Which transport/port must be permitted so APs can join a WLC when directed broadcasts are used on a Cisco IOS switch?

When Cisco Access Points (APs) join a Wireless LAN Controller (WLC) using directed broadcasts, they utilize the Control And Provisioning of Wireless Access Points (CAPWAP) protocol. CAPWAP operates over User Datagram Protocol (UDP). Specifically, CAPWAP control messages, which are essential for the initial discovery and joining process, use UDP port 5246. Therefore, this port and transport must be permitted through any firewalls or access control lists (ACLs) between the APs and the WLC. TCP 5246 is incorrect because CAPWAP uses UDP, not TCP, for its control plane. TCP 5247 and UDP 5247 are incorrect because while CAPWAP data messages use UDP 5247, the initial discovery and control plane, which is critical for an AP to join, uses UDP 5246.