Physical Connections for WLAN Components

What it is

Every access point and controller connects to the wired network, and each link needs the right switch configuration.

A wireless LAN is not only radio. Behind every access point there is cabling, a switch port and a controller.

This topic describes how access points (APs) and wireless LAN controllers (WLCs) are physically connected to the wired network, and which type of switch port to use for each.

How it works

The AP port type depends on the AP mode, and the controller usually connects through trunks or a LAG.

The AP connection

An AP plugs into a switch with a single Ethernet cable. The same cable usually also powers the AP through Power over Ethernet (PoE), so no separate power outlet is needed at the ceiling.

The right switch port type depends on the AP's mode.

In local mode, the AP builds CAPWAP tunnels to the controller, and all client traffic travels inside them. The switch only sees traffic between the AP and the controller, all in one VLAN.

An access port example for a lightweight AP in local mode:

interface GigabitEthernet0/10
 switchport mode access
 switchport access vlan 100
 power inline auto

A trunk port example for a FlexConnect AP:

interface GigabitEthernet0/11
 switchport mode trunk
 switchport trunk native vlan 100
 switchport trunk allowed vlan 100,110,120

An autonomous AP that carries more than one SSID mapped to different VLANs needs a trunk. With one VLAN, an access port is enough.

The controller connection

A WLC can be a physical appliance, a virtual machine or software on a switch. A physical controller has several kinds of port:

• Distribution system ports: carry traffic between the controller and the network, including the CAPWAP tunnels from the APs. They normally connect to the switch as trunk ports, because the controller handles many VLANs.
• Service port: a separate out-of-band port for management and recovery.
• Redundancy port: connects a pair of controllers for high availability.
• Console port: for direct, local access.

The controller also has logical interfaces. The management interface is used for management and for CAPWAP communication with the APs. Dynamic interfaces connect WLANs to VLANs, so client traffic can be put in the right VLAN.

The names above follow AireOS controllers. On the IOS XE based Catalyst 9800, VLANs and SVIs play the part of dynamic interfaces.

Link aggregation on the controller

The controller carries the traffic from many APs, so a single link may become a bottleneck or a point of failure.

Several of the controller's ports can be combined into a link aggregation group (LAG), which acts as one logical link. This increases bandwidth and gives redundancy, because the bundle keeps working if one port fails.

The connected switch must be set up to match, using EtherChannel on its side. On AireOS controllers, the LAG is static with no negotiation protocol, so the switch ports use mode on. The Catalyst 9800 also supports LACP.

A mismatch in the bundling mode causes the link to fail.