Data path down and Control path is up on wlc

[networklearner1]

Hello All,

We have 2 WLC's. 

5508- Anchor WLC (8.5.161.7)

3504- Foreign WLC (8.10.185.0)

I have created a mobility group and added the WLC's MAC respectively.

The FW ports 16666, 16667, 97 are all open.

The control path is UP but the Data path is DOWN. I tried removing the IP from group and adding again. Also tried rebooting the WLC's but it is still showing Down. Could someone please let me know how to fix this.

[marce1000]

 - Have a look at https://community.cisco.com/t5/wireless/static-mobility-group-status-control-and-data-path-down/m-p/4713192#M247666

 M.

[networklearner1]

Thank you @marce1000 , I don't see any block or drop on our FW. Is there anything else that can be checked?

[marce1000]

   - Well, to verify correct firewall behavior , examine (full)  logs and confirm allowed traffic for the involved ports ; (check that you can see the needed pass trough traffic). The response I pointed to in my initial reply also mentions :
                     https://mrncciew.com/2013/03/24/mobility-ping-tests/

  Have a go with that too , if that does not work for instance, again iterate on the firewall and check what it does with the intended traffic.

 M.
                            

[MHM Cisco World]

what is the FW you have?
MHM

[networklearner1]

It’s Paloalto

[MHM Cisco World]

I was hope it Cisco but anyway 
try open port UDP
5246/5247 

MHM

[networklearner1 · Accepted solution]

Hello All, 
It seems the EtherIP traffic was getting denied in another firewall, we allowed it and then both the tunnels came up.