2.6 Wireless Architectures and AP Modes

Cisco Certified Network Associate CCNA

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the CCNA 200-301 Exam Domains and Weights Study Strategies and Tips

2 Chapter 1: Network Fundamentals (20%)

1.1 Network Components 1.2 Network Topology Architectures 1.3 Physical Interfaces and Cabling 1.4 TCP vs. UDP 1.5 IPv4 Addressing and Subnetting 1.6 IPv6 Addressing and Prefix 1.7 Wireless Principles 1.8 Virtualization Fundamentals 1.9 Switching Concepts 1.10 OSI and TCP/IP Reference Models 1.11 Verifying IP Parameters on Client Operating Systems

3 Chapter 2: Network Access (20%)

2.1 VLANs — Configuration and Verification 2.2 Trunking and 802.1Q 2.3 Layer 2 Discovery Protocols (CDP and LLDP) 2.4 EtherChannel (Link Aggregation) 2.5 Spanning Tree Protocol (STP) and RSTP 2.6 Wireless Architectures and AP Modes 2.7 Network Access Troubleshooting 2.8 Inter-VLAN Routing — Deep Dive

4 Chapter 3: IP Connectivity (25%)

3.1 Routing Table Components 3.2 Router Forwarding Decisions 3.3 IPv4 and IPv6 Static Routing 3.4 Single-Area OSPFv2 — Concepts 3.5 Single-Area OSPFv2 — Configuration 3.6 First Hop Redundancy Protocols (FHRP) 3.7 Troubleshooting IP Connectivity 3.8 OSPF Troubleshooting Scenarios

5 Chapter 4: IP Services (10%)

4.1 NAT (Network Address Translation) 4.2 DHCP and DNS 4.3 NTP, SNMP, and Syslog 4.4 QoS Fundamentals 4.5 TFTP/FTP and Remote Access 4.6 IP Services — Comprehensive Review

6 Chapter 5: Security Fundamentals (15%)

5.1 Key Security Concepts 5.2 Device Access Control and Password Policies 5.3 VPN Fundamentals 5.4 Access Control Lists (ACLs) 5.5 Layer 2 Security Features 5.6 Network Security Best Practices and Hardening 5.7 Threat Mitigation and Incident Response

7 Chapter 6: Automation and Programmability (10%)

6.1 Impact of Automation on Network Management 6.2 Controller-Based and Software-Defined Architectures 6.3 AI and Machine Learning in Network Operations 6.4 REST-Based APIs 6.5 Configuration Management Tools 6.6 JSON-Encoded Data 6.7 Automation and Programmability — Comprehensive Review

2.6 Wireless Architectures and AP Modes

Key Takeaways Explain This Topic AI

Autonomous APs are standalone, configured one at a time, and suit only tiny deployments; they do not scale.

Lightweight APs (LAPs) are controlled by a Wireless LAN Controller (WLC) over CAPWAP, which centralizes config, security, and RF.

CAPWAP uses UDP 5246 for the control channel (encrypted with DTLS) and UDP 5247 for the data channel between AP and WLC.

Cloud-managed APs (e.g., Cisco Meraki) are run from a cloud dashboard, but user data is still switched locally at the AP.

Local mode tunnels client data to the WLC; FlexConnect mode keeps switching traffic locally if the WAN/WLC link drops.

Last updated: June 2026

Three Wireless Deployment Models

The CCNA tests you on three ways to deploy enterprise Wi-Fi, each trading off scale against simplicity:

• Model Management Best for Drawback
• Autonomous AP Each AP individually (CLI/GUI) 1-3 APs, very small sites No central control; config drift

Controller-based (lightweight) Wireless LAN Controller (WLC) Campuses, hundreds of APs Requires a WLC appliance

Cloud-managed (e.g., Meraki) Cloud dashboard over the internet Distributed branches Depends on internet for management

An autonomous access point is a full standalone device — it holds its own SSID, security, and RF config. Managing 200 of them individually is unworkable, so enterprises use a controller.

Controller-Based Architecture and Split-MAC

A Wireless LAN Controller (WLC) centralizes the brains; the APs become lightweight access points (LAPs) that handle only real-time radio functions. This division is the split-MAC model. The WLC handles roaming , RF management (auto channel/power), security policies , client authentication , and centralized configuration; the LAP handles beaconing, transmitting/receiving frames, and encryption at the radio. A new LAP with no config can be plugged in anywhere, find the WLC, download its configuration, and join the network.

CAPWAP — the AP-to-WLC Tunnel

Lightweight APs and the WLC communicate through CAPWAP (Control And Provisioning of Wireless Access Points) , defined in RFC 5415. CAPWAP forms two logical tunnels, and the exam wants the exact UDP ports:

• Channel UDP port Encrypted? Carries
• Control 5246 Yes, via DTLS Config, status, management, firmware
• Data 5247 Optional Encapsulated client traffic

DTLS (Datagram Transport Layer Security) always protects the control channel; data-channel encryption is optional. CAPWAP succeeded the older LWAPP , which is obsolete on current equipment. A key benefit: because client traffic is tunneled to the WLC, an AP can be on any subnet and still extend a given VLAN/SSID — the tunnel carries it back to the controller. CAPWAP also lets the WLC push a single firmware image and config to every AP at once.

AP Operating Modes

A lightweight AP can run in several modes on the WLC; two matter most for CCNA:

Local mode is the default. The AP tunnels all client data back to the WLC (centralized switching) and serves clients on its channel while periodically scanning others.

FlexConnect mode lets the AP switch client traffic locally at the branch even when the WAN link to the WLC is down . This is the right answer for a remote branch with an unreliable connection to the central WLC — clients keep working during a WAN outage.

Other modes you may see listed: Monitor (no client service; dedicated to scanning/IPS and location), Sniffer (captures and forwards 802.11 frames to an analyzer), and Bridge/Mesh (links sites wirelessly). On the exam, the distinguishing question is almost always Local versus FlexConnect: if the requirement mentions surviving a WLC/WAN outage at a branch, choose FlexConnect; if it mentions centralized policy and switching with the WLC always reachable, choose Local.

How a Lightweight AP Joins the WLC

The CCNA expects a high-level grasp of the AP join process because it explains many "AP won't come online" troubleshooting questions. A new lightweight AP boots, gets an IP via DHCP , then must discover a WLC. It learns the controller's management IP through one of several methods: a DHCP Option 43 entry, a DNS lookup of CISCO-CAPWAP-CONTROLLER, a previously remembered controller, or a Layer 3 broadcast on the local subnet. The AP then sends a CAPWAP discovery request , the WLC replies, and the two build the DTLS-secured CAPWAP control tunnel on UDP 5246.

The AP downloads its configuration and, if its software differs, the matching image from the WLC before serving clients.

Because of this sequence, a stuck AP usually points to one of a short list of causes: no DHCP/IP, a firewall blocking UDP 5246/5247, a missing Option 43 or DNS record so the AP cannot find the controller, a software-version mismatch forcing a slow upgrade, or a time/certificate problem breaking DTLS. Knowing the join order lets you diagnose in the right sequence.

Choosing an Architecture

Use this decision guide, which mirrors how exam scenarios are worded:

• Requirement in the question Best architecture
• 1-3 APs, no budget for a controller Autonomous
• Hundreds of APs, central policy, seamless roaming Controller-based (WLC + LAPs)
• Many small branches, IT managed remotely Cloud-managed (e.g., Meraki)
• Branch must keep Wi-Fi alive during a WAN outage Controller-based with FlexConnect APs

Key distinctions the exam rewards: autonomous APs do not scale because each is configured by hand; controller-based designs centralize the management/control plane via split-MAC while the AP keeps real-time radio work; cloud-managed designs put the dashboard in the cloud yet still switch user data locally at the AP , so a cloud outage does not stop client traffic. Tie every answer back to where management lives and where data is switched, and the wireless questions become straightforward.