Campus access points receive DHCP addresses, and a firewall sits between them and the Catalyst 9800. They never join. A capture shows UDP 5246 from the access points is dropped. What must the firewall permit?
Select an answer to reveal the explanation.
Short Explanation
The access points already have addresses, so the lease is not the stuck part. Your join rides CAPWAP control on UDP 5246, and the firewall is throwing those packets away. Opening a web port does not build that tunnel.
Full Explanation
CAPWAP control between a Cisco access point and the controller uses UDP 5246. The capture shows those packets dropped, and the access points never join, so the firewall has to permit UDP 5246 from the access-point subnets to the controller. Data traffic uses a companion UDP port, but the join itself cannot start while control is blocked. TCP 80 is ordinary web traffic. CAPWAP join is not a web session to the controller, so opening only TCP 80 leaves the drop in place. ICMP to the gateway proves the access point can ping toward the network. These access points already have addresses, and a ping is not the join protocol. DHCP replies are how the access point got its address. The stem says DHCP already succeeded, so more DHCP permission does not replace the CAPWAP packets that are being dropped. Exam caveat: if the controller answer is also filtered, one-way permission still fails. Allow the control conversation, not a single request with no return path. Operational check: after the firewall change, confirm UDP 5246 packets in both directions and that a test access point moves from discovery to joined.