Questions? Call 1.800.716.8955

Chapter 18

Wireless Architectures and WLC Configuration

Exam topics covered

2.6 Describe Cisco Wireless Architectures and AP modes

2.7 Describe physical infrastructure connections of WLAN components (AP, WLC, access/trunk ports, and LAG)

2.8 Describe network device management access (Telnet, SSH, HTTP, HTTPS, console, TACACS+/RADIUS, and cloud managed)

2.9 Interpret the wireless LAN GUI configuration for client connectivity, such as WLAN

creation, security settings, QoS profiles, and advanced settings Foundation. An enterprise may run thousands of APs, far too many to configure one by one. This chapter shows how Cisco architectures centralise control in a wireless LAN controller (WLC) or the cloud, how APs and controllers are cabled to the switched network, how administrators reach them securely, and how to read the WLC GUI pages that create a WLAN, map it to a VLAN, secure it, apply a QoS profile and set advanced options. The exam shows screenshots of these pages and asks what a setting does.

18.1 Cisco Wireless Architectures

18.1.1 Autonomous APs

An autonomous AP is a self-contained device: it runs its own full configuration, handles all 802.11 functions, and bridges each SSID to a VLAN on its Ethernet uplink, which is therefore an 802.1Q trunk. Each AP is managed individually, so in a large WLAN every change must be repeated on every AP, channel and power planning is manual, and every user VLAN must reach every AP's access switch.

18.1.2 Lightweight APs and the split-MAC architecture

Cisco's lightweight AP (LAP) architecture divides the 802.11 work between the AP and a WLC; this is the split-MAC architecture. The AP keeps the real-time functions that must happen within microseconds at the radio, and the WLC takes the management functions that benefit from a network-wide view (Table 18-1). A lightweight AP has no useful configuration of its own: when it boots it obtains an IP address, discovers a WLC (by DHCP option 43, DNS lookup of CISCO-CAPWAP-CONTROLLER , broadcast or a previously learned address), joins it and downloads its configuration and firmware.

Table 18-1 Split-MAC division of functions

Lightweight AP (real-time) WLC (management)

Transmitting beacons, answering probes Client authentication and association management Sending ACKs and retransmissions Security policy, 802.1X/AAA with RADIUS Encryption and decryption of 802.11 frames Roaming management between APs Frame queuing and packet prioritization Radio Resource Management (RRM): channel and power

  • 802.11 to 802.3 frame translation (in
  • FlexConnect)
  • QoS policy, WLAN-to-VLAN mapping, rogue
  • detection

The AP and WLC communicate using CAPWAP (Control and Provisioning of Wireless Access Points, RFC 5415), which builds two tunnels between the AP and the WLC's management address:

CAPWAP control on UDP 5246 carries configuration and management messages. It is always encrypted with DTLS.

CAPWAP data on UDP 5247 carries client traffic, encapsulated so that the AP needs to be in only one VLAN. Data encryption with DTLS is optional.

Wlc

Lap

Access switch

AP port: access VLAN 100

Wlc

  • management interface
  • CAPWAP control — UDP 5246 (DTLS encrypted)
  • CAPWAP data — UDP 5247 (client frames)
  • Real-time 802.11 functions at the AP
  • Management functions at the WLC

Figure 18-1 Split-MAC: a lightweight AP tunnels control and data traffic to the WLC with CAPWAP.

18.1.3 Cloud-managed APs

In a cloud-managed architecture, such as Cisco Meraki, there is no on-premises controller. APs connect to the Internet, register with a cloud dashboard, and receive their configuration from it. Only management traffic goes to the cloud; client data is switched locally, so an Internet outage stops configuration changes but not wireless service.

Table 18-2 Comparing wireless architectures

Best for Very small sites Campus, large enterprise Many distributed sites

18.2 WLC Deployment Models

Where the WLC sits determines how much traffic crosses the WAN and how large the network can grow.

Centralized (unified) – one or more physical WLCs (appliances such as the Catalyst 9800-40/80) in a central location such as the data centre or campus core. Typical capacity is thousands of APs per controller. All APs run in local mode, so all client traffic is tunnelled to the central WLC.

Cloud-based controller – the WLC runs as a virtual machine in a public or private cloud (Catalyst 9800-CL).

Embedded – the controller function runs inside an access switch (Catalyst 9300 with an embedded WLC), suitable for a branch with a few hundred APs or fewer.

Embedded Wireless Controller (EWC) on an AP – one AP in the group (a Catalyst 9100 series AP) also acts as the WLC for the others; for small sites with up to roughly 100 APs. (On older Cisco Mobility Express it was called the master AP.)

FlexConnect – APs at remote branches join a central WLC across the WAN, but switch client traffic locally at the branch instead of tunnelling it back. If the WAN fails, existing clients keep working in standalone mode.

Local mode (centralized) FlexConnect with local switching

Wlc

Wlc

Figure 18-2 Client traffic path in local mode (tunnelled to the WLC) compared with FlexConnect local switching.

18.3 Lightweight AP Modes

A lightweight AP can run in one of several modes, set from the WLC. The mode determines whether the AP serves clients, what it does with their traffic, or whether it only listens.

Table 18-3 Cisco lightweight AP modes

Mode

Serves

clients?

  • Purpose
  • Local
  • (default)

Yes Tunnels all client traffic to the WLC in CAPWAP. Briefly scans other channels (off-channel scanning) for RRM and rogue detection.

FlexConnect Yes For branches across a WAN: switches traffic locally per WLAN (or centrally), can authenticate locally, and keeps working if the WLC link fails.

Monitor No Dedicated sensor: scans all channels for rogue APs, intrusion detection (wIPS) and location tracking.

Sniffer No Captures all 802.11 frames on a channel and forwards them to a PC running a protocol analyser such as Wireshark.

Rogue

detector

No Radios off; listens on the wired network for MAC addresses of rogue clients learned over the air, to find rogue APs plugged into the LAN.

SE-Connect No Spectrum Expert: spectrum analysis of all RF energy, including non-Wi-Fi interferers, using Cisco CleanAir/Spectrum Expert tools. Bridge /

Mesh

Yes Builds wireless backhaul links between APs (point-to-point or mesh), with a wired root AP (RAP) and wireless mesh APs (MAPs).

Flex+Bridge Yes Combines FlexConnect behaviour with mesh backhaul.

Know which modes serve clients (local, FlexConnect, bridge/mesh, Flex+Bridge) and which do not (monitor, sniffer, rogue detector, SE-Connect). Remember CAPWAP ports: UDP 5246 control and UDP 5247 data. In local mode traffic is tunnelled to the WLC; in FlexConnect it can be switched locally at the AP.

18.4 Physical Infrastructure Connections

18.4.1 Connecting APs to switches

Most APs are powered by PoE from the access switch. How the switch port is configured depends on the AP's mode:

A local-mode AP sends everything inside CAPWAP from its own IP address, so it needs only one VLAN: configure an access port in the AP management VLAN. Client VLANs exist only at the WLC.

A FlexConnect AP with local switching places each WLAN's traffic into a VLAN at the branch, so its port is an 802.1Q trunk. The AP's own management traffic uses the native

Vlan.

An autonomous AP also needs a trunk, one VLAN per SSID.

SW1(config)# interface GigabitEthernet1/0/10
SW1(config-if)# description LAP-Floor1 (local mode)
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 100 ! AP management VLAN
SW1(config-if)# spanning-tree portfast
SW1(config-if)# interface GigabitEthernet1/0/11
SW1(config-if)# description LAP-Branch (FlexConnect)
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 100 ! AP management untagged
SW1(config-if)# switchport trunk allowed vlan 10,20,100 ! locally switched WLAN VLANs
SW1(config-if)# spanning-tree portfast trunk

18.4.2 WLC ports

A WLC has ports (physical connectors) and interfaces (logical connections with IP addresses and VLANs). The physical ports on an AireOS appliance are:

Service port (SP) – a dedicated out-of-band management Ethernet port, used for initial setup and recovery. It connects to an access port in the management network and supports no VLAN tagging.

Distribution system (DS) ports – the main data ports, connected to the switched network as 802.1Q trunks. All AP CAPWAP traffic and client traffic flow over them. Several DS ports are normally bundled with LAG.

Redundancy port (RP) – connects directly to a second WLC for high availability (stateful switchover, HA SSO), carrying keepalives and state synchronisation.

Console port – serial out-of-band CLI access, as on routers and switches.

18.4.3 WLC interfaces

Management interface – the in-band IP address used for GUI/SSH/SNMP management and as the CAPWAP endpoint that APs join.

Dynamic interfaces – similar to SVIs: each has a VLAN ID, an IP address and a DHCP server, and each WLAN is mapped to one, which is how wireless users end up in a given VLAN and subnet.

Virtual interface – a non-routable address (typically 192.0.2.1) used for DHCP relay and as the redirect address for web authentication; it must be the same on all WLCs in a mobility group.

Service-port interface – the IP address bound to the service port.

Redundancy management interface – used with HA SSO to manage the standby WLC.

Wlc

  • Logical interfaces (carried on the DS ports, tagged)
  • Management 10.10.100.5 · VLAN 100
  • Dynamic “corp-vlan10” 10.10.10.5 · VLAN 10
  • Dynamic “guest” 10.10.20.5 · VLAN 20
  • Virtual 192.0.2.1
  • SP RP DS ports 1–2 (LAG) L3

Wlc

Figure 18-3 WLC physical ports (DS, SP, RP) and the logical interfaces carried on the DS ports. 18.4.4 Link aggregation (LAG)

To add bandwidth and redundancy, the WLC bundles its DS ports with link aggregation (LAG). AireOS WLCs support a single LAG containing all DS ports, and they do not negotiate with LACP or PAgP, so the switch side must use a static EtherChannel: channel-group n mode on . (Catalyst 9800 controllers, which run IOS XE, also support LACP.) If one link fails, traffic continues on the others without APs or clients noticing.

DSW1(config)# interface range GigabitEthernet1/0/1 - 2
DSW1(config-if-range)# switchport mode trunk
DSW1(config-if-range)# switchport trunk allowed vlan 10,20,100
DSW1(config-if-range)# channel-group 1 mode on ! static: WLC does not speak LACP/PAgP

DSW1 — console

DSW1# show etherchannel summary
  • Flags: D - down P - bundled in port-channel
  • I - stand-alone s - suspended
  • R - Layer3 S - Layer2
  • U - in use f - failed to allocate aggregator
  • (remaining flag lines omitted)
  • Number of channel-groups in use: 1
  • Number of aggregators: 1
  • Group Port-channel Protocol Ports

------+-------------+-----------+----------------------------------------------- 1 Po1(SU) - Gi1/0/1(P) Gi1/0/2(P)

Figure 18-4 The EtherChannel to the WLC is up (SU) with both ports bundled; the Protocol column shows “-” because mode on

uses no negotiation protocol. (Output is illustrative of Cisco IOS 15 / IOS XE.)

Watch out

Configuring mode active or mode desirable on the switch toward an AireOS WLC leaves the bundle down, because the WLC never answers LACP or PAgP. Also make sure every VLAN used by the management and dynamic interfaces is allowed on the trunk.

18.5 Management Access to APs and WLCs

Like routers and switches, WLCs and autonomous APs can be managed in several ways. Lightweight APs are managed through the WLC; cloud-managed APs through the cloud dashboard.

Table 18-4 Management access methods

  • Method Transport Secure? Notes
  • Console Serial cable Physical access
  • only
  • Out-of-band; used for initial setup and
  • recovery

Telnet TCP 23 No (clear text) Disabled by default on the WLC; avoid SSH TCP 22 Yes Encrypted CLI access; preferred

Administrator logins can be checked against local user accounts or centrally with RADIUS (UDP 1812/1813) or TACACS+ (TCP 49). TACACS+ is generally preferred for device administration because it encrypts the entire payload and separates authentication, authorization and accounting, allowing per-command authorization (see Chapter 28). On the WLC you add the servers under Security > AAA and set the order in which they are tried under Security > Priority Order > Management User.

Note

The GUI figures in this chapter are generic mock-ups modelled on the classic Cisco AireOS WLC interface, which is what most CCNA exam screenshots show. The Catalyst 9800 (IOS XE) GUI organises the same settings into WLAN profiles, policy profiles and tags, but the concepts are identical.

WLC — Management > Telnet-SSH | HTTP-HTTPS | Security > Priority Order Allow New Telnet Sessions No

  • Allow New SSH Sessions Yes
  • HTTP Access Disabled
  • HTTPS Access Enabled
  • Web Session Timeout 30 minutes
  • Management User order 1. TACACS+ 2. LOCAL
  • TACACS+ server 1 10.10.50.10 port 49 Enabled

Figure 18-5 Secure management access: SSH and HTTPS enabled, Telnet and HTTP disabled, administrators authenticated by TACACS+ with local fallback.

18.6 Configuring a WLAN in the WLC GUI

A WLAN on a WLC ties together an SSID, a security policy, a QoS profile and a VLAN (through an interface). Creating one involves four tasks: (1) make sure a dynamic interface exists for the WLAN's VLAN, (2) create the WLAN, (3) configure its security, QoS and advanced settings, and (4) enable it. In this section we create a WLAN named Corp for employees in VLAN 10.

18.6.1 Step 1: Create a dynamic interface

Under Controller > Interfaces > New, give the interface a name and VLAN ID, then fill in its IP settings. The DHCP server field tells the WLC where to relay client DHCP requests; the switch must allow VLAN 10 on the trunk and route for the subnet.

Figure 18-6 A dynamic interface maps VLAN 10 and subnet 10.10.10.0/24 to the WLC.

18.6.2 Step 2: Create the WLAN and set the General tab

Under WLANs, choose Create New > Go and enter a Profile Name (an internal label), the SSID (what clients see) and an ID (1–512; by default APs broadcast WLANs with IDs 1–16). The WLAN edit page has the tabs General, Security, QoS, Policy-Mapping and Advanced. On the General tab you enable the WLAN, restrict it to particular radios if needed, select the Interface/Interface Group (this is where the WLAN is mapped to VLAN 10) and choose whether to broadcast the SSID.

WLC — WLANs > Edit “Corp-Profile” [ General ] Security QoS Policy-Mapping Advanced Profile Name Corp-Profile

Figure 18-7 General tab: the WLAN is enabled and mapped to the corp-vlan10 dynamic interface.

18.6.3 Step 3: Security tab

The Security tab has sub-tabs for Layer 2, Layer 3 and AAA Servers. Layer 2 security selects WPA2 and/or WPA3, the encryption cipher (AES/CCMP), and the authentication key management (AKM): PSK (or SAE for WPA3) for a passphrase, or 802.1X to authenticate each user against a RADIUS server listed on the AAA Servers tab. Layer 3 security is used for web authentication (captive portals), common on guest WLANs. Chapter 32 explains these methods in depth.

WLANs > Edit “Corp-Profile” General [ Security ] > [ Layer 2 ] Layer 3 AAA Servers Layer 2 Security WPA+WPA2

  • MAC Filtering ☐
  • WPA2 Policy ☑ Encryption: ☑ AES (CCMP128) ☐ TKIP
  • Authentication Key Mgmt ☐ 802.1X ☑ PSK ☐ FT PSK
  • PSK Format ASCII ••••••••••••
  • Protected Mgmt Frame Optional

Figure 18-8 Security > Layer 2: WPA2 with AES and a pre-shared key (WPA2-Personal).

18.6.4 Step 4: QoS tab

Wireless is a shared, half-duplex medium, so prioritising delay-sensitive traffic matters even more than on wired links. Each WLAN is assigned one of four QoS profiles, which sets the maximum priority (802.11e/WMM access category, and the DSCP marking on the CAPWAP outer header) that traffic in the WLAN may receive. The default is Silver.

Table 18-5 WLC QoS profiles

  • Profile Intended traffic WMM access category
  • Platinum Voice Voice (highest)
  • Gold Video Video
  • Silver (default) Best effort, normal data Best effort
  • Bronze Background, guest traffic Background (lowest)

WLANs > Edit “Corp-Profile” General Security [ QoS ] Policy-Mapping Advanced Quality of Service (QoS) Gold (video) ▾

Figure 18-9 QoS tab: the Corp WLAN may use up to the Gold (video) priority. A voice WLAN would use Platinum; a guest WLAN, Bronze.

18.6.5 Step 5: Advanced tab

The Advanced tab collects many options. The ones most worth recognising are: Allow AAA Override – lets the RADIUS server assign per-user settings such as a VLAN or QoS level, overriding the WLAN defaults.

Enable Session Timeout – how long (in seconds) before a client must reauthenticate (default 1800 s for 802.1X WLANs).

Client Exclusion – temporarily blocks clients that fail authentication repeatedly (default timeout 60 s).

DHCP Addr. Assignment Required – clients must obtain their address by DHCP; static addresses are refused.

Maximum Allowed Clients – limits clients per WLAN (0 = unlimited).

Peer-to-Peer Blocking – stops clients on the WLAN talking directly to each other (useful for guests).

FlexConnect Local Switching – switches this WLAN's traffic locally at FlexConnect APs. WLANs > Edit “Corp-Profile” General Security QoS Policy-Mapping [ Advanced ] Allow AAA Override ☐ Enabled

  • Coverage Hole Detection ☑ Enabled
  • Enable Session Timeout ☑ 1800 (seconds)
  • Client Exclusion ☑ Enabled Timeout 60 s
  • Maximum Allowed Clients 0
  • P2P Blocking Action Disabled
  • DHCP Addr. Assignment ☑ Required
  • FlexConnect Local Switching ☐ Enabled

Figure 18-10 Advanced tab settings for the Corp WLAN.

Finally, click Apply. The WLAN list (Figure 18-11) confirms that the WLAN is enabled with the expected security, and Monitor > Clients shows associated users with their AP, WLAN and IP address.

WLC — WLANs | Monitor > Clients

WLAN ID Type Profile Name WLAN SSID Admin Status Security Policies 1 WLAN Guest-Profile Guest Enabled Web-Auth

2 WLAN Corp-Profile Corp Enabled [WPA2][Auth(PSK)]

Client MAC AP Name WLAN Profile IP Address Protocol Status

a4:83:e7:2c:11:9f LAP-Floor1 Corp-Profile 10.10.10.57 802.11ax (5 GHz) Associated

Figure 18-11 Verifying the WLAN list and an associated client in VLAN 10's subnet.

When a screenshot asks “which VLAN will clients use?”, look at General > Interface/Interface Group, then the interface's VLAN ID. For “which security?”, read Security > Layer 2 (WPA2/WPA3, AES, PSK or 802.1X). For voice, expect the Platinum QoS profile.

LAB Connect a WLC and create a secure WLAN

Goal: Connect a WLC to a distribution switch with a static LAG, connect a local-mode AP, and create a WPA2-PSK WLAN that places employees in VLAN 10.

L3 wlc

Figure 18-12 Lab topology: one AP, one distribution switch and one WLC.

Steps:

  • 1. On DSW1, create VLANs 10, 20 and 100 with SVIs, and configure Gi1/0/1–2 as a trunk in channel-group 1 mode on (Section 18.4.4).
  • 2. Configure Gi1/0/10 as an access port in VLAN 100 with PortFast for the AP, and provide DHCP option 43 (or a DNS entry) pointing to 10.10.100.5 so the AP finds the

Wlc.

  • 3. On the WLC, verify HTTPS and SSH are enabled and Telnet/HTTP disabled (Figure 18-5).
  • 4. Create dynamic interface corp-vlan10 (Figure 18-6).
  • 5. Create WLAN ID 2, profile Corp-Profile , SSID Corp ; map it to corp-vlan10 ; set WPA2, AES, PSK; QoS Gold; DHCP address assignment required; enable it.
  • 6. Connect a laptop to SSID Corp.

Verify: show etherchannel summary on DSW1 shows Po1(SU) with both ports (P). The WLC's AP list shows LAP-Floor1 joined in Local mode. The WLAN list shows Corp enabled with [WPA2][Auth(PSK)], and Monitor > Clients lists the laptop with an address in 10.10.10.0/24.

Expected results: the client associates, receives a VLAN 10 address via the WLC's DHCP relay and can ping its gateway 10.10.10.1. If the AP never joins, check the VLAN 100 access port, DHCP option 43 and reachability of UDP 5246/5247.

  • Key terms
  • autonomous AP
  • lightweight AP
  • split-MAC

Capwap

Wlc

Lag

  • QoS profile
  • AAA override
  • Review questions
  • 1. Which protocol and ports do lightweight APs use to communicate with a WLC?
  • A. LWAPP, UDP 12222/12223
  • B. CAPWAP, UDP 5246/5247
  • C. CAPWAP, TCP 5246/5247
  • D. RADIUS, UDP 1812/1813
  • 2. In a split-MAC architecture, which two functions are performed by the AP? (Choose two.)
  • A. Transmitting beacons
  • B. Radio Resource Management
  • C. Encryption of 802.11 frames
  • D. Client authentication policy
  • E. Roaming management
  • 3. Which AP mode allows branch APs to switch client traffic locally and keep working if the WAN to the WLC fails?
  • A. Local
  • B. Monitor
  • C. FlexConnect
  • D. Sniffer
  • 4. Which AP mode forwards captured 802.11 frames to a protocol analyser?
  • A. Rogue detector
  • B. Sniffer
  • C. SE-Connect
  • D. Monitor
  • 5. How should the switch port for a lightweight AP in local mode normally be configured?
  • A. As a trunk carrying every WLAN VLAN
  • B. As an access port in the AP management VLAN
  • C. As a routed port
  • D. As a member of a LACP EtherChannel
  • 6. Which WLC port is used for out-of-band management and recovery?
  • A. Distribution system port
  • B. Redundancy port
  • C. Service port
  • D. Virtual port
  • 7. An engineer connects an AireOS WLC to a switch with two links bundled in LAG. Which switch command is required?
  • A. channel-group 1 mode active
  • B. channel-group 1 mode desirable
  • C. channel-group 1 mode on
  • D. channel-group 1 mode passive
  • 8. Which WLC interface maps a WLAN to a VLAN?
  • A. Management interface
  • B. Dynamic interface
  • C. Virtual interface
  • D. Service-port interface
  • 9. Which two management protocols should be enabled on a WLC for secure access? (Choose two.)
  • A. Telnet
  • B. HTTP
  • C. SSH
  • D. HTTPS
  • E. TFTP
  • 10. Which AAA protocol uses TCP 49 and encrypts the entire payload, making it preferred for device administration?
  • A. RADIUS
  • B. TACACS+
  • C. LDAP
  • D. Kerberos
  • 11. A WLAN carries IP phones. Which QoS profile should be assigned?
  • A. Bronze
  • B. Silver
  • C. Gold
  • D. Platinum
  • 12. On which WLAN tab do you select WPA2 with AES and PSK?
  • A. General
  • B. Security > Layer 2
  • C. Security > Layer 3
  • D. Advanced
  • 13. Which Advanced tab option lets a RADIUS server assign a different VLAN to an individual user?
  • A. Client Exclusion
  • B. DHCP Addr. Assignment Required
  • C. Allow AAA Override
  • D. Coverage Hole Detection

Answers

  • 1. B. CAPWAP uses UDP 5246 for control and UDP 5247 for data.
  • 2. A, C. Real-time functions (beacons, ACKs, encryption) stay at the AP; RRM, authentication and roaming are WLC functions.
  • 3. C. FlexConnect supports local switching and standalone operation.
  • 4. B. Sniffer mode sends captures to an analyser such as Wireshark.
  • 5. B. A local-mode AP tunnels everything in CAPWAP, so it needs only an access port.
  • 6. C. The service port provides out-of-band management.
  • 7. C. AireOS WLCs do not negotiate LACP or PAgP, so the bundle must be static.
  • 8. B. Each WLAN is mapped to a dynamic interface, which has a VLAN ID.
  • 9. C, D. SSH and HTTPS are encrypted; Telnet and HTTP send credentials in clear text.
  • 10. B. TACACS+ (TCP 49) encrypts the whole payload; RADIUS encrypts only the password.
  • 11. D. Platinum is intended for voice.
  • 12. B. Layer 2 security holds the WPA2/WPA3, cipher and AKM settings.
  • 13. C. AAA Override lets RADIUS attributes override WLAN settings such as the VLAN.
Use ← → to move between sections