2.6 Wireless Architecture

Moving beyond the SOHO router. Master the transition to Lightweight APs, the Split-MAC architecture, and WLC deployment models.

Access Point Paradigms

Autonomous APs ('Fat APs')

Traditional access points that are completely self-contained. Every AP must be individually configured with management IPs, VLANs, RF channels, and security settings. They are great for small businesses but are a nightmare to scale for enterprise networks.

Lightweight APs ('Thin APs')

'Brainless' access points that cannot function on their own. They must connect to a Wireless LAN Controller (WLC) to download their configuration and firmware. This allows for zero-touch deployment and centralized management of thousands of APs.

The Split-MAC Architecture

In an enterprise deployment, the processing of 802.11 wireless frames is split. The Access Point handles real-time RF tasks (like sending beacons), while the WLC handles management tasks (like authentication and roaming control).

Architecture & Protocol Mechanics

LAP: Real-Time Duties

! Handled instantly by the Access Point hardware

#Transmitting and receiving RF signals.
#MAC management (beacons, probe responses).
#Hardware encryption/decryption (WPA2/WPA3).

WLC: Management Duties

! Handled centrally by the Wireless LAN Controller

#Authentication (RADIUS / 802.1X).
#Seamless client roaming between APs.
#RF resource management (Auto-channel/power).

The CAPWAP Tunnel

Control and Provisioning of Wireless Access Points (CAPWAP) creates two separate UDP tunnels between every AP and the WLC. You must memorize these port numbers for the exam.

CAPWAP ControlUDP 5246

CAPWAP DataUDP 5247

CCNA Exam Gotchas

Unified vs. Embedded vs. Cloud

Cisco will test your knowledge of WLC deployments. Unified = A dedicated hardware appliance in a datacenter. Embedded = WLC software running directly on an access switch. Cloud = Managed via the web (e.g., Meraki). Mobility Express = WLC software running inside a master AP.

CAPWAP Data is Clear Text

By default, CAPWAP Control traffic is encrypted via DTLS so hackers cannot steal management credentials. However, CAPWAP Data traffic (actual user payloads) is sent in clear text to save WLC CPU cycles. You must use WPA2/WPA3 at the client level.

LAG on the WLC

When connecting a hardware WLC to your core switch, you will use EtherChannel. However, the WLC does not support LACP or PAgP negotiation. You must hardcode the switchport channel-group to 'mode on'. This is the rare exception to the EtherChannel rule!