How does a WLC achieve stateful switchover for APs and clients?

The standby WLC does not establish its own CAPWAP tunnel to the AP initially; it receives state information from the active WLC to prepare for a failover.

In a WLC High Availability (HA) deployment with stateful switchover (SSO), the active WLC establishes the CAPWAP tunnels to all connected APs and maintains the operational state for all APs and clients. The active WLC then continuously and actively synchronizes this critical AP and client state information to the standby WLC, allowing for a seamless failover without interruption to clients or APs.

The active WLC does not establish a CAPWAP tunnel with the standby WLC to share AP state directly in the context of HA SSO; state is synchronized over a dedicated HA port/link.

Only the active WLC establishes and maintains the CAPWAP tunnels to the APs in an SSO pair; if both established separate tunnels, it would not be a clean active/standby failover.