Controller & LWAPP Architecture Overview

1. Controller & LWAPP Architecture Overview

2. Centralized Wireless LAN ArchitectureOverview • Processing split between APs and controllers • 802.11 functionality shared • Central management—AP is essentially a remote RF interface • Based on LWAPP protocol • APs hold no security credentials • APs unusable without a controller—Just expensive paperweights! • Data traffic can be bridged locally or at controller Cisco WLAN Controller LWAPP LWAPP

3. Centralized Wireless LAN ArchitectureAP/Controller: Division of Labor Controller • 802.11 MAC Mgmt – (re)association requests & action frames • 802.11 data – encapsulate and sent to AP • 802.11e resource reservation – control protocol carried to AP in 802.11 mgmt frames – signaling done in the controller. • 802.11i authentication & key exchange AP • 802.11 – beacons, probe response, auth (if open) • 802.11 control – packet ack & retransmission (latency) • 802.11e – frame queuing & packet prioritization (real-time access) • 802.11i – Layer 2 encryption Cisco WLAN Controller LWAPP Lightweight Access Points

4. Centralized Wireless LAN ArchitectureWhat Is LWAPP? • LWAPP—Light weight access point protocol is used between APs and WLAN controller • LWAPP carries control and data traffic between the two • Control plane is AES-CCM encrypted • Data plane is not encrypted • It facilitates centralized management and automated configuration • Open, standards-based protocol (submitted to IETF CAPWAP WG) Business Application Data Plane LWAPP Access Point Controller WiFi Client Control Plane

5. LWAPP ModesLayer 2 and Layer 3 LWAPP • Layer 2 LWAPP is in an Ethernet frame • AP and WLC in same L2 domain • Layer 3 LWAPP is in a UDP/IP frame • AP need IP address • Support routing between AP and WLC Cisco WLAN Controller Cisco WLAN Controller LWAPP-L3 LWAPP-L3 LWAPP-L2 Lightweight Access Points Lightweight Access Points LWAPP-L3 Is the Preferred Solution

6. Layer 2/3 Wired Network – Single or Multiple Broadcast Domains Lightweight Access Point Wireless LAN Controller Ingress/Egress point from/to upstream switched/routed wired network (802.1Q trunk) Layer-3 LWAPP Architecture • Access Points require IP addressing • APs can communicate w/ WLC across routed boundaries • L3 LWAPP is more flexible than L2 LWAPP and all products support this LWAPP operational ‘flavor’ L3 LWAPP Tunnel Data Encapsulation – UDP 12222 Control Messages – UDP 12223

7. LWAPP State Machine (Simplified) • LWAPP defines a state machine that governs the AP and controller behavior • Major states: • Discovery—AP looks for a controller • Join—AP attempts to establish a secured relationship with a controller • Image Data—AP downloads code from controller • Config—AP receives configuration from controller • Run—AP and controller operate normally and service data • Reset—AP clears state and starts over • Note: LWAPP/CAPWAP RFC defines other states

8. Layer-3 LWAPP WLAN Controller Discovery • The AP goes through the following discovery steps: • LWAPP Discovery Request broadcast on local subnet (IP broadcast) • WLAN Controller on same subnet as AP will respond to LWAPP Discovery Request • LWAPP Discovery Request sent to controller IP addresses learned via Over-the-Air Provisioning (OTAP) • OTAP—Already joined APs advertise WLAN Controller in Over-the-Air neighbor messages • LWAPP Discovery Request sent to ALL locally stored controller IP address(es) • AP stores controller IP address of previously joined controller plus the controller’s “Mobility Group” members in NVRAM • LWAPP Discovery Request sent to IP Address(es) learned in vendor specific DHCP Option 43 • LWAPP Discovery Request sent to IP Address(es) learned through DNS resolution of “CISCO-LWAPP-CONTROLLER.localdomain” • If no controller found, start hunting algorithm over • AP compiles a LIST of candidate controllers from the received LWAPP Discovery Responses

9. WLAN Controller Join Process • LWAPP Discovery Response contains important information from the WLAN Controller: • Controller sysName, controller type, controller AP capacity, current AP load, “Master Controller” status, AP Manager IP address(es) and number of APs joined to the AP Manager • After an “LWAPP Discovery Interval” timer expires, the AP selects a controller to join using the following decision criteria: • If AP has been previously configured with a primary, secondary, and/or tertiary controller, the AP will attempt to join these first (specified in the Controller sysName) • Attempt to join a WLAN Controller configured as a “Master” controller • Attempt to join the WLAN Controller with the greatest excess AP capacity • This last step provides the whole system with dynamic AP load-balancing

10. Securing the LWAPP Join Process • LWAPP Join implements strong mutual authentication between AP and WLC • AES key is used to encrypt the payloads of subsequent LWAPP Control Messages

11. LWAPP State Machine Review

12. LWAPP Operations—Client Connections • AP handles real-time 802.11 control and management • Non-real time 802.11 handled at controller • Controller is the 802.1x authenticator and centrally stores client QoS, security context • 802.11 data frames are encrypted/decrypted at the RF interface • “Action frames” are management frames as defined by 802.11

13. Understanding Packet Flow in the Centralized Architecture

14. Broadcast and Multicast on the WLC • WLC, by default, does not send broadcast/multicast traffic to WLAN • No impact on typical client DHCP and ARP behavior • WLC Acts as an ARP proxy for the WLAN • WLC acts as a DHCP relay agent for WLAN clients