I have exactly the same problem. Other AP models were able to successfully be converted except 203H. I have 205H, 207, 225 connected as RAPs to my controller running 6.5.4.6 (this also happened with 6.5.3.1). I have tried 2 units of 203H and both failed.
I whitelisted them but only the 203H had vpn error:
Jul 6 09:40:49 cli[3136]: [primary tunnel] cli_proc_rapper_msg(864): Receive rapper msg from 59168 port.
Jul 6 09:40:49 cli[3136]: [primary tunnel] Error!!!: Received RC_OPCODE_ERROR lms 11x.2xx.8x.2xx tunnel 0.0.0.0 RC_ERROR_IKEP2_PKT1 debug-error:-8949
Jul 6 09:40:49 cli[3136]: [primary tunnel] tunnel_err_msg_recv(1602): Error!!! Received RC_OPCODE_ERROR peer public ip 11x.2xx.8x.2xx tunnel ip 0.0.0.0, controller ip 0.0.0.0, RC_ERROR_IKEP2_PKT1 debug-error:-8949
Jul 6 09:40:49 cli[3136]: tunnel_err_msg_recv 1624: Cause tunnel down by ipsec error, index primary tunnel