Cisco ENWLSD 300-425 cheat sheet

Site survey inputs: floor plans with scale, wall materials and attenuation values, ceiling height/type, rack locations, existing AP mounting points, and cable pathway availability.

Predictive design requires: attenuation per material (dB), AP antenna pattern and EIRP, band (2.4/5/6 GHz), and target RSSI/SNR per use case; without these the model is only a rough estimate.

Passive survey records received signal strength from existing APs; active survey associates to an SSID and measures real client experience including retries, data rates, and roaming.

Spectrum analysis captures noise floor, non-Wi-Fi interferers (microwave, DECT, analog video, LTE), channel utilization, and duty cycle per band; compare noise floor against -92 dBm (2.4/5 GHz) reference.

Capacity baseline: count associated clients per AP, per-SSID client distribution, average/peak throughput per client, and busy-hour concurrency to size AP density.

Existing wired infrastructure checks: switch port availability, PoE budget per switch (802.3af 15.4 W / 802.3at 30 W / 802.3bt 60-90 W), uplink bandwidth, VLAN and trunk configuration.

Roaming baseline: record client roam counts, roam times, and sticky-client behavior; note whether CCKM/OKC/802.11r is enabled and which client OS types dominate.

Regulatory and physical constraints: country regulatory domain, DFS channel availability, outdoor coverage needs, and any restricted areas (radiology, EMI-heavy rooms) that change AP placement.

AP count estimate = total coverage area ÷ coverage area per AP, then adjust upward for capacity: required APs = peak concurrent clients ÷ clients per AP at target throughput.

Design targets commonly used: -67 dBm RSSI for voice, -72 dBm for data, SNR ≥ 25 dB, and cell overlap of 15-20% at the coverage boundary for roaming.

Channel plan: 2.4 GHz uses 1/6/11 only (3 non-overlapping); 5 GHz uses 20 MHz channels with UNII-1/2A/2C/3 and DFS; 6 GHz (Wi-Fi 6E) offers 7 x 160 MHz or 14 x 80 MHz channels with no DFS legacy clients.

Cisco AP power: PoE 802.3af supports limited radio configurations; 802.3at is typically required for full 4x4 MIMO and both radios at max power; verify AP datasheet power tables.

Controller sizing: Cisco 9800 series throughput and AP/client scale per model (e.g., 9800-L for small branch, 9800-40/80 for campus, 9800-CL virtual for up to 6000 APs per instance family).

CAPWAP: control traffic uses UDP 5246, data uses UDP 5247; APs must reach the controller through routed L3 or be on the same L2 segment; MTU must accommodate CAPWAP encapsulation.

Multicast/broadcast design: enable multicast forwarding for mDNS/Bonjour and video; set broadcast/multicast rate limiting and disable low data rates (1, 2, 5.5, 11 Mbps) to shrink cell size.

High-density venues: enable band steering, 802.11k/v, client load balancing, and Airtime Fairness; design for one AP per 25-50 seats in auditorium-style spaces with directional antennas.

Controller HA options in Cisco 9800: N+1 (standby controller), N+N (active/active), and SSO (stateful switchover) with an HA pair using redundancy management and RP redundancy ports.

SSO failover preserves client sessions and CAPWAP state; sub-second to few-second switchover is typical, and the standby must run the same software image and have matching configuration.

CAPWAP AP fallback: configure primary/secondary/tertiary controller names and a capwap ap fallback timer so APs re-home automatically if the primary is unreachable.

Mobility/roaming resilience: 802.11r Fast Transition reduces roam time; OKC and CCKM are alternatives; design for at least 15-20% cell overlap and consistent security (same WLAN/VLAN mapping) across controllers.

DHCP and AAA redundancy: dual DHCP servers with split scope or failover, redundant RADIUS (ISE) nodes with failover, and consistent NAC/CoA reachability from all controllers.

Wired path HA: redundant switch stacks, VPC/StackWise, redundant uplinks, and PoE budget headroom so a single switch failure does not drop a whole floor of APs.

Power HA: UPS on switches and controllers, PoE budget accounting with N+1 power supply sizing, and consideration of AP power draw at maximum radio configuration.

RF HA: avoid single-AP coverage holes; design overlapping cells so an AP outage does not create a coverage gap, and monitor for DFS radar events that remove channels.

L2 roaming: client keeps IP address; APs and controllers share the same VLAN/subnet. L3 roaming: client crosses subnet boundaries and requires mobility tunneling or anchor/foreign design.

Cisco 9800 mobility uses mobility peers and, for L3, mobility tunnels or Cisco Catalyst Center/9800 fabric; older AireOS used anchor/foreign with EoIP tunnels (UDP 16666/16667).

802.11r Fast BSS Transition: FT-PSK or FT-802.1X with MDIE/FTIE; requires consistent mobility domain identifier (MDID) and R0KH/R1KH configuration across controllers.

802.11k Neighbor Reports give clients a list of candidate APs; 802.11v BSS Transition Management steers clients; both reduce probe scanning and improve roam decisions.

Roaming decision rules: client-driven, not AP-driven; design RSSI thresholds around -67 to -70 dBm for roam trigger and avoid excessive overlap that causes ping-pong roams.

Guest and BYOD mobility: use a dedicated guest SSID with L3 mobility or local breakout; avoid stretching large L2 domains across buildings because of broadcast and roaming domain size.

Voice mobility: enable 802.11r, WMM/ QoS (voice AC), CAC, and consistent DSCP marking across controllers; verify roam times under 50 ms for voice quality.

Mobility group design: keep mobility group sizes reasonable; large groups increase control-plane chatter; document which controllers are peers and which subnets require tunneling.

Guest WLAN security: open SSID with web portal (web-auth) or PSK; use WPA2/WPA3-Enterprise for internal. Guest traffic must be isolated from corporate VLANs.

Anchor/foreign or centralized guest tunneling keeps guest traffic on a dedicated DMZ anchor controller; Cisco 9800 uses mobility tunnels to a guest anchor.

Guest VLAN design: dedicated subnet, DHCP scope sized for peak guest concurrency plus churn, short lease times (e.g., 1-4 hours), and ACLs restricting guest-to-guest and guest-to-internal traffic.

Web portal options: internal Cisco web auth (local or external splash page), external portal with ISE/guest server, and social login; captive portal detection requires DNS/HTTP interception (Apple CNA, Android/Windows probes).

Guest access control: sponsor approval workflows, self-registration with SMS/email verification, time-limited accounts, and device count limits per guest account.

Bandwidth and QoS: rate-limit guest SSID per client and per SSID, mark guest traffic best-effort, and cap guest usage so internal business traffic is not starved.

DNS and firewall: permit guest DNS to internal resolvers or use public DNS; allow only required ports (80/443) outbound; block guest access to management subnets and RFC1918 internal ranges.

Compliance: guest retention/logging requirements, acceptable use policy display, and separation of guest traffic from PCI/regulated networks.

Cisco location stack: APs report RSSI to a mobility services engine or Catalyst Center; Cisco Spaces (or DNA Spaces) consumes location data for analytics and engagement.

RSSI-based location accuracy is roughly 5-10 m in ideal conditions; it degrades with multipath, low AP density, and 5 GHz-only designs because higher frequency attenuates faster.

Hyperlocation uses the AP's hyperlocation module/antenna array with angle-of-arrival and fast packet detection for 1-3 m accuracy in high-value areas (retail, healthcare).

AP placement for location: at least 3-4 APs must hear a client for good trilateration; avoid mounting where a single AP dominates; use consistent orientation and document AP coordinates on the floor plan.

Bluetooth Low Energy: Cisco APs with BLE (integrated or USB module) support beaconing and BLE scanning for IoT and proximity; design BLE coverage separately from Wi-Fi coverage.

Wi-Fi 6/6E considerations: 6 GHz has shorter range and different propagation; location engines need updated calibration and may require more APs or dedicated location APs.

Calibration: perform site calibration walks to build the RF fingerprint; recalibrate after major AP moves, wall changes, or antenna changes; validate with test tags/clients.

Privacy and compliance: location tracking requires consent notices, data retention policies, and MAC randomization handling (locally administered MAC addresses break device tracking).

WLAN security selection: WPA2-Enterprise (802.1X/EAP) for corporate, WPA3-Enterprise or WPA3-192 for high assurance, WPA3-SAE for PSK replacement, and open+web-auth only for guest.

802.1X flow: supplicant to authenticator (AP/controller) via EAPOL, authenticator to RADIUS (ISE) via RADIUS; EAP-TLS uses certificates, PEAP-MSCHAPv2 uses credentials; prefer EAP-TLS.

RADIUS and CoA: UDP 1812/1813 (or 1645/1646 legacy); CoA uses UDP 3799 to change authorization mid-session (VLAN, ACL, URL redirect).

Management plane: secure controller/AP management with HTTPS, SSH, AAA (TACACS+/RADIUS), RBAC, and restrict management VLAN access; disable Telnet and default credentials.

Control plane: enable Management Frame Protection (MFP) for 802.11w to protect management frames; use PMF optional/required per WLAN; protect against rogue APs and evil twins with rogue detection and containment.

Guest and BYOD: separate SSIDs and VLANs, device profiling, posture assessment, and onboarding (ISE BYOD) with certificate enrollment; block lateral movement between clients.

RF security: detect and classify rogues, ad-hoc networks, and honeypots; use IDS/IPS signatures on the controller/WLC; monitor for DoS (deauth floods) and set alarm thresholds.

Policy design: consistent ACLs, VLAN mapping, and SGT/TrustSec enforcement across controllers; document which WLANs map to which VLANs, ACLs, and QoS policies.