An engineer has configured an anchor controller in the DMZ for guest traffic, but the traffic is failing at the firewall. Which two ports must be opened on the firewall? (Choose two.)

IP Protocol 43 is used for IPv6 routing headers in IPv6-over-IPv4 tunneling, not for Cisco WLC EtherIP mobility tunnels.

IP Protocol 97 is EtherIP, the Layer 3 encapsulation protocol Cisco WLCs use to carry Ethernet frames across the mobility tunnel between the foreign and anchor controllers - this must be permitted through the firewall for guest traffic to flow.

TCP port 23 is Telnet management access, which is unrelated to the data or control plane traffic required for a WLC guest anchor deployment.

TCP port 443 is HTTPS and while it may be used for WLC web management or WebAuth guest portals, it is not one of the two ports specifically required for the mobility tunnel itself to function.

UDP port 123 is NTP time synchronization, which is not required for the mobility tunnel between a foreign and anchor WLC to pass guest traffic.

UDP port 16666 is the mobility messaging port used by Cisco WLCs to exchange mobility handshake and control messages between the foreign controller and the anchor controller, and must be open on the firewall separating them.