the OpenWRT image for the AP: Therefore open this URL: downloads.openwrt.org/releases/ select the release to install and then navigate to <version>/targets/ath79/nand. There should be an image named aerohive_hiveap-121-squashfs-factory.bin. Use the factory-image for firsttime install, not the sysupgrade-image.

1. Set 192.168.1.10 with netmask 255.255.255.0 as static ip for the RJ45-interface of the PC you want to use.
2. Install PuTTY and the TFTP-Server. Configure the TFTP-Server to host the OpenWRT-image. In case you used the PumpKIN-TFTP-Server: After installing, the TFTP-Server will be started by starting the following executeable: C:\Program Files\Klever\Nothings\PumpKIN.exe. Select Options and set the root path to the directory where the OpenWRT-image was saved. It's recommended to rename the image file to something more simple like openwrt.bin because this makes it easier to type the name into the console later.
3. Then connect your AP with a Laptop or any PC as following but do not power on the PoE-injector/power supply yet: Show/Hide Image
4. Open the Device Manager and select Ports, there you should see an interface like COM1 or COM3. Select this interface in PuTTY as it is your serial cable to the AP.
5. In PuTTY select Serial, type in the Serial line (e.g. COM1) and set the speed/baudrate to 9600. Then open the connection.
6. Finally power on the injector.
7. You should now see the boot process of the AP. Interrupt it by hitting any key. When getting asked for a password either try AhNf?d@ta06 or administrator. Here to copy:

   AhNf?d@ta06

8. Then verify the firmware version again with, if it prints something higher as v1.0.0.25 everything is ok:

   version

9. After that transfer the firmware file, replace <name-of-firmware-image> with openwrt.bin or the name you gave the firmware file:

   tftpboot 0x81000000 <name-of-firmware-image>

10. If using PumpkinTFTP and the TFTP-client on the AP can find the image on the server, a pop-up will appear. Accept the transfer and the firmware will be transferred.
11. Then erase the NAND-flash to make the way free for OpenWRT:

    nand erase 0x800000 0x7400000

    Command Breakdown: 0x800000 is the flash memory address in the Access Point. 0x7400000 is the filesize. This is important later.
12. Now write the image to the NAND:

    nand write 0x81000000 0x800000 0x7400000

    Command Breakdown: 0x8100000 is the memory address that the OpenWRT image is stored in. 0x800000 is the flash memory address for the Access Point. 0x7400000 is the filesize.
13. If both commands ran successfully reboot by typing:

    reset

    During first reboot, if the AP was booting via its secondary backup flash chip located at 0xd00000 then the boot may fail with a Bad Magic number error. Do not panic, allow the boot process to fail 3 times, after which the AP will then default to booting from 0x800000 and should boot OpenWRT Normally.

14. During boot watch for the orange light to turn flashing white. This means the boot process is occuring, monitor the console for errors. If the LED turns solid white then the AP has successfully booted - this may take 90s or more.
15. Finally you can navigate to 192.168.1.1 it should load the LuCI-webinterface of OpenWRT. The default password for OpenWRT is passwd.

1. Under Network > Wireless you can change the WiFi/Network config.
2. To set the AP to DHCP on the ethernet port navigate to Network > Interfaces, edit br-lan and change the protocol to DHCP. Additionally disable the firewall by switching to the Firewall-tab and under Create/Assign firewall zone select unspecified. Then press Save and Apply

For troubleshooting and more information check the OpenWRT wiki: openwrt.org - AP121 or visit github.com - NWSpitfire - AP121 OpenWRT Install from which some parts of this tutorial are sourced.

It might also be possible to flash OpenWRT on AP122, but we haven't tested this yet:

github.com - Aerohacking - AP122

Also have a look at other tutorials concerning Aerohive and OpenWRT:

Sources used:

• openwrt.org - Aerohive AP121/HiveAP 121
• github.com - NWSpitfire - AP121 OpenWRT Install