topic CAPWAP Though NAT (AP Side and Controller Side) in Wireless

CAPWAP Though NAT (AP Side and Controller Side)

rgreville666 — Mon, 05 Jul 2021 17:49:53 GMT

Hi,

I’m working on a design at the moment where the customer runs a Zero Trust model, The customer has multiple sites with no WAN. All traffic is Internet based towards there cloud provider where they run SAML aware proxies to permit access to their applications. They are cloud heavy and have no on-prem services.

Meraki works well for them to provide untrusted WiFi access, however we have a situation where I need to run Aireos /IOSXE on one of the sites due to the high density and feature requirements.

Is it possible for the AP to be behind NAT (option 43 on the router pointing towards a Public IP) and in the cloud environment NAT the Public IP to the MGMT interface of the controller, controller configured for FLEX (9800 Controller).

I’ve tested this and can see in the DTLS packet the controller is returning its real address and hence the AP doesn’t register as it doesn’t have routing access to the RFC1918 address the controller is on.

Thanks

Re: CAPWAP Though NAT (AP Side and Controller Side)

patoberli — Fri, 09 Aug 2019 09:35:40 GMT

Not sure if this is possible. Is the AP for OEAP configured? That is in the AP configuration under FlexConnect and named "Enable OfficeExtend AP" (at least on the 8.5.x code for the 5520).
Have you configured the public facing IP address on the AP under High Availability (plus the WLC name as configured under Controller -General - Name).
If that doesn't work, you probably need a VPN between the sites, but I think it should work.

Also check this: https://community.cisco.com/t5/other-wireless-mobility-subjects/wlc-nat-feature-problem-for-oeap/td-p/2632340

Re: CAPWAP Though NAT (AP Side and Controller Side)

rgreville666 — Fri, 09 Aug 2019 09:57:51 GMT

Hi, Thanks for the reply. This is on a 9800 IOSXE controller.. I think this is what im looking for.. "config network ap-discovery nat-ip-only" I can't seem to find that on the new controller.

Thanks

Re: CAPWAP Though NAT (AP Side and Controller Side)

patoberli — Fri, 09 Aug 2019 10:38:59 GMT

In that case, I suggest to open a TAC, the 9800 platform is still very new and doesn't yet have all features of the AireOS controllers.

Re: CAPWAP Though NAT (AP Side and Controller Side)

Rich R — Fri, 09 Aug 2019 13:25:01 GMT

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/release-notes/rn-16-10-9800.html

Guidelines and Restrictions

Software

AP connection over network address translation (NAT) and port address translation (PAT) is not supported.
Mobility NAT is not supported.