Access point register on anchor wlc in DMZ

[m.arienti]

Hello,

I have an environment in which two WLC 4400 are connected to an anchor WLC 4400 in DMZ, This WLC in DMZ pass the Guest Wlan to other two WLC and terminate tunnel CAPWAP. The Ap in the remote sites, that are configure to register to WLCs in the remote sites, usually are registered on the two WLCs but sometimes they register to WLC in DMZ, how is possible if between WLC in DMZ and other WLC there is a firewall that block all the traffic except CAPWAP traffic? 

If I reboot the APs they register on the two correct WLCs in remote sites.

Thanks

[sungy]

AP also uses CAPWAP.  you should only allow capwap connection from internal controllers only on the fw.