Cisco WLCOR 350-101 cheat sheet

0 dBm = 1 mW; +3 dB doubles power, +10 dB is tenfold; 20 dBm = 100 mW and 30 dBm = 1 W.

EIRP (dBm) = AP transmit power (dBm) + antenna gain (dBi) - cable and connector loss (dB).

FSPL (dB) = 32.44 + 20log10(f in MHz) + 20log10(d in km); loss rises 6 dB per doubling of distance.

2.4 GHz offers only three non-overlapping 20 MHz channels (1, 6, 11); 5 GHz offers up to 25 in the US UNII bands.

Coverage thresholds: -67 dBm RSSI at the cell edge for voice, -70 to -75 dBm for data; SNR of 25 dB for voice, 20 dB for data.

Higher MCS rates need higher SNR: 256-QAM requires roughly 30 dB or more, while BPSK works near 5 dB.

Fresnel zone: keep at least 60% of the first zone clear for outdoor point-to-point links.

Multipath causes fading and intersymbol interference; MIMO spatial diversity and equalization mitigate it.

Predictive (virtual) survey uses a floor plan, wall attenuation values, and AP models with no hardware on site.

AP-on-a-stick uses one AP moved to candidate locations while the survey tool records measured RSSI, SNR, and overlap.

Validation survey after installation proves coverage, capacity, overlap, and roaming before handover.

Design target: 15-20% overlap between adjacent cells; voice cells should overlap at the -67 dBm contour.

Reuse plan: assign non-adjacent channels to APs that hear each other; 5 GHz provides the channel count for dense designs.

Capacity planning multiplies client count by per-client throughput, then divides by realistic per-AP airtime.

Disable 1, 2, 5.5, and 11 Mbps on 2.4 GHz to shrink cells, cut airtime, and discourage far-range clients.

Typical attenuation: drywall about 3 dB, concrete block about 12 dB, metal mesh and coated glass much higher; measure rather than assume.

CAPWAP control = UDP 5246 (DTLS protected), CAPWAP data = UDP 5247 (DTLS optional); heartbeats maintain AP-to-WLC state.

Local mode AP tunnels all client data to the WLC; FlexConnect APs switch client traffic locally at the branch.

AireOS platforms include 3504, 5520, and 8540; Catalyst 9800 runs IOS-XE as appliance, virtual (C9800-CL), or embedded wireless.

9800 configuration model: policy, site, RF, and flex profiles bound to an AP by policy tag, site tag, and RF tag.

AP discovery order: DHCP option 43, DNS CISCO-CAPWAP-CONTROLLER, local subnet broadcast, previously joined controller, then priming.

FlexConnect features: local switching, local authentication, VLAN-to-WLAN mapping, and AP groups for branch survivability.

Mobility Express and embedded wireless place the controller function on an access point for small deployments.

Fabric-enabled wireless uses LISP/VXLAN with fabric APs; client policy is applied at the fabric border.

802.11 state machine: unauthenticated/unassociated, then authenticated/unassociated, then authenticated/associated.

WPA2-PSK derives the PMK from passphrase and SSID; the 4-way handshake then derives the PTK and delivers the GTK.

PMK caching and OKC skip full 802.1X on roam; 802.11r FT pre-establishes keys and typically completes in under 50 ms.

802.11k supplies neighbor reports, 802.11v BSS transition management steers clients, 802.11r accelerates re-keying.

Intra-controller roam stays within one WLC; inter-controller roam uses the mobility group EoIP tunnel on UDP 16666/16667.

Mobility anchor tunnels guest client traffic from a foreign controller to an anchor controller for a common DMZ egress.

Voice roam budget is roughly 50 ms; data clients tolerate 100-200 ms without losing the session.

CCKM is the legacy Cisco fast-roam method that stores key material on the controller for LEAP and EAP-FAST clients.

WPA2-Personal = PSK; WPA2-Enterprise = 802.1X/EAP to RADIUS; WPA3-Personal = SAE; WPA3-Enterprise 192-bit uses GCMP-256.

SAE provides forward secrecy and defeats offline dictionary attacks that succeed against captured PSK handshakes.

PMF (802.11w) protects deauthentication, disassociation, and action frames; mandatory in WPA3, optional in WPA2.

4-way handshake message 3 carries the GTK; replay counters block replayed key messages.

EAP-TLS uses certificates on both sides; PEAP and EAP-FAST use a server certificate with MSCHAPv2 inside the tunnel.

Rogue detection compares over-the-air BSSIDs to the wired MAC table; states are unclassified, friendly, alert, and malicious.

Guest design: web-authentication WLAN, anchor controller in the DMZ, and WLAN ACLs for client isolation.

ISE or AAA override can push VLAN, ACL, or QoS to a client via CoA during or after 802.1X authorization.

RRM DCA recalculates channel assignments at a default 600-second interval; the DCA avoid list pins APs off chosen channels.

RRM TPC adjusts AP power in 3 dB steps using third-party and neighbor RSSI to balance coverage against interference.

CleanAir classifies non-802.11 interference such as microwave, DECT, Bluetooth, and Zigbee and raises alarms to the controller.

Catalyst 9800: show wireless client summary, show ap summary, show wireless tag policy; AireOS: show client summary, show ap summary.

Client-level debug: debug client on AireOS, debug wireless mac on 9800; disable immediately after capture.

Verify the join path with show ap join stats summary all, which surfaces DNS, DHCP, and CAPWAP discovery failures.

A monitor-mode AP dedicates its radio to scanning for rogues and interferers and stops serving clients.

show tech-support wireless bundles config, logs, and diagnostics for TAC; syslog and SNMP traps cover ongoing monitoring.