What default behavior applies when an encrypted mobility tunnel is used between two Cisco WLCs?

When an encrypted mobility tunnel is established between two Cisco Wireless LAN Controllers (WLCs), both control plane traffic (for WLC communication and management) and data plane traffic (user data) are encrypted. This ensures secure communication and data transfer across the tunnel. The tunnel primarily uses Control and Provisioning of Wireless Access Points (CAPWAP) for encapsulation, which can then be secured using Datagram Transport Layer Security (DTLS) for encryption. While IPsec can be used for VPNs, it's not the default for inter-WLC mobility tunnels. EoIP (Ethernet over IP) is not used for this purpose. TCP port 443 (HTTPS) is for secure web management, and UDP port 21 is typically for FTP, neither of which are directly involved in the default encrypted mobility tunnel operation between WLCs.