Maybe this might help:
Q. Can I place the Lightweight Access Point (LAP) under Network Address Translation (NAT)? Does the IETF standard Control and Provisioning of Wireless Access Points Protocol (CAPWAP) from access point (AP) to WLC work through NAT boundaries?
A. Yes, you can place the LAP under NAT. On the AP side, you can have any type of NAT configured.
But on the WLC side, you can have only 1:1 (Static NAT) configured and the external NAT IP address configured on dynamic AP management interface (only for Cisco 5500 Series Controllers). PAT cannot be configured on the WLC side because LAPs cannot respond to WLCs if the ports are translated to ports other than 5246 or 5247, which are meant for control and data messages.
Note: Select the Enable NAT Address check box and enter the external NAT IP address if you want to be able to deploy your Cisco 5500 Series Controller behind a router or other gateway device that is using one-to-one mapping network address translation (NAT). NAT allows a device, such as a router, to act as an agent between the Internet (public) and a local network (private). In this case, it maps the controller's intranet IP addresses to a corresponding external address. The controller's dynamic AP-manager interface must be configured with the external NAT IP address so that the controller can send the correct IP address in the Discovery Response.
Note: With CAPWAP, WLC behind NAT is not supported with the 4400 series, 2100 series Wireless LAN Controllers and the WiSM.
http://www.cisco.com/en/US/products/ps6366/products_qanda_item09186a008064a991.shtml
Sent from Cisco Technical Support iPhone App
-Scott
*** Please rate helpful posts ***
