Static Mobility Group Status - Control and Data Path Down

[latenaite2011]

Does anyone know why the Control and Data Path Down status appears for the Static Mobility Group an an IP setup between the a 9800 WLC and a 5508 Anchor WLC?  We double-checked the configuration and the firewall rules and ensure that everything is setup the same (even set up added the new 9800 WLC to the same firewall rule) but yet it still remains down. Is there anyway to troubleshoot this from the 9800 WLC to see what might be causing this? Is there a packet packet or what logs can we look at on the 9800 WLC via CLI (we looked at the GUI's logs and didn't see anything).

[balaji.bandi · Accepted solution]

As you mentioned there is FW between, what logs you see on the Firewall when the traffic passing through FW.

Monitor on FW to see if BLOCK UDP  16666  / UDP 16667  or IP 97 

check some mping ping tests:

https://mrncciew.com/2013/03/24/mobility-ping-tests/

[latenaite2011]

Excellent Balaji, this is excellent and well written!  Will try this.  Exactly what I needed and thanks for the quickly reply!

Note that even though secure tunnel is enabled (and so is the original controller), I didn't any rules for UDP 16667 or IP 97 (even for the first one so not sure how the first one worked).  Are those need to be allowed? As for firewall rules logs, didn't see anything at all, which is weird and they could see logs being denied/ping on the for the first controller. 

[balaji.bandi]

Not sure how your network topology looks like ? so we need more information here.

If the FW do not see the logs at all that means that packers not even reaching FW ( I am assuming this) - so you need to where it is blocking before reaching FW.

[latenaite2011]

Yes. Agree.  Packet captures might be next, thanks again! 

[latenaite2011]

Hey Balaji,

Have another question. 

Should multicast be enabled (it is not now) if there is just one Anchor WLC Controller in the DMZ but this anchor controllers talk to two different foreign controllers on the LAN side.  Since we have now introduced a new WLC controller, would it make sense to enable multicast or would it work just as fine without enabling multicast.

Thanks in advance!