PracticeLabs
Week 80%

Lesson 2 — WLC Architecture, AP Modes, and CAPWAP

Week 8Lesson 2Required52 min estimated0% progress

WLC Architecture, AP Modes, and CAPWAP

Compare autonomous and lightweight-AP deployments, trace how a lightweight AP joins a WLC over CAPWAP control and data tunnels, and map a WLAN to a VLAN through a WLC dynamic interface.

Lesson orientation

What you'll learn (5 objectives)~52 min: video → lesson → check → apply → lab prep

Learning objectives

  • Contrast an autonomous-AP deployment with a lightweight-AP-plus-WLC (split-MAC) deployment and say which functions live where
  • Trace the CAPWAP join sequence and name the control (UDP 5246) and data (UDP 5247) tunnels and what each carries
  • Identify common lightweight-AP modes (Local, FlexConnect, Monitor, Sniffer) and when each is used
  • Map a WLAN/SSID to a VLAN through a WLC dynamic interface and explain why AP switch ports are usually access ports in centralized mode
  • Describe how the WLC management interface is reached and why AP-to-WLC join uses X.509 certificates

Terms you will see

Autonomous APLightweight APWLCSplit-MACCAPWAPUDP 5246 / 5247DHCP option 43Dynamic interfaceLocal / FlexConnect / Monitor / SnifferLAG

Time breakdown

  • Read the notes24 min
  • Trace the CAPWAP join and data path14 min
  • Work the AP-mode and VLAN-mapping cases14 min

Assigned video

Opens on YouTube
Recommended video

Wireless Architectures (Day 56)

By Jeremy's IT Lab · Opens externally on YouTube

Assigned watch
~8 min

Where to stop

If autonomous versus lightweight is already clear from the reading, jump to the CAPWAP tunnel and AP-mode segments.

The source marks this segment timestampStatus="unresolved" with no start or end, so no bounds are shown here.

Watch on YouTube(opens in a new tab)

The link opens in a new browser tab. Return here when you finish watching.

Watch for these concepts

  • How split-MAC divides the AP and WLC roles
  • The CAPWAP join, and what control 5246 and data 5247 each carry
  • What the common AP modes are for

Go beyond the video

The assigned video introduces the idea. CCNA Practice Labs completes the learning path: clarify core concepts, explore how each device behaves, visualize the communication path, check your understanding, and prepare for hands-on lab work.

Watch the concept → understand it → visualize it → practice it → apply it.

Why 400 APs cannot be configured one at a time

An autonomous AP holds its own configuration and bridges SSIDs directly onto the wired network. That is fine for a handful of APs. At 400 it means 400 places to make — and to mistake — the same change, no coordinated RF planning, no central view of roaming, and client VLANs stretched everywhere. Because one autonomous AP can serve several SSIDs and VLANs, its switch port is typically a trunk.

In the controller model the AP is lightweight: it keeps only the real-time radio jobs, and everything else moves to the Wireless LAN Controller. That division is called split-MAC.

Split-MAC — what stays local, and what centralises
Lightweight AP (real-time, local)WLC (policy and coordination, central)
Transmit and receive RF; send beacons; answer probesRF management — channel and transmit-power assignment
Encrypt and decrypt framesSecurity and QoS policy
Buffer and prioritise frames for the airClient authentication, association, and roaming

The payoff is that one policy change on the WLC applies to every AP, and the controller can optimise channels and power and steer roaming across the whole coverage area — none of which an autonomous AP can do, because it cannot see beyond its own cell.

Certificates are what make the join trustworthy
Before an AP is allowed to join, the AP and the WLC validate each other's X.509 certificates. That mutual authentication is why a random device cannot impersonate an AP to the controller, or a controller to the AP, on the CAPWAP path. You administer the WLC itself through its management interface — HTTPS for the GUI, SSH, or the console for recovery — and that management traffic rides the management VLAN, kept separate from client data.

CAPWAP: two tunnels, two ports

The two CAPWAP tunnels — the exam wants both ports
TunnelUDP portCarries
Control5246Configuration and management between AP and WLC (encrypted by default)
Data5247Client traffic tunnelled from the AP to the WLC (optional DTLS encryption)
Why the AP's switch port is an access port
In centralized mode the client's traffic is tunnelled inside CAPWAP data all the way to the WLC, so the switch port to the AP does not need to carry every client VLAN — it only carries the CAPWAP tunnels. The client's VLAN is applied at the controller, via the dynamic interface, and never appears on the AP's switch port at all. That is why centralized-mode AP ports are access ports, and it is the direct opposite of the autonomous model, where the AP port is a trunk. Getting this backwards is the most common design error in the topic.

The WLC's own uplink to the distribution switch is a different matter. Because one controller aggregates the CAPWAP traffic of many APs, that uplink is frequently a link aggregation group — several physical ports bundled into one logical link for bandwidth and redundancy, so a single port failure does not take the controller offline.

  1. The AP powers up and gets an IP address, typically by DHCP. DHCP option 43 can hand it the WLC management IP so it knows where to look.
  2. It discovers candidate WLCs — via option 43, DNS, or broadcast — and picks one.
  3. It validates certificates and joins, building the CAPWAP control tunnel on UDP 5246.
  4. It downloads its configuration and image from the WLC, then builds the CAPWAP data tunnel on UDP 5247 and begins serving clients.
The four AP modes to know
ModePurpose
LocalDefault — serves clients in normal BSS operation
FlexConnectBranch survivability — switch client traffic locally if the CAPWAP path to the WLC fails
MonitorServes no clients; scans for rogues and interference
SnifferCaptures 802.11 frames and forwards them to a packet analyzer

The data path, and where the VLAN actually lives

Following one client frame through centralized mode
HopWhat travelsNotes
Client to AP802.11 frameEncrypted over the air
AP to WLC (data)CAPWAP data, UDP 5247AP switch port is an access port
WLC to switchClient frame on its VLANWLAN mapped to a dynamic interface
AP to WLC (control)CAPWAP control, UDP 5246Config, image, RF and security policy

On the WLC, each WLAN — each SSID — is bound to a dynamic interface, and that dynamic interface is tagged into a VLAN. So "SSID CorpWiFi lands in VLAN 100" really means "the CorpWiFi WLAN maps to the dynamic interface on VLAN 100". You build the dynamic interface first and attach the WLAN to it afterwards, which is exactly the order the next lesson follows.

Troubleshooting — the AP that never joins
Symptom: a lightweight AP powers up, gets an IP address, and then loops indefinitely in discovery without ever appearing as Registered on the controller. Diagnosis: the AP knows its own address but not the controller's. DHCP option 43 is missing or mis-encoded, and neither DNS nor broadcast discovery is reaching a WLC — which is common when the AP and the controller sit in different subnets, since broadcast will not cross a router. Fix: encode option 43 with the WLC management IP in the AP's DHCP scope. If discovery succeeds but the join still fails, suspect the certificates rather than the network path.

What you should retain

  • Autonomous APs are self-contained; lightweight APs plus a WLC split the work — the AP does real-time RF, the controller does policy and coordination.
  • The join flow is DHCP (option 43 supplies the WLC IP), discover, certificate-validated join, control tunnel, data tunnel, serve clients.
  • CAPWAP control is UDP 5246 and CAPWAP data is UDP 5247. Swapping them is the classic wrong answer.
  • A WLAN maps to a dynamic interface, which maps to a VLAN — so the client VLAN lives at the WLC and the AP switch port is an access port.
  • AP modes: Local by default, FlexConnect for branch survivability, Monitor for rogue scanning, Sniffer for capture.
  • The WLC uplink is often a LAG, because one controller aggregates many APs' traffic.
Pause and predictNot scored — nothing is recorded

Before you read on

(1) A campus needs 400 APs with identical SSIDs and security. Name two problems the autonomous model creates at that scale, and what a controller centralises to fix them. (2) In centralized mode, why is the AP's switch port an access port rather than a trunk — and what would you expect instead in an autonomous deployment?

Interactive tool

See it happen

Optional~8 min

Wireless Explorer

Trace the AP-to-WLC relationship and confirm for yourself which segment carries CAPWAP and which carries the client VLAN — that distinction is the whole lesson in one picture.

Open the tool
Section quiz

Check this section before moving on

Required8 questions~10 min

RF Fundamentals & Controller Architecture

The quiz opens on its own page so you can focus on it. It is a Week 1 milestone, tracked separately from this lesson's own completion.

Topics covered

  • • CSMA/CA and the shared medium
  • • The 1/6/11 channel plan and adjacent-channel interference
  • • SSID, BSSID, and the service sets
  • • Split-MAC and the CAPWAP tunnels
  • • AP modes and WLAN-to-VLAN mapping
Start the quiz

Study deeper

Topic guides extend this lesson — they do not replace the first-party walkthrough above.

Wireless Architectures

For the fuller split-MAC and WLC deployment-model reference

Open guide