Wow. I tried provisioning for R300 with 100 and 104 and SZ100 with 3.6.x in this morning.
Command for provision was "set director ip".
Ap was failed upgrade in intial provisioning step.
AP tried tcp 21 port and pasv port , and it works good.
But AP's upgrade was failed finally.
I'll also try it on ap with 1000 sz100 with 3.5.
If all test is failed, it may ap's provison must use "set scg ip".