When a data path mobility tunnel fails to come up between WLCs, one of the key troubleshooting steps is to verify whether the necessary ports are open through firewalls in the path. Cisco AireOS mobility tunnels use UDP port 16666 for mobility control traffic and IP Protocol 97 (EtherIP) for mobility data traffic in legacy mode. Establishing a Telnet connection from a local PC to the firewall on port 16666 tests whether the control path port is reachable and not being blocked by the firewall. If the Telnet connection fails, it confirms that the firewall is blocking port 16666, which would prevent the mobility control tunnel from establishing — a prerequisite for the data tunnel. While a Telnet test to port 16666 specifically tests the control path, in practice this is the first verification performed when the data path cannot establish (since the data path depends on the control path being operational). IP Protocol 97 cannot be tested via Telnet (which is TCP). The mping command (Option D, not ' mapping ' ) tests mobility tunnel connectivity from the WLC itself after the tunnel is established. Reference: WLSD Study Guide — Mobility Tunnel Troubleshooting, Firewall Port Requirements, UDP 16666 and IP Protocol 97.

Designing for 50-100 clients per cell with 5 Mbps minimum throughput and no 802.11b clients requires two critical optimizations. First, setting minimum mandatory data rates to 12-18 Mbps (Option A) removes legacy lower data rates from the AP ' s supported rate set. When 1, 2, 5.5, and 11 Mbps rates are disabled and 12 Mbps becomes the minimum mandatory rate, legacy 802.11b clients are excluded from the cell, airtime efficiency improves dramatically, and clients connecting at higher rates use less channel time per frame, increasing effective capacity. Second, Flexible Radio Assignment (FRA) for 2.4 GHz reduction (Option D) is critical in high-density environments. FRA allows the WLC to dynamically reassign some 2.4 GHz radios to 5 GHz operation or monitor mode, reducing 2.4 GHz cell size and interference while increasing 5 GHz capacity in the high-density area. Option C directly contradicts the no-802.11b requirement. Option B (6 SSIDs per AP) is a management consideration but does not directly address throughput. Option E (80-160 MHz channels) would consume available spectrum, reducing the number of usable non-overlapping channels and worsening co-channel interference at high density. Reference: WLSD Study Guide — High-Density WLAN Design, Minimum Data Rate Configuration, Flexible Radio Assignment (FRA).

In a high-availability configuration with multiple WLCs in a mobility group, when APs that only have a primary controller configured become orphaned (their primary WLC fails), they will by default join the controller with the lowest percentage of associated APs per license capacity. This load-based selection mechanism ensures a balanced distribution of APs across the remaining controllers in the mobility group. The WLC with the lowest percentage of AP capacity utilized is chosen because it has the most headroom to accept additional APs without becoming overloaded. This prevents a single backup controller from becoming overwhelmed while others remain underutilized. The selection is not based on absolute number of APs (Option D), available free licenses in absolute terms (Option A), or CPU utilization (Option C) — it specifically uses the percentage of license capacity occupied, which normalizes across controllers with different total AP capacities. Reference: WLSD Study Guide — N+1 Redundancy Default Behavior, AP Orphan Failover Logic, WLC Load-Based AP Assignment.

In a high-availability configuration with multiple WLCs in a mobility group, when APs that only have a primary controller configured become orphaned (their primary WLC fails), they will by default join the controller with the lowest percentage of associated APs per license capacity. This load-based selection mechanism ensures a balanced distribution of APs across the remaining controllers in the mobility group. The WLC with the lowest percentage of AP capacity utilized is chosen because it has the most headroom to accept additional APs without becoming overloaded. This prevents a single backup controller from becoming overwhelmed while others remain underutilized. The selection is not based on absolute number of APs (Option D), available free licenses in absolute terms (Option A), or CPU utilization (Option C) — it specifically uses the percentage of license capacity occupied, which normalizes across controllers with different total AP capacities. Reference: WLSD Study Guide — N+1 Redundancy Default Behavior, AP Orphan Failover Logic, WLC Load-Based AP Assignment.

Link Aggregation Group (LAG) is the correct design approach for a single Cisco 9800-40 WLC that requires high availability between the WLC and the core switch in the event of a cable failure. LAG combines multiple physical ports on the WLC into a single logical channel, providing both redundancy (traffic automatically redistributes across remaining links when one fails) and load balancing (traffic is distributed across all active links). Importantly, LAG operates transparently to AP management — APs see a single logical uplink regardless of which physical port their traffic traverses. With a single WLC, Multi-LAG (Option B) is not applicable — Multi-LAG is a feature of the Catalyst 9800 that allows multiple separate LAG bundles for different network connections, typically used with SSO pairs. LACP (Option C) is the protocol used to negotiate LAG member links — it is the mechanism within LAG, not an independent design approach. PAgP (Option D) is a Cisco proprietary alternative to LACP for port aggregation but the question asks for the design approach, which is LAG. Reference: WLSD Study Guide — Catalyst 9800 LAG Design, Port Redundancy and Load Balancing, Single-Controller High Availability.

In a Cisco Catalyst 9800 SSO deployment using Link Aggregation Group (LAG) for network interface redundancy, the SSO pair — WLC1 (active) and WLC2 (standby) — must both have their physical interfaces connected to the network infrastructure as part of the LAG bundle. LAG on the 9800 in an SSO configuration is implemented as a multi-chassis LAG across both the active and standby controllers. This means both WLC1 and WLC2 contribute physical member links to the port channel, and the connected switches must have LACP or PAgP bundle members from both controllers in the same port channel group. When an SSO failover occurs — WLC1 fails and WLC2 takes over as active — the LAG remains operational because WLC2 ' s physical links are already established members of the bundle and continue forwarding traffic without any link renegotiation. If only WLC1 had LAG connectivity and WLC2 had independent links, an SSO failover would cause a LAG topology change requiring re-convergence, introducing downtime. WLC3 is a separate N+1 backup controller joined via a mobility tunnel — not part of the SSO pair and its LAG configuration is independent. Reference: WLSD Study Guide — Catalyst 9800 SSO with LAG, Multi-Chassis Link Aggregation, High Availability Network Redundancy Design.