
11-10
Cisco Wireless LAN Controller Configuration Guide
OL-13826-01
Chapter 11 Configuring Mobility GroupsWireless Device Access
Configuring Mobility Groups
• When you configure mobility groups using a third-party firewall, Cisco PIX, or Cisco ASA, you
need to open ports 16666, 16667, 12222, and 12223; IP protocols 50 and 97; and UDP port 500 if
you are not using secure mobility groups. If you are using secure mobility groups with
Encapsulating Security Payload (ESP), you must allow Internet Security Association and Key
Management Protocol (ISAKMP) through the firewall by opening UDP port 500. You also have to
allow the encrypted data through the firewall using IP protocol 50. The mobility data on ports 16666
and 16667 is encapsulated in ESP. Therefore, you do not need to create an ACL to allow ports 16666
and 16667 because it is already encapsulated within the ESP.
Note You cannot perform port address translation (PAT) on the firewall. You must configure
one-to-one network address translation (NAT).
Using the GUI to Configure Mobility Groups
Follow these steps to configure mobility groups using the GUI.
Note See the “Using the CLI to Configure Mobility Groups” section on page 11-13 if you would prefer to
configure mobility groups using the CLI.
Step 1 Click Controller > Mobility Management > Mobility Groups to open the Static Mobility Group
Members page (see Figure 11-8).
Figure 11-8 Static Mobility Group Members Page
This page shows the mobility group name in the Default Mobility Group field and lists the MAC address
and IP address of each controller that is currently a member of the mobility group. The first entry is the
local controller, which cannot be deleted.
Note You can also view the default mobility group by clicking Monitor and looking at the last field
under Controller Summary.
Note If you want to delete any of the remote controllers from the mobility group, hover your cursor
over the blue drop-down arrow for the desired controller and choose Remove.
Comentarios a estos manuales