Mobility tunnel between Anchor and Foreign controller

[Manindersinghnegi]

Hi All,

I need clarification on traffic passing through Mobility tunnel between Foreign and Anchor controller.

DHCP\Authentication\Switching is all Central.

 Once any traffic like  radius\DHCP\DNS\Data traffic will reach Foreign WLC it will go to Anchor controller 

inside Mobility tunnel 

OR

Authentication radius traffic will not go inside Mobility tunnel to Anchor controller and rest of traffic ( DHCP\DNS\Data Traffic) will only go inside mobility tunnel.

[Simon Blomqvist]

Radius traffic would be sent from the foreign controller if it's L2 authentication and from the anchor controller if it's L3 authentication. For CWA the MAB auth would be sent from the foreign but the client's portal traffic would go through the anchor. The CWA redirect ACL needs to be on both foreign and anchor controller but only the ACL on the anchor controller needs the actual ACL entries. All the client's traffic, including DHCP and DNS, would be sent through the mobility tunnel and out to the client's VLAN via the anchor controller.