Wireless Controller 9800 17.3.5a Cannot join APs on NAT

[safiullahtariq1]

Hi,

I am having an issue,

My APs cannot join the controller when they are on NAT, meaning that they are on the same router but different subnets. Controller is fine, it is able to join the APs when they are on the same network. From the AP I am also able to ping the controller. I have added the option 43 and also added the DNS entry of the CISCO-CAPWAP-CONTROLLER and CISCO-LWAPP-CONTROLLER.

Below is the log output from the AP.

*Feb 8 23:06:05.999: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.68.1:5246

*Feb 8 23:06:16.003: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Feb 8 23:06:17.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.68.25 peer_port: 5246

*Feb 8 23:06:17.367: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 192.168.68.25 peer_port: 5246

*Feb 8 23:06:17.367: %CAPWAP-5-SENDJOIN: sending Join Request to 192.168.68.25

*Feb 8 23:06:22.367: %CAPWAP-5-SENDJOIN: sending Join Request to 192.168.68.25

*Feb 8 23:06:22.411: %DTLS-5-ALERT: Received WARNING : Close notify alert from 192.168.68.25

*Feb 8 23:06:22.411: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 192.168.68.25:5246

*Feb 8 23:06:22.411: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.

*Feb 8 23:06:22.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.68.1 peer_port: 5246

*Feb 8 23:06:51.999: DTLS_CLIENT_ERROR: ../capwap/base_capwap/dtls/base_capwap_dtls_connection_db.c:2214 Max retransmission count reached for Connection 0xCAED9DC!

Can anyone please help me ?
The controller does detect it. This is a fresh AP, never connected to this controller, it has detected but not joining. Can anyone please help

[MHM Cisco World]

can I see how you config the NAT ?
how do NATing here is it FW? if Yes are FW open port for CAPWAP ?
MHM

[safiullahtariq1]

First of all, thank you for your reply. 
I am pasting here my running config file.

By NAT i meant 
I have Mikrotik router, on its port 5, I have a network running of 192.168.68.0/24 and on port 6, I have network which is of normal devices, 192.168.51.0/24. There is no VLAN. 
Both are able to access the networks without any issue. No firewall no nothing. Simple network.

[marce1000]

 - Review this article , check if it can help you : https://un-bounded.co.uk/cisco-9800-capwap-discovery-w-nat/

 M.

[Rich R · Accepted solution]

You have 3 different default routes configured - how do you expect the WLC to reliably route to remote subnets?
ip route 0.0.0.0 0.0.0.0 172.16.0.1
ip route 0.0.0.0 0.0.0.0 192.168.56.1
ip route 0.0.0.0 0.0.0.0 192.168.68.1
You should generally only have 1 default route unless there really are 3 different routes out but 192.168.56.1 doesn't seem to be a local subnet at all and sharing the traffic across G1 and G2 is a recipe for disaster.  G1 on 9800-CL is generally only intended to be for out of band management anyway.

Your other possible problem is:
wireless management interface GigabitEthernet2
public-ip 192.168.68.1
You're telling the WLC to report its public address to the AP as 192.168.68.1 when it's really 192.168.68.25 - that makes no sense at all.  You only use that if you are using WLC NAT to a real public internet address whereas your connections are all private so you should not have that enabled at all.  Turn off the WLC NAT and remove that 192.168.68.1 IP which is presumably your router because that's one of the default gateways you configured and that definitely won't accept CAPWAP connections.