Query regarding CAPWAP connectivity through FTD

[gavinhook]

Hi,

I'm looking to configure rules on an FTD firewall to allow CAPWAP wireless traffic between Wireless Access Points and Wireless Access Controllers.  CAPWAP uses UDP ports 5246 & 5247 to encapsulate the wireless data.  I believe CAPWAP works in a similar way to GRE in that it encapsulates an inner packet with the main packet.

I know when configuring GRE rules (we use GRE for Aruba Wireless comms) through FTD, the rules need to be configured in the prefilter policy and action set to fastpath.

My question is - can CAPWAP rules be simply added as standard ACP rules or do these need to be configured as prefilter policy rules?

Thanks 

[Mohammed al Baqari · Accepted solution]

Hi,

You can add them both ways and they will work. If you add them through
pre-filter and action fastpath (which I recommend), then they go with any
inspection (just allow/deny). This should be OK as CAPWAP is encrypted with
DTLS and there is no point of inspection.

If you allow them through ACP they will still work whether the action is
trust or allow. But this is an unnecessary inspection.

The GRE through pre-filter and action tunnel is a different concept of
inspecting encapsulated traffic. FTD can't inspect CAPWAP encapsulations
cuz its DTLS encrypted and they don't have preprocessors for this.

***** please remember to rate useful posts

[MHM Cisco World]

perfect answer 

[orghat]

Can you advise on what the rules would need to look like to add to prefilter policy?  Is it just UDP 5246 & 5247 initiated from Wireless APs to Wireless Controller or does it need to be in both directions?  Or more than just this?

I see this old article:-

https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113344-cuwn-ppm.html#anc8

Many Thanks in advance.

[gavinhook]

Many thanks Mohammed