Local-mode access points join a Catalyst 9800, and client data never arrives at the controller. The firewall allows UDP 5246 and blocks UDP 5247. What is blocked?
Select an answer to reveal the explanation.
Short Explanation
The access points found the controller and the clients' traffic did not. You allowed the control port and blocked the data port. Local-mode client traffic needs UDP 5247, and the join you already see is the other port.
Full Explanation
CAPWAP uses UDP 5246 for control and UDP 5247 for data. Local-mode client traffic is carried in the data tunnel, so a firewall that allows 5246 and blocks 5247 lets the access point join and then drops the client data before it reaches the controller. Control is not what is blocked. The access points joined, which is the evidence that 5246 is open. DHCP is not UDP 5247, and an access point does not substitute DHCP for the CAPWAP data tunnel. DNS is not UDP 5246, and DNS does not carry local-mode client traffic after the join. The join already proved that UDP 5246 is open. Local-mode client traffic is the other port, UDP 5247, and that is the one this firewall drops. Confirm the result on one live client before changing anything else. Exam caveat: FlexConnect local switching would keep client data off this tunnel, and the same firewall rule would look harmless. This stem is local mode, so the data port matters. Operational check: permit UDP 5247, then confirm client traffic shows up at the controller and a client can pass traffic.