CAPWAP APs cannot reach the WLC even though IP connectivity is OK. What action fixes this?

CAPWAP (Control and Provisioning of Wireless Access Points) uses UDP ports 5246 for control messages and 5247 for data messages. If these ports are blocked by a firewall between the APs and the WLC, the APs will not be able to establish a CAPWAP tunnel, even if basic IP connectivity exists. Opening these specific ports in the firewall allows the necessary communication for AP discovery and operation. UDP port 12222 is not used by CAPWAP. Enabling UDP Lite on the WLC is not a standard solution for firewall port blocking. A AAA server is used for authentication and authorization of users, not for AP-WLC communication itself.