Control Path Down on virtual wireless 9800 controller

[pthakkar]

so we changed the management ip address on the wireless controller and after the mobility tunnel keeps on saying control path down.

We have changed ip address on the other controllers and when we delete the mobility config and re-add it with new ip address and it straight away comes up. able to ping between the two no issues. also other tunnel between the primary and secondary is up and running.

[balaji.bandi]

Do you have any firewall between these devices, male sure required ports are open for the control path up and working.

what code running in WLC ?

command line check the logs and show command - show wireless mobility summary

TCP/97 and UDP/16666 /7 required to open.

check the ports requirement :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213913-building-mobility-tunnels-on-catalyst-98.html

[pthakkar]

version : 17.9.4a

ports are open since controller can do mobility tunnel with other controllers fine already check firewall no issues there

IP Public Ip MAC Address Group Name Multicast IPv4 Multicast IPv6 Status PMTU
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
170.4.110.28 N/A 001e.bdbe.a2ff IRV-Mobility 0.0.0.0 :: N/A N/A
170.4.110.29 170.4.110.29 001e.bd2e.78ff IRV-Mobility 0.0.0.0 :: Up 1385
170.191.32.211 170.191.32.211 001e.bd2c.daff default 0.0.0.0 :: Control Path Down 1385

IRV-WLAN-vWLC1#

[balaji.bandi]

Not sure this required some troubleshoot and debug, either you can open TAC to investigate.

I had some issue like this then when we upgrade to new code it fixed, but your case only Management IP changed and it was working, and you mentioned all the firewall allowed between chassis, not have any other option suggest (other upgrade Code to 17.9.5 to check or tac)

if ICMP allowed can you ping it

@Haydn Andrews  - Original Post mentioned they do able to ping each other no issue, that was my suspect before, since he has Firewall between (in guess) 

[marce1000]

 - I would still validate the new config on both controllers with https://cway.cisco.com/wireless-config-analyzer/

Note it needs the input from CLI : show tech wireless.

  Use the full command , it does not work with 'show tech'

 M.

[Haydn Andrews]

Do you have connectivity from the Foregin to the anchor?

if ICMP allowed can you ping it
Check the anchor config as well