CCIE Enterprise Wireless (v1.0) – 3.9 Controller Mobility – 3.9.e Mobility anchoring
On any firewall between the guest anchor controller and the remote controllers, these ports need to be open:
Legacy mobility: IP Protocol 97 for user data traffic, UDP Port 16666 New mobility: UDP Port 16666 and 16667
For optional management, these firewall ports need to be open:
SSH/Telnet - TCP Port 22/23 TFTP - UDP Port 69 NTP - UDP Port 123 SNMP - UDP Ports 161 (gets and sets) and 162 (traps) HTTPS/HTTP - TCP Port 443/80 Syslog - TCP Port 514 RADIUS Auth/Account UDP Port 1812 and 1813
If your 9800 WLCs are set in a HA pair it is mandatory to configure a mobility MAC address. The default mobility group name is “default” but can customize to a desired value. Remember that you must configure the same Mobility Group Name on 9800 WLCs where roams between them is
Foreign Controller – 10.0.0.40
Collect mobility configuration of both 9800 WLCs.
Foreign – 10.0.0.40
Anchor – 10.0.66.3
Configure the mobility peer on the foreign (internal ) 10.0.4.140
Configure the mobility peer on the anchor (DMZ) 10.0.0.66
verify the status of the mobility tunnels – the data/control path should be in an UP/UP status
Foreign – 10.0.0.4
DMZ anchor – 10.0.66.3
the data/control path are down – if both WLCs are configured correctly look at the firewall to see if mobility traffic is allowed between the two devices. Remember that the ports are as follows:
Legacy mobility: IP Protocol 97 for user data traffic, UDP Port 16666
New mobility: UDP Port 16666 and 16667
Log into ASA
First i will take a look at the ASA Firewal logs. The log shows that traffic originating from the DMZ (anchor controller – 10.0.66.3) is being denied to the foreign (internal controller – 10.0.4.140) on UDP ports 16666 and 16667.
BTW 10.0.4.140 is defined as the wireless management interface.
TIP: verify that the correct MAC addresses are defined when configuring the mobility master peer. After fixing the firewall rules below..
The tunnels were in a down state. The logs on the DMZ controller revealed that it could not process the packet that came from the foreign controller. In this case internal traffic to the DMZ is allowed so it was NOT a firewall issue.
The log did reveal an interesting mis-configuration on my end.
DMZ (anchor controller) log.
I also grabbed a wireshark capture from the controller
Once i updated the MAC the tunnels came up
no wireless mobility group member mac-address 000c.29d9.53e ip 10.0.4.140 public-ip 10.0.4.140 group 9800Cloud
wireless mobility group member mac-address 001e.14d9.d3ff ip 10.0.4.140 public-ip 10.0.4.140 group 9800Cloud
Foreign tunnels UP
DMZ Anchor tunnels up
The next blog post – here – will cover sending traffic from the foreign to the anchor controller in the DMZ via the mobility tunnel.