Cisco Unified Wireless Network Protocol and Port Matrix

This document provides information about protocols and port numbers used across the entire product series as they interact in a comprehensive Cisco Unified Wireless Network (CUWN) deployment. This information is based on Software Version 7.0.220.0 series code release train. This information is not meant to replace or supersede specific product documentation found in existing configuration guides, but only to serve as a consolidated source of information available at the time this document was created.
Background Information
The main purpose of this document is to provide a consolidated source of communication protocols that incorporate a CUWN solution. Goals are to implement appropriate firewall and security policies based on this information to properly secure the CUWN infrastructure.

Terms Used
Here is a list of terms used in this document:

  • WCS - Wireless Control System
  • NCS - Network Control System
  • PI -
  • WLC - Wireless LAN Controller
  • MSE - Mobility Services Engine
  • OS - Operating System
  • AP - Access Point
  • SSH - Secure Shell
  • SMTP - Simple Mail Transfer Protocol
  • AAA - Authentication, Authorization, and Accounting
  • DNS - Domain Name System
  • ISE - Identity Services Engine
  • NTP - Network Time Protocol
  • SOAP - Simple Object Access Protocol
  • HA - High Availability
  • QoS - Quality of Service
  • DB - Database
  • RDP - Remote Desktop Protocol
  • VNC - Virtual Network Computing
  • TLS - Transport Layer Security
  • LOCP -
  • ICMP - Internet Control Message Protocol
  • SNMP - Simple Network Management Protocol
  • NMSP - Network Mobility Services Protocol
  • AwIPS -
  • EoIP - Ethernet over IP
  • RDLP -
  • CAPWAP - Control and Provisioning of Wireless Access Points
  • LWAPP - Light Weight Access Point Protocol
  • NSI - Network Spectrum Interface
  • OEAP - OfficeExtend Access Point

Network Overview
cuwn-ppm-01.gif

Protocol and Port Number Information

Here is a list of tables in this document:

Table 1 - WCS/NCS/PI Protocols and Ports

WCS/NCS/PI Protocols
Source Device Destination Device Protocol Destination Port Description
WCS/NCS/PI WLC and MSE TCP 21 FTP - Used to transfer files to/from devices
Various Management Stations WCS Host Server OS-Linux TCP 22 SSH - Used for remote Linux Host Access
WCS/NCS/PI Cisco aIOS® AP TCP 23 Telnet - Used for Cisco aIOS AP Configuration
WCS/NCS/PI SMTP mail servers TCP 25 SMTP - used for fault notifications
AAA Servers / ISE WCS/NCS/PI TCP/UDP 49 TACACS+
WCS/NCS/PI aIOS AP UDP 53 DNS - used for Cisco aIOS AP Configuration
WLC WCS/NCS/PI UDP 69 TFTP - Used to transfer files to/from devices
Various Management Stations WCS/NCS/PI TCP 80 HTTP (Configurable at install time)
NTP Server WLC UDP 123 NTP
WLC and MSE WCS/NCS/PI UDP 161 SNMP discovery, inventory Cisco aIOS AP and others
WLC and MSE WCS/NCS/PI UDP 162 SNMP Trap Receiver
Various Management Stations WCS/NCS/PI TCP 443 HTTPS (Configurable at install time)
MSE WCS/NCS/PI TCP 443 SOAP/XML (SOAP used for MSE Management
WLC WCS/NCS/PI UDP 514 Syslog (Optional)
Local only WCS/NCS/PI TCP 1299 RMI Registry port (local only)
Various and HA Server WCS/NCS/PI TCP 1315 Database Server HA (QoS)
WCS HA Server WCS/NCS/PI TCP 1316-1320 HA DB Ports
AAA Servers / ISE WCS/NCS/PI UDP 1812 / 1645 RADIUS
AAA Servers / ISE WCS/NCS/PI UDP 1813 / 1646 RADIUS
Various Management Stations WCS Host Server OS-Microsoft Windows TCP / UDP 3389 RDP - Microsoft Windows Remote Desktop (Optional)
Various WCS/NCS/PI TCP 5001 Apache Axis SOAP Monitoring: Java Listener
Various Management Stations WCS Host Server OS-Microsoft Windows TCP 5500 VNC - (Optional) Used for remote Microsoft Windows Host Access
Various Management Stations WCS Host Server OS-Microsoft Windows TCP 5800 VNC - (Optional) Used for remote Microsoft Windows Host Access
Various Management Stations WCS Host Server OS-Microsoft Windows TCP / UDP 5900 VNC - (Optional) Used for remote Microsoft Windows Host Access
Local only WCS/NCS/PI TCP 6789 RMI Server Port (local only)
MSE-Location Appliance WCS/NCS/PI TCP 8001 Location Server Data Sync. Communication Port
Local only WCS/NCS/PI TCP 8005 Tomcat Shutdown Port
Local only WCS/NCS/PI TCP 8009 Web Server / Java Server Connector (local only)
HA Web Server WCS/NCS/PI TCP 8082 HA Web Server Port: Health Monitor for WCS HA
Various Management Stations WCS/NCS/PI TCP 8456 HTTP Connector
Various Management Stations WCS/NCS/PI TCP 8457 HTTP Redirect
Various Management Stations WCS/NCS/PI TCP 16113 LOCP TLS Port
WLC WCS/NCS/PI UDP 29001-29005 TFTP Child threads
Various AP ICMP ICMP - Optional

Table 2 - MSE - AwIPS Protocols

MSE - AwIPS Protocols
Source Device Destination Device Protocol Destination Port Description
WCS/NCS/PI MSE TCP 21 FTP - Used to transfer files to/from devices
Various Management Stations MSE Host Server OS-Linux TCP 22 SSH - Used for remote Linux Host Access
WCS/NCS/PI MSE TCP 80 HTTP (Configurable at install time)
NTP Server WLC UDP 123 NTP
WCS/NCS/PI MSE UDP 161 SNMP
MSE WCS/NCS/PI UDP 162 SNMP Trap Receiver
WCS/NCS/PI MSE TCP 443 HTTPS (Configurable at install time)
WCS/NCS/PI MSE TCP 443 SOAP/XML
WCS/NCS/PI MSE TCP 8001 HTTPS (Configurable at install time)
WLC MSE and Spectrum Expert TCP 16113 NMSP
Various AP ICMP ICMP - Optional

Table 3 - MSE - Context Protocols

MSE - Context-Aware and AwIPS Protocols
Source Device Destination Device Protocol Destination Port Description
WCS/NCS/PI MSE TCP 21 FTP - Used to transfer files to/from devices
Various Management Stations MSE Host Server OS-Linux TCP 22 SSH - Used for remote Linux Host Access
WCS/NCS/PI MSE TCP 80 HTTP (Configurable at install time)
NTP Server WLC UDP 123 NTP
WCS/NCS/PI MSE UDP 161 SNMP
MSE WCS/NCS/PI UDP 162 SNMP Trap Receiver
WCS/NCS/PI MSE TCP 443 HTTPS (Configurable at install time)
WCS/NCS/PI MSE TCP 443 SOAP/XML
WCS/NCS/PI MSE TCP 8001 HTTPS (Configurable at install time)
WLC and Catalyst LAN Switches MSE and Spectrum Expert TCP 16113 NMSP
Various AP ICMP ICMP - Optional

Table 4 - WLC Protocols

WLC Protocols
Source Device Destination Device Protocol Destination Port Description
WCS/NCS/PI WLC TCP 21 FTP - Used to transfer files to/from devices
WCS and Various Management Stations WLC TCP 22 SSH - Used for remote Management (optional)
WCS and Various Management Stations WLC TCP 23 Telnet - Used for remote Management (optional)
AAA Servers / ISE WLC TCP/UDP 49 TACACS+
WCS and Various Management Stations WLC UDP 69 TFTP - Used to transfer files to/from devices
Various Management Stations WLC TCP 80 HTTP (Configurable at install time)
WLC WLC TCP 91
WLC Mobility Group members WLC EoIP IP Protocol 97 EoIP IP Protocol 97 EoIP Tunnel - Client Anchor/Tunneling traffic
NTP Server WLC UDP 123 NTP
WCS/NCS/PI WLC UDP 161 SNMP
WCS/NCS/PI WLC UDP 162 SNMP Trap Receiver
Various Management Stations WLC TCP 443 HTTPS (Configurable at install time)
WLC and Various Syslog Servers WLC UDP 514 Syslog (Optional)
AAA Servers / ISE WLC UDP 1812 / 1645 RADIUS
AAA Servers / ISE WLC UDP 1813 / 1646 RADIUS
AP WLC UDP 6352 RDLP
Various Management Stations (MSE, Spectrum Expert) WLC TCP 16113 LOCP TLS Port NMSP
WLC WLC UDP 16666 Mobility - non-secured
WLC WLC UDP 16667 Mobility - secured ** In release. 5.2+ feature was removed
AP WLC UDP 5246-5247 CAPWAP Ctl/Data
AP WLC UDP 5248 CAPWAP Mcast.
AP WLC UDP 12222-12223 LWAPP Ctl/Data
AP WLC UDP 12224 LWAPP Mcast.
Various AP ICMP ICMP - Optional

Table 5 - AP Protocols

AP CAPWAP-LWAPP Protocols
Source Device Destination Device Protocol Destination Port Description
Various AP UDP 69 TFTP - used for remote code update
Various AP TCP 22 SSH - used for optional remote troubleshooting access. Can be administratively disabled.
Various AP TCP 23 Telnet - used for optional remote troubleshooting access. Can be administratively disabled.
AP DNS Server TCP/UDP 53 DNS
AP DHCP Server UDP 68 DHCP
AP Various UDP 514 Syslog - Destination configurable. Default is 255.255.255.255
WLC AP UDP 1024 - 65535 * CAPWAP Ctl/Data
WLC AP UDP 5248 CAPWAP Mcast.
AP WLC UDP 6352 RDLP
WLC AP UDP 12222-12223 LWAPP Ctl/Data
WLC AP UDP 12224 LWAPP Mcast.
AP Monitor PC TCP 37540 for 2.4 GHz 37550 for 5GHz NSI Protocol for SE-Connect
Various AP ICMP ICMP - Optional

* - Arbitrary port number is assigned to every AP from range 1024 - 65535 when the AP joins the WLC. The WLC uses the number as the Destination Port for CAPWAP Ctl/Data as long as the AP is connected.

Table 6 - OEAP600 Firewall Protocols

AP CAPWAP-LWAPP Protocols
Source Device Destination Device Protocol Destination Port Description
WLC AP UDP 5246-5247 CAPWAP Ctl/Data

cuwn-ppm-02.gif

Source:

comments powered by Disqus