ENWLSI 300-430 cheat sheet

FlexConnect local switching forwards client data at the AP's trunk/access port; centrally switched WLANs tunnel client traffic in CAPWAP to the WLC.

Local mode APs use one CAPWAP data tunnel per WLAN (plus control); FlexConnect APs need the VLAN present on the AP switchport for locally switched WLANs.

AP join order: DHCP address, controller discovery (broadcast, DHCP option 43, DNS, configured controller name), CAPWAP discovery/DTLS, image download if mismatched, config download, join.

DHCP option 43 for Cisco APs is a hex string of one or more controller IPs, each prefixed with type 0xf1 and length 0x04 (e.g., f1040a01010a).

Country code and regulatory domain must match the AP's -A/-B/-E/-K/-N/-Q/-R/-S/-T/-Z suffix; mismatched regulatory domain prevents radio enablement.

Mobility Express runs the controller function on an 802.11ac Wave 2 or later AP; it uses a virtual interface and supports up to 100 APs/2000 clients on supported platforms.

AP priority in the WLC AP configuration is 1 (low) to 4 (medium) to 5 (high); the primary controller is used first, then secondary, then tertiary.

RF profiles bind to AP groups and define 802.11a/b/g radio parameters (DCA channels, TX power, data rates); a default RF profile is assigned to the default AP group.

Web authentication (web consent) is a Layer 3 security type; the WLC intercepts HTTP/HTTPS and redirects to a login page before allowing the client through.

Web passthrough requires only acceptance of an AUP page (no credentials); web consent requires a valid local or RADIUS username/password.

Guest anchor design: guest WLAN is configured on the foreign controller with the anchor controller's management IP/MAC as the mobility anchor; client traffic tunnels over the mobility tunnel to the anchor.

The anchor controller must have the same WLAN configured with the same SSID and security policy, and the mobility tunnel must be up before clients can anchor.

Guest WLANs typically use interface groups or a dedicated DMZ interface on the anchor controller; the anchor's egress interface must route to the internet with NAT.

Web auth certificate installation on the WLC (signed by a trusted CA) avoids browser certificate warnings on the redirect page; the virtual interface DNS hostname must match the certificate CN/SAN.

Client exclusion on web auth: excluded after 3 failed login attempts by default; exclusion timeout is configurable (default 180 seconds).

Sleeping client, session timeout, and idle timeout on the guest WLAN control how long anchored clients remain associated and how long their session persists.

WPA2-PSK uses CCMP/AES; WPA2-Enterprise uses 802.1X with EAP (PEAP, EAP-TLS, EAP-FAST) and requires a RADIUS server such as Cisco ISE.

WPA3-Personal uses SAE (Simultaneous Authentication of Equals) and WPA3-Enterprise uses 802.1X with GCMP-256; WPA3 transition mode supports WPA2 and WPA3 clients on the same WLAN.

PMF (802.11w) protects management frames; required mode breaks clients that do not support 802.11w, optional mode allows both.

Management frame protection, rogue detection, and rogue containment are configured under the WLC Security > Wireless Protection Policies and AP-level rogue policies.

Local EAP on the WLC supports EAP-FAST, PEAP, and EAP-TLS with a local user database, but is limited in scalability and typically used for small deployments.

RADIUS accounting on the WLAN sends start/interim/stop records to the AAA server for guest and BYOD auditing; accounting is enabled per WLAN under Security > AAA Servers.

Web auth, 802.1X, and PSK are mutually exclusive Layer 2/3 security combinations on a single WLAN; MAC filtering can be added as an additional check.

Cisco ISE posture and profiling integrate with the WLC via RADIUS CoA (RFC 5176) to change authorization or disconnect clients after posture assessment.

WLC QoS maps traffic to four access categories: Platinum (voice), Gold (video), Silver (best effort), Bronze (background); the WLAN's QoS profile sets the default UP for untagged traffic.

802.11e/WMM uses User Priority (UP) 0-7 mapped to AC_VO (6,7), AC_VI (4,5), AC_BE (0,3), AC_BK (1,2).

AVC (Application Visibility and Control) identifies applications via NBAR2 and can mark or drop traffic; it requires AVC to be enabled on the WLAN and the AP to support it.

Fastlane (802.11r plus QoS) requires WLAN QoS set to Platinum (or Gold with Fastlane enabled) and 11ac Wave 2 APs; it prioritizes voice and video over other traffic.

EDCA parameters (CWmin, CWmax, AIFS, TXOP) differ per access category; the WLC can use default or custom EDCA profiles per WLAN.

Call Admission Control (CAC) limits the number of voice calls per AP/radio using bandwidth-based or load-based (channel utilization) methods; SIP CAC uses an installed AVC/SIP snooping profile.

Trust DSCP on the WLC uses the DSCP value from the wired side; untrust uses the WLAN QoS profile's default UP for all traffic.

Multicast/broadcast traffic is sent at the lowest mandatory data rate; setting a higher multicast data rate reduces airtime but may reduce range and reliability.

Multicast on the WLC uses a configured multicast group address and requires IGMP snooping on the infrastructure; the WLC sends multicast on the management interface by default.

Multicast mode must be enabled globally on the WLC and per WLAN; the multicast group address must be in the 224.0.0.0/4 range and not overlap other groups.

mDNS (Bonjour) uses UDP 5353 to 224.0.0.251; the WLC's mDNS gateway snoops service advertisements and responds to queries on behalf of devices.

mDNS service profiles define which services are bridged or filtered; default service policy can be set to drop or allow all services on a per-WLAN basis.

mDNS AP mode (multicast-to-unicast) forwards mDNS traffic from wired to wireless as unicast to each AP, avoiding multicast replication issues on the WLAN.

mDNS snooping must be enabled on the WLAN (mDNS profile) for the WLC to learn services; without it, queries are flooded as multicast.

For Apple devices, AirPlay, AirPrint, and Google Cast rely on mDNS; service names include _airplay._tcp.local, _ipp._tcp.local, and _googlecast._tcp.local.

Multicast-to-unicast (mDNS AP mode) is configured per WLAN under the mDNS settings and requires the AP to support it; it reduces multicast airtime.

HA SSO uses two WLCs in an active/standby pair with a redundancy port (RP) link and a redundancy management (RP management) link; the standby takes over on failover with the same management IP.

HA SSO requires the same hardware model, software version, and license; the RP port must be directly connected or on the same Layer 2 segment.

Mobility groups allow client roaming across controllers; mobility messages use UDP 16666 (data) and 16667 (control) over the mobility tunnel.

Roaming types: intra-controller (same WLC), inter-controller Layer 2 (same subnet, mobility tunnel), and inter-controller Layer 3 (different subnet, mobility tunnel with anchor).

Mobility group member types: client, controller, and mesh; a mobility group name must be identical on all members, and each member's MAC/IP must match its configuration.

Guest anchor: the foreign controller forwards client traffic over the mobility tunnel to the anchor controller, which provides the client's IP and internet access.

Auto-anchor (guest anchor redundancy) allows a backup anchor controller; the foreign controller anchors to the primary and falls back to the secondary if the primary fails.

CleanAir, RRM, and rogue detection operate across the HA pair; after failover, APs rejoin the standby controller and re-download configuration.

WLC show commands: show ap summary, show client summary, show wlan summary, show interface summary, show redundancy summary, show mobility summary.

Debug commands on the WLC: debug client , debug capwap events, debug dot11 events; disable debugs with undebug all after troubleshooting.

SNMP traps and syslog (default UDP 514) from the WLC provide event monitoring; configure logging host and logging level on the WLC.

CleanAir reports interference sources (microwave, Bluetooth, cordless phones) and classifies them as severe, medium, or low impact; Air Quality Index (AQI) ranges from 0-100.

RRM (DCA/TPC) adjusts channel and power automatically; DCA runs every 600 seconds by default (configurable 10-3600), TPC runs every 600 seconds.

Client troubleshooting: check association, authentication (802.1X/PSK), DHCP, and DNS; the WLC client detail page shows the client's state, SNR, and data rate.

Packet capture on the WLC (monitor mode AP) uses a monitor-mode AP to capture 802.11 frames; the AP must be in monitor mode and the capture is saved as a .pcap file.

High client count, retries, and low SNR indicate RF issues; use the WLC's AP performance and client performance reports to identify problem APs and clients.