Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Firewall blocking lightweight access points?

Unanswered Question
May 4th, 2009
User Badges:

I have 3 access points that I recently converted to LWAPP. After the conversion, all 3 AP's are now MIA - no sign of them in WCS or on any of our controllers. I can trace them back to the switch that they are directly connected to and they do pull a DHCP address. I found this on the firewall:

May 04 2009 16:39:58: %ASA-7-710005: UDP request discarded from <AP's ip>/26586 to inside:

I am wondering if there is something on the firewall that is blocking the requests from the AP's to join the controller.

Any thoughts?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
rjaaouan Tue, 05/05/2009 - 01:56
User Badges:
  • Cisco Employee,


When you turn on a LWAAP AP, he start descovering a DHCP server to get a an IP Address,and TFTP server to get his configuration. the LWAAP tunnel use some UDP port, and I think that you should allow them in your firewall.

A. Follow these guidelines when you use CAPWAP:

If your firewall is currently configured to allow traffic only from access points that use LWAPP, you must change the rules of the firewall to allow traffic from access points that use CAPWAP.

Make sure that the CAPWAP UDP ports 5246 and 5247 (similar to the LWAPP UDP ports 12222 and 12223) are enabled and are not blocked by an intermediate device that could prevent an access point from joining the controller.

If access control lists (ACLs) are in the control path between the controller and its access points, you need to open new protocol ports to prevent access points from being stranded.

more info: http://www.cisco.com/en/US/products/ps6366/products_qanda_item09186a008064a991.shtml

I hope it's useful,

from a Future CCSP

[email protected]


vancamt76 Tue, 05/05/2009 - 07:26
User Badges:

I appreciate any assistance as sometimes we tend to overthink the obvious. We opened the firewall for IP from /8 to each Ap's ip that should cover those 2 ports.


This Discussion