2.4Cisco wireless architecture

The optimal architecture differs between a small site served by a few APs and a large environment running hundreds of APs company-wide in a unified way. CCNA compares three approaches—autonomous (configure each AP individually), cloud-based (manage centrally from a cloud dashboard), and split-MAC (concentrate control in a WLC, the wireless LAN controller)—in terms of their division of labor and manageability, and even asks how you actually create a WLAN in the WLC GUI (SSID, security, QoS).

2.4.1The three wireless architectures

• Autonomous AP is where each AP is self-contained, with SSID, security, and channel configured individually on each AP. Fine for a small site with a few APs, but as the count grows, manually applying a config change to every AP breaks down.
• Cloud-based manages APs centrally from a cloud dashboard (e.g., Meraki). Configuration, monitoring, and firmware updates are unified in a GUI over the internet, suiting unified operation across sites. Typically control is in the cloud while data forwarding stays local at each AP/site.
• Split-MAC (WLC) divides work between a lightweight AP and a WLC (wireless LAN controller). The AP handles real-time functions (transmitting/receiving 802.11 frames, encryption, beacons), while the WLC centrally handles management/control (pushing config, authentication, RF management, roaming coordination). AP and WLC connect over a CAPWAP tunnel. Ideal for unified operation at the scale of hundreds of APs.

2.4.2AP modes and management access

• A lightweight AP's AP mode is switched by purpose: local (default, serves normal client connectivity), FlexConnect (connects to the WLC over a WAN and keeps switching/authenticating locally at a branch even if the WLC is unreachable), monitor (serves no clients, dedicated to RF monitoring, rogue-AP detection, and location), and sniffer (captures wireless frames and forwards them to an analyzer).
• Management access to an AP/WLC is organized by how you reach its CLI/GUI: the physically attached console (out-of-band, for initial setup), unencrypted Telnet (discouraged), encrypted SSH (preferred), and the web GUI over HTTP/HTTPS (WLC configuration is mainly via the HTTPS GUI). Because a WLC is the linchpin aggregating many APs, the security best practice is to restrict management access to encrypted paths such as SSH/HTTPS.

2.4.3Creating a WLAN in the WLC GUI (WPA2 PSK, QoS)

• In the WLC GUI, WLAN creation roughly follows: create a new WLAN, set its SSID (the over-the-air wireless network name) and profile name, and map that WLAN to the appropriate interface/VLAN (the wired-side segment). The SSID is the user-visible name; the WLAN is the WLC-side configuration unit that contains that SSID.
• On the Security (Layer 2) tab you choose the authentication method. WPA2 PSK (Personal), which protects simply with a pre-shared key, is set by making Layer 2 Security WPA2 and auth key management PSK, then entering the shared password. For enterprise per-user authentication via RADIUS you choose WPA2 Enterprise (802.1X) instead (AAA/RADIUS is covered in Chapter 5).
• On the QoS tab you select a QoS profile. Cisco wireless QoS has four levels from the top: Platinum (voice), Gold (video), Silver (best effort, default), and Bronze (background), assigned per the SSID's purpose (e.g., Platinum for an IP-phone SSID). The Advanced tab sets details such as session timeout, per-client bandwidth limits, and AAA override.

A company deploys about 120 APs across a 10-floor office and wants a company-wide unified SSID and security, plus seamless roaming that does not drop as users move between floors. Initially each AP was configured individually as an autonomous AP, but manually pushing a config to all 120 every time an SSID password changed or channels were tuned was near collapse. So it migrates to a split-MAC architecture, introducing one WLC and joining each AP as a lightweight AP over CAPWAP. Now SSID, security, QoS, and RF (channel/power) are configured once in the WLC GUI and pushed to all APs, and the WLC coordinates roaming centrally, greatly easing operations. In the WLC GUI, the admin creates an employee WLAN with SSID CORP-WIFI, sets WPA2 with PSK auth on the Security (Layer 2) tab and a pre-shared key (WPA2 PSK), and maps the wired side to a VLAN 20 interface. A separate IP-phone SSID CORP-VOICE is created with the QoS profile set to Platinum to prioritize voice latency and jitter. After go-live, it emerges that management access to the WLC was over Telnet (unencrypted); to avoid eavesdropping, access is restricted to SSH and the HTTPS GUI and Telnet is disabled. If branch WAN links are thin and the WLC lives only at HQ, and the requirement is to keep branch wireless working even when the WLC is unreachable, the branch APs are put in FlexConnect mode so they keep switching/authenticating locally if the WLC goes down. Choosing the architecture and AP mode by scale, site topology, and availability requirements is the crux of CCNA wireless design.

2.4.4Section summary

• Autonomous = per-AP config (small); cloud-based = centralized in the cloud; split-MAC = lightweight AP + WLC dividing work (CAPWAP, large-scale unified)
• In split-MAC the AP does real-time 802.11 processing, the WLC handles management/control/RF. AP modes include local/FlexConnect (keeps working at a branch even if the WLC is unreachable)/monitor. Restrict WLC/AP management access to SSH/HTTPS
• WLAN creation in the WLC GUI: SSID -> map to interface/VLAN -> security (WPA2 PSK = Personal) -> QoS profile (Platinum voice > Gold video > Silver default > Bronze) -> Advanced