It is already possible to operate CAPs over a WAN line, only certain requirements must be met. The AP behavior can also be optimized, it is documented here.
The AP goes online as soon as it has established an IPSec tunnel to the controller. If no tunnel has been established, the controller shows it as offline, even though the AP is reachable and you can ping it.
Use show crypto ipsec sa peer <CAP-IP> to check the IPSec status.
I don't think you'll get anywhere with an SSH session on the AP, you won't find the familiar syntax there.
Troubleshoot IP-Sec behavior on the controller instead. Increase log level on mobility controller by using the following commands in MM:
1) Debugging IKE and ISAKMP
OS version dependent
(config)# logging level debugging security process crypto
(config)# logging level debugging security subcat ike
or
(config)# logging security process crypto level debugging
(config)# logging level debugging security subcat ike
2) Debugging L2TP and local-db authentication:
(config)# logging level debugging security process l2tp
(config)# logging level debugging security process localdb
Check log on the mobility controller useng commands:
show log system 300 | include <AP-Name>,<AP-IP>,<AP-Wired-MAC>
show log security 300 | include <AP-Name>,<AP-IP>,<AP-Wired-MAC>
------------------------------
Regards,
Waldemar
ACCX # 1377, ACEP, ACX - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------