Cisco CCNP Enterprise (ENCOR 350-401) · lesson 8 of 12 · 30 min
Wireless Architecture Overview
Enterprise wireless networks have evolved from standalone APs to centrally managed architectures. Understanding the different deployment models and how they handle traffic is essential for the ENCOR exam.
CAPWAP: The WLC-AP Protocol
CAPWAP (Control and Provisioning of Wireless Access Points) is the protocol that connects lightweight APs to the WLC. It uses two UDP tunnels: The AP discovery process: AP boots → sends CAPWAP Discovery Request (broadcast/multicast/DHCP option 43/DNS) → WLC responds → AP joins WLC → WLC pushes configuration → AP begins serving clients. CAPWAP vs LWAPP LWAPP was the predecessor to CAPWAP. CAPWAP is the IETF standard (RFC 5415). The exam uses CAPWAP terminology.
WLC Traffic Modes
802.11 Standards and Frequencies
Wireless Roaming
Roaming occurs when a client moves from one AP to another. The type of roaming depends on whether the APs are on the same controller, different controllers, or different mobility groups. The ENCOR exam focuses on 802.11r/k/v as a trio for seamless roaming. 802.11r handles fast re-authentication, 802.11k helps clients find the best AP, and 802.11v allows the network to guide client roaming decisions.
Wireless Security
Flashcard Drill
CAPWAP Control and Provisioning of Wireless Access Points — protocol connecting lightweight APs to WLC. UDP 5246 (control) and 5247 (data). FlexConnect AP mode that can switch traffic locally when WLC is unreachable — used in branch offices. 802.11r Fast BSS Transition — pre-authenticates with target AP before roaming to reduce latency. 802.11ax (Wi-Fi 6) Latest mainstream standard — OFDMA, BSS coloring, target wake time. Focuses on efficiency in dense environments. WPA3-Personal (SAE) Replaces WPA2-PSK — Simultaneous Authentication of Equals, resistant to offline dictionary attacks. Local mode AP All client traffic tunneled through CAPWAP to WLC — WLC handles switching and routing. Inter-controller L3 roam Client moves to AP on different WLC in different subnet — client gets new IP, session may break. PMF (802.11w) Protected Management Frames — encrypts deauth/disassoc frames to prevent deauthentication attacks. DHCP option 43 Used to tell APs the WLC IP address during CAPWAP discovery — alternative to DNS or broadcast.
Knowledge Check — 12 Questions
Wireless Architecture: WLC, CAPWAP & Roaming
Which UDP ports does CAPWAP use for control and data tunnels?
- 5246 control, 5247 data
- 5247 control, 5246 data
- 4500 control, 4501 data
- 8080 control, 8443 data
Answer: 5246 control, 5247 data
CAPWAP uses UDP 5246 for the control tunnel (encrypted with DTLS) and UDP 5247 for the data tunnel.
Which AP mode switches client traffic locally when the WLC is unreachable?
- Local mode
- Monitor mode
- FlexConnect
- Sniffer mode
Answer: FlexConnect
FlexConnect APs can switch traffic locally when the WLC is unreachable — designed for branch offices with WAN connectivity to a central WLC.
What does 802.11r provide?
- Neighbor reports for better AP selection
- Fast BSS Transition — pre-authentication before roaming
- BSS Transition Management — network-guided roaming
- Protected Management Frames
Answer: Fast BSS Transition — pre-authentication before roaming
802.11r (Fast BSS Transition) pre-authenticates with the target AP before the client roams, reducing roaming latency — critical for voice and video.
Which Wi-Fi standard introduced OFDMA and BSS coloring?
- 802.11ac (Wi-Fi 5)
- 802.11n (Wi-Fi 4)
- 802.11ax (Wi-Fi 6)
- 802.11a
Answer: 802.11ax (Wi-Fi 6)
802.11ax (Wi-Fi 6) introduced OFDMA for efficient multi-user access and BSS coloring to reduce co-channel interference in dense environments.
What security improvement does WPA3-Personal (SAE) provide over WPA2-PSK?
- Longer passwords
- Per-user certificates
- Resistance to offline dictionary attacks
- Faster encryption
Answer: Resistance to offline dictionary attacks
SAE (Simultaneous Authentication of Equals) uses a Dragonfly handshake that prevents offline dictionary attacks against captured handshakes.
CAPWAP uses DTLS to encrypt the _____ tunnel.
Answer: control
The CAPWAP control tunnel (UDP 5246) is encrypted with DTLS. The data tunnel (UDP 5247) is optionally encrypted.
What happens during an inter-controller Layer 3 roam?
- Client keeps its IP address seamlessly
- Client gets a new IP address — session may break
- WLC creates a tunnel to maintain the session
- Client is forced to re-authenticate
Answer: Client gets a new IP address — session may break
In a Layer 3 inter-controller roam, the client moves to a different subnet and must get a new IP address. Sessions that depend on the IP address will break.
Which AP mode scans all channels for rogue detection without serving clients?
- Local mode
- FlexConnect
- Sniffer mode
- Monitor mode
Answer: Monitor mode
Monitor mode APs scan all channels for rogue APs and perform spectrum analysis. They do not serve wireless clients.
What does 802.11w (PMF) protect against?
- Offline dictionary attacks
- Deauthentication attacks
- Rogue APs
- Evil twin attacks
Answer: Deauthentication attacks
PMF (Protected Management Frames) encrypts deauthentication and disassociation frames, preventing attackers from forging them to disconnect clients.
Which DHCP option tells APs the WLC IP address during CAPWAP discovery?
- Option 43
- Option 66
- Option 82
- Option 150
Answer: Option 43
DHCP option 43 (vendor-specific) is used to provide APs with the WLC IP address during the CAPWAP discovery process.
802.11ac (Wi-Fi 5) operates on which frequency band?
- 2.4 GHz only
- 5 GHz only
- Both 2.4 GHz and 5 GHz
- 6 GHz only
Answer: 5 GHz only
802.11ac operates exclusively on the 5 GHz band. 802.11n and 802.11ax support both 2.4 GHz and 5 GHz.
What is the purpose of 802.11v (BSS Transition Management)?
- Pre-authenticate before roaming
- Provide neighbor AP reports
- Allow the network to suggest or force client roaming
- Encrypt management frames
Answer: Allow the network to suggest or force client roaming
802.11v allows the AP/WLC to suggest or force clients to roam to a better AP — used for load balancing and band steering.
Previous lesson: Advanced STP: RSTP, MST (802.1s), loop prevention (BPDU guard, root guard, loop guard)
Back to Cisco CCNP Enterprise (ENCOR 350-401)
Next lesson: QoS: classification, marking (DSCP/CoS), queuing (CBWFQ/LLQ), policing, shaping, congestion avoidance