# Wireless Deployment Models and Security

> Chapter 13 of the Courseiva ENCOR curriculum — https://courseiva.com/learn/encor/wireless-deployment-and-security

**Official objective:** 5.2 — Describe wireless deployment models (autonomous, centralized, cloud) and wireless security (WPA2, WPA3)

## Introduction

Wireless deployment models define how an organisation manages and controls its Wi-Fi access points across a physical space, from a single standalone unit to thousands of APs spread globally. Wireless security protocols encrypt over-the-air traffic and verify the identity of connecting devices, solving the problem that radio waves ignore office walls and can be intercepted by anyone nearby. Understanding these models and security standards is essential for the 350-401 ENCOR exam because enterprises expect you to select the right architecture and protection level for a given business scenario.

## The Department Store Security Analogy

A century-old department store chain secures its 200 locations through three generations of management philosophy. The earliest stores each had a dedicated guard who memorised local incident procedures and kept a logbook in a cupboard—this guard possessed full authority and could make every decision independently, just as an autonomous access point stores its own configuration and operates without external help.

As the chain grew, the head office installed a central security command centre. Every camera feed, door alarm, and guard call now travelled back to this nerve centre through private phone lines. The guards in each store became sensors and physical responders; the brains moved to the command centre, where a single team observed all stores, applied consistent policies, and coordinated foot patrols across the city. This is the centralised controller model, where Lightweight Access Points tunnel all control and data back to a Wireless LAN Controller.

When the chain acquired overseas shops, maintaining private phone lines became impossible. They switched to a cloud-based security platform: each store’s devices connected over the internet to a shared dashboard, giving regional managers a single pane of glass whether they sat in London or Singapore. No local command centre existed, but the cloud platform pushed policies, analysed threats, and allowed instant reconfiguration. This is the cloud-managed wireless model. Meanwhile, the locks on the stockroom door evolved from a metal key copied at the corner shop (WEP) to a programmable magnetic-stripe card shared by all employees (WPA2-Personal), and finally to individual digital fobs that perform a secret cryptographic handshake every time they are presented, thwarting card cloning (WPA3-SAE).

## Core explanation

Enterprise wireless networks can be built in three fundamental ways: autonomous, centralised, and cloud-based. Each model determines where the intelligence lives and how access points are configured, monitored, and updated.

An autonomous access point is a self-contained device that contains all the software needed to bridge wireless traffic onto the wired network. It runs its own web or command-line interface for configuration, maintains its own security policies, and handles client authentication locally. If you have three autonomous APs, you configure each one separately. Autonomous APs are simple to deploy in very small offices—one or two units—but become a logistical nightmare as the number grows because there is no central place to change the Wi‑Fi password or push a firmware update. Historically, early Wi‑Fi networks were entirely autonomous.

Centralised wireless architecture addresses this scale problem by splitting the access point into two components: a lightweight access point (LWAP) and a wireless LAN controller (WLC). A lightweight AP retains the radio and antenna but offloads all decision-making—what SSIDs to broadcast, which encryption keys to use, how to handle roaming—to the WLC. The communication between them uses a protocol called CAPWAP (Control And Provisioning of Wireless Access Points). CAPWAP establishes two tunnels: a control tunnel for management commands and configuration, and an optional data tunnel that can backhaul client traffic to the controller for processing. Because the WLC sees every client session, it can coordinate seamless roaming: as a user walks from one AP to another, the controller transfers session information so the client does not drop its connection or re-authenticate. Multiple controllers can be grouped into a mobility group, sharing client state so roaming works across an entire campus. Centralised deployments suit medium to large enterprises that need consistent policy and low-latency control, but they require the capital expense of a controller appliance (physical or virtual) and careful network design to avoid the controller becoming a bottleneck.

Cloud-managed wireless shifts the controller function to a cloud service, such as Cisco Meraki. The access points connect to the internet and establish a secure control channel to the vendor’s cloud dashboard. All configuration, monitoring, and firmware upgrades are performed through a web interface, and the administrator never touches a local controller. In most cloud deployments, client data is bridged locally onto the wired network rather than tunnelled through the cloud, so performance remains high. This model is ideal for organisations with many small sites (retail stores, clinics) where dispatching an engineer to each location is impractical. The trade-off is that internet connectivity must be reliable; if the site’s WAN link goes down, the AP continues to serve clients using its last-known configuration but cannot be modified until connectivity returns.

Wireless security has evolved alongside deployment models. WPA2 (Wi‑Fi Protected Access 2), standardised in 2004, uses AES-CCMP encryption to protect data frames. It comes in two variants: Personal, which relies on a Pre-Shared Key (PSK) that every client types in, and Enterprise, which uses 802.1X authentication with a RADIUS server to give each user unique credentials. WPA2-Personal has a well-known flaw: an attacker who captures the four-way handshake when a client joins can then run an offline dictionary attack to guess the password, and once the password is known, all traffic encrypted with that PSK can be decrypted.

WPA3, introduced in 2018, fixes this by replacing PSK with Simultaneous Authentication of Equals (SAE), also called the Dragonfly handshake. SAE uses a Diffie-Hellman key exchange tied to the password, ensuring that each session gets a unique encryption key that cannot be derived from passive capture, thereby providing forward secrecy. Even if an attacker later learns the password, they cannot decrypt previously captured traffic. Additionally, WPA3 makes Protected Management Frames (PMF) mandatory, preventing attackers from spoofing deauthentication packets to kick clients off the network. For open (public) networks that historically had zero encryption, WPA3 defines Opportunistic Wireless Encryption (OWE), which encrypts each client’s session using a Diffie-Hellman exchange without any pre-shared secret. The Enterprise variant of WPA3 can optionally use a 192-bit security suite with CNSA-suite cryptography for government and high-security environments. WPA3 networks often run in transition mode, allowing WPA2 and WPA3 clients to coexist on the same SSID; however, this mode may still be vulnerable to downgrade attacks if not configured with care.

For the 350-401 ENCOR exam, you must be comfortable matching a business need to a deployment model—autonomous for tiny offices, centralised for campus LANs, cloud for distributed sites—and explaining why an architecture delivers seamless roaming or zero-touch provisioning. You must also articulate the exact cryptographic improvements WPA3 brings over WPA2, and recognise that the controller in a centralised design is not just a management box but an active participant in the data path via CAPWAP.

## Real-world context

A real IT professional implementing wireless for a mid-size logistics company with a headquarters, two regional warehouses, and ten small dispatch offices walks through a structured decision process.

The professional first surveys each location. The headquarters has open-plan offices for 400 employees, a large warehouse floor, and high client density. The regional warehouses are similar but smaller, while the dispatch offices house only six to eight staff each, often in remote areas with spotty broadband.

For the headquarters, a centralised model is chosen. The team deploys 60 Cisco Catalyst lightweight APs across the campus and installs two redundant 9800 Series Wireless LAN Controllers in the data centre. CAPWAP tunnels backhaul guest traffic to a demilitarised zone for inspection, while employee traffic is locally switched at the AP to keep load off the controller. The controllers are added to a mobility group so forklift-mounted scanners roaming across warehouse zones keep their IP session alive. The employee SSID uses WPA3-Enterprise with RADIUS and certificate-based EAP-TLS, giving each user a unique identity. A legacy barcode scanner SSID still runs WPA2-Personal with a strong PSK because the scanners cannot support WPA3; the network team enforces PMF on this SSID to mitigate deauth attacks and plans a hardware refresh.

The regional warehouses replicate this design on a smaller scale, each with a local virtual WLC running on an existing hypervisor to save cost. The dispatch offices, however, cannot justify a local controller. Instead, the company adopts a cloud-managed solution with Meraki APs. The IT team creates a single cloud dashboard account, configures the network template once, and ships the Meraki APs to each office. A non-IT receptionist plugs the AP into the broadband router; the AP calls home to the cloud, downloads the full configuration, and begins broadcasting the office SSID within minutes. The IT team uses the dashboard’s built-in packet capture tool to troubleshoot a client connectivity issue remotely, something that would have required a desk visit with autonomous APs.

Guest access in all locations uses an open SSID with OWE, so visitors get encryption without needing a password. The dashboard provides a single view of all sites from a smartphone, and the team schedules firmware updates for 2 a.m. The project is completed within the budget because the right model was matched to each site’s characteristics.

## Exam focus

The 350-401 ENCOR exam treats wireless deployment and security as a practical design topic, not a deep configuration exercise. Multiple-choice and drag-and-drop questions dominate, often asking you to place a deployment model next to its characteristic or to identify which security feature prevents a specific attack.

Key concepts they test relentlessly include the following:

- The division of labour between a lightweight AP and a WLC. Expect questions like “Where does the MAC layer processing occur in a CAPWAP split‑MAC architecture?” The answer is split—the AP handles real-time 802.11 functions, the WLC handles management and frame translation.
- CAPWAP protocol details, especially UDP port 5246 for control and 5247 for data, and the difference between local switching and centralised tunnelling.
- Mobility groups as the mechanism that enables Layer 2 and Layer 3 roaming across controllers. A trap question involves an anchor controller setup for guest access.
- Cloud management recognition. Questions describe a scenario with many remote sites and zero‑touch deployment; the correct answer is usually a cloud‑managed solution like Meraki.
- WPA2 weaknesses: offline dictionary attack against the four‑way handshake, lack of forward secrecy, and management frame vulnerability when PMF is not used.
- WPA3 enhancements: SAE/Dragonfly handshake, mandatory PMF, forward secrecy, OWE for open networks, and transition mode.
- WPA3‑Enterprise 192‑bit mode and its cryptographic suite (GCMP‑256, SHA‑384, ECDH with 384‑bit curves).

Common trap patterns to watch for:

- Questions that equate “autonomous” with “standalone” but then ask you to pick the model that scales best—beginners may over‑select autonomous because it sounds simpler.
- Security questions that mention “stronger encryption” as the main WPA3 benefit; ENCOR wants you to recognise it is actually the authentication and key exchange that improved, not the symmetric cipher.
- Answers that claim a cloud‑managed AP cannot function without internet; it can continue serving clients with the last configuration, just not be reconfigured.
- Drag‑and‑drop items placing CAPWAP exclusively in cloud deployments—CAPWAP is the protocol between lightweight AP and local controller, not between AP and cloud.

Key definitions to memorise:

- SAE: a secure password-based authentication and key establishment protocol that uses a zero‑knowledge proof.
- PMF: Protected Management Frames that encrypt unicast management frames and integrity‑protect broadcast ones to stop deauth attacks.
- OWE: encryption for open networks using Diffie‑Hellman, indicated by the RSN element “OWE”.
- Split‑MAC: the functional split where the AP handles real‑time radio tasks and the WLC handles policy enforcement and frame conversion.

## Step by step

1. **Assess the physical footprint and IT staffing** — Count the number of sites, their floor area, expected client density, and whether local IT staff exist. This determines if you can tolerate per-AP manual configuration (autonomous) or require central control (controller or cloud).
2. **Select the deployment model per site** — Match each site to a model: a single small office might use two autonomous APs; a campus with hundreds of APs needs a pair of redundant WLCs running CAPWAP; scattered remote kiosks suit cloud-managed access points that obtain configuration from a web dashboard.
3. **Design SSID and security tiers** — Create separate SSIDs for employees, business-critical devices, and guests. Map each SSID to a security method—WPA3-Enterprise with 802.1X for employees, WPA3-Personal or transition mode for legacy scanners, and OWE for guest access—to balance security and compatibility.
4. **Configure the control plane and mobility** — If using controllers, define mobility groups, RF profiles, and CAPWAP timers. In cloud environments, set the network-wide template that includes VLANs, firewall rules, and traffic-shaping policies. Test roaming with a client to ensure the session persists across AP boundaries.
5. **Validate and harden the security posture** — Enforce PMF on all SSIDs where possible, disable legacy 802.11b/g rates to improve airtime efficiency, and run an active penetration test to confirm that an attacker cannot spoof deauthentication frames or capture handshakes that lead to cracking. Schedule regular firmware updates through the centralised or cloud management interface.

## Comparisons

### Autonomous AP vs Lightweight AP

**Autonomous AP:**
- Contains full independent network stack and local configuration interface.
- Operates without any controller; each AP is a separate island.
- Suited to small, single-site deployments where central management is not required.

**Lightweight AP:**
- Offloads control and policy decisions to a Wireless LAN Controller.
- Uses CAPWAP tunnels exclusively for control and optionally for data.
- Scales to hundreds of APs with consistent policy and seamless roaming.

### WPA2-Personal vs WPA3-Personal

**WPA2-Personal:**
- Uses a Pre-Shared Key that all clients share and a four-way handshake.
- AES-CCMP encryption is used, but forward secrecy is absent.
- Vulnerable to offline dictionary attack after capturing the handshake.

**WPA3-Personal:**
- Replaces PSK with SAE (Dragonfly) handshake that never transmits the password.
- Provides forward secrecy so past sessions stay encrypted if password leaks later.
- Mandates Protected Management Frames to prevent deauth attacks.

### Centralised (on-prem WLC) vs Cloud-Managed (Meraki)

**Centralised (on-prem WLC):**
- Controller hardware or VM sits on the local network, offering sub-millisecond latency.
- CAPWAP control and data tunnels stay inside the enterprise WAN.
- Requires upfront capital investment and local administrator for maintenance.

**Cloud-Managed (Meraki):**
- Controller function hosted in a vendor cloud, reached over the internet.
- APs pull configuration from the cloud; user data is usually bridged locally.
- Zero-touch deployment ideal for distributed sites with no IT staff on site.

### PSK (Pre-Shared Key) vs SAE (Simultaneous Authentication of Equals)

**PSK (Pre-Shared Key):**
- A static passphrase, identical for all users on the SSID.
- The same key encrypts all sessions, so one compromised client threatens others.
- Capturing the four-way handshake allows offline brute-force cracking of the password.

**SAE (Simultaneous Authentication of Equals):**
- A password is still used, but it participates in a zero-knowledge proof handshake.
- Each session derives a unique Pairwise Master Key, isolating clients from each other.
- Passive capture yields no data useful for cracking; attacks require active participation.

## Diagram

_A high-level map linking deployment models to their components and showing how wireless security splits between WPA2 and WPA3 families._

```mermaid
flowchart TD
  A[Wireless Deployment Models] --> B[Autonomous]
  A --> C[Centralised]
  A --> D[Cloud-Managed]
  C --> E[Lightweight AP]
  E -->|CAPWAP| F[Wireless LAN Controller]
  D --> G[Cloud Dashboard]
  A --> H[Wireless Security]
  H --> I[WPA2]
  H --> J[WPA3]
  I --> K[PSK / 802.1X]
  J --> L[SAE / OWE / PMF]
```

## Common misconceptions

- **Misconception:** WPA3 is fundamentally stronger because it uses a new, better encryption algorithm than WPA2. **Reality:** WPA2 and WPA3 both use AES-based encryption. WPA3's security improvement comes from a revamped authentication handshake (SAE) that resists offline dictionary attacks and provides forward secrecy, not from a different cipher. (Marketers often label new standards as 'more secure' without explaining the mechanism, leading people to assume the encryption was upgraded rather than the key exchange.)
- **Misconception:** A wireless LAN controller is always a physical hardware appliance sitting in a rack. **Reality:** A WLC can be a dedicated physical box, a virtual machine running on a hypervisor, embedded in a switch, or delivered as a cloud service—Cisco supports all form factors. (Early controller-based Wi-Fi was synonymous with expensive hardware appliances, so the image persists even though modern designs use virtual or cloud controllers.)
- **Misconception:** Cloud-managed access points send all user traffic through the cloud, which must hurt performance. **Reality:** In most cloud-managed architectures, the management plane goes to the cloud while the data plane is bridged locally onto the wired LAN. Traffic to the internet does not typically pass through the cloud controller. (The word 'cloud' in networking creates a mental picture of all data travelling to a remote data centre; beginners confuse the control plane with the data plane.)
- **Misconception:** WPA2-Enterprise is just WPA2-Personal with a stronger password, because both use a Pre-Shared Key. **Reality:** WPA2-Enterprise does not use a Pre-Shared Key at all; it uses 802.1X with a RADIUS server so each user gets a unique set of credentials, typically a certificate or username-password. (The term 'Enterprise' suggests a corporate version, so learners assume the difference is simply a longer, harder-to-guess key rather than a completely different authentication framework.)
- **Misconception:** If you deploy WPA3, every client on your network must support WPA3. **Reality:** WPA3 supports a transition mode that allows WPA2 and WPA3 clients to coexist on the same SSID, so you can gradually migrate client devices without disruption. (New standards often feel like a hard cut; people worry about compatibility and assume the new protocol is backwards-incompatible in all modes.)

## Key takeaways

- Autonomous access points each have a full management stack and operate independently, making them manageable only at very small scale.
- Centralised wireless splits the AP into a lightweight radio unit and a Wireless LAN Controller, using CAPWAP tunnels to centralise policy and enable seamless roaming.
- Cloud-managed wireless hosts the controller function in a provider's cloud dashboard, ideal for multi-site deployments that need zero-touch provisioning and remote visibility.
- WPA2-Personal relies on a single Pre-Shared Key whose four-way handshake can be captured and subjected to offline dictionary attacks.
- WPA3-Personal replaces the PSK handshake with Simultaneous Authentication of Equals (SAE), providing forward secrecy and resistance to offline cracking.
- Protected Management Frames (PMF), mandatory in WPA3, stop an attacker from sending forged deauthentication frames to disrupt client connections.
- Opportunistic Wireless Encryption (OWE) finally brings encryption to open guest networks without any password, using a per-session Diffie-Hellman exchange.
- Mobility groups allow a client to roam across APs connected to different WLCs without dropping its IP address or requiring a new authentication.

## FAQ

**What exactly is CAPWAP and why do lightweight APs need it?**

CAPWAP is the Control And Provisioning of Wireless Access Points protocol. It creates encrypted UDP tunnels between an AP and a Wireless LAN Controller, separating control messages (UDP 5246) from optional data tunnelling (UDP 5247). Lightweight APs depend on it because they do not contain full network logic; the controller makes all forwarding and authentication decisions.

**How does WPA3-Personal prevent my neighbour from cracking my home Wi‑Fi password?**

It uses Simultaneous Authentication of Equals (SAE). Instead of the static four-way handshake that can be captured and brute‑forced offline, SAE performs a Dragonfly key exchange where the password is never transmitted and each session derives a unique encryption key. Even if your neighbour later learns the password, they cannot decrypt past traffic because of forward secrecy.

**Can I mix WPA2 and WPA3 clients on the same SSID without ruining security?**

Yes, WPA3 transition mode permits both. The AP offers WPA3 SAE to capable clients and falls back to WPA2-PSK for older ones. However, an attacker can still target the WPA2 handshake from legacy clients, so the overall security is only as strong as the weakest allowed protocol. IT teams should eventually remove WPA2 support when all devices are upgraded.

**Why would I choose a cloud-managed Wi‑Fi solution over an on-premises controller?**

Cloud‑managed networks eliminate the upfront cost and maintenance of a physical controller, offer intuitive dashboards accessible from any device, and simplify remote site deployments—simply ship an AP and plug it in. They excel when you have many small, geographically dispersed locations and limited local IT staff.

**What is a mobility group and when do I need one?**

A mobility group is a collection of Wireless LAN Controllers that share client session data. It is required when a wireless client must roam between access points attached to different controllers without re-authenticating or losing its IP address, such as in a large campus or across multiple floors served by different controllers.

**Do I need new hardware to deploy WPA3?**

Not always. Many recent access points and client devices support WPA3 via a firmware or driver update. However, very old chipsets that lack the computational power for SAE Dragonfly key exchange may require replacement. Check the vendor’s compatibility guide before planning a migration.

## Check your understanding

1. **Which protocol does a lightweight access point use to communicate with a Wireless LAN Controller?**

   Answer: CAPWAP (Control And Provisioning of Wireless Access Points), which uses UDP port 5246 for control and optionally UDP 5247 for data tunnelling.

2. **What WPA3 feature replaces the Pre-Shared Key handshake and prevents offline dictionary attacks?**

   Answer: Simultaneous Authentication of Equals (SAE), also called the Dragonfly handshake, which provides forward secrecy and never transmits the password.

3. **How does a mobility group benefit a large campus wireless deployment?**

   Answer: It allows wireless clients to roam between access points connected to different Wireless LAN Controllers without dropping their IP address or re-authenticating.

4. **What is the role of Protected Management Frames (PMF) mandated by WPA3?**

   Answer: PMF encrypts and integrity‑protects management frames so an attacker cannot forge deauthentication or disassociation frames to disconnect legitimate clients.

5. **In cloud-managed Wi‑Fi, what happens if the site's internet connection fails?**

   Answer: The access points continue to serve clients using the last-known configuration, but no policy changes, firmware updates, or remote troubleshooting are possible until the connection is restored.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/encor/wireless-deployment-and-security