Upcoming Maintenance Alert:

The UBNT Community will be upgraded at 5pm MDT on April 25th. During this time the community forums will be set to read-only status.

Learn more

×
Reply
New Member
Posts: 12
Registered: ‎12-11-2013

Re: HOWTO: Unbrick your UniFi AP

hi you can try using TFTP2.exe to upload and rewrite the firmware , 

Press and hold reset button and power on device  till it reaches TFTP mode, green/orange led starts blinking, HIT upload button in TFTP2.EXE , wait till device finish writing and reboot . this worked for me and i have recovered few APs . find attached firmware 2.4.6 for UAP , UAP-LR  this is a very stable version which worked for me . 

New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Hi amit_rastogi
I tried tftp from dos, tftpgui, pumpkin and none are transfering bin file..My device enter tftp mode just fine (using button)
showing waiting for connection in serial console, but none are transfering file (BZ.ar7240.v3.7.40.6115.170208.1059). ..
where is attached firmware 2.4.6 for UAP ? I will try tftp2

In my understanding...tftp need lan connection to ubnt unit..so it has to be pingable at some level
I cant ven ping my own ip (1.20) on uboot

 

 

com42_4.jpg
com42_3.jpg
New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

I tried verbose mode in uboot..but I dont understand anything....Mad2

Attached is the full log 

 

I can login on putty console (not web not ssh) now and I can ping 1.20 ; but i cant ping any other host from putty console ; and I cant ping 1.20 from the network
At the end its just doing looping device is down ...so do I need to take it to repairement ? Is it hardware problem as I suspected or something else...?

 

Here's is the loop log

[ 610.541000] br0: port 2(ath0) entering disabled state
[ 612.345000] br0: port 2(ath0) entering learning state
[ 613.350000] br0: port 2(ath0) entering forwarding state
[ 613.678000] ieee80211_ioctl_getparam : parameter 0x284 not supported
[ 613.722000] DEVICE IS DOWN ifname=ath1
[ 613.731000] DEVICE IS DOWN ifname=ath1
[ 613.744000] br0: port 2(ath0) entering disabled state
[ 614.317000] br0: port 2(ath0) entering learning state
 

 

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: HOWTO: Unbrick your UniFi AP

Start with a couple of basics.

 

where the AP plugs into the switch, does the light show up to indicate a connection ?

 

Does the AP show up in the management console ?

 

What is the actual problem you are trying to solve?

New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Hi @

 

 

 

 

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: HOWTO: Unbrick your UniFi AP

The management console is the applet used to adopt the AP.

With you saying adoption failed, that must mean its apeared there which would usually suggest that it isnt bricked.

Is this a brand new AP or one from another enviroment you've aquired?
New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

Oh.. so thats call management console.. Than its good news for me it's not bricked.

Its from another environment...I already reset it many times.
Tried within dhcp server network at boot (orange solid), booting (blinking orange)..the unplug lan thing..tried statis ip also...none are working.
My dhcp server log shows offer ip but unify doesnt seem to respond to it.
Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: HOWTO: Unbrick your UniFi AP



Its from another environment...I already reset it many times.


That makes far more sense, If you dont know the password to adopt it then you wont be able to adopt it using the interface. You'll need to factory reset using the following proceedure.

 

  1. Power up the UAP and leave a minute or so to settle.
  2. Press and hold the reset button for 10 seconds
  3. Release the button (the LEDs on the UAP will stop glowing)
  4. Do not disconnect the UAP from its POE injector during the reboot process
  5. The UAP will restore factory settings
  6. Wait for it to stop flashing orange and go steady.
  7. Wait for it to show up on the console and then adopt it.

 

No. 4 is very important, if you remove the power then you can run the risk of damaging the config and or bricking the unit.

 

New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

Hi @stevebird as I said earlier ...I already reset it many times...using normal procedure (as your suggestion), using unplug lan method by @azimmerman and none are working. But I'm doing it again to give you a screenshoot. Any other idea @stevebird ?

 

-----------------------

 

I tried something today on uboot but still have no good result. Still cant tftp, cant ping, cant adopt

bdinfo
boot_params = 0x83F53FB0
memstart    = 0x80000000
memsize     = 0x04000000
flashstart  = 0x9F000000
flashsize   = 0x00800000
flashoffset = 0x000320D0
ethaddr     = 00:00:00:00:00:00 
ip_addr     = 192.168.1.20
baudrate    = 115200 bps

I believe my ethernet mac address is  24:a4:3c:0e:4d:3d and eth0 is 00:03:7F:11:20:00 but I cant find it printed on motherboard.

 

ifconfig
ath0      Link encap:Ethernet  HWaddr 24:A4:3C:0F:4D:3D
          UP BROADCAST RUNNING PROMISC ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:150 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br0       Link encap:Ethernet  HWaddr 00:03:7F:11:20:00
          inet addr:192.168.1.20  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:91 errors:0 dropped:0 overruns:0 frame:0
          TX packets:91 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:26061 (25.4 KiB)  TX bytes:27335 (26.6 KiB)

eth0      Link encap:Ethernet  HWaddr 00:03:7F:11:20:00
          UP BROADCAST RUNNING PROMISC ALLMULTI MULTICAST  MTU:1500  Metric:1
          RX packets:91 errors:0 dropped:0 overruns:0 frame:0
          TX packets:91 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:27699 (27.0 KiB)  TX bytes:27699 (27.0 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:68 errors:0 dropped:0 overruns:0 frame:0
          TX packets:68 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:4450 (4.3 KiB)  TX bytes:4450 (4.3 KiB)

wifi0     Link encap:UNSPEC  HWaddr 24-A4-3C-0F-4D-3D-00-4C-00-00-00-00-00-00-00-00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1366 errors:9759 dropped:0 overruns:0 frame:9759
          TX packets:2786 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:4095
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)
          Interrupt:48 Memory:b0000000-b0010000

I change mac address to atho mac 24:a4:3c:0e:4d:3d and also to eth0 mac 00:03:7F:11:20:00

setenv ethaddr 24:a4:3c:0e:4d:3d
saveenv
reset

the change is good (ethaddr shows =  24:a4:3c:0e:4d:3d and 00:03:7F:11:20:00 on bdinfo), sorry forgot to copy bdinfo for 24:a4:3c:0e:4d:3d

ar7240> bdinfo
boot_params = 0x83F53FB0
memstart    = 0x80000000
memsize     = 0x04000000
flashstart  = 0x9F000000
flashsize   = 0x00800000
flashoffset = 0x000320D0
ethaddr     = 00:03:7F:11:20:00
ip_addr     = 192.168.1.20
baudrate    = 115200 bps

but no effect on adoption and tftp, and serial console still also displaying looping session 

[ 610.541000] br0: port 2(ath0) entering disabled state
[ 612.345000] br0: port 2(ath0) entering learning state
[ 613.350000] br0: port 2(ath0) entering forwarding state
[ 613.678000] ieee80211_ioctl_getparam : parameter 0x284 not supported
[ 613.722000] DEVICE IS DOWN ifname=ath1
[ 613.731000] DEVICE IS DOWN ifname=ath1
[ 613.744000] br0: port 2(ath0) entering disabled state
[ 614.317000] br0: port 2(ath0) entering learning state

 

I also tried " mtdparts default " thats result in showing mac address of 00:03:7F:11:20:00 on bdinfo

mangemnt console.jpg
New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Im stuck...I will turn off UAP now, unplug usb ttl and waiting for any input....

 

After "mtdparts default" my mac change to 00:03:7f:11:20:00 (showed in managment console), but the problem still : cant adopt it, cant ping it, did not accept ip from dhcp. And now I can not change mac address on uboot

Can't overwrite "ethaddr", tried progmac but no change.

 

I also notice something on mangement console : it shows 2 different version ( this is the same unify uap)

I attached the ss ..and the uboot imls result

ar7240> imls
Image at 9F050000:
   Image Name:   MIPS Ubiquiti Linux-2.6.32.33
   Created:      2017-03-15  18:15:50 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    921625 Bytes = 900 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum ... OK

 

2software copy.jpg
Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

If I were you, I would stop messing about in the UBOOT options before you permantly cause damage to your AP.

Your problem is what you said before that it came from another enviroment and you dont know the password, this is why it will not adopt. there is probably nothing wrong with the AP other than its security preventing you adopting it.

If you cannot ask the people it came from for the password, then follow the instructions posted above to factory reset the AP back to defaults and then it will adopt using the propper method. Messing about in the UBOOT options and re-writing firmward via the unbricking methods will not solve your problem.

 

If you are in the UK and want to send it to me, then I can give it some workshop time and factory reset it or recover it using the methord I've posted in other threads. I dont charge much for my time.

New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Thanks for your advice @stevebird.
I think I will leave it for now and send it to repair ..I'm not in UK. Postal service to UK is about 35 USD, so I think send it to you is not an option.

I also have different opinion from you about my device. It did enter factory default state everytime I reset it. In my previous post (screenshot : management console ) shows that it does in factory default state but its turn to unreachable if I "set inform".

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: HOWTO: Unbrick your UniFi AP

You dont use the set inform option unless the management server isnt on the same lan, which you have already shown that it is.

 

You are trying to solve a problem you dont have using a method that is used to recover bricked AP's which everything you have already said suggestes that yours isnt.

 

I dont really think the AP is faulty or at least it wasnt when you first started posting. I think the problem was that you're not following the manual when it comes to adopting the AP into the console.

 

Good luck..

New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

Thank You @stevebird. I dunno if I did break my unify. Or as you said its not broke at the begining. By the time I start the post is about 20-30 times I already reset the unit. I did not know my actual problem was...
So here is in chronological order.

I ve got 4 unify unit, reset them all to test. 3 of them reset just fine, ip assigned by dhcp server and receive by 3 of them. I adopt and set the 3 unify within minutes.

The 1 unit with problem is that...IP shows 1.20 no matter what. I set it static tp 1.22 still shows 1.20. Revert back to dhcp and change dhcp range, change dhcp server etc still shows ip 1.20. Tried to ping it...unreachable. Cant adopt it, said adoption failure. Reset it many times but it still the same. The unify discovery ss is to show you that it did enter default factory

Then I moved to tftp method and monitor it using serial console. It did enter tftp mode...waiting for connection..but I still cant transfer bin to it. It still cant be ping

I thinks its clear enough
-------

If I used set inform on the same lan, what is supposed to happen ?
Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: HOWTO: Unbrick your UniFi AP



I thinks its clear enough


Not very clear unfortunantly.

 

Have you tried the proceedure described here - https://help.ubnt.com/hc/en-us/articles/204911324-airMAX-How-to-reset-your-device-with-TFTP-firmware... thats for airmax but the process is the same.

 

I think things started going wrong when you directly connected and started messing about with the UBoot settings. These AP's are a really good product and usually very stable. bricking usually occours when people mess about with the settings via serial console, change the firmware or an upgrade goes wrong.

 

dont forget to configure the computer, thats a very important and key part.

New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

Sorry its been a while Im not monitoring suggestion from this thread...

Hi @stevebird Yes. I tried TFTP. If you check my previous ss you can see that I did.

 

Btw..I ve got news from repairement that my processor or NPU IC (network processing unit) is broken and need to be replaced. Its back on and adoptable..It cost about 25 USD. So its hardware issue...

 

thanks all

New Member
Posts: 2
Registered: ‎04-23-2017

Re: HOWTO: Unbrick your UniFi AP

Hello!

 

I have an UAP. "urescue" command not working, only tftpboot. I need  to write partitions manually, but I haven't got them.

Anyone can help me?

The bootloader date is 2017. febr.

Very Thanks!

New Member
Posts: 16
Registered: ‎03-28-2017

Re: HOWTO: Unbrick your UniFi AP

If you're not sure dont do it and keep searching the forum. I m not really sure what you re intention are.

First thing first...can you ping unifi AP IP ?

If you issued urescue on uboot and it did not enter tftp mode (as I did experienced before...you can check my ss), you can try tftp mode using button method (prefered than urescue...you dont need to open the case and you warranty is intact).

If you in tftp mode and you need to write default partiotion (you can check my previous ss) you can issued mtparts default. Dwyor.

Emerging Member
Posts: 48
Registered: ‎03-09-2014
Kudos: 14

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

I wrote this in another thread some time ago and its buried now, so here it is again for people trying to unbrick. Its the whole process. I still write the old version partitions and then do an upgrade to current but the process would be the same if you had the new partitions to hand.

 

Below is the output of my TTL Serial console connected to the Unify

 

** BE CAREFUL You can make the situation worse than it already is by miss typing the commands, getting a memory address wrong etc.. ** BE CAREFUL ** (Worth saying twice) And remember your results may vary to mine. I have sucuessfully recovered eleven unify's that would not recover via the urescue process using the below.

Board: Ubiquiti Networks AR7241 board (e502-6.0101.002e)
DRAM:  64 MB
Flash:  8 MB
*** Warning - bad CRC, using default environment

***           saving default environment ...
Un-Protected 1 sectors
Erasing Flash.... done
Erased 1 sectors
Writing to Flash... write addr: 9f040000
done
Protected 1 sectors
Net:   eth0, eth1
Hit any key to stop autoboot:  0
## Booting image at 9f050000 ...
   Image Name:   MIPS Ubiquiti Linux-2.6.15-5.2
   Created:      2012-02-24  16:55:55 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    730087 Bytes = 713 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum at 0x9f050040 ...Bad Data CRC

ar7240> mtdparts default
ar7240> saveenv
Saving Environment to Flash...
Un-Protected 1 sectors
Erasing Flash.... done
Erased 1 sectors
Writing to Flash... write addr: 9f040000
done
Protected 1 sectors
ar7240> tftp 83000000 3.2.10.2886/mtdblock2
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename '3.2.10.2886/mtdblock2'.
Load address: 0x83000000
Loading: #################################################################
         #################################################################
         #################################################################
         ##########
done
Bytes transferred = 1048576 (100000 hex)
ar7240> protect off all
Un-Protect Flash Bank # 1
ar7240> erase 0x9f050000 +0x100000
................ done
Erased 16 sectors
ar7240> cp.b 0x83000000 0x9f050000 0x100000
Copy to Flash... write addr: 9f050000
done
ar7240> cmp.b 0x83000000 0x9f050000 0x100000
Total of 1048576 bytes were the same
ar7240> tftp 83000000 3.2.10.2886/mtdblock3
Using eth0 device
TFTP from server 192.168.1.254; our IP address is 192.168.1.20
Filename '3.2.10.2886/mtdblock3'.
Load address: 0x83000000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         #################################################################
         ######
done
Bytes transferred = 6684672 (660000 hex)
ar7240> erase 0x9f150000 +0x660000
...................................................................................................... done
Erased 102 sectors
ar7240> cp.b 0x83000000 0x9f150000 0x660000
Copy to Flash... write addr: 9f150000
done
ar7240> cmp.b 0x83000000 0x9f150000 0x660000
Total of 6684672 bytes were the same
ar7240>
ar7240> reset

Resetting...

U-Boot unifi-v1.2.1.71-g529c499d (Dec 21 2012 - 12:50:21)

Board: Ubiquiti Networks AR7241 board (e502-6.0101.002e)
DRAM:  64 MB
Flash:  8 MB
*** Warning - bad CRC, using default environment

***           saving default environment ...
Un-Protected 1 sectors
Erasing Flash.... done
Erased 1 sectors
Writing to Flash... write addr: 9f040000
done
Protected 1 sectors
Net:   eth0, eth1
Hit any key to stop autoboot:  0
## Booting image at 9f050000 ...
   Image Name:   MIPS Ubiquiti Linux-2.6.15-5.2
   Created:      2013-10-08  18:37:43 UTC
   Image Type:   MIPS Linux Kernel Image (lzma compressed)
   Data Size:    729748 Bytes = 712.6 kB
   Load Address: 80002000
   Entry Point:  80002000
   Verifying Checksum at 0x9f050040 ...OK
   Uncompressing Kernel Image ... OK

Starting kernel ...

Booting...

And from then on its accessable again from the regular Unifi web interface.


I've invested time in reading about U-Boot and what commands were available and knowing linux and networking already, together with programming knowledge this is how I have bought it all together to transfer the parts of the image nessasary and write then directly,

What you will also need is the seperate parts of the NAND flash that make up the whole filing system, I only used the kernel and rootfs parts though. You will also need a working tftp server for the unify to pull the partitions from, but you'll probably have this already since you've tried the urescrue and found it not to work.


To get the working partitions you'll need another working unify that you can ssh into and then extract from and copy to your tftp server ready to be transfered.

I've attached 3.2.10.2886 here, this works and then once you've adopted the AP just do a regular update.

Attachment
New Member
Posts: 2
Registered: ‎04-23-2017

Re: HOWTO: Unbrick your UniFi AP

[ Edited ]

Thank You!

That's what I needed. Man Happy

This device is out of warranty, and probably has hardware failure.

The first thing was "adoption failure", thereafter I take a firmware upgrade and looks like OK, but now this fail happened again.

I typed the commands above, but now tftpboot, tftp commands not working.

I discovered that the MAC address was set to 00:00:00:00:00:00, so I reset it with the setenv ethaddr command, now bdinfo shows the correct MAC, but the urescue, tftpboot, tftp commands still not working.

Since I reset the MAC, the AP automatically run the urescue mode, but not accepting files.

When I ping the TFTP server address, I get this:

 

ar7240> ping 192.168.1.254
Using eth0 device
ping failed; host 192.168.1.254 is not alive
ar7240>

 

Meanwhile I successfully erased the mtdblock2 so can't booting.

Seems like the ethernet controller is dying.

Help command not listing serial transfer availability e.g. ZMODEM.

Any idea what I need to try, or I need put in to trash?

Reply