WLC 2504 and AIR-CAP16021-E-K9 IP forwarding

[zsd]

I have a WLC 2504 along with multiple AIR-CAP16021-E-K9. We've just had an internal pen test performed and it has come up that IP forwarding is enabled on the AIR-CAP16021.

I've looked around the management page of the WLC 2504 to see how to disable IP forwarding, but have not been able to find it. Can someone tell me where I can disable IP forwarding for these devices?

[patoberli]

Never heard that this must/should/could be disabled on the APs.
I assume they run as lightweight and not autonomous?

[zsd]

Yes, you are right, they are lightweight.

I've looked around the management page on the WLC 2504, but couldn't find anything referencing it. When the pen test was made, the WLC 2504 was running an older version of the firmware. Do you think this may have been disabled with the later version? (Now running 8.5.103.0)

[patoberli · Accepted solution]

Then this should not be needed to be changed. See here regarding how a WLC forwards packets: https://community.cisco.com/t5/wireless-and-mobility/how-does-wlc-switch-packets/td-p/2035619

Regarding your software release, this is also a very old version, and I'm pretty sure it contains known security issues. You should upgrade to the current release 8.5.140.0.

[zsd]

Thanks for the information. I will look into getting it updated.