diff --git a/src/ac/config.ktv b/src/ac/config.ktv
index 55454ab8..59dd0978 100644
--- a/src/ac/config.ktv
+++ b/src/ac/config.ktv
@@ -83,9 +83,6 @@ radio.255/admin-state :Str: enabled
 radio.255/operational-state/cause :Str: Normal
 radio.255/operational-state/state :Str: enabled
 
-radio.0/wlan.0/add-lw-wlan/misc :Bstr16: .x3e9904fac0000100
-radio.0/wlan.0/add-lw-wlan/misc2 :Word: 4
-radio.0/wlan.0/add-lw-wlan/ssid :Str: TubeSSID
 
 radio.1/admin-state :Byte: reserved
 radio.1/cisco-multi-domain-capability/first-channel :Word: 36
@@ -105,8 +102,6 @@ radio.1/cisco/multi-domain-capability/first-channel :Word: 36
 radio.1/cisco/multi-domain-capability/max-tx-power-level :Word: 20
 radio.1/cisco/multi-domain-capability/number-of-channels :Word: 4
 radio.1/cisco/multi-domain-capability/reserved :Byte: 1
-radio.1/cisco/tx-power/current-tx-power :Word: 0
-radio.1/cisco/tx-power/reserved :Byte: 1
 radio.1/cisco/wtp-radio-config/beacon-period :Word: 100
 radio.1/cisco/wtp-radio-config/bss-id :Bstr16: .x04fe7f499b90
 radio.1/cisco/wtp-radio-config/cfg-period :Byte: 4
diff --git a/src/ac/wtpman.c b/src/ac/wtpman.c
index 522f57c9..769d1efb 100644
--- a/src/ac/wtpman.c
+++ b/src/ac/wtpman.c
@@ -445,10 +445,18 @@ static void * wtpman_main(void *arg)
 		while (!cw_timer_timeout(timer)) {
 			if (conn->update_cfg != NULL){
 				mavl_t tmp;
+		
+
 				tmp = conn->local_cfg;
 
-				/*conn->local_cfg=conn->update_cfg;*/
-				conn->default_cfg = conn->remote_cfg;
+				mavl_merge(conn->default_cfg, conn->local_cfg);
+				mavl_merge(conn->default_cfg, conn->remote_cfg);
+
+				conn->local_cfg=conn->update_cfg;
+								
+
+
+
 								
 				cw_dbg(DBG_INFO, "Updating WTP %s",sock_addr2str(&conn->addr,sock_buf));
 
diff --git a/src/cw/cw_out_radio_generic_struct.c b/src/cw/cw_out_radio_generic_struct.c
index 6da497d6..de8ab262 100644
--- a/src/cw/cw_out_radio_generic_struct.c
+++ b/src/cw/cw_out_radio_generic_struct.c
@@ -44,13 +44,14 @@ int cw_out_radio_generic_struct(struct cw_ElemHandler * handler, struct cw_ElemH
 
 
 int cw_out_traverse0(struct cw_ElemHandler * handler, struct cw_ElemHandlerParams * params
-			, uint8_t * dst, int i, const char *current, const char * next)
+			, uint8_t * dst, int i, const char *current, const char * next, 
+			int * stack)
 {
 	char *sl;
 	int l;
 	char key[CW_KTV_MAX_KEY_LEN];
-	char tcurrent[CW_KTV_MAX_KEY_LEN];
-	
+	int len;
+	len = 0;
 	
 	sl = strchr(next,'/');
 	if (sl==NULL){
@@ -58,7 +59,25 @@ int cw_out_traverse0(struct cw_ElemHandler * handler, struct cw_ElemHandlerParam
 		sprintf(key,"%s/%s",current,next);
 		result = cw_ktv_base_exists(params->conn->local_cfg,key);
 		if (result != NULL){
+			int offset;
+			int i,l;
+			offset = params->conn->header_len(handler);
 			printf("Yea! We can do it: %s\n",result->key);
+			for (i=0;i<stack[0];i++){
+				printf("I=%i\n",stack[i+1]);
+			}
+			l= cw_ktv_write_struct(params->conn->local_cfg,params->conn->default_cfg, 
+				handler->type,key,dst+offset);
+			
+			printf("Write struct len %i\n",l);
+			
+			l=params->conn->write_header(handler,dst,l);
+			printf("header wr len %d\n",l);
+			if (handler->patch){
+				handler->patch(dst+offset,stack);
+			}
+			
+			return l;
 		}
 		
 		return 0;
@@ -88,28 +107,27 @@ int cw_out_traverse0(struct cw_ElemHandler * handler, struct cw_ElemHandlerParam
 			continue;
 		}
 
-		cw_out_traverse0(handler,params,dst,-1,basekey,next+l+1);
+		stack[0]++;
+		stack[stack[0]]=i;
+		len += cw_out_traverse0(handler,params,dst+len,-1,basekey,next+l+1, stack);
+		printf("Len is now %d\n", len);
 	}
 
 
-
+	return len;
 }
 
 int cw_out_traverse(struct cw_ElemHandler * handler, struct cw_ElemHandlerParams * params
 			, uint8_t * dst)
 
 {
-	int i;
+
 	char current[CW_KTV_MAX_KEY_LEN];
-	i=-1;
-	
+	int stack[10];
+	stack[0]=0;
 
 	current[0]=0;
 	
-	cw_out_traverse0(handler,params,dst,-1,current,handler->key);
-	
-	printf("Hello world\n");
-	exit(0);
-	
+	return cw_out_traverse0(handler,params,dst,-1,current,handler->key, stack);
 }
 
diff --git a/src/cw/cw_type_word.c b/src/cw/cw_type_word.c
index efb68a0d..ed56da3e 100644
--- a/src/cw/cw_type_word.c
+++ b/src/cw/cw_type_word.c
@@ -50,6 +50,19 @@ static const char * get_type_name(cw_KTV_t *data)
 {
 	return CW_TYPE_WORD->name;
 }
+static int cast(cw_KTV_t * data)
+{
+	if (strcmp(data->type->name,CW_TYPE_WORD->name)==0)
+		return 1;
+	if (strcmp(data->type->name,CW_TYPE_STR->name)==0){
+		char *src = data->val.ptr;
+		CW_TYPE_WORD->from_str(data,src);
+		free(src);
+		return 1;
+	}
+	return 0;
+}
+
 
 const struct cw_Type cw_type_word = {
 	"Word",			/* name */
@@ -60,7 +73,8 @@ const struct cw_Type cw_type_word = {
 	from_str,		/* from_str */ 
 	NULL,
 	NULL,
-	get_type_name
+	get_type_name,
+	cast
 	
 };
 
diff --git a/src/cw/mavl.h b/src/cw/mavl.h
index bf061023..77f3d3b6 100644
--- a/src/cw/mavl.h
+++ b/src/cw/mavl.h
@@ -114,7 +114,7 @@ void *mavl_del ( struct mavl *t, const void *data );
 void *mavl_replace ( struct mavl *t, const void *data, int * result );
 void mavl_destroy ( struct mavl *t );
 void mavl_del_all ( struct mavl *t );
-void mavl_merge ( mavl_t m, mavl_t t );
+void mavl_merge ( mavl_t target, mavl_t source );
 void mavlnode_destroy ( struct mavl *t, struct mavlnode *n );
 struct mavlnode *mavlnode_get ( struct mavl *t, void *data );
 struct mavlnode * mavl_get_node_cmp(struct mavl *t ,void *data,
diff --git a/src/cw/mavl_merge.c b/src/cw/mavl_merge.c
index 731a3c6e..c6594faa 100644
--- a/src/cw/mavl_merge.c
+++ b/src/cw/mavl_merge.c
@@ -68,10 +68,10 @@ static void mavl_merge0(mavl_t m, mavl_t t ,struct mavlnode * n)
  * 
  * 
  */ 
-void mavl_merge(mavl_t m, mavl_t t)
+void mavl_merge(mavl_t target, mavl_t source)
 {
-	mavl_merge0(m,t,t->root);		
-	t->root=NULL;
+	mavl_merge0(target,source,source->root);		
+	source->root=NULL;
 }
 
 
diff --git a/src/cw/msgset.h b/src/cw/msgset.h
index 6c391991..fedc2978 100644
--- a/src/cw/msgset.h
+++ b/src/cw/msgset.h
@@ -58,6 +58,7 @@ struct cw_ElemHandler {
 	int (*put)(struct cw_ElemHandler * handler, struct cw_ElemHandlerParams * params, uint8_t * dst);
 
 	int (*mkkey)(const char *pkey, uint8_t*data, int len, char *dst);
+	int (*patch)(uint8_t *dst, void *data );
 
 
 };
diff --git a/src/mod/cisco/cisco_actions_ac.c b/src/mod/cisco/cisco_actions_ac.c
index e0f7e05e..64edfea0 100644
--- a/src/mod/cisco/cisco_actions_ac.c
+++ b/src/mod/cisco/cisco_actions_ac.c
@@ -528,7 +528,13 @@ static int cisoc_add_lwwlan_mkkey(const char *pkey, uint8_t*data, int len, char
 	return 1;
 }
 
-
+static int cisco_patch_add_lwwlan(uint8_t * data, void * st)
+{
+	int * stack = st;
+	cw_set_byte(data,stack[1]);
+	cw_set_byte(data+1, stack[2]);
+	return 0;
+}
 
 
 
@@ -1205,7 +1211,8 @@ static struct cw_ElemHandler handlers73[] = {
 		"radio/wlan/add-lw-wlan",		/* Key */
 		cw_in_generic_struct,			/* get */
 		cw_out_traverse,			/* put */
-		cisoc_add_lwwlan_mkkey
+		cisoc_add_lwwlan_mkkey,
+		cisco_patch_add_lwwlan
 	}
 	,
 
diff --git a/src/wtp/cisco.ktv b/src/wtp/cisco.ktv
index 54fbdcff..d854c6ac 100644
--- a/src/wtp/cisco.ktv
+++ b/src/wtp/cisco.ktv
@@ -10,17 +10,17 @@ ac-descriptor/software/vendor :Dword: 4232704
 ac-descriptor/software/version :Bstr16: .x08007900
 ac-descriptor/station-limit :Word: 1000
 ac-descriptor/stations :Word: 0
-ac-name :Bstr16: CisAC
+ac-name :Bstr16: X1
 ac-name-with-index.0 :Bstr16: tabbe88
 ac-name-with-index.1 :Bstr16: nudelnudel
 ac-name-with-index.2 :Bstr16: nadelnalde
 ac-name-with-priority/X1 :Byte: 3
 ac-name-with-priority/ac2 :Byte: 5
-capwap-control-ip-address/address.0 :IPAddress: 192.168.0.180
-capwap-control-ip-address/address.1 :IPAddress: 192.168.0.180
+capwap-control-ip-address/address.0 :IPAddress: 192.168.0.14
+capwap-control-ip-address/address.1 :IPAddress: 192.168.0.14
 capwap-control-ip-address/address.2 :IPAddress: 192.168.0.173
-capwap-control-ip-address/wtps.0 :Word: 1
-capwap-control-ip-address/wtps.1 :Word: 1
+capwap-control-ip-address/wtps.0 :Word: 2
+capwap-control-ip-address/wtps.1 :Word: 2
 capwap-control-ip-address/wtps.2 :Word: 1
 capwap-local-ip-address :IPAddress: 192.168.0.14
 capwap-timers/echo-interval :Byte: 30
@@ -61,7 +61,7 @@ cisco/ap-regulatory-domain.1/slot :Byte: 1
 cisco/ap-sub-mode :Byte: 0
 cisco/ap-telnet-ssh/ssh :Bool: false
 cisco/ap-telnet-ssh/telnet :Bool: false
-cisco/ap-timesync/timestamp :Dword: 1526767373
+cisco/ap-timesync/timestamp :Dword: 1526887622
 cisco/ap-timesync/type :Byte: 0
 cisco/ap-username-and-password/802.1x-credentials/option :Word: 2
 cisco/ap-username-and-password/802.1x-credentials/password :Str: 
@@ -152,7 +152,7 @@ radio.0/cisco/wtp-radio-config/cfg-period :Byte: 4
 radio.0/cisco/wtp-radio-config/cfg-type :Byte: 1
 radio.0/cisco/wtp-radio-config/cfp-maximum-duration :Word: 60
 radio.0/cisco/wtp-radio-config/country-str1 :Str: DE
-radio.0/cisco/wtp-radio-config/country-str2 :Str: DE 
+radio.0/cisco/wtp-radio-config/country-str2 :Str: DE
 radio.0/cisco/wtp-radio-config/gpr-period :Byte: 10
 radio.0/cisco/wtp-radio-config/max-stations :Byte: 200
 radio.0/cisco/wtp-radio-config/occupancy-limit :Word: 100
@@ -160,8 +160,11 @@ radio.0/cisco/wtp-radio-config/reg :Dword: 65536
 radio.0/cisco/wtp-radio-config/unknown75 :Byte: 0
 radio.0/decryption-error-report-period :Word: 120
 radio.0/operational-state/cause :Byte: Normal
-radio.0/operational-state/state :Byte: enabled
+radio.0/operational-state/state :Byte: 0
 radio.0/rate_set :Bstr16: .x82848b960c1218243048606c
+radio.0/wlan.0/add-lw-wlan/misc :Bstr16: .x3e9904fac0000100
+radio.0/wlan.0/add-lw-wlan/misc2 :Word: 4
+radio.0/wlan.0/add-lw-wlan/ssid :Str: TubeSSID
 radio.0/wlan.0/allow-aaa-override :Byte: 0
 radio.0/wlan.0/broadcast-ssid :Bool: true
 radio.0/wlan.0/dtim-period :Byte: 1
@@ -201,7 +204,7 @@ radio.1/cisco/wtp-radio-config/cfg-period :Byte: 4
 radio.1/cisco/wtp-radio-config/cfg-type :Byte: 1
 radio.1/cisco/wtp-radio-config/cfp-maximum-duration :Word: 60
 radio.1/cisco/wtp-radio-config/country-str1 :Str: DE
-radio.1/cisco/wtp-radio-config/country-str2 :Str: DE 
+radio.1/cisco/wtp-radio-config/country-str2 :Str: DE
 radio.1/cisco/wtp-radio-config/gpr-period :Byte: 10
 radio.1/cisco/wtp-radio-config/max-stations :Byte: 200
 radio.1/cisco/wtp-radio-config/occupancy-limit :Word: 100
@@ -209,7 +212,7 @@ radio.1/cisco/wtp-radio-config/reg :Dword: 65536
 radio.1/cisco/wtp-radio-config/unknown75 :Byte: 1
 radio.1/decryption-error-report-period :Word: 120
 radio.1/operational-state/cause :Byte: Normal
-radio.1/operational-state/state :Byte: enabled
+radio.1/operational-state/state :Byte: 0
 radio.1/rate_set :Bstr16: .x8c129824b048606c
 radio.1/wlan.0/add-lw-wlan/misc :Bstr16: .x3e9904fac0000100
 radio.1/wlan.0/add-lw-wlan/misc2 :Word: 4
@@ -242,7 +245,7 @@ radio.3/cisco/rad-extended-config/c-ccat :Word: 1
 radio.3/cisco/rad-extended-config/multicast-buffer :Word: 0
 radio.3/cisco/rad-extended-config/multicast-data-range :Word: 0
 radio.3/cisco/rad-extended-config/rx-sensop-threshold :Word: 0
-radio.255/admin-state :Byte: reserved
+radio.255/admin-state :Byte: enabled
 radio.255/operational-state/cause :Byte: Normal
 radio.255/operational-state/state :Byte: enabled
 radio/0/cisco/regulatory-domain/code0 :Byte: 0