That is the only command required if you want to enable secure mobility.  So UPD port 16667 will need to be allowed, but 16666 doesn't need to be since you are using secure mobility.  Now depending on how your setup, you will need other ports allowed if required:

Q. What ports do I need to permit for Lightweight Access Point Protocol (LWAPP) communication when there is a firewall in the network?

A. You must enable these ports:

• Enable these UDP ports for LWAPP traffic:

  • Data - 12222

  • Control - 12223

• Enable these UDP ports for Mobility traffic:

  • 16666 - Secured Mode

  • 16667 - Unsecured Mode

Mobility and data messages are usually exchanged through EtherIP packets. IP protocol 97 must be allowed on the firewall to allow EtherIP packets. If you use ESP to encapsulate mobility packets, you have to permit ISAKMP through the firewall when you open UDP port 500. You also have to open the IP protocol 50 to allow the encrypted data to pass through the firewall.

These ports are optional (depending on your requirements):

• TCP 161 and 162 for SNMP (for the Wireless Control System [WCS])

• UDP 69 for TFTP

• TCP 80 and/or 443 for HTTP or HTTPS for GUI access

• TCP 23 and/or 22 for Telnet or secure shell (SSH) for CLI access