In a controller-based WLAN the 802.11 MAC is split between the access point and the controller, and the AP's mode decides where client traffic leaves the tunnel — which in turn decides whether its switchport is an access port or a trunk. This chapter covers AP modes, controller interface roles, the CAPWAP control and data tunnels, channel-width planning, and the order you build a WLAN in.
A lightweight AP is not a dumb radio and it is not a self-contained access point either. The 802.11 MAC layer is split in two. The AP keeps every job that has to complete in microseconds: sending beacons and probe responses, acknowledging frames, retrying failed transmissions, buffering for power-save clients, and encrypting or decrypting the data as it crosses the air.
The controller keeps every job that can survive a round trip across the wired network: association and re-association, 802.1X/EAP authentication and key management, roaming, radio resource management (which channel and how much power each AP uses), and the security, QoS and VLAN policy attached to each wireless network. That split is why one change on the controller reaches two hundred APs at once — and why a controller outage does not instantly silence a radio.
| Function | Handled by |
|---|---|
| Beacons, probe responses, 802.11 ACKs, retries | AP — real-time MAC |
| Frame buffering and power-save delivery | AP — real-time MAC |
| Over-the-air encryption / decryption | AP — real-time MAC |
| Association, re-association, disassociation | Controller |
| 802.1X / EAP authentication and key management | Controller |
| Channel and transmit-power assignment (RRM) | Controller |
| Per-WLAN security, QoS, and VLAN mapping | Controller |
An AP discovers a controller (from DHCP option 43, a DNS record, a broadcast on its own subnet, or a controller it has joined before), then builds a CAPWAP tunnel to it. CAPWAP is the IETF standard (RFC 5415) that replaced the earlier proprietary LWAPP.
There are two tunnels, not one. The control tunnel runs over UDP 5246 and carries AP configuration, RRM instructions, and client management. The data tunnel runs over UDP 5247 and carries the actual client frames when the wireless network is centrally switched. The control tunnel is DTLS-encrypted by default; encrypting the data tunnel as well is optional and costs throughput.
The consequence to remember: because CAPWAP encapsulates client frames, the AP's wired path only ever sees packets sourced from the AP's own IP address. In local mode a client's VLAN never appears on the AP's switchport at all — it appears on the controller's uplink, where the tunnel is unwrapped. That single fact answers most 'what should the AP's switchport be?' questions.
CAPWAP also routes: the AP and the controller do not have to share a VLAN or a subnet, which is what makes a central controller with branch APs possible. The tunnel does add header overhead, so an undersized MTU somewhere on the path shows up as APs that join and then drop again.
6 more sections in this chapter, plus a 6-question quiz.
You can see the title, summary, and learning objectives. To read the chapter, build the labs, and chat with ARIA, create a free account — Module 1 is fully readable on the free plan.
NetForge-AI is an independent educational platform and is not affiliated with, endorsed by, or sponsored by any networking vendor or certification body. All product names, protocols, and standards referenced are the property of their respective owners and are used for descriptive, educational purposes only.
Free account · no card required · upgrade to Pro any time