Cisco ENWLSD 300-425 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Predictive site survey

A software model of RF coverage using floor plans, wall attenuation values, AP antenna patterns, and transmit power. It estimates coverage and capacity before hardware is installed but must be validated with a physical survey.

Passive survey

A survey in which the adapter only listens to existing AP beacons and records RSSI, SNR, and channel utilization. It does not associate, so it does not measure client authentication, roaming, or throughput behavior.

Active survey

A survey where the client associates to the SSID and measures real performance: data rates, retries, roaming, and throughput. It reflects actual client experience but requires a live network and valid credentials.

Spectrum analysis

Measurement of the RF environment including noise floor, non-Wi-Fi interferers, channel utilization, and duty cycle. It identifies sources such as microwave ovens, DECT phones, and analog video that degrade Wi-Fi performance.

PoE power budgets

802.3af supplies 15.4 W, 802.3at supplies 30 W, and 802.3bt supplies up to 60 or 90 W. Cisco APs may need at least 802.3at for full radio chains and maximum transmit power.

Non-overlapping 2.4 GHz channels

In the 2.4 GHz band only channels 1, 6, and 11 are non-overlapping in North America. Using any other combination creates adjacent-channel interference that reduces throughput and increases retries.

CAPWAP ports

CAPWAP uses UDP 5246 for control messages and UDP 5247 for encapsulated data. APs must reach the controller on these ports, and MTU must accommodate the encapsulation overhead.

Cell overlap for roaming

Designing 15-20% overlap at the coverage boundary gives clients a second AP before the first becomes unusable. Too little overlap causes drops; too much causes ping-pong roaming and co-channel interference.

Capacity-based AP count

Required APs equals peak concurrent clients divided by clients per AP at the target per-client throughput. Take the larger of the coverage-based and capacity-based counts for the final design.

Controller SSO pair

Stateful switchover keeps a standby controller synchronized so it can take over with client sessions and CAPWAP state intact. Both units need matching software, configuration, and redundancy port connectivity.

AP fallback timer

A configured interval after which an AP tries its primary controller again after joining a secondary. It prevents APs from remaining on backup controllers after the primary recovers.

N+1 controller redundancy

One standby controller covers multiple active controllers. It is cost-effective but failover capacity is limited and sessions are not preserved unless SSO is used.

802.11r fast transition

Fast BSS Transition pre-authenticates the client with the target AP before roaming, reducing handoff time. It requires consistent mobility domain and key holder configuration across controllers.

Layer 3 roaming

A client roams to an AP on a different subnet and keeps its original IP address. Traffic is tunneled to an anchor or home agent, which adds overhead and requires mobility tunneling support.

802.11k neighbor reports

The AP provides the client a list of nearby APs with channel and RSSI information. The client scans only those channels, reducing probe delay and improving roam decisions.

802.11v BSS transition

The network can suggest or steer a client to a better AP using BSS Transition Management frames. It helps with load balancing and sticky clients but the client ultimately decides.

Mobility group

A set of controllers that share client and AP information to support roaming. Larger groups increase control-plane traffic, so keep groups scoped to actual roaming domains.

Voice roam target

For acceptable voice quality, aim for roam times under about 50 ms and consistent QoS marking. Enable 802.11r, WMM, and call admission control across all controllers in the path.

Guest anchor design

Guest traffic is tunneled from foreign controllers to a dedicated anchor in a DMZ. This centralizes guest policy, keeps guest VLANs off the internal core, and simplifies firewall rules.

Captive portal detection

Operating systems probe known URLs to detect a captive portal. DNS interception and HTTP redirect must be allowed so the splash page appears on Apple, Android, and Windows devices.

Guest DHCP sizing

Size the guest scope for peak concurrency plus churn and use short leases. An undersized scope causes address exhaustion and failed guest connections during busy periods.

Guest traffic isolation

Guest VLANs use ACLs to block access to internal RFC1918 subnets and to other guests. Only required outbound ports such as 80 and 443 are permitted.

RSSI location accuracy

RSSI trilateration typically achieves 5-10 m accuracy in good conditions. Multipath, sparse AP density, and 5 GHz attenuation degrade accuracy, so calibration and AP density matter.

Hyperlocation

A Cisco AP feature using an antenna array and angle-of-arrival plus fast packet detection. It improves accuracy to roughly 1-3 m in high-value areas such as retail and healthcare.

Location AP density rule

At least three to four APs should hear a client for reliable trilateration. Designs with fewer overlapping APs produce poor or missing location fixes.

BLE in access points

Cisco APs with integrated or USB Bluetooth Low Energy modules can beacon and scan for IoT and proximity use cases. BLE coverage must be designed separately from Wi-Fi coverage.

WPA3-Enterprise

WPA3-Enterprise uses 802.1X with stronger cryptography, and the 192-bit mode adds Suite B algorithms. It requires supplicant, RADIUS, and controller support across the deployment.

EAP-TLS

A certificate-based EAP method in which both client and server present certificates. It avoids password exposure and is preferred over PEAP-MSCHAPv2 for corporate wireless.

RADIUS CoA

Change of Authorization messages are sent from the RADIUS server to the network device on UDP 3799. They can change a session's VLAN, ACL, or URL redirect without reauthentication.

Management frame protection

802.11w encrypts or authenticates management frames to prevent spoofed deauthentication and disassociation attacks. It can be optional or required per WLAN.

Rogue AP detection

The controller and APs scan for unauthorized SSIDs and classify them by wired MAC, SSID match, and security. Containment can be enabled but must comply with local regulations.

TrustSec SGT on WLAN

Security Group Tags classify wireless traffic for policy enforcement across the network. Consistent SGT and VLAN mapping across controllers keeps policy intact during roaming.