nerdexam
Cisco

300-425 · Question #28

An engineer has configured guest anchoring for a newly created SSD however, the mobility tunnels are not up, and EPING is failing from the foreign WLC to the anchor WLC. Which traffic flow must be…

The correct answer is B. IP protocol 97. EPING tests the EtherIP data-plane tunnel between WLCs using IP Protocol 97, so firewalls must permit IP Protocol 97 for guest anchor mobility tunnels to establish.

Wireless Security and Mobility

Question

An engineer has configured guest anchoring for a newly created SSD however, the mobility tunnels are not up, and EPING is failing from the foreign WLC to the anchor WLC. Which traffic flow must be allowed at the firewall to enable the communication?

Exhibit

300-425 question #28 exhibit

Options

  • AUDP port 16666
  • BIP protocol 97
  • CUDP port 97
  • DTCP port 97

How the community answered

(34 responses)
  • A
    15% (5)
  • B
    71% (24)
  • C
    6% (2)
  • D
    9% (3)

Why each option

EPING tests the EtherIP data-plane tunnel between WLCs using IP Protocol 97, so firewalls must permit IP Protocol 97 for guest anchor mobility tunnels to establish.

AUDP port 16666

UDP port 16666 carries mobility control messages between WLCs, not the EtherIP data-plane tunnel that EPING validates; allowing only port 16666 leaves the data tunnel blocked.

BIP protocol 97Correct

Cisco WLC mobility tunnels use EtherIP (IP Protocol 97) to encapsulate and forward client traffic between the foreign WLC and the anchor WLC. EPING specifically tests this data-path tunnel; if IP Protocol 97 is blocked by a firewall, the mobility tunnel cannot form and EPING will fail even if control-plane (UDP 16666) traffic is permitted.

CUDP port 97

UDP port 97 is not a valid Cisco WLC mobility protocol; IP Protocol 97 (EtherIP) is a Layer 3 protocol number, not a UDP destination port.

DTCP port 97

TCP port 97 is not used by Cisco WLC mobility; EtherIP (IP Protocol 97) operates directly over IP without a TCP or UDP transport header.

Concept tested: WLC guest anchor mobility tunnel using EtherIP IP Protocol 97

Source: https://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-lan-controllers/118361-technote-wlc-00.html

Topics

#guest anchoring#mobility tunnel#IP protocol 97#firewall rules

Community Discussion

No community discussion yet for this question.

Full 300-425 Practice