A corporation has employees working from their homes. A wireless engineer must connect 1810 OEAP at remote teleworker locations. All configuration has been completed on the controller side, but the network readiness is pending. Which two configurations must be performed on the firewall to allow the AP to join the controller? (Choose two.)

For a Cisco OfficeExtend Access Point (OEAP) to establish a connection with a Wireless LAN Controller (WLC) across the public internet, two fundamental network configurations are required. First, the WLC, which resides on the private corporate network, must be reachable from the AP at the remote location. This is accomplished by configuring Network Address Translation (NAT) on the firewall to map a public, internet-routable IP address to the WLC's AP-Manager interface. The WLC must also be configured with this public NAT IP. Second, the firewall must be configured to permit the Control and Provisioning of Wireless Access Points (CAPWAP) protocol traffic. CAPWAP uses UDP port 5246 for control plane communication and UDP port 5247 for data plane traffic, both of which must be allowed inbound to the WLC.

A. Block UDP ports 1812 and 1813 on the firewall. These are RADIUS ports. Blocking them is unrelated to the AP joining the controller and would likely break 802.1X authentication services.
C. Configure a static IP on the OEAP 1810. OEAPs are designed for zero-touch deployment and typically obtain an IP address via DHCP from the teleworker's home router. A static IP is not a requirement.
E. Allow UDP ports 12222 and 12223 on the firewall. These ports are used by the legacy Lightweight Access Point Protocol (LWAPP). The 1810 AP and 5520 WLC use the modern CAPWAP protocol.

1. Cisco Wireless LAN Controller Configuration Guide, Release 8.5, "Configuring OfficeExtend Access Points" chapter, "Firewall and Access Control List Configuration" section. This document states, "The following ports need to be opened on the firewall: ... For CAPWAP traffic: UDP 5246 and 5247." It also specifies, "If the controller is behind a firewall that is performing Network Address Translation (NAT), you must configure the controller with the IP address of the firewall." This directly supports options B and D.

2. Enterprise Mobility 8.5 Design Guide, "FlexConnect and OfficeExtend AP" chapter, "OfficeExtend AP" section. This guide details deployment considerations: "CAPWAP control and data (UDP 5246 and 5247) must be permitted from the Internet to the WLC AP-Manager interface." Regarding NAT, it states, "When the WLC is located behind a NAT device... the public IP address that maps to the WLC must be configured on the WLC." This confirms the necessity of both chosen configurations.

3. Cisco Aironet 1810 OfficeExtend Access Point Deployment Guide, "Prerequisites" section. This guide explicitly lists the required open ports for a successful deployment: "Ensure that the following ports are open on the firewall... CAPWAP control port - UDP 5246... CAPWAP data port - UDP 5247." It also notes, "If the controller is behind a Network Address Translation (NAT) device, you must configure the NAT IP address on the controller."