DTLS Handshake Failure in 9800-CL Mobility Group

[Dilip Rehan]

I have two Cisco 9800-CL WLCs in the same mobility group:

• WLC-1: 192.168.138.130/24

• WLC-2: 192.168.138.132/24

UDP 16666 is allowed between them, DTLS is enabled, and keepalives are exchanged.

However, I keep getting:

I’ve checked mobility peer cofig, NTP sync, MTU, connectivity, and firewall logs. Both WLCs can ping each other.

Has anyone seen this before? Are additional ports/settings needed beyond UDP 16666?

[Mark Elsen · Accepted solution]

 - @Dilip Rehan  Verify the configuration of both controllers with the CLI command : show tech wireless 

 And feed the output from that into : https://cway.cisco.com/wireless-config-analyzer/

 M.

[Dilip Rehan · Accepted solution]

Thank you so much. The issue was with certficate mismacted. Regenreated a new One from both controllers and the mobility groups is up.