WLAN infrastructure connections
Physical connections between APs and wireless LAN controllers: access versus trunk switch ports, CAPWAP tunnels and LAG.
AP switch-port connections
Physically, a lightweight AP connects to a switch access port (in the AP-management VLAN); it needs no trunk because its client traffic travels inside the CAPWAP tunnel, not as tagged 802.1Q frames. The WLC connects to the distribution/core with one or more ports, typically bundled with LAG (a port-channel) for bandwidth and redundancy — most WLC designs treat the controller ports as one logical link.
Component connections
| Component | Switch port type | Why |
|---|---|---|
| Lightweight AP | Access port (AP-management VLAN) | Client VLANs ride inside CAPWAP; tagging at the AP port is unnecessary |
| WLC uplinks | LAG / port-channel (trunk) | Aggregates capacity and survives a member link failure |
| FlexConnect AP | Can be a trunk when local-switching multiple WLANs to VLANs | Only needed when the AP itself maps WLANs to VLANs |
| Autonomous AP with multiple SSIDs | Trunk port | Each SSID maps to a VLAN and must be tagged |
Provision an access port for a lightweight AP — Privileged EXEC → Interface configuration
Cisco IOS / IOS XE
configure terminal interface gigabitethernet1/0/10 switchport mode access switchport access vlan 50 spanning-tree portfast end
show interfaces status show cdp neighbors gi1/0/10 detail ping <wlc-mgmt-ip>
- AP appears in CDP/LLDP on the access port.
- AP receives a DHCP lease in VLAN 50 and discovers the WLC.
- Use a trunk instead only if the AP needs to switch client VLANs locally (FlexConnect).
Changes device configuration.
WLC uplinks and CAPWAP path
In local mode the data path is client → AP → CAPWAP tunnel (UDP 5247) → WLC → wired VLAN. The AP needs IP reachability to the WLC's management address only — routing, ACLs or NAT in between must permit the CAPWAP control (5246) and data (5247) ports.
- Client
- Associated to WLAN 'CORP' (mapped to VLAN 20 on the WLC)
- AP
- Access port in VLAN 50, CAPWAP to WLC
- Client sends an 802.11 frame to the AP's radio.
- AP wraps it in CAPWAP over its single-VLAN access link toward the WLC.
- WLC decapsulates, maps the WLAN to VLAN 20 and puts the frame onto the wired network — its LAG uplink carries that VLAN.
- The server sees an ordinary Ethernet frame in VLAN 20; the CAPWAP hop was transparent.
The AP's own port only needs the management VLAN — the client VLAN exists between the WLC and the wired network.
Verification
Common mistakes
- Trunking every client VLAN to AP access ports — unnecessary for CAPWAP-tunneled (local mode) APs.
- Forgetting that the WLC needs the client VLANs on its LAG — that's where they enter the wired side.
- Blocking UDP 5246/5247 between AP and WLC — joins and client data both fail.
- Assuming the AP needs a trunk for PoE — PoE and VLAN mode are independent; access ports deliver PoE fine.
Observation: Clients join the SSID and authenticate, but DHCP never completes.
- The WLC's LAG uplink doesn't carry the client VLAN
- WLAN mapped to the wrong VLAN/interface on the WLC
- DHCP path blocked between the WLC and the server
| Check | Indicates |
|---|---|
| WLC interface/WLAN-to-interface mapping | Each WLAN maps to a VLAN — a wrong mapping strands clients. |
| Trunk/LAG allowed VLAN list toward the WLC | Client VLAN must be allowed on the WLC's uplink. |
DHCP offer path (ip helper-address on the client VLAN SVI) | Broadcasts need a relay to cross subnets. |
Correction: Fix the WLAN→interface mapping or the uplink VLAN list, then retest.
Client receives a lease in the intended VLAN and reaches the gateway.
Related resources
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- RFC 5415 — CAPWAP Protocol Specification — reviewed 2026-11-02
- Wi-Fi Alliance — Security — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.