ENWLSI 300-430 key terms

A WLC deployment mode in which the access point bridges client traffic locally onto the access switch VLAN instead of tunneling it to the controller, keeping traffic local while the AP stays controller-managed.

A feature where the FlexConnect AP itself validates 802.1X or web credentials against a locally reachable RADIUS or local database when the WAN link to the WLC is down, allowing survivable client access.

In Cisco Catalyst 9800 configuration, an object holding client-facing settings such as VLAN, QoS, access control lists, and session timeout that is bound to an AP join profile and WLAN.

A Catalyst 9800 construct that maps a WLAN profile to a policy profile and to the site tag, determining which policies apply to a client joining that SSID at a given location.

A Catalyst 9800 object that groups access points by physical location and controls which AP join profile, flex profile, and roaming settings the APs at that site use.

A Catalyst 9800 template of access point parameters such as CAPWAP timers, statistics interval, and failover behavior that is applied to APs through the site tag.

Control and Provisioning of Wireless Access Points, the protocol carrying control and optional data traffic between lightweight access points and a wireless controller over UDP ports 5246 and 5247.

An architecture where a supported access point runs the wireless controller function itself, managing a small group of APs without a dedicated appliance, suitable for small branch deployments.

A controller function hosted on a Catalyst 9000 switch that manages access points in the same wiring closet, removing the need for a separate appliance in small and midsize sites.

A guest access method where the client's HTTP session is intercepted and redirected to a login portal; credentials are checked before the client is placed into an authorized state.

A dedicated controller, typically in a DMZ, to which guest client traffic is tunneled via an Ethernet-over-IP mobility tunnel so guest traffic exits to the internet separately from internal networks.

A web authentication option that presents acceptable-use terms and requires the guest to acknowledge them before network access is granted, without collecting a username or password.

A WLAN configured specifically for visitor access, usually mapped to a dedicated interface or anchor, isolated from internal subnets, and protected by web authentication or a preshared key.

Client software that performs EAP authentication over LAN or Wi-Fi, exchanging credentials with the authenticator so the RADIUS server can authorize the port or session.

Extensible Authentication Protocol, a framework carried inside 802.1X that defines how supplicant and authentication server exchange credential proofs, with variants such as PEAP, EAP-TLS, and EAP-FAST.

A AAA protocol used by the controller to send client identity and authorization requests to a central server, receiving accept or reject decisions plus attributes such as VLAN or ACL.

A WLAN setting that lets RADIUS attributes returned for a client override the WLAN's configured VLAN, ACL, QoS, or session timeout, enabling per-user policy.

The 802.11w amendment that cryptographically protects certain management frames such as deauthentication and disassociation, mitigating spoofed-frame denial-of-service and some roaming attacks.

A Wi-Fi Alliance certification introducing Simultaneous Authentication of Equals for personal networks and 192-bit cryptographic suites for enterprise, with mandatory protected management frames.

An unauthorized AP detected on the air or wire; classification as rogue, neighbor, or honeypot determines whether the controller sends deauthentication containment frames against it.

The controller's use of monitor-mode AP radios to scan channels, build a neighbor list, and correlate wired MAC addresses via switch ARP or CDP data to identify unauthorized access points.

A controller policy that temporarily blocks a client MAC address after repeated authentication failures, excessive 802.11 management frames, or repeated web-auth failures.

Wi-Fi Multimedia, the 802.11e quality-of-service certification that maps traffic to four access categories (voice, video, best effort, background) using EDCA contention parameters.

Differentiated Services Code Point, the six-bit IP header field marking a packet's per-hop behavior; the controller maps DSCP values to WMM access categories and can trust or override upstream markings.

Application Visibility and Control, a feature that uses deep packet inspection to identify applications and can mark, drop, or rate-limit them per WLAN or per client.

In Catalyst 9800 configuration, a reusable object defining the average and burst bandwidth rates and the marking policy applied to a client or SSID.

A mechanism that limits the number of voice clients or calls per AP or WLAN based on estimated bandwidth, refusing new calls when capacity would be exceeded.

A controller mode where multicast packets are replicated to the APs in a group and forwarded as native multicast on the wired network, avoiding unicast replication to every AP.

A configured list of APs that receive multicast traffic for a WLAN; membership determines which APs replicate the stream to wireless clients.

Multicast DNS, used by Bonjour and similar discovery protocols to advertise services such as printers and AirPlay on the local link; the controller can snoop and bridge it across subnets.

A controller feature that learns mDNS service advertisements and answers queries on behalf of devices, allowing clients on different VLANs to discover services without flooding multicast everywhere.

An Ethernet-over-IP tunnel between controllers that carries client data and control traffic, enabling clients to roam across controllers and supporting guest anchor designs.

A set of controllers configured to share client and AP information so that clients can roam between them while keeping the same IP address and session.

A high-availability licensing option where a standby controller shares the primary's licenses and takes over its APs and clients if the primary fails, providing 1:1 redundancy.

The process by which paired high-availability controllers negotiate which unit actively serves APs, based on configured priority, reachability, and redundancy port health.

A client moving between APs managed by different controllers in the same mobility group, with the tunnel carrying the client's traffic to the original controller or anchor.

A spectrum intelligence feature in which AP radios detect and classify non-Wi-Fi interferers such as microwave ovens, Bluetooth headsets, and cordless phones, reporting them to the controller.

Radio Resource Management, the controller algorithm that dynamically assigns channels and transmit power to APs based on neighbor and interference measurements, with configurable sensitivity and monitoring intervals.