AP communication via Port udp 16670

[jan.kunze]

Hi there,

we are using an new 9800 WLC with old 28xx and new 91xx APs. After some time we noticed UDP traffic hitting our firewall on Port 16670 between some differnt APs. I was not aware that APs "talk" to each other. Is this normal behavior?

The usual communication is between the WLC and the AP back and forth.

Thanks in Advance

Jan

[Scott Fella]

AP's from what I know, only talks to the controller.  There is a old port matrix out there for ports used by various wireless devices and 16670 is not one of them.

[jan.kunze]

Hi Scott,

thanks for your information. I found this old matrix, its' from the 5508 Series. In this Matrix the UDP Port 16670 is mentioned but only in the communication between AP and WLC.#
https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113344-cuwn-ppm.html

Anyone has an idea?

[Scott Fella]

That is the matrix I was talking about.  This port is not used by Cisco, you can look up that port.  If this is something that you want to diagnose more, then I would say either open a TAC case, or block that port on your FW and see what happens.  AP's do not communicate to each other, they communicate back to the controller.

[Reinvtv]

We are running into the same issue.

Have you found anything about this?

Apr  5 2022 09:06:49.781 CEST: %SEC-6-IPACCESSLOGP: list ACL-IN-VJL103-CLN-Wireless denied udp 10.48.34.36(5261) (Vlan103 009e.00c2.0400) -> 10.48.66.50(16670), 6 packets 
Apr  5 2022 09:06:49.781 CEST: %SEC-6-IPACCESSLOGP: list ACL-IN-VJL103-CLN-Wireless denied udp 10.48.34.35(5250) (Vlan103 009e.00be.0000) -> 10.48.66.50(16670), 3 packets 
Apr  5 2022 09:06:49.781 CEST: %SEC-6-IPACCESSLOGP: list ACL-IN-VJL103-CLN-Wireless denied udp 10.48.34.36(5261) (Vlan103 009e.00be.0000) -> 10.48.66.50(16670), 6 packets 
Apr  5 2022 09:06:49.781 CEST: %SEC-6-IPACCESSLOGP: list ACL-IN-VJL103-CLN-Wireless denied udp 10.48.34.36(5261) (Vlan103 009e.00be.0000) -> 10.48.66.47(16670), 3 packets 
Apr  5 2022 09:06:49.781 CEST: %SEC-6-IPACCESSLOGP: list ACL-IN-VJL103-CLN-Wireless denied udp 10.48.34.36(5261) (Vlan103 009e.00c2.0400) -> 10.48.66.47(16670), 2 packets 
Apr  5 2022 09:06:49.781 CEST: %SEC-6-IPACCESSLOGP: list ACL-IN-VJL103-CLN-Wireless denied udp 10.48.34.35(5250) (Vlan103 009e.00c2.0400) -> 10.48.66.50(16670), 2 packets 
Apr  5 2022 09:06:54.572 CEST: %SEC-6-IPACCESSLOGP: list ACL-IN-VJL103-CLN-Wireless denied udp 10.48.34.35(5250) (Vlan103 009e.00c2.0400) -> 10.48.66.38(16670), 1 packet 

(We are blocking inter-switch traffic on our vlans, that is how we noticed in the first place)

(both IP's are Access points, but on different switches (but physically close to each other)

[Alejandro Ramirez Gomez]

Maybe this helps... its a table that mentions AP-AP Communication for Client Policies.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-8/release-notes/rn-17-8-9800.html#Cisco_Reference.dita_fd1a1a9f-282c-4d1e-8948-166cb824fb8f

[Rich R]

Thanks @Alejandro Ramirez Gomez can you ask WNBU devs for more info on exactly what "client policies" is or does?  What are the APs communicating to each other?