There are many different things that can affect an APs CAPWAP connection. Commonly firewalls, IDP, content filters and MPLS networks are the culprits. Please be sure you have white listed/allowed the APs full access on ports UDP 12222 and TCP 22. As a test you can switch an AP over to HTTP over TCP on 80 and 443.
SSH into an AP and run the following commands in order.
no capw cli en
capw cli transport http
capw cli en
save conf
The AP will now traverse ports 80 and 443 instead of 12222 and 22.
