Autonomous, lightweight and cloud APs

A real-life situation

A school has 60 access points. Each one was set up by hand. Now the guest password must change, and someone has to log in to 60 APs, one by one. Halfway through, half the APs have the new password and half the old one. Teachers roaming between classrooms keep losing Wi-Fi.

The fix is to manage all APs from one place. That is what this lesson is about: the three ways enterprise APs are built and managed, how lightweight APs talk to a controller, and the AP modes the CCNA expects you to know.

What the three architectures are

An autonomous AP is a complete device: it runs its own configuration, security and RF settings. An AP with two SSIDs mapped to two VLANs needs an 802.1Q trunk to its switch. Roaming between autonomous APs is slower because each one works alone.

A lightweight AP (LAP) can't work on its own. It downloads its configuration and software from a WLC and does only the time-critical work itself.

A cloud-managed AP is configured from a web dashboard. If the internet link fails, the AP keeps serving clients with its last settings, but you can't change anything until the link returns.

Why split-MAC: who does what

The 802.11 standard defines a lot of work at the MAC layer. Some of it must happen within microseconds, right at the radio. Some of it is about policy and the big picture. Cisco splits the two. This is called split-MAC:

Because the WLC sees every AP and every client, it can choose channels for all APs together, keep a client's session when it roams, and push one change to all APs at once.

How CAPWAP carries the traffic

The AP and WLC talk with CAPWAP (Control And Provisioning of Wireless Access Points, RFC 5415). It is an open standard based on Cisco's older LWAPP. CAPWAP builds two tunnels between the AP's IP address and the WLC's management IP address:

• Control tunnel, UDP 5246: AP configuration, software, radio settings. Always encrypted with DTLS (TLS over UDP).
• Data tunnel, UDP 5247: client frames. Not encrypted by default.

Because CAPWAP runs over IP, the AP and WLC can be in different subnets, even different buildings. In the lab, AP1 is in VLAN 30 (10.10.30.21) and WLC1 is in VLAN 99 (10.10.99.10); SW1 routes between them.

How an AP finds and joins a WLC

A new lightweight AP boots with no idea where its controller is. It first gets an IP address (usually by DHCP), then looks for WLCs in this order of methods:

1. Broadcast a discovery request on its local subnet (works only if a WLC is in the same subnet).
2. WLC addresses it learned before (stored in the AP's memory), and addresses of other WLCs in the same mobility group.
3. DHCP option 43: the DHCP server hands out the WLC's IP address.
4. DNS: the AP looks up CISCO-CAPWAP-CONTROLLER.<domain> using the domain name it got from DHCP.
5. Primary, secondary and tertiary WLCs configured on the AP itself (once it has joined before).

From all the answers, the AP picks a WLC: first a configured primary controller, otherwise the least-loaded one. Then the join begins:

WLC deployment options

The controller itself can live in different places:

AP modes

A lightweight AP can be put in one of several modes from the WLC. The CCNA lists these:

How to configure the switch ports on Cisco IOS

The AP itself is configured from the WLC, but the switch port it plugs into is yours. The right port type depends on the mode:

On the DHCP server for the AP VLAN, option 43 tells APs where WLC1 is. On a Cisco IOS DHCP server, the value is a hex string: type f1, length (4 bytes per WLC), then the WLC address in hex. 10.10.99.10 is 0a0a630a:

How to verify it

On SW1, CDP shows the AP on its port. On a Catalyst 9800 WLC (IOS XE), show ap summary lists every joined AP:

SW1#show cdp neighbors GigabitEthernet1/0/10
Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge
                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone

Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID
AP1              Gig 1/0/10        142             T I    C9120AXI- Gig 0

WLC1#show ap summary
Number of APs: 2

AP Name   Slots  AP Model      Ethernet MAC    Radio MAC       Location  Country  IP Address    State
-------------------------------------------------------------------------------------------------------
AP1       2      C9120AXI-B    a4b2.3c11.2201  a4b2.3c44.5500  Floor 1   US       10.10.30.21   Registered
AP2       2      C9120AXI-B    a4b2.3c11.2202  a4b2.3c44.5600  Floor 2   US       10.10.30.22   Registered

On an AireOS WLC, the same list is in the GUI under WIRELESS › Access Points › All APs, where you can also open an AP and change its AP Mode.

What goes wrong and how to troubleshoot it

Common mistakes

• Configuring a trunk for a local-mode AP "to carry the SSIDs". The SSIDs travel inside CAPWAP; an access port is enough.
• Putting a FlexConnect AP that switches locally on an access port. Its client VLANs then never reach the switch.
• Blocking UDP 5246 and 5247 between AP and WLC subnets.
• Mixing up Monitor (radio listens for attacks) and Rogue detector (radio off, watches the wire).
• Thinking a cloud AP stops serving clients when the internet is down. Only management stops.

💡 Exam tip: expect questions on CAPWAP ports 5246 (control, DTLS) and 5247 (data), which functions belong to the AP and which to the WLC in split-MAC, and matching each AP mode to its job. Know that a local-mode AP uses an access port, while an autonomous AP with several VLANs and a locally switching FlexConnect AP use a trunk.

Key takeaways

• Autonomous APs work alone; lightweight APs depend on a WLC; cloud APs are managed from a dashboard.
• Split-MAC: the AP does real-time radio work, the WLC does management and policy.
• CAPWAP: UDP 5246 control (DTLS), UDP 5247 data, between AP and WLC IP addresses.
• APs find WLCs by broadcast, stored addresses, DHCP option 43 or DNS.
• Local mode tunnels client traffic to the WLC; FlexConnect can switch it locally.

Check yourself