Yeah that one thing I was considering, change the DNS entry and issue clear ap-config

They said they had they had tried this when I last spoke to them but I doubt it !

How about changing the primary controller entry for each AP. It is simply an IP address and controller name.

The problem with this is that I believe the controllers need to be in the same mobility group for this to work (but I may be wrong?).

That doesnt seem to work with telnet, because the ap's are still connected to the controller they get "ERROR!!! Command is disabled". And through the GUI I think it has to be the controller by name when they are in the same mobility group.

The only reason it wouldn't work was if there was some other method in place for controller discovery (like DHCP options).

Well obviously there could be routing/firewall measure in place in the WAN preventing the AP traffic from going to other networks, but I'm guessing this has already been adressed if it was a problem.

Yes if you wipe the config. But if you simply reboot the AP with a new primary it should redirect to the primary. Again, I'd have to look at code version you're running but try it on one AP and see what happens. Apply the new primary and reboot the AP. It will either work or fail. If it fails it will fall back to the original controller. Make sure all applicable ports are open and routes to the other controller are established.

You can either clear the configuration like they mentioned above or if you want to telnet or ssh to the ap then you need to assign a username and password and allow telnet or ssh:

config ap username password

Telnet:

config ap telnet enable

SSH:

config ap ssh enable