Here is what I can offer:
If RAPs are rebooting frequently and currently show active:
- Verify upstream bandwidth from the controller to the ISP is good.
- Verify operation of networking equipment between the RAP and the controller: switch <> firewall <> edge router <> ISP device.
- If all these check out, call TAC.
If RAPs are not currently active:
- Type "show crypto ipsec sa" to determine if the RAPs have an IPSec association, but just aren't showing online.
- If they are associating, but are not active ("show ap active"), then follow the steps above.