Cisco Catalyst 9800 to AireOS Mobility Peer Control Path Failure
Refer to the exhibit. An engineer is about to establish a mobility peer connection between a Cisco Catalyst 9800-CL version 16.10.1 e and Cisco AireOS 5520 version 8.8.120.0. The data path between the 9800-CL and AireOS 5520 is up, but its control path is down. Based on the configuration, what is the root of the issue? - 
Community Votes
67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you know that AireOS encrypted mobility requires explicit certificate exchange, which is often missing when connecting to a newer IOS-XE controller that handles encryption differently by default.
This question tests the interoperability requirements between Cisco IOS XE (Catalyst 9800) and AireOS WLCs for mobility peering, specifically focusing on encryption defaults. The page establishes that mismatched encryption settings are the root cause of control path failures.
Candidates often select option C, assuming the AireOS configuration itself is the problem. However, the AireOS config is valid; the issue is the lack of corresponding certificate trust on the AireOS side for the connection initiated by or with the 9800-CL.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The correct answer is D. When establishing a mobility peer between a Catalyst 9800 (IOS XE) and an AireOS WLC, if encrypted mobility is enabled on the AireOS side, a certificate hash key must be configured on the AireOS WLC to trust the certificate presented by the IOS XE peer. Without this specificmobility <peer-ip> cert-hash configuration on the AireOS device, the control path fails because the AireOS WLC cannot verify the identity of the modern IOS XE controller. The 9800-CL generates certificates automatically, but the legacy AireOS system needs explicit instruction on which certificate to accept.Why the Other Options Are Wrong
Option A is incorrect because data-link encryption is not required for the control path to establish; it affects data traffic security. Option B is incorrect because CAPS (Controller Access Point Server) uses MAC addresses for authentication in specific contexts, but this does not prevent the mobility control path from forming if certificates are handled correctly; furthermore, IOS XE typically uses certificates for mobility peers. Option C is partially descriptive but misleading; while the AireOS config shows encrypted mobility enabled, this setting is not inherently 'wrong'—it just mandates the presence of the certificate hash key mentioned in D. The failure isn't the use of encryption, but the missing trust anchor.Community Comment Notes
Some community members like user Farhad123 argue for C, stating that encrypted mobility causes the down state due to missing steps. This is a common misconception; the feature works if configured correctly. Users Rododendron2 and Jonycici correctly identify D, noting that the AireOS config requires the hash key to match the 9800's certificate. One commenter noted that 'control path encrypted by default' on the 9800 makes the AireOS config look suspicious, but the real blocker is the untrusted certificate on the AireOS side.Exam Strategy
When troubleshooting mobility peers between different OS generations, always check for certificate trust mismatches first. Remember that AireOS requires explicit certificate hash configuration for encrypted mobility, whereas IOS XE may handle this more automatically or require different parameters.
Frequently Asked Questions
Does Catalyst 9800 support encrypted mobility with AireOS?
Yes, but the AireOS WLC must be configured with the certificate hash key of the 9800 to establish a secure control path.
Why is option C incorrect regarding encrypted mobility?
Encrypted mobility is a valid configuration. It only fails if the receiving end (AireOS) lacks the necessary certificate trust configuration.