Branch AP, DMZ controller, firewall in the middle
- Services & wireless
- Advanced
- 15 min
- 2 steps
- Cisco IOS-XE-style
Real CAPWAP deployments place the WLC in a corporate DMZ with a firewall between branch APs and the controller. Today AP1 sits behind a deny-by-default firewall (FW) that blocks UDP/5246 — the AP picks up its DHCP lease + option-138 fine, but the join handshake never completes. Fix the firewall ACL so AP1 transitions from phase: discovered to phase: joined, then verify in pcap.
Open this lab in your browser →
Free · no install · no account
Scenario
The CAPWAP control plane (UDP/5246) carries the discover/join handshake between an AP and its controller. In a typical enterprise deployment: - APs at branch sites get IP addresses + option-138 (controller IP) from the local DHCP server. - WLCs sit in a DMZ at HQ, behind a corporate firewall that filters traffic from branch subnets. - The firewall must permit UDP/5246 (control) and UDP/5247 (data, when the data plane is in scope) for AP join + client traffic to flow. Slice G makes this real: the AP emits an actual CAPWAP join-request UDP/5246 frame on lease completion. If the firewall ACL drops it, the request never reaches the controller; the AP stays in phase: discovered indefinitely; pcap shows the dropped attempt. Verification flow: 1. show capwap client summary on AP1 → reports phase. Joined when the round-trip succeeded; discovered when blocked along the path. 2. show capwap ap summary on WLC1 → reports the AP's join from the controller side. Empty when the handshake never completed. 3. PCAP export → captures every CAPWAP frame on the wire, including the dropped one. Look for the capwap-control UDP payload with messageType: 'join-request'.
Topology
2 × router, 1 × wireless controller, 1 × switch, 1 × access point · Cisco IOS-XE-style
BR_RTR— routerFW— routerWLC1— wireless controllerHUB— switchAP1— access point
What you will do
Confirm the broken state. AP1's
show capwap client summaryshould reportphase: discovered(not joined). The DHCP lease + option-138 worked, but the CAPWAP control packet got dropped.Fix the firewall: replace the deny-UDP-5246 rule with a permit. After convergence, AP1 should transition to
phase: joined.
Open this lab in your browser →
More labs on this topic
- Configure a DHCP serverBeginner · 12 min
- WLAN — broadcast a basic SSIDBeginner · 10 min
- HSRP: configure first-hop redundancyIntermediate · 12 min
- NAT: PAT (overload) for an inside LANIntermediate · 14 min
- HSRP — interface tracking with priority decrementIntermediate · 12 min
- VRF-Lite — two customers on one routerIntermediate · 12 min
This lab in other languages
Zweig-AP, DMZ-Controller, Firewall in der MitteAP de sucursal, controlador DMZ, firewall en el medioFilial AP, controlador DMZ, firewall no meioBranche AP, contrôleur DMZ, pare-feu au milieuशाखा एपी, डीएमजेड नियंत्रक, बीच में फ़ायरवॉल分支AP、DMZ控制器、中间防火墙AP della filiale, controller DMZ, firewall al centroブランチ AP、DMZ コントローラー、中間のファイアウォールBranch AP, DMZ 컨트롤러, 방화벽이 중간에 위치Точка доступа филиала, контроллер DMZ, межсетевой экран посередине.Şube AP, DMZ denetleyicisi, ortada güvenlik duvarıNhánh AP, bộ điều khiển DMZ, tường lửa ở giữa