Clients cannot connect to SSID on 9800 WLC

[pgill.uwo@gmail.com]

I have two WLCs ( main enterprise and other behind firewall  ) in my network hosting same SSID. One behind firewall is anchored on the enterprise WLC through a firewall. 

When clients connect with main enterprise WLC they can get connected .Also when they are moved/roam to WLC behind firewall they work fine. But when clients try to directly join same SSID hosted on WLC behind firewall they cannot connect. Looking for some help on troubleshooting this.

Appreciate your help!

[Arshad Safrulla]

Can you provide more info, like Authentication mechanism, AP model, WLC model, AireOS/IOS XE code running, Client type.

Also paste a debug client or RA trace for the client who is failing to connect.