Expert · Wireless networking · topic 47 of 57 · 30 min
WLAN architectures, CAPWAP and AP modes
Explanation
Why architecture matters
One AP at home is easy. A hospital with 200 APs is not: every AP needs the same SSIDs, security, channels and power settings, and clients must roam between them during calls. Configuring 200 boxes one by one is slow and error-prone. Wireless architectures are about where the configuration and the "brain" live.
Three architectures
| Architecture | How it is managed | Good for |
|---|---|---|
| Autonomous APs | Each AP configured on its own (CLI or web page). Each SSID is mapped to a VLAN on the AP. | Very small sites with one or two APs |
| Lightweight APs + WLC | A Wireless LAN Controller configures and controls all APs centrally. | Campuses, hospitals, large offices |
| Cloud-managed (for example Cisco Meraki) | APs connect over the internet to a cloud dashboard; configuration and monitoring are done there. User traffic stays local. | Many branches with no on-site IT staff |
A WLC can be a hardware appliance, a virtual machine in the data centre or cloud, or even built into a switch or an AP for small sites. Cisco's current controllers are the Catalyst 9800 family; older ones run AireOS. The ideas below apply to both.
Split-MAC: sharing the work
With lightweight APs, the 802.11 functions are split between the AP and the WLC. This is called split-MAC architecture. The AP keeps the jobs that must happen in real time, within microseconds. The WLC takes the jobs that need a view of the whole network.
| Lightweight AP (real-time) | WLC (management) |
|---|---|
| Sending and receiving 802.11 frames | RF management: choosing channels and power for all APs |
| Beacons and probe responses | Security management and client authentication |
| Acknowledgements and retransmissions | Association and roaming management |
| Frame encryption and decryption | QoS management |
CAPWAP: the tunnel between AP and WLC
Lightweight APs and the WLC talk using CAPWAP (Control And Provisioning of Wireless Access Points), an open standard. Each AP builds two tunnels to its WLC:
- Control tunnel, UDP port 5246: configuration and management messages. It is always encrypted with DTLS (Datagram Transport Layer Security, the UDP version of TLS).
- Data tunnel, UDP port 5247: the clients' own traffic, carried to the WLC. DTLS encryption is optional here and usually off by default.
Because client traffic is tunnelled to the WLC in local mode, the WLC is where it enters the wired VLANs. That is why the access switch port for such an AP is usually a plain access port in the AP management VLAN: the switch never sees the client VLANs.
AP modes
| Mode | What the AP does |
|---|---|
| Local (default) | Serves clients and tunnels all their traffic to the WLC. Scans other channels in spare moments. |
| FlexConnect | For branches across a WAN: can switch client traffic locally onto VLANs and keep serving clients if the link to the WLC fails. |
| Monitor | Serves no clients; listens on all channels to find rogue APs, detect attacks and help locate devices. |
| Sniffer | Captures 802.11 frames on a channel and sends them to a PC running a packet analyser such as Wireshark. |
| Rogue detector | Listens on the wired side to spot rogue APs connected to the LAN. |
| Bridge / mesh | Links APs wirelessly to each other, for example between buildings, as a point-to-point or mesh network. |
| SE-Connect | Spectrum analysis: scans all frequencies to find non-Wi-Fi interference such as microwave ovens. |
Switch ports for APs
- Lightweight AP in local mode: access port, in the AP management VLAN. All client traffic is inside CAPWAP.
- Autonomous AP with several SSIDs: trunk port, because the AP itself puts each SSID onto its VLAN.
- FlexConnect AP with local switching: trunk port, for the same reason.
- Most APs are powered by PoE (Power over Ethernet) from the switch, so check the switch power budget.
WLC ports and interfaces
Ports are the physical sockets. The service port is for out-of-band management (a separate management network) and recovery; it is not a trunk. Distribution system ports connect the WLC to the switched network and carry all AP and client traffic; they are normally 802.1Q trunks. Several distribution system ports can be bundled with LAG (link aggregation, like an EtherChannel) for speed and redundancy; AireOS controllers support only a static bundle (mode on), not LACP or PAgP. There is also a console port, and a redundancy port for a high-availability pair.
Interfaces are logical, like VLAN interfaces on a switch. The management interface is the WLC's own address for management and for CAPWAP to the APs. Dynamic interfaces map WLANs to VLANs: each has a VLAN ID, an IP address and a DHCP server, so the staff WLAN can land in VLAN 10 and the guest WLAN in VLAN 30. There are also the virtual interface (used for DHCP relay and web login pages), the service-port interface and the redundancy management interface.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
WLAN architectures, CAPWAP and AP modes · 1/7
This lesson is about how company Wi-Fi is built and managed when there are many access points.
Prefer a video by a teacher? Find free videos on “CCNA wireless architectures WLC CAPWAP split MAC AP modes” on YouTube ↗
In real life: A hospital chain with branches
A hospital group in Hyderabad has a main campus with 220 APs and 15 small clinics. The campus APs are lightweight in local mode, on access ports, with a pair of WLCs in the data centre. The clinics use FlexConnect APs on trunk ports, so patient-record traffic is switched locally and Wi-Fi keeps working even if the WAN link to the data centre drops. Two APs in the main building run in monitor mode to detect rogue APs.
interface GigabitEthernet1/0/10
description LWAP-Floor2-East
switchport mode access
switchport access vlan 50
spanning-tree portfastPractice (0/3 done)
Which switch port type is normally used for a lightweight AP in local mode?
A firewall sits between a branch and the WLC. Which ports must it allow for lightweight APs to join and pass traffic?
Choose an AP mode (and the switch port type where it matters) for each case: (a) normal APs in an office with a local WLC; (b) a small branch over a WAN link that must keep Wi-Fi working if the WAN fails; (c) an AP that should only look for rogue APs and attacks; (d) capturing Wi-Fi frames for Wireshark to debug a problem; (e) a wireless link between two buildings on a campus.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Wi-Fi security: WPA2, WPA3 and guest networksWireless networking · same module
- Configuring a WLAN on a WLC and troubleshooting Wi-FiWireless networking · same module
- EtherChannel: bundling linksSpanning Tree and EtherChannel
- Trunks and 802.1Q taggingSwitching and VLANs
- Layer 2 security: port security, DHCP snooping, DAINetwork security
- How a switch learns and forwardsEthernet, MAC addresses and the Cisco CLI
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
In split-MAC architecture, which job stays on the lightweight AP?
Answer: Sending beacons and acknowledgements
Real-time tasks like beacons, ACKs and encryption stay on the AP; the WLC handles network-wide management.
Which statement about CAPWAP is correct?
Answer: The control tunnel is encrypted with DTLS; data encryption is optional
Control traffic on UDP 5246 is always protected by DTLS; data on UDP 5247 can be encrypted but often is not.
Which AP mode lets a branch keep serving clients if the WAN link to the WLC fails?
Answer: FlexConnect
FlexConnect can switch traffic locally and keep clients connected without the WLC.
What does a dynamic interface on a WLC do?
Answer: Maps a WLAN to a VLAN with its own IP address
Dynamic interfaces are like SVIs: they place each WLAN's clients into a VLAN.
Which LAG mode do AireOS WLCs support on distribution system ports?
Answer: Static (mode on)
AireOS WLCs support only a static bundle, so the switch side must use channel-group mode on.
In the WLC GUI, where do you map a WLAN to a VLAN?Related
Answer: By choosing a dynamic interface on the General tab
The dynamic interface chosen on the General tab places the WLAN's clients in that interface's VLAN.
What does a wireless LAN controller do?Related
Answer: Centrally manages many lightweight access points
A WLC pushes configuration to APs and handles roaming.
From Network devices
Which command makes Fa0/5 an access port in VLAN 30 (after switchport mode access)?Related
Answer: switchport access vlan 30
switchport access vlan 30 sets the data VLAN of an access port.
Which pair of modes does NOT form an EtherChannel?Related
Answer: passive and passive
Passive only answers LACP messages, so with passive on both ends nobody starts.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 2 more topics in “Wireless networking” before its exam: Wi-Fi security: WPA2, WPA3 and guest networks, Configuring a WLAN on a WLC and troubleshooting Wi-Fi.
- Module 10 exam: Wireless networking · 13 questions · 25 min, without help. 4 topics of this module still to finish first.
- Then the next module, Automation, SDN and cloud networking. 57 topics left in the course before the final exam.