Wireless architectures and AP modes
Autonomous, lightweight (CAPWAP) and cloud-based AP architectures, split-MAC operation, and AP modes such as local, monitor and FlexConnect.
Deployment models
Three deployment models: autonomous APs (each AP is configured independently, does everything itself), lightweight APs + WLC (CAPWAP tunnel splits functions — the split-MAC model), and cloud-based management (APs managed by a cloud dashboard, e.g., Meraki-style). The CCNA blueprint focuses on the WLC model.
Model comparison
- Autonomous: full config on each AP, no roaming coordination, fine for a single AP.
- Lightweight + WLC: central policy, tunneled or local switching, enterprise scale.
- Cloud-managed: cloud dashboard replaces the WLC control plane; data plane typically stays local at the AP.
- Requirement
- 30 APs across a campus, centralized security policy, seamless roaming
- Autonomous APs would need 30 individual configs — drift and inconsistent policy become the cost at scale.
- A WLC pushes one WLAN/SSID policy to all APs and coordinates roaming between them.
- Cloud management is the alternative when you don't want controller hardware — same centralization, different location.
WLC-based lightweight APs (or cloud-managed) are the answer for any multi-AP deployment.
Split-MAC and CAPWAP
Split-MAC responsibilities
| Function | Lightweight AP | WLC |
|---|---|---|
| 802.11 MAC: beacons, probes, acknowledgements | ✓ (real-time, on the AP) | |
| Association and authentication state | Handled at AP via WLC policy | ✓ (central control) |
| Config: SSID, channels, power, security | Pushed down from WLC | ✓ (authored centrally) |
| Client traffic path (local mode) | Encapsulated in CAPWAP to the WLC | Decapsulated onto the wired network |
CAPWAP carries both the control channel (DTLS-encrypted config and management, UDP 5246) and the data channel (client frames, UDP 5247) between each AP and its WLC. The AP discovers the WLC via DHCP option 43, DNS or broadcast, then joins and receives its entire configuration.
AP modes
Common AP modes
| Mode | Behavior |
|---|---|
| Local | Serves clients on its channels; client traffic tunnels to the WLC (default) |
| FlexConnect | Serves clients but can switch traffic locally — survives WLC outage for that site |
| Monitor | Doesn't serve clients — scans channels for RF conditions and rogue APs |
| Sniffer | Captures wireless traffic for analysis |
| Bridge/mesh | Wireless backhaul between APs where wiring isn't possible |
Common mistakes
- Assuming every multi-AP deployment needs a controller — autonomous APs work standalone (at config cost); without a WLC, lightweight APs only serve clients if FlexConnect local switching/authentication is designed for it.
- Believing client data always passes through the WLC — FlexConnect and cloud-managed models switch locally.
- Treating CAPWAP as optional overhead — it is the control and data channel that makes central management work.
- Thinking 'controller' here means Cisco DNA Center — the wireless controller is the WLC.
Observation: A new AP powers on but never appears in the WLC's AP list.
- AP can't discover the WLC (no DHCP option 43/DNS record)
- CAPWAP ports blocked between AP and WLC
- AP's regulatory domain/time incompatible
| Check | Indicates |
|---|---|
| AP console/discovery logs | Shows which discovery methods it tried and failed. |
| UDP 5246/5247 reachability (ACLs, firewalls) | Filtered CAPWAP ports block the join even with discovery working. |
| WLC's failed-join logs | Reveals auth/cert or regulatory rejects. |
Correction: Provide a discovery path (option 43/DNS/local broadcast) and open CAPWAP ports.
AP appears in the WLC list, downloads its config and broadcasts the SSIDs.
On this page
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 5415 — Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification — reviewed 2026-11-02
- Wi-Fi Alliance — Security — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.