CAPWAP Discovery Fails After Store Router Replacement
A retail chain has a headquarters AC6805 pair in VRRP hot standby with VIP 10.10.10.10 and physical addresses 10.10.10.11/12. Thirty stores each have 6–10 APs on VLAN 200, and the store router is the DHCP server. The router inserts DHCP option 43 with the AC VIP. The AC is across an IPsec tunnel, and the tunnel policy permits 10.20.0.0/16 (stores) to 10.10.10.0/24 (AC). After a router replacement at 12 stores, APs get 10.20.x.x/24 addresses and send Discovery Requests to 10.10.10.10, but no Discovery Response arrives. The firewall now permits UDP 5246/5247 from stores to 10.10.10.10. The AC CAPWAP source interface is VLAN 100, 10.10.100.1. DTLS is enabled. At three stores, option 43 was manually set to AC1's physical IP 10.10.10.11, and those APs join AC1 but not the standby AC. The customer sees APs in fault state for 15 minutes, then rebooting.
1. Given that UDP 5246/5247 is permitted to 10.10.10.10, why do the APs still receive no Discovery Response? Trace the packet flow and identify the configuration mismatch.
Read the worked answer
The Discovery Request reaches the VIP, but the AC answers from the CAPWAP source interface, not from the VIP. The AC source is 10.10.100.1, which is outside the IPsec policy 10.20.0.0/16 <-> 10.10.10.0/24. The store firewall may permit UDP 5246/5247 to 10.10.10.10, but the return packet has source 10.10.100.1 and destination 10.20.x.x. It either does not match the tunnel selector or is dropped by the firewall's return policy. The AP sees no Discovery Response and eventually goes to fault/reboot. At the three stores using 10.10.10.11, the AP can form a CAPWAP session to AC1, but because option 43 carries only one physical address and no VIP/secondary, the AP has no path to the standby AC. Other stores working confirms that AP, DHCP, and basic routing are fine; the failure is source-address and return-path selection.
2. Design the DHCP option 43 and AC source-interface/firewall configuration so APs can onboard and survive an AC failover. Address the three stores that use physical IPs.
Read the worked answer
Make the CAPWAP source deterministic and reachable. Set the AC source interface to an address inside 10.10.10.0/24, or add 10.10.100.0/24 to the IPsec selectors and firewall policy in both directions. Permit UDP 5246/5247 to and from all AC addresses, not just the VIP. In DHCP option 43, return the VIP and, where the AP supports a list, both physical AC addresses; do not hand-configure only AC1's physical IP. For the three stores, replace the manual single-IP option with the same list or the VIP. Verify VRRP preempt and HSB so the VIP moves cleanly; test by failing AC1 and confirming APs re-form CAPWAP to the new master. If APs must survive a total AC failure, configure dual-link backup with primary and secondary AC addresses, but those addresses must still be routable through the IPsec tunnel.