WLC 9800 contacts strange ip's on UDP port 12134/12135

Darkmatter · ‎11-03-2021

Strange behaviour detected on our new WLC 9800, as i discovered in our firewall that the WLC tries to connect constantly to some private ip's on UDP port 12134/12135 (10.166.33.8 and 10.166.33.21) that we even don't use in our network.

In the mean time, an ACL has been put in place on the WLC to block this traffic.

What could explain this?

marce1000 · ‎11-03-2021

- Check this thread :

https://community.cisco.com/t5/wireless/wlc-rrm-monitoring-and-packets/td-p/977565

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

Darkmatter · ‎11-04-2021

Thank you for pointing this out to me.

But then the question remains, why are 10.166.33.8 and 10.166.33.21 used, ip's we have nowhere in use or configured in our network?

There is nothing to find in the config referencing those addresses.

marce1000 · ‎11-04-2021

- Scrutinize the controller configuration with : # show run | inc 10.166.33.8 and show run | inc 10.166.33.21

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '