Cisco Wireless Architectures and AP Modes

What it is

A wireless network can be managed in three main ways, and each access point also runs in a mode.

The choice affects how easy it is to configure many access points, how users roam between them and where traffic flows.

This topic covers the main Cisco wireless architectures, and the AP modes that tell an access point (AP) what job it should do.

How it works

The architecture decides who manages the AP, and the AP mode decides what the AP does.

Autonomous architecture

In an autonomous design, each AP is a complete device. It has its own configuration, its own security settings and its own management interface.

It connects to the wired network and bridges wireless clients onto it, usually through a trunk when more than one VLAN is used.

This works for a small site with a few APs. As the number of APs grows, it becomes a burden. Every setting must be repeated on every AP, and there is no central view of the radio environment.

Cloud-based architecture

In a cloud-based design, the APs are managed from a platform on the internet. An administrator logs in to a web dashboard to configure all sites and see all APs.

Cisco Meraki is the typical example. The management traffic goes to the cloud, while user traffic normally goes straight onto the local network.

Split-MAC controller-based architecture

In a controller-based design, the work of a wireless AP is divided between the AP and a wireless LAN controller (WLC). This is called split-MAC.

• The AP handles the real-time tasks: sending and receiving radio signals, encryption and acknowledging frames.
• The controller handles the management tasks: configuration, security policy, radio resource management (channel and power choices) and client roaming.

The AP and the controller communicate through CAPWAP (Control and Provisioning of Wireless Access Points) tunnels. There are two tunnels:

• a control tunnel that carries management and configuration messages, using UDP port 5246
• a data tunnel that carries client traffic, using UDP port 5247

An AP that works this way is called a lightweight AP. When it powers up, it finds a controller, joins it, and downloads its configuration. You configure a WLAN once on the controller, and every joined AP receives it.

With the default arrangement, all client traffic is tunnelled back to the controller, and the controller places it on the right VLAN. This is centralised switching. It gives strong central control, but all client traffic passes through the controller.

The controller can be placed in different ways:

• Centralised: one controller, often in the data centre or core, for the whole campus.
• Distributed: several controllers spread across the network, for example one per building.
• Embedded: the controller function runs inside a switch.
• Controller on the AP: in small sites, one AP can host the controller function for the others.

AP modes

A lightweight AP can run in several modes. The mode decides what the AP does.

Mode names vary slightly between controller software versions.

Local mode is the normal one. FlexConnect is used for branch offices, so staff can still work if the link to the head-office controller is down. Monitor and sniffer are for security and troubleshooting, and the AP serves no clients in those modes.