topic Re: Data path down control path up issue in Wireless

Data path down control path up issue

Adam Watts — Sun, 04 Jul 2021 01:46:50 GMT

have just set up a WLC 4402 as a Guest WLan controler on the DMZ of our network.

i have sucsessfully managed to get our internal controllers to connect to it, with the exception of 1. it says the control path is up but the data path is down. the other 14 controllers worked fine, and in testing the last one was ok but it is now not working properly. the 2 controllers can ping each other but just won't create the data tunnel. there is a firewall in the middle but that has been set up to allow traffic between the 2 groups of controllers to be unrestricted.

the internal controllers are 4404's and all controllers are running the same version of code. 5.1.151.0

any ideas would be great.

Adam

Re: Data path down control path up issue

Surendra BG — Tue, 11 May 2010 08:30:07 GMT

We have to take care of the ports that should be allowed on the Firewall..

http://www.cisco.com/en/US/docs/wireless/controller/4.1/configuration/guide/c41mobil.html

Re: Data path down control path up issue

christopher.hodge — Sat, 29 Jan 2011 13:40:00 GMT

I'm having the same problem. Why is the responder pointing you to documentation when you have clearly removed the issue as a config problem?

As in my scenario, I have active EoIP tunnels it's just one that's not playing nice.

Re: Data path down control path up issue

George Stefanick — Sat, 29 Jan 2011 16:26:43 GMT

What code are you using?

Is there a FW in the middle of your anchor and foreign controller?

Did you anchor your WLAN on the foreign controller to the anchor controller?

Re: Data path down control path up issue

christopher.hodge — Sat, 29 Jan 2011 17:28:31 GMT

George, thanks for the response.

Code level 7.0.98

Yes, anchor resides behind FW and verified port traffic 16,666-16,667 including UDP 97.

I have two active remote branch site tunneled back to the anchor now and working fine. This is a third WLC and the data/path are down state.

Verified Symetric tunnel and mirroring active working configurations. Can't go wrong as it's a cut-paste config.

Powered cycled the new WLC and NOGO. Read in the forum to cycle the anchor next.

Pretty scary as there appears to be numerous threads noting similiar issues and we plan to expand the guest user access across the enterprise.

Obvious ICMP works and rebuilt configs already. Becoming exhausted and frustrated as this deployment is only going to grow across our enterprise.

We have a NAC in the DMZ which doesn't come into play.

Re: Data path down control path up issue

George Stefanick — Sat, 29 Jan 2011 21:37:33 GMT

What is the name of the mobility group on the anchor and the name of the mobility group on your foreign controller?

Re: Data path down control path up issue

christopher.hodge — Sat, 29 Jan 2011 21:50:30 GMT

Hey george,

Thanks for the question,

Group name - same for all WLC's

Virtual IP - same for all WLC's

Symetric tunnel enbled - same for all WLC's

Anchor IP - same for all WLC's

Guest VLAN name - same for all WLC's

FW open ports - same for all WLC's

End points ICMP response testing - same for all WLC's

Did I miss anything...I don't think I did...

There are other threads which address similiar issue and recommend resetting the anchor....(reboot)

Re: Data path down control path up issue

George Stefanick — Sat, 29 Jan 2011 21:54:23 GMT

Lets get back to basics... From your WLC CLI can you mping and eping the anchor controller?

Re: Data path down control path up issue

christopher.hodge — Sat, 29 Jan 2011 23:32:26 GMT

Just researched and not familiar with mping and eping. I do have ping response from the WLC.

Googled the mping and eping...appears to be a MS utility. Is that built into the WLC IOS?

Please provide input as to completing ping type response. How is that accomplished?

Re: Data path down control path up issue

George Stefanick — Sat, 29 Jan 2011 23:34:40 GMT

from the WLC CLI mping and eping your anchor. If this doesnt work you need to check your ports

http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080b1a506.shtml

Re: Data path down control path up issue

christopher.hodge — Sun, 30 Jan 2011 00:02:35 GMT

Well, I'll be darned...they FAIL..

I reviewed the FW ACL and ran a trace between the two WLC's. They both check open for defined ports 97 and 16,666-16,667. I think it's going to be the requirement to (reboot) the anchor WLC. Internet forums address this as a (known) problem. But, I'm still listening...

(Cisco Controller) >mping 10.48.27.182

Send count=3, Receive count=0 from 10.48.27.182

(Cisco Controller) >eping ?

Enter a mobility peer IP addr.

(Cisco Controller) >eping 10.48.27.182

Send count=3, Receive count=0 from 10.48.27.182

(Cisco Controller) >

Re: Data path down control path up issue

George Stefanick — Sun, 30 Jan 2011 00:40:00 GMT

I cant say Ive ever had to reboot a anchor to make mobility work. Is there a route back from the firewall?I mean if the ports are listing then they should respond .. Is there any other ACLs you may have over looked ?

Did you say you can ping the management ip address of the anchor ?

Re: Data path down control path up issue

Scott Fella — Sun, 30 Jan 2011 16:33:00 GMT

If you look at your output, it seems like you forgot to add the other WLC in the mobility group. When you do an eping, the wlc response tells you it doesn't know if that ip address.

Sent from Cisco Technical Support iPhone App

Re: Data path down control path up issue

christopher.hodge — Sun, 30 Jan 2011 21:11:37 GMT

There is an active mobility group called GUEST,

There are two active controllers in a mobility group which are not experiencing any issues. My new WLC is unable to establish a control/data patch.

Configuration parameters match existing mobility group configurations which makes the configuration pretty straight forward. I can ping from the new WLC back to the anchor but NO mping or eping.

My suspect I may have a FW inline that I'm unaware of as I am new to the organization. Then again, there is mention to rebooting the anchor WLC.

I read up on the mping and eping, not sure why they would fail but the standard ping (8) type would pass. Ports 97 and 16,666/16,667 verified with the network traffic sniffer.

Mping and eping appear to be a glorified extended ping with added functionality/multi host response tool.

Re: Data path down control path up issue

Scott Fella — Sun, 30 Jan 2011 21:37:28 GMT

This link will help you understand mping and eping.

http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080b1a506.shtml

Sent from Cisco Technical Support iPhone App

Re: Data path down control path up issue

George Stefanick — Sun, 30 Jan 2011 21:41:19 GMT

Are you positive that you anchored your WLAN on the foreign controller?

Is this Anchor controller used for guest anchoring with your other controllers?

Re: Data path down control path up issue

christopher.hodge — Sun, 30 Jan 2011 23:10:44 GMT

Are you positive that you anchored your WLAN on the foreign controller? YES

Is this Anchor controller used for guest anchoring with your other controllers? YES

I read the Cisco doc and confirm eping and mping test the required ports.

Still...NOGO.....have a good night and I plan to respond with findings.

Re: Data path down control path up issue

dperowne — Fri, 06 May 2011 08:14:24 GMT

In my case this was the firewall. I had end-end IP connectivity, managed to establish mping successfully, but eping wasn't working. I had Data down between the anchors and the foreign WLCs. I had the 16666-7 capwap ports allowed back, but turned out I needed a rule returning for the snmp & protocol 97 traffic, despite having in on egress from the foreign side, they are needed on the anchor side as well for initiation, ie: it's bi-directional.

Re: Data path down control path up issue

chris.van.krieken — Thu, 12 May 2011 14:34:52 GMT

Facing the same issue here. Control Path up, Datapath down when Checkpoint firewall policy is pushed with SecureXL enabled.

What kind of firewalls are in between achor and foreign controller ?

Data path down control path up issue

Dave Lewis — Fri, 21 Oct 2011 14:18:49 GMT

I know this post is old but I came across it when I was really stuck with the same issue and thought I'd share what resolved it for me.

So controller in DMZ (anchor) would not respond to eping from foreign controller. mping and icmp were fine.

ASA was the firewall.

Much packet tracing and frustration followed as the rule to allow IP protocol 97 was in the ACL for both the DMZ interface and the inside interface.

In my case the problem was that I had added the UDP CAPWAP rule into the ACL's first, this allowed the control path to come up. Unfortunately, because the mobility group keep-alive is set to 10 seconds it kept the flow up between the two WLC's on the ASA. Therefore when I added the ACE for IP 97 it wasn't reflected because there was an existing flow between the two.

So, solution for me was this on the firewall..

clear conn add x.x.x.x add y.y.y.y

...where x.x.x.x equals the management IP of your DMZ controller and y.y.y.y is the management IP of the foreign controller.

Once this was done I could then eping succesfully. So frustraing seeing the correct ACL's in place and traffic still not passing, still - it's a lesson learned for me!

Hope this helps someone else in a similar situation in future.

Dave