> <proposed text>
> 3.  CAPWAP Transport
> [...]
>    In order for CAPWAP to be compatible with potential middleboxes in
>    the network, CAPWAP implementations MUST send return traffic from the
>    same port on which it received traffic from a given peer.  Further,
>    any unsolicited requests generated by a CAPWAP node MUST be sent on
>    the same port.
> </proposed text>
> 
> And the same text in the NAT Considerations section.

> Section 11 and 9:
> 
> Another issue with NATs that my read through don't think is covered in
> enough detail is the importance of the source address for the CA->WTP
> Image Data Request messages. They need to be sent from the CA control
> channel destination port on which it received the Image Data Request
> from the WTP. And it needs to send to the source address present in that
> download initiating request.
> 
> For the CA behind NAT the same applies for the WTP data upload.