Three architectures
| Architecture | Who controls the APs | Typical use |
|---|---|---|
| Autonomous | Each AP is configured on its own (its own CLI or web page) | One or two APs; this module's labs |
| Lightweight + WLC | A Wireless LAN Controller configures and manages every AP | Campuses with tens or thousands of APs |
| Cloud-managed | A cloud dashboard (for example Meraki) manages APs over the internet | Many small sites |
Lightweight APs and CAPWAP
With a WLC the work is split (split-MAC): the AP handles real-time radio jobs (beacons, acknowledgements, encryption), and the WLC handles management (associations, roaming, security policy, RF tuning). They talk over CAPWAP tunnels (UDP 5246 for control, 5247 for data). The APs find the controller through DHCP option 43, DNS, or a broadcast.
How each connects to the switch
| Device | Switch port | Why |
|---|---|---|
| Autonomous AP | Trunk (if it carries several SSIDs/VLANs) or access | It puts each SSID's traffic in its own VLAN itself |
| Lightweight AP (local mode) | Access port | All client traffic goes inside the CAPWAP tunnel to the WLC |
| Lightweight AP (FlexConnect) | Trunk | Some SSIDs are switched locally into VLANs |
| WLC | Trunk(s), usually bundled with LAG (EtherChannel mode on) | It carries every WLAN's VLAN |
Power over Ethernet
APs and IP phones usually take power from the switch port (PoE: 802.3af up to 15.4 W, PoE+ 802.3at up to 30 W, 802.3bt more). show power inline shows what each port delivers, and power inline never turns it off on a port:
In NetLab
▶ SW1 SW1>enable SW1#show power inline | include Fa0/1 |Available|Interface Available:740.0(w) Used:15.4(w) Remaining:724.6(w) Interface Admin Oper Power Device Class Max Fa0/1 auto on 15.4 AP NL-AP2800 3 30.0 SW1#show cdp neighbors Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone, D - Remote, C - CVTA, M - Two-port Mac Relay Device ID Local Intrfce Holdtme Capability Platform Port ID AP1 Fas 0/1 163 T B I NL-AP2800 Gig 0 R1 Gig 0/1 163 R B S I NL-R3000 Gig 0/0 Total cdp entries displayed : 2
Managing APs and controllers
You reach a WLC or AP's management address with HTTPS (the GUI) or SSH (the CLI); HTTP and Telnet send passwords in clear text and should be off. A console port is used for first setup. Admin logins can be checked against TACACS+ or RADIUS servers instead of local accounts.
Remember: Lightweight AP in local mode: access port. Autonomous AP with several SSIDs, FlexConnect AP, and the WLC: trunks. WLC ports bundled with LAG.