Wireless LAN Controller Deployment

A Wireless LAN Controller (WLC) is a centralized network device that manages multiple lightweight access points (APs) in a wireless network. In the early days of Wi-Fi, each AP operated independently (autonomous or 'fat' APs), requiring individual configuration and lacking coordination. As enterprises scaled, this became unmanageable. The WLC model emerged to centralize control, simplify management, and enable advanced features like seamless roaming, RF management, and security enforcement.

The exam objective (2.2) focuses on understanding the difference between controller-based and standalone AP deployments, the split-MAC architecture, and the various deployment modes (local, FlexConnect, monitor, etc.). You must know how the WLC and APs communicate (CAPWAP protocol) and how clients roam between APs.

In a controller-based WLAN, the WLC and APs split the functions of a traditional autonomous AP. The WLC handles time-sensitive or network-critical functions (often called 'control plane' or 'management plane'), while the APs handle real-time radio functions. The standard split is defined by the LWAPP (Lightweight Access Point Protocol) and later CAPWAP (Control and Provisioning of Wireless Access Points) protocols (RFC 5415).

Functions typically performed by the WLC: - Client authentication (802.1X, PSK, etc.) - Association and reassociation management - Roaming coordination - Security key management - Quality of Service (QoS) enforcement - RF management (channel assignment, power control) - Firmware updates and configuration management - Encryption/decryption (if using WPA2-Enterprise or WPA3)

Functions typically performed by the AP: - Beacon transmission - Probe response - Frame forwarding (data plane) - Real-time encryption/decryption (if using WPA2-PSK or WPA3-PSK) - Fragmentation and reassembly - ACK generation

This split allows the APs to be 'thin' or 'lightweight'—they only need enough processing power to handle real-time wireless frames. The WLC handles the complex logic.

CAPWAP (Control and Provisioning of Wireless Access Points) is the IETF standard (RFC 5415) for communication between WLCs and lightweight APs. It supersedes the proprietary LWAPP. CAPWAP operates over UDP, using: - Control channel: Port 5246 (UDP) – encrypted with DTLS (Datagram Transport Layer Security) by default. - Data channel: Port 5247 (UDP) – optionally encrypted.

The AP must discover and join a WLC. Discovery methods include: - DHCP option 43: The DHCP server provides the WLC's IP address in a custom option. - DNS lookup: The AP queries a predefined DNS name (e.g., CISCO-CAPWAP-CONTROLLER.localdomain). - Broadcast: The AP sends a broadcast on the local subnet. - Over-the-air provisioning (OTAP): The AP learns the WLC IP from another AP already joined to the WLC (Cisco proprietary, disabled by default for security).

Once discovered, the AP and WLC perform a DTLS handshake to establish a secure control channel. The AP then downloads its configuration and firmware from the WLC.

The N10-009 exam expects you to differentiate the following modes:

1. Local Mode (Default): - AP tunnels all client traffic back to the WLC via CAPWAP. - The WLC performs encryption/decryption (if using central switching). - Used for maximum control and security. - Client data is encapsulated and sent to the WLC, which forwards it to the wired network. - Supports all advanced features (roaming, QoS, RF management).

2. FlexConnect (formerly Hybrid Remote Edge Access Point or H-REAP): - Designed for branch offices where a WLC is at a central site. - AP can switch client traffic locally (at the branch) or tunnel to the WLC. - If the WAN link fails, the AP can operate in standalone mode (connected locally). - Reduces latency and WAN bandwidth usage. - Two sub-modes: - FlexConnect Local Switching: Client data is bridged locally at the AP. - FlexConnect Central Switching: Client data is tunneled to the WLC. - The AP still uses the WLC for authentication and management.

3. Monitor Mode: - AP is used only for monitoring and security scanning (no client traffic). - It listens on all channels for rogue APs, interference, and intrusion detection. - No SSIDs are broadcast.

4. Sniffer Mode: - AP acts as a dedicated packet sniffer on a specific channel. - Captures 802.11 frames for analysis using tools like Wireshark.

5. Rogue Detector Mode: - AP monitors the wired network for rogue APs by listening to traffic. - Works in conjunction with monitor mode APs.

6. SE-Connect (Spectrum Expert Connect): - AP captures spectrum analysis data for interference detection. - Used with Cisco Spectrum Expert software.

7. Bridge Mode (Mesh): - AP acts as a wireless bridge for point-to-point or point-to-multipoint connections. - Used for outdoor or mesh deployments.

Roaming is the process of a client moving from one AP to another without losing connectivity. The exam tests three types:

Layer 2 Roaming: - The client moves between APs on the same VLAN/subnet. - The client's IP address remains unchanged. - Fast and seamless; the WLC updates its client database. - No need for a new DHCP lease.

Layer 3 Roaming: - The client moves between APs on different VLANs/subnets. - The client must obtain a new IP address via DHCP (unless a mobility anchor is used). - More complex; the WLC must coordinate with other WLCs (if multiple controllers). - Can cause brief interruption.

Mobility (Inter-Controller Roaming): - The client roams between APs connected to different WLCs. - Requires a mobility group (a set of WLCs that share client information). - Uses mobility tunnels (CAPWAP or proprietary) to forward client traffic to the original WLC (anchor). - The anchor WLC maintains the client's IP address and forwards traffic to the foreign WLC.

WLCs can be deployed in redundancy pairs or groups: - Primary/Secondary/Tertiary: APs are configured with a list of WLCs. If the primary fails, the AP joins the secondary. - N+1 Redundancy: One backup WLC serves multiple primary WLCs. - Mobility Groups: Up to 24 WLCs can be grouped for seamless roaming and load balancing. - Stateful Switchover (SSO): In Cisco WLCs, two controllers operate in an active/standby pair with synchronized state (client sessions, configurations).

While the exam doesn't require CLI configuration, you should understand the general steps and commands. A typical WLC setup involves:

System Name: WLC-1
Management IP: 10.1.1.10/24
Gateway: 10.1.1.1
Service Interface IP: 192.168.1.10/24

(Cisco Controller) >config wlan create 1 Corporate
(Cisco Controller) >config wlan security wpa akm psk set-key 1 MySecurePassphrase
(Cisco Controller) >config wlan enable 1

3. Assigning APs to the WLC: - APs automatically join via DHCP option 43 or DNS. - Verify with:

(Cisco Controller) >show ap summary

4. Configuring interfaces: - Management interface: for AP and WLC management traffic. - Service port: out-of-band management. - Dynamic interfaces: VLANs for client data.

A financial company with 5000 employees across a 10-building campus deploys 500 APs managed by two Cisco 5520 WLCs in a mobility group. The WLCs are in a redundant pair at the data center. All APs operate in local mode, tunneling all traffic to the WLCs. This centralizes security enforcement—the WLCs apply ACLs, perform 802.1X authentication against a RADIUS server, and enforce QoS for VoIP traffic. The network team uses the WLC's RF management to automatically adjust channels and power levels to avoid interference. The WLCs handle inter-AP roaming seamlessly. A common issue is that if the WAN link to a remote building fails, APs in that building lose connectivity to the WLC, causing a complete outage. To mitigate this, the company uses FlexConnect for remote buildings, allowing APs to switch traffic locally during WAN failure.

A national retailer with 200 stores uses a WLC cluster at headquarters and FlexConnect APs at each store. Each store has 4 APs. The WLC manages authentication and pushes configuration, but client traffic is switched locally at the store to avoid tunneling over the WAN. This reduces latency and bandwidth usage. The APs can operate independently if the WAN goes down. A misconfiguration pitfall: setting FlexConnect APs to central switching when the WAN has high latency causes poor performance for time-sensitive applications like credit card processing. The network engineer must choose local switching for those applications. Also, if the WLC is unreachable, new clients cannot authenticate unless the AP has cached credentials (FlexConnect local authentication).

A university with 30,000 students deploys 1500 APs across dormitories, lecture halls, and outdoor areas. They use multiple WLCs (e.g., Cisco 8540) in a mobility group. In high-density areas like lecture halls, the WLC is configured for client load balancing and band steering (pushing dual-band clients to 5 GHz). The WLC also monitors for rogue APs. A common problem: during large events, the WLC's CPU spikes due to excessive client association requests. The solution is to use APs with local mode but enable client limit per AP and aggressive load balancing. The network team must also ensure that the mobility group is properly configured so that students roaming between buildings maintain their IP addresses (Layer 3 roaming with anchor controllers).