Cisco Catalyst 9800 to AireOS Mobility Peer Control Path Failure
Short answer
D The certificate hash key is missing from the AireOS 5520 WLC mobility configuration, which causes the control path to be down.
Question
Key Takeaways
The exam tests whether you know that AireOS encrypted mobility requires explicit certificate exchange, which is often missing when connecting to a newer IOS-XE controller that handles encryption differently by default.
This question tests the interoperability requirements between Cisco IOS XE (Catalyst 9800) and AireOS WLCs for mobility peering, specifically focusing on encryption defaults. The page establishes that mismatched encryption settings are the root cause of control path failures.
Common mistake: Candidates often select option C, assuming the AireOS configuration itself is the problem. However, the AireOS config is valid; the issue is the lack of corresponding certificate trust on the AireOS side for the connection initiated by or with the 9800-CL.
Expert Analysis
Why the Answer Is Correct
The correct answer is D. When establishing a mobility peer between a Catalyst 9800 (IOS XE) and an AireOS WLC, if encrypted mobility is enabled on the AireOS side, a certificate hash key must be configured on the AireOS WLC to trust the certificate presented by the IOS XE peer. Without this specific mobility <peer-ip> cert-hash configuration on the AireOS device, the control path fails because the AireOS WLC cannot verify the identity of the modern IOS XE controller. The 9800-CL generates certificates automatically, but the legacy AireOS system needs explicit instruction on which certificate to accept.
Why the Other Options Are Wrong
Option A is incorrect because data-link encryption is not required for the control path to establish; it affects data traffic security. Option B is incorrect because CAPS (Controller Access Point Server) uses MAC addresses for authentication in specific contexts, but this does not prevent the mobility control path from forming if certificates are handled correctly; furthermore, IOS XE typically uses certificates for mobility peers. Option C is partially descriptive but misleading; while the AireOS config shows encrypted mobility enabled, this setting is not inherently 'wrong'—it just mandates the presence of the certificate hash key mentioned in D. The failure isn't the use of encryption, but the missing trust anchor.
Community Comment Notes
Some community members like user Farhad123 argue for C, stating that encrypted mobility causes the down state due to missing steps. This is a common misconception; the feature works if configured correctly. Users Rododendron2 and Jonycici correctly identify D, noting that the AireOS config requires the hash key to match the 9800's certificate. One commenter noted that 'control path encrypted by default' on the 9800 makes the AireOS config look suspicious, but the real blocker is the untrusted certificate on the AireOS side.
Exam Strategy
When troubleshooting mobility peers between different OS generations, always check for certificate trust mismatches first. Remember that AireOS requires explicit certificate hash configuration for encrypted mobility, whereas IOS XE may handle this more automatically or require different parameters.
Frequently Asked Questions
Does Catalyst 9800 support encrypted mobility with AireOS?
Why is option C incorrect regarding encrypted mobility?
Community Votes
67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
raresalexa_22 👍 1 Answered CC. Encrypted mobility is being used in the 5520 configuration, which causes the control path to be down. Explanation: The AireOS 5520 configuration explicitly enables encrypted mobility (encrypt enable and data-dtls enable), which requires corresponding support on the 9800-CL. If the 9800-CL does not have compatible settings or the proper certificate setup, the control path will not establish correctly due to encryption mismatches. The key issue is likely related to encrypted mobility configurations not aligning properly between the devices, requiring either configuration adjustments or additional settings for compatibility.
-
Farhad123 👍 1C. Encrypted mobility is being used in the 5520 configuration, which causes the control path to be down: This is correct. The AireOS 5520 configuration shows that encrypted mobility is enabled. Encrypted mobility requires additional configuration steps, such as exchanging certificates between the devices, to establish a secure control path. Since the control path is down, it's likely that these additional steps have not been completed.
-
Jonycici 👍 1 Answered DD is correct. The Cisco Catalyst 9800 Series control path is DTLS encrypted by default. Data path DTLS can be enabled when you add the mobility peer.
-
Rododendron2 👍 1 Answered D9800-CL - cloud based WLC - hash key is required in AireOS config C is not correct (control path encrypted by default)
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.