WLC Architecture and WPA Security

Watch first

Plain-English explanation

In centralized wireless, lightweight APs (LAPs) are mostly radios — brain functions move to the Wireless LAN Controller (WLC). APs tunnel traffic to the WLC with CAPWAP, which separates management from client data (split-MAC).

WPA2 uses AES encryption — Personal (PSK) shares one passphrase; Enterprise (802.1X) uses per-user credentials via RADIUS. WPA3 improves handshake resistance (SAE) and forward secrecy — know CCNA-level comparisons.

Deep dive

Split-MAC concept:

| Function | Lightweight AP | WLC | |----------|--------------|-----| | Beacons, RF | Yes | Coordinates | | Association auth | Partial | Policy | | Encryption keys | Often AP | WLC policy | | VLAN mapping | AP tags | WLAN config |

CAPWAP: UDP tunnels — control and data channels — between AP and WLC. AP discovers WLC via DNS, DHCP option, or broadcast (environment dependent).

Security comparison:

| Mode | Auth | Typical use | |------|------|-------------| | WPA2-Personal | PSK | Home, small office | | WPA2-Enterprise | 802.1X + RADIUS | Corporate | | WPA3-Personal | SAE | Modern devices | | Open | None | Guest — isolate VLAN |

Step-by-step — WLAN to VLAN mapping

Design: SSID CORP → VLAN 10 (staff). SSID GUEST → VLAN 99 (isolated, ACL to Internet only).

1. Create VLANs on switch with trunk to WLC
2. On WLC: WLAN CORP bound to interface/VLAN 10, WPA2-Enterprise
3. WLAN GUEST on VLAN 99, WPA2-Personal or captive portal (awareness)
4. APs join WLC — SSIDs pushed to AP radios

Use wireless channel planner tool to finalize 5 GHz plan alongside VLAN design.

WLC AireOS GUI — CCNA topics 2.9 and 5.10

The exam expects you to configure and verify WLANs in the GUI (especially WPA2 PSK) and interpret partial GUI output for client connectivity.

Workflow summary:

1. Controller → Interfaces — create dynamic interface per VLAN/subnet
2. WLANs → Create New — profile name, SSID, WLAN ID
3. General — Enable, bind Interface/Interface Group, set radio policy
4. Security — Layer 2: WPA+WPA2; encryption AES; enable PSK; enter passphrase (≥ 8 chars)
5. QoS — Silver default; use Gold for video, Platinum for voice
6. Advanced — FlexConnect for branch local switching; client exclusion, session timeout (awareness)
7. Apply on each tab — verify WLAN Enabled and APs registered

| GUI tab | Exam focus | | --- | --- | | General | SSID, status, VLAN/interface binding | | Security | WPA2-PSK vs 802.1X + RADIUS | | QoS | Platinum / Gold / Silver / Bronze | | Advanced | FlexConnect, DHCP required, client exclusion |

VPN tie-in: Branch APs reach a centralized WLC over site-to-site IPsec (tunnel mode on Internet-facing routers). FlexConnect lets APs switch client traffic locally when the WAN/VPN path is designed for it. Do not confuse WPA2-PSK (wireless Security tab) with IPsec VPN (router crypto) or CAPWAP (WLC-to-AP tunnel).

Commands to know

show wlan summary
show ap summary
show client summary
show advanced 802.11a summary

Troubleshooting

| Issue | Check | |-------|-------| | AP not joining WLC | CAPWAP UDP 5246/5247 blocked, wrong WLC IP | | SSID visible, auth fails | PSK typo, RADIUS down for Enterprise | | Client no DHCP | WLAN VLAN mapping, trunk allowed VLANs | | Poor roaming | Overlapping cells, power too high, wrong band |

Wireless + VLAN trunk issues overlap — verify wired path first.

Exam relevance

Practice checklist

• Draw CAPWAP path from client through AP to WLC to VLAN
• Compare WPA2-Personal vs Enterprise auth paths
• Plan guest isolation with separate VLAN and ACL
• Use wireless channel planner for 5 GHz AP layout
• Explain one reason enterprises use 802.1X