Examkin

Question

Difficulty: MediumWireless Principles and Architecture

A network administrator is troubleshooting an issue where Lightweight Access Points (LAPs) across a WAN link are unable to form control tunnels with the central Wireless LAN Controller (WLC). ICMP reachability between the LAPs and the WLC is verified, but CAPWAP tunnel negotiation fails at the transport layer due to firewall filtering. Which transport protocol and destination port must be permitted on perimeter firewalls to allow CAPWAP control traffic to establish?

  1. UDP port 5246Answer
  2. B
    TCP port 5246
  3. C
    UDP port 5247
  4. D
    TCP port 5247

Answer

UDP port 5246 is required for CAPWAP control traffic between Lightweight Access Points and the Wireless LAN Controller.
The Control and Provisioning of Wireless Access Points (CAPWAP) protocol uses UDP as its transport layer protocol. Specifically, CAPWAP Control messages operate over UDP port 5246 (secured via DTLS), enabling the LAP to join the WLC, receive configuration updates, and exchange management metrics. Permitting UDP port 5246 allows the control channel to initialize successfully.

Step-by-Step Solution

1
Identify the protocol used for Cisco Split-MAC architecture management plane communications.
Lightweight APs use the Control and Provisioning of Wireless Access Points (CAPWAP) protocol to communicate with the WLC.
CAPWAP establishes two distinct tunnels: a control tunnel for AP management/configuration and a data tunnel for encapsulated wireless client traffic.
2
Determine the transport protocol and port numbers assigned to CAPWAP control and data planes.
CAPWAP Control uses UDP port 5246 (secured with DTLS), while CAPWAP Data uses UDP port 5247.
UDP is chosen for lower overhead and real-time processing performance, relying on DTLS for control channel reliability and security.
3
Match the requirement in the scenario to the correct port.
To resolve the control tunnel initialization failure, UDP port 5246 must be allowed through the firewall.
Allowing UDP port 5246 ensures the LAP can perform CAPWAP discovery, join, and configuration state exchanges with the WLC.

Key Concept

CAPWAP Transport Layer Ports (Control vs Data)
Rate this question

Topics

Wireless Principles and Architecture

More questions from this topic