topic Re: Firewall blocking lightweight access points? in Network Security

Firewall blocking lightweight access points?

vancamt76 — Mon, 11 Mar 2019 15:27:20 GMT

I have 3 access points that I recently converted to LWAPP. After the conversion, all 3 AP's are now MIA - no sign of them in WCS or on any of our controllers. I can trace them back to the switch that they are directly connected to and they do pull a DHCP address. I found this on the firewall:

May 04 2009 16:39:58: %ASA-7-710005: UDP request discarded from <AP's ip>/26586 to inside:255.255.255.255/12223

I am wondering if there is something on the firewall that is blocking the requests from the AP's to join the controller.

Any thoughts?

Re: Firewall blocking lightweight access points?

rjaaouan — Tue, 05 May 2009 08:56:55 GMT

Hi,

When you turn on a LWAAP AP, he start descovering a DHCP server to get a an IP Address,and TFTP server to get his configuration. the LWAAP tunnel use some UDP port, and I think that you should allow them in your firewall.

A. Follow these guidelines when you use CAPWAP:

If your firewall is currently configured to allow traffic only from access points that use LWAPP, you must change the rules of the firewall to allow traffic from access points that use CAPWAP.

Make sure that the CAPWAP UDP ports 5246 and 5247 (similar to the LWAPP UDP ports 12222 and 12223) are enabled and are not blocked by an intermediate device that could prevent an access point from joining the controller.

If access control lists (ACLs) are in the control path between the controller and its access points, you need to open new protocol ports to prevent access points from being stranded.

more info: http://www.cisco.com/en/US/products/ps6366/products_qanda_item09186a008064a991.shtml

I hope it's useful,

from a Future CCSP

j.reda7@gmail.com

Reda

Re: Firewall blocking lightweight access points?

vancamt76 — Tue, 05 May 2009 14:26:16 GMT

I appreciate any assistance as sometimes we tend to overthink the obvious. We opened the firewall for IP from 10.0.0.0 /8 to each Ap's ip that should cover those 2 ports.