First, the essential ideas
- AP and WLC
- An access point (AP) provides an 802.11 radio connection. A wireless LAN controller (WLC) manages participating APs and policies; it is not automatically the client's IP gateway.
- SSID and WLAN
- A service set identifier (SSID) is a wireless network name. A wireless LAN (WLAN) configuration combines that name with security and forwarding policy. Identical names do not guarantee identical policies.
- Control and data
- Control traffic coordinates operation, such as AP configuration. Data traffic carries client payloads. The two can take different paths in the same wireless design.
- CAPWAP and tunnel
- Control And Provisioning of Wireless Access Points (CAPWAP) carries AP-controller messages. A tunnel encapsulates one packet inside another; the outer addresses identify tunnel endpoints.
- VLAN and trunk
- A virtual LAN (VLAN) is a Layer 2 broadcast domain. An access port normally carries one untagged VLAN; an 802.1Q trunk can carry several identified VLANs, with a defined native VLAN for untagged traffic.
- LAG and LACP
- A link aggregation group (LAG) combines compatible links into one logical connection. Link Aggregation Control Protocol (LACP) negotiates membership where supported; LAG is not a synonym for LACP.
- FlexConnect
- FlexConnect is an AP deployment mode. A locally switched WLAN exits through the AP's wired connection, while centrally switched traffic is tunneled to the controller.
- Roaming and BSSID
- Roaming changes a client's AP association. A basic service set identifier (BSSID) identifies a particular radio service, unlike the shared SSID name.
- PoE and RF
- Power over Ethernet (PoE) supplies power over suitable Ethernet cabling. Radio frequency (RF) describes wireless electromagnetic signals; virtual cables do not emulate coverage or interference.
- DTLS
- Datagram Transport Layer Security protects datagram exchanges. CAPWAP discovery is initially unprotected; established control protection is distinct from optional data-channel protection.
Draw two questions separately: how does the AP receive management instructions, and where does this client's payload enter the wired network? A controller can remain reachable while one client VLAN is wrong. Start with the definitions, then annotate each connection according to its job.
See the idea
Where does the client VLAN leave Wi-Fi?
AP management can work while the client VLAN takes the wrong wired exit.
Read the policy
Central switching sends client data to the WLC before its wired VLAN exit.
What this model leaves out: Conceptual policy comparison, not cabling or captured traffic. Radio behavior, roaming and failure recovery timing are not measured.
Full visual explanation and references
Two policy records compare central switching at the WLC with local switching at the AP. Both must deliver the client VLAN to its server.
Conceptual policy comparison, not cabling or captured traffic. Radio behavior, roaming and failure recovery timing are not measured.
- Read the policy
Central switching sends client data to the WLC before its wired VLAN exit.
www.cisco.com - Follow the local exit
Local switching puts client VLAN 20 on the AP-facing trunk toward the server.
www.cisco.com - Keep evidence separate
A healthy control path does not verify that either client-data path reaches the server.
www.rfc-editor.org
One idea at a time
Start with something familiar.
Start with a blank sheet and the five named roles below. Mark the AP's management address separately from the client's address. A source-reviewed prediction is not a captured packet; write predicted beside every result in this exercise.
Why learn this?
A phone can see an SSID and an AP can appear healthy on a controller while the phone cannot reach its intended subnet. Knowing where traffic leaves the tunnel determines which switch port and VLAN deserve inspection.
An everyday comparison
Think of a branch office receiving instructions from headquarters while delivering some local work directly to a nearby customer. The instructions and the delivered work need not travel through the same building.
What happens in a network
The instructions resemble controller management, while the local delivery resembles FlexConnect local switching. A centrally processed job instead resembles data sent through the controller before entering the wired service network.
Where the comparison stopsThis is only a memory aid. People and parcels do not model authentication, frame encapsulation, VLAN tags or RF behavior, and office geography cannot predict packet delay.
Follow one worked example
- Draw the control relationship independently.
AP1 at 192.0.2.11 communicates with WLC1 at 192.0.2.2 over the management network; the client is not a CAPWAP controller endpoint.
Why: Separating the endpoints prevents confusing the laptop address with the AP's management address.
- Choose exactly one data-switching policy.
For central switching, trace Client1 through AP1, WLC1 and SW1 to Server1. For local switching, trace Client1 through AP1 and SW1 to Server1.
Why: The relevant VLAN exit changes with policy, even though AP1 still has a controller relationship.
- Change the worksheet, then restore it.
Move only the local WLAN mapping from VLAN 20 to VLAN 30. Predict the failed server exchange, restore VLAN 20 and retrace the original path.
Why: This controlled comparison teaches a dependency without claiming that paper work executed a wireless fault.
Your first small task
On the worksheet, circle the point where a VLAN 20 client frame reaches the wired network for central switching and then for FlexConnect local switching. Keep the management VLAN 10 annotations unchanged.
Show a hint
Follow the payload, not the line labeled management. An AP's operational mode and its WLAN switching policy are related but are not interchangeable labels.
Check the expected result
Central switching exits at WLC1's service side; local switching exits at AP1's Ethernet side. The control relationship still ends at WLC1.
Pause and explain it in your own words
AP1 is joined, but its locally switched VLAN 20 client cannot reach Server1. Does a healthy CAPWAP session clear the AP trunk?
Show a hint
Ask which evidence describes the management path and which describes the client's wired exit.
Show the explanation
No. AP join supports management-path operation, not correct carriage of VLAN 20. Inspect the WLAN-to-VLAN mapping and the AP-facing trunk's allowed and native VLAN settings before treating controller health as client success.
Short answer
What should you understand today?
An AP provides radio access, while a controller coordinates the participating APs. In central switching, client data crosses the AP-controller tunnel; with FlexConnect local switching, it leaves at the AP's wired VLAN. Identify the actual switching policy and controller platform before deciding which uplink must carry a client VLAN or which aggregation protocol to use.
Before you begin
Learning targets
- Review VLAN access ports, trunks and link aggregation from the switching module.
- Use paper or a drawing tool for the required exercise; no Cisco image or radio is required.
- Any physical observation requires the owner's permission and a preconfigured isolated training rack.
- Trace central and local switching to a named final server.
- Compare client-serving, monitoring and specialized AP modes.
- Distinguish AireOS static LAG from supported Catalyst 9800 LACP.
- Explain roaming evidence without promising an interruption-free session.
- Diagnose one wrong client-VLAN assignment on a controlled worksheet.
Words you will meet
Open a word when you need its meaning. You do not need to memorize the whole list before reading.
AP and WLC
An access point (AP) provides an 802.11 radio connection. A wireless LAN controller (WLC) manages participating APs and policies; it is not automatically the client's IP gateway.
SSID and WLAN
A service set identifier (SSID) is a wireless network name. A wireless LAN (WLAN) configuration combines that name with security and forwarding policy. Identical names do not guarantee identical policies.
Control and data
Control traffic coordinates operation, such as AP configuration. Data traffic carries client payloads. The two can take different paths in the same wireless design.
CAPWAP and tunnel
Control And Provisioning of Wireless Access Points (CAPWAP) carries AP-controller messages. A tunnel encapsulates one packet inside another; the outer addresses identify tunnel endpoints.
VLAN and trunk
A virtual LAN (VLAN) is a Layer 2 broadcast domain. An access port normally carries one untagged VLAN; an 802.1Q trunk can carry several identified VLANs, with a defined native VLAN for untagged traffic.
LAG and LACP
A link aggregation group (LAG) combines compatible links into one logical connection. Link Aggregation Control Protocol (LACP) negotiates membership where supported; LAG is not a synonym for LACP.
FlexConnect
FlexConnect is an AP deployment mode. A locally switched WLAN exits through the AP's wired connection, while centrally switched traffic is tunneled to the controller.
Roaming and BSSID
Roaming changes a client's AP association. A basic service set identifier (BSSID) identifies a particular radio service, unlike the shared SSID name.
PoE and RF
Power over Ethernet (PoE) supplies power over suitable Ethernet cabling. Radio frequency (RF) describes wireless electromagnetic signals; virtual cables do not emulate coverage or interference.
DTLS
Datagram Transport Layer Security protects datagram exchanges. CAPWAP discovery is initially unprotected; established control protection is distinct from optional data-channel protection.
Three architectures, different places to inspect
A standalone AP holds its wireless configuration locally and bridges clients onto its attached network. A controller-based AP receives policy from a WLC, but the client-data exit depends on switching policy. Cloud management names the location of management services; it does not by itself mean every user packet passes through a cloud server. Keep device management, wireless association and IP forwarding as separate jobs. A client may pass one stage and fail the next, so an inventory of APs is not a connectivity test.
- An AP name in an inventory is not evidence that a client has authenticated.
- A cloud-management label alone does not specify a client forwarding path.
CAPWAP carries coordination and, when selected, payloads
CAPWAP separates control and data exchanges between an AP and controller. The standard controller UDP ports are 5246 for control and 5247 for data. Encapsulation adds an outer transport path; the inner client addresses retain their own meaning. Discovery precedes the protected control relationship. Do not describe all CAPWAP packets as encrypted: discovery is clear, and data protection is a separate consideration. Reachability, discovery, certificates and software compatibility can each affect AP join.
- Control health and end-to-end client health are different observations.
- CAPWAP is context for wireless architecture in v1.1, not a separately named v2.0 objective.
AP modes are operational roles, not signal-strength levels
Local mode normally serves clients with centrally switched traffic in the conventional controller design. FlexConnect supports branch operation and per-WLAN switching choices. Monitor mode dedicates an AP to observing the wireless environment rather than normal client service. Sniffer mode sends selected captured radio traffic to an analyzer. Bridge or mesh roles interconnect supported wireless infrastructure; supported radio roles and combinations depend on model and release. Legacy modes such as rogue detector are platform-specific, not a required capability of every modern AP.
- Check AP model, radio role and software before promising a mode.
- FlexConnect local switching and local authentication are separate decisions.
Choose the physical port from the real VLAN exit
An AP carrying only untagged management and centrally tunneled client traffic can use an access port in the management VLAN in this design. A locally switched AP carrying management plus multiple client VLANs needs an appropriate trunk. The AP's native VLAN and the switch's treatment of untagged frames must agree. The controller service uplink must carry centrally switched client VLANs. PoE requirements also depend on AP model and feature set; a link LED alone does not prove adequate power.
- Do not add client VLANs to every AP link without examining switching policy.
- A diagram can specify PoE intent but cannot measure delivered power.
Controller LAG needs a platform-specific agreement
A LAG is a logical link made from physical member ports. Both ends need compatible VLAN and aggregation settings. In the cited AireOS implementation, configure the neighboring switch's EtherChannel statically in mode on; LACP and PAgP negotiation are not supported by that controller LAG. Catalyst 9800 releases document LACP support with platform restrictions. Therefore, neither 'all WLCs use LACP' nor 'no WLC supports LACP' is safe. Enabling AireOS LAG can require a reboot and alter interface mappings, so do not casually toggle it for discovery.
- Match aggregation mode and VLAN policy on every member.
- LAG is link redundancy, not a second controller or guaranteed seamless failover.
Roaming changes association; evidence defines the result
A client generally decides when to roam, with infrastructure features able to assist or influence it. Moving between APs with a compatible WLAN requires more than matching SSID text: security and network policy must remain appropriate. A BSSID change identifies a changed radio association; application continuity needs its own measurements. Layer 2 versus more complex mobility designs affect where traffic is anchored. This chapter explains those dependencies without measuring a roam or configuring a mobility domain.
- A stable IP address does not prove that no packets were lost during a roam.
- Keep physical RF and timing observations separate from architectural predictions.
Real-world walkthrough
A healthy AP with a broken local client VLAN
In this hypothetical branch, AP1 is visible to its controller and Client1 authenticates, but the client cannot reach a same-subnet test server. The branch WLAN uses FlexConnect local switching. An operator who checks only controller uptime can miss the point where VLAN 20 leaves AP1 and enters the switch.
- Confirm the WLAN is locally switched before choosing the uplink to inspect. Record the management and client addresses as separate evidence.
- Compare the WLAN-to-VLAN assignment with the AP trunk's allowed VLANs. Do not infer the client VLAN from the SSID spelling.
- Check Server1's access VLAN and address as well as the AP side. Both endpoints must belong to the intended service segment.
- Correct only the documented local VLAN mismatch, then repeat the same client-to-server exchange and record the actual result.
- Retain any remaining authentication or RF symptoms as separate hypotheses; one repaired VLAN does not prove roaming or application performance.
Guided GNS3 lab
Paper lab: two wireless forwarding policies
Construct central and local switching models, predict one wrong-VLAN failure, restore the intended mapping and explain which operational checks a real rack would require. All results below are predictions, not measured wireless behavior.
Addressing plan
| Device | Interface | Address | Purpose |
|---|---|---|---|
| AP1 | Management VLAN 10 | 192.0.2.11/24 | CAPWAP source; no gateway in this local model |
| WLC1 | Management VLAN 10 | 192.0.2.2/24 | Controller endpoint |
| WLC1 | Client VLAN 20 | 198.51.100.2/24 | AireOS dynamic interface role, not a router |
| Client1 | Wireless VLAN 20 | 198.51.100.10/24 | Same-subnet client; no default gateway needed |
| Server1 | Ethernet0 VLAN 20 | 198.51.100.20/24 | Final recipient; no default gateway needed |
Set up the lab
- Use paper or a diagram editor; create two copies labeled CENTRAL and LOCAL, and mark all observations predicted.
- Optional physical observation requires an authorized AireOS 8.10.190.0 WLC 3504, compatible AP1832i, PoE switch and owned client; use vendor-supported software and regulatory settings.
- A physical instructor must prepare isolated VLANs, AP join, WLAN security and the static controller LAG before observation. This chapter does not supply a from-factory wireless build.
- Do not bridge a virtual lab to household or company networks. GNS3 and CML cannot reproduce RF or PoE; hardware timing remains unmeasured.
Label each independent address
Create all five roles and the exact cables above. Put management addresses in VLAN 10 and endpoint addresses in VLAN 20. Annotate that no Internet, default gateway or external authentication server exists in this paper model.
- What you should see
- Every endpoint and cable has a name, and no drawn path silently ends at an omitted router.
- Why this step matters
- Naming both endpoints of every link makes later path claims checkable rather than suggestive.
Establish the central baseline
On CENTRAL, mark the AP port access VLAN 10 and the controller LAG trunk VLANs 10 and 20. Trace Client1 to AP1, through the controller tunnel to WLC1, then SW1 and Server1; draw the return path.
- What you should see
- The predicted client exchange crosses WLC1 in both directions and terminates at Server1.
- Why this step matters
- The final recipient matters: reaching a controller is not the same as delivering a client's payload.
Separate the control exchange
Draw a dotted annotation AP1 192.0.2.11 to WLC1 192.0.2.2, labeled CAPWAP control UDP 5246. Add a distinct central-data annotation for UDP 5247, without labeling all traffic encrypted.
- What you should see
- The worksheet distinguishes management endpoints from the client and server addresses inside the service exchange.
- Why this step matters
- This prevents an apparently healthy management path from being mistaken for proof of user-data delivery.
Create the local-switching baseline
On LOCAL, map the WLAN to VLAN 20 and AP1's trunk to native VLAN 10 with VLANs 10 and 20 allowed. Trace Client1, AP1, SW1 and Server1, retaining the separate AP-controller control annotation.
- What you should see
- The predicted data path reaches Server1 without taking a data detour through WLC1.
- Why this step matters
- Local switching changes the wired exit dependency without removing the controller's management role.
Inject one worksheet VLAN fault
Only on LOCAL, change the WLAN's local VLAN mapping from 20 to 30. Leave client and server addresses, server access VLAN and all cable labels unchanged. Predict what a same-subnet client attempt would require.
- What you should see
- Client1's traffic no longer enters Server1's VLAN 20 segment. The predicted exchange fails despite unchanged management reachability.
- Why this step matters
- One changed variable allows an explanation tied to VLAN membership rather than a vague claim that Wi-Fi is down.
Restore and retrace both directions
Restore the local WLAN mapping to VLAN 20, then trace request and reply again through AP1, SW1 and Server1. Compare every label with the pre-fault LOCAL copy; retain both versions in your notes.
- What you should see
- The restored model again has a complete VLAN 20 path, but no real ping or authentication has been measured.
- Why this step matters
- A paper retest checks reasoning and documentation; it cannot substitute for an actual client exchange.
Audit the controller bundle
Inspect the AireOS WLC1 ports 1/2 to SW1 Gi1/0/23-24 annotation. Write static mode on, consistent trunk policy and platform-specific reboot planning. Beside it, note that supported 9800 LACP is a different platform case.
- What you should see
- The bundle design does not incorrectly require AireOS to negotiate LACP, nor prohibit LACP universally.
- Why this step matters
- Aggregation configuration belongs to the exact controller family and release rather than to the generic word WLC.
Close with a practical evidence plan
List the physical checks an instructor would collect: AP join and mode, WLAN switching policy, switch VLAN settings, client association and addresses, and same-server reachability. Add a second AP only on a separate future roaming plan.
- What you should see
- The report labels RF, PoE, roaming latency and LAG member failure as unmeasured, with a specific path to later observation.
- Why this step matters
- Clear limits make the exercise reusable without converting drawings into invented test results.
Verify
- Confirm that both complete model paths end at Server1 and include a return path.
- Check management VLAN 10 separately from client VLAN 20; WLC management is not a client gateway.
- Show baseline, VLAN 30 fault and restored VLAN 20 worksheets with only that one changed variable.
- Explain why static AireOS LAG and supported 9800 LACP cannot share an unqualified command recipe.
Troubleshoot
- If your data path stops at WLC1, add the service-side VLAN, SW1 and Server1; a tunnel endpoint is not the final application destination.
- If management and client addresses appear in the same subnet by accident, rebuild the two-column address ledger before diagnosing the VLAN fault.
- If a real rack lacks a joined AP or compatible WLAN, stop at the paper alternative. Do not claim radio execution from a virtual switch or change live AP modes.
GNS3 does not provide Cisco images. Use software only when the applicable license or entitlement permits that environment. Do not share or redistribute image files. Cisco Modeling Labs is the official alternative; its reference images are licensed for use within CML unless separately licensed. A paper exercise needs no image, but does not establish hands-on competence. Virtual routers do not reproduce physical radios, PoE delivery, hardware forwarding rates or failover timing.
- Restore VLAN 20 on the worksheet and retain the faulty copy as labeled evidence.
- Do not change an optional physical rack; return borrowed equipment and remove any temporary observation access with its owner.
Practice set
Answer before you reveal
01Why can AP join succeed while a locally switched client fails?
The AP can communicate in VLAN 10 while its WLAN is mapped to the wrong client VLAN or that VLAN is absent from the AP-facing trunk.
02Where does our central-switching client enter wired VLAN 20?
The AP uplink carries the encapsulated exchange in the management network; the configured controller service mapping provides the central data exit.
03Must every WLC LAG use LACP?
LAG describes the bundle. Negotiation capabilities and configuration restrictions are properties of the particular controller platform and release.
04Does dedicated monitor mode improve normal client service?
The model and radio role matter, so never change a serving AP simply to see what a diagnostic mode looks like.
05What would you record to establish that a client roamed?
SSID names can stay the same across a roam. A BSSID change establishes association movement, but loss and application behavior need separate observations.
06Which AP port needs the client VLAN in our local variant?
The local client data leaves AP1 rather than WLC1. The switch port must therefore carry the VLAN where Server1 resides.
Knowledge check
Quiz: prove the reasoning
Keep these
Technical takeaways
- Keep AP management and client payload evidence separate.
- Select the AP port mode from the WLAN's actual wired exit.
- Dedicated diagnostic AP modes can remove normal client service.
- Identify the controller family before selecting a LAG protocol.
- A roaming claim needs association evidence and separate continuity tests.
- Paper predictions are useful preparation, not measured radio performance.