HCIP-WLAN cheat sheet

802.11 PHY lineage: 802.11b (2.4 GHz, DSSS/CCK, 11 Mbps), 802.11a/g (OFDM, 54 Mbps), 802.11n (HT, 2.4/5 GHz, MIMO up to 4 streams, 40 MHz), 802.11ac (VHT, 5 GHz only, up to 8 streams, 80/160 MHz, 256-QAM), 802.11ax (HE, 2.4/5/6 GHz, OFDMA, 1024-QAM, MU-MIMO).

Channel width doubles throughput but halves the number of non-overlapping channels: 2.4 GHz has only 3 non-overlapping 20 MHz channels (1, 6, 11); 5 GHz UNII-1/UNII-3 provide far more 20 MHz channels and roughly 9-12 at 40 MHz.

RF link budget: received power (dBm) = Tx power (dBm) + Tx antenna gain (dBi) - path loss (dB) + Rx antenna gain (dBi). RSSI is an arbitrary vendor-scaled value, not a standardized dBm reading.

Free-space path loss (dB) = 32.44 + 20log10(f in MHz) + 20log10(d in km); doubling distance costs about 6 dB, doubling frequency also costs about 6 dB.

SNR = signal (dBm) - noise floor (dBm). Higher-order modulation needs higher SNR: 64-QAM requires roughly 25-30 dB, while BPSK/QPSK works near 5-10 dB; rate adaptation (MCS selection) follows this.

MAC is CSMA/CA with DCF: station senses the medium, waits DIFS, backs off a random number of slots, transmits, and waits for an ACK after SIFS. RTS/CTS mitigates the hidden-node problem.

WLAN architecture modes: autonomous (fat AP, local config), centralized (fit AP + AC via CAPWAP), and cloud-managed (AP to cloud controller). Fit APs hold no service configuration; the AC delivers it.

Fresnel zone clearance matters: obstruction within the first Fresnel zone degrades signal even without a line-of-sight break; 60% clearance is the practical design target.

CAPWAP runs over UDP: control channel on UDP 5246 (DTLS-encrypted in Huawei implementations), data channel on UDP 5247. Both are optional to encrypt, but the control channel is normally protected.

AP onboarding states: AP boots, gets an IP (DHCP or static), discovers the AC (DHCP option 43, DNS, broadcast, or static AC address), establishes the CAPWAP control tunnel (DTLS handshake, join request/response), downloads firmware and configuration, then moves to Run state.

DHCP option 43 carries the AC IP list in vendor-specific format; Huawei uses sub-option 0x0B with the AC IPs. Without option 43, the AP falls back to broadcast or DNS discovery.

CAPWAP tunnel modes: direct forwarding (local forwarding, traffic exits the AP locally, only control traffic goes to the AC) versus tunnel forwarding (all data is encapsulated to the AC). Direct forwarding saves AC bandwidth.

AP whitelist/authentication: an AP must be authenticated (MAC or SN-based whitelist, or no-auth) before joining; unauthenticated APs stay in a pending state and cannot carry service.

AC source interface: the AC's CAPWAP source interface (usually a loopback or VLAN interface) must be reachable from the AP and must be consistent with the address advertised to the AP.

Split MAC: 802.11 management and control are handled by the AC, while real-time functions (beacons, ACKs, encryption) stay on the AP. This is why latency-sensitive frames are not tunneled in direct-forwarding mode.

NAT traversal: if the AP is behind NAT, the AC must support CAPWAP NAT traversal so the AP's mapped address is used for the data tunnel.

802.11 management frames: beacon (periodic, default 100 TU = 102.4 ms), probe request/response, authentication, association request/response, deauthentication, disassociation. Beacons carry SSID, supported rates, and capability info.

802.11k (Radio Resource Measurement): the AP provides a neighbor report so the client knows which APs to scan, reducing probe time during roaming.

802.11v (BSS Transition Management): the network can send a BTM request suggesting a better AP; the client decides whether to accept. Also covers WNM sleep and timers.

802.11r (Fast BSS Transition): pre-authenticates and pre-derives keys so the client skips full 802.1X on roam; uses PMK-R0/PMK-R1 hierarchy and mobility domain. Reduces roam time to tens of milliseconds.

Roaming decision rules: a client roams when RSSI drops below its own threshold; the network can only influence it via 802.11k/v or by adjusting power/coverage. Sticky clients stay on a weak AP.

Band steering: the AP suppresses or delays probe responses on 2.4 GHz for dual-band clients so they associate on 5 GHz; it must not block 2.4-only clients.

Roam types: intra-AC (same AC, fast, 802.11r helps), inter-AC (requires mobility group / roaming group configuration and key exchange), and inter-subnet roaming (client keeps IP; requires tunnel or mobility).

Frame aggregation: A-MPDU and A-MSDU increase throughput by batching frames; block ACK is used. Aggregation improves efficiency but adds latency, so voice traffic benefits from smaller aggregates.

WEP uses RC4 with a 24-bit IV and a shared key; IV reuse and weak ICV make it broken. It must never be used in production.

WPA (TKIP) wraps RC4 with per-packet key mixing and a MIC (Michael). WPA2 uses AES-CCMP with a 128-bit key; WPA3 uses AES-GCMP-256 and SAE.

WPA2-Personal uses PSK with the 4-way handshake to derive PTK; WPA2-Enterprise uses 802.1X (EAP) with RADIUS. WPA3-Personal replaces PSK with SAE (Dragonfly) to resist offline dictionary attacks.

802.1X roles: supplicant (client), authenticator (AP/AC), authentication server (RADIUS). EAP methods: EAP-TLS (certificate both sides), PEAP/EAP-TTLS (server cert, inner MS-CHAPv2), EAP-SIM/AKA for cellular credentials.

RADIUS: authentication on UDP 1812, accounting on UDP 1813 (legacy 1645/1646). Shared secret must match on AC and RADIUS server; the AC acts as the RADIUS client.

Portal authentication: client gets an IP, is redirected to a portal page, credentials are validated (local or RADIUS), then the AC opens the ACL. Common flows: CHAP/PAP portal, and Portal 2.0/3.0 with HTTPS.

MAC authentication: the AC sends the client MAC as username and password (or a configured password) to RADIUS; useful for printers and IoT devices without supplicants.

PKI in WLAN: a CA issues the AC/AP and server certificates; EAP-TLS requires client certificates. Certificate expiry or a wrong CA chain is a common cause of 802.1X failures.

PMF (802.11w) protects management frames (deauth/disassoc) with BIP; required for WPA3 and recommended to stop deauth attacks.

WMM defines four access categories: Voice (AC_VO), Video (AC_VI), Best Effort (AC_BE), Background (AC_BK). Higher priority gets smaller AIFSN and CWmin, so it wins contention more often.

802.11e EDCA parameters: AIFSN, CWmin, CWmax, TXOP limit. Voice uses AIFSN=2, CWmin=3; Background uses AIFSN=7, CWmin=15.

WMM mapping: 802.1p/DSCP values map to ACs. Typical mapping: DSCP EF (46) to Voice, AF41 (34) to Video, 0 to Best Effort, CS1 to Background.

Channel planning: 2.4 GHz uses 1/6/11 with 20 MHz only; 5 GHz prefers 20/40 MHz and avoids DFS channels where radar is present. Automatic channel selection (ACS) should be scheduled off-peak.

Transmit power planning: lower AP power reduces co-channel interference and encourages roaming; a common target is -65 to -70 dBm RSSI at cell edge with 15-20% cell overlap.

Co-channel interference (CCI) comes from APs on the same channel; adjacent-channel interference (ACI) comes from overlapping spectrum. CCI is managed by channel reuse distance; ACI by using non-overlapping channels.

Air interface control: limit low-rate clients (disable 1/2/5.5/11 Mbps) to shrink cell size and improve airtime efficiency; enable band steering and load balancing.

Interference sources: microwave ovens, Bluetooth, cordless phones (2.4 GHz), radar (DFS 5 GHz), and rogue APs. Use spectrum analysis and WIDS/WIPS to locate them.

VRRP hot standby: two ACs form a VRRP group; the master holds the virtual IP and handles CAPWAP, the backup takes over on failure. APs re-establish tunnels to the new master.

HSB (Hot Standby) syncs AP sessions, keys, and DHCP/AAA state between master and backup so APs can rejoin quickly; without state sync, all APs must re-onboard.

Dual-link backup: an AP is configured with a primary and a backup AC address; if the primary tunnel fails, the AP tries the backup. This protects against single-AC failure without VRRP.

AC virtualization (VAC): multiple physical ACs are pooled into one logical AC; APs are load-balanced across members and can fail over within the pool. Improves scale and resilience.

CAPWAP echo interval and retransmission timers determine how fast an AP detects AC failure; default echo is 25 s, so tune timers for faster failover.

N+1 backup: N active ACs share one standby AC. 1+1 is active/standby. Choose based on AP count and acceptable failover time.

License and capacity: AC capacity is limited by AP count, client count, and throughput. HA pairs must each be sized to carry the full load after failover.

Upgrade in HA: upgrade the backup first, switch over, then upgrade the former master to avoid a service outage.

Common AP-not-online causes: no IP address, AC unreachable (routing/VLAN), wrong AC address or missing DHCP option 43, AP not in whitelist, certificate/DTLS mismatch, firmware incompatibility.

Diagnostic commands: display ap all (state, IP, AC), display capwap statistics, display station all, display station roam-history, display wlan config, and display ap performance.

Client cannot associate: check SSID broadcast, security profile match, 802.1X/RADIUS reachability, DHCP pool exhaustion, and ACL on the AC.

Client associates but no IP: VLAN not allowed on the AP uplink or AC, DHCP relay missing, or the direct-forwarding VLAN is not configured on the access switch.

Weak signal/poor throughput: check RSSI, SNR, channel utilization, retry rate, and interference; verify channel width and rate adaptation. High retries point to interference or a sticky client.

WLAN Planner (Huawei) performs offline coverage and capacity simulation: import floor plans, set AP model and power, and output heat maps and AP placement. eSight/CloudCampus provides online monitoring and alarms.

Upgrade: AP firmware is delivered by the AC (auto-update) or manually; keep the AP and AC versions compatible. Batch upgrade during off-peak hours with rollback plan.

Roaming failures: verify mobility group/roaming group configuration, 802.11k/v/r consistency, and that both ACs share the same security profile and keys.

Wired-wireless integration: the AC connects to the core/aggregation switch; APs connect to access switches with the AP management VLAN and service VLANs trunked. Direct forwarding requires service VLANs on the access switch.

CAPWAP and VLAN planning: management VLAN for AP-AC control, service VLANs for clients. In tunnel forwarding, client VLANs terminate on the AC; in direct forwarding, on the access switch.

CloudCampus: APs register to a cloud controller over the internet (CAPWAP or HTTPS), tenant-based management, plug-and-play onboarding via registration code or DHCP option.

IoT WLAN: 802.11ah (sub-1 GHz, long range, low power) and 802.11ax-based IoT; BLE/Zigbee gateways can be integrated into APs for IoT backhaul.

Location services: RSSI fingerprinting and trilateration with multiple APs; 802.11mc FTM (Fine Timing Measurement) gives round-trip time for meter-level indoor positioning.

Guest network: separate SSID with portal auth, isolated VLAN, and ACL restricting access to internal subnets; often paired with rate limiting.

High-density venues (stadiums, campuses): small cells, 5 GHz/6 GHz preference, band steering, load balancing, and per-SSID airtime quotas.

WLAN and wired redundancy: VRRP on the AC, link aggregation on uplinks, and redundant CAPWAP paths so APs survive a single link failure.

WPA3-Enterprise offers 192-bit mode (GCMP-256, SHA-384, ECDHE/ECDSA) for high-security networks; WPA3-Personal uses SAE and forward secrecy.

SAE (Simultaneous Authentication of Equals) is a PAKE that resists offline dictionary attacks; it replaces the PSK 4-way handshake's offline-crackable PMK.

802.1X EAP exchange: EAPOL-Start, EAP-Request/Identity, EAP-Response/Identity, EAP method exchange, EAP-Success, then 4-way handshake for keys.

RADIUS attributes: User-Name, Calling-Station-Id (client MAC), NAS-IP-Address, Tunnel-Type/Medium/Private-Group-ID for dynamic VLAN assignment.

Dynamic VLAN assignment via RADIUS Tunnel attributes lets the AC place a client into a VLAN based on identity; the VLAN must exist on the forwarding path.

Certificate-based EAP-TLS: the server certificate must match the RADIUS server name the client validates; a mismatched CN/SAN or expired cert breaks authentication.

Portal 2.0/3.0 uses HTTPS and token-based redirect; Portal 3.0 supports third-party authentication and social login. The AC must reach the portal server.

WIDS/WIPS detects rogue APs, ad-hoc networks, and deauth floods; WIPS can contain rogue APs by sending deauth frames.

Airtime fairness: slow clients consume more airtime per frame; airtime-based scheduling prevents one low-rate client from starving others.

A-MPDU aggregation: multiple MPDUs in one PPDU, acknowledged by block ACK; max aggregate size is bounded by the TXOP and buffer.

MU-MIMO (802.11ac Wave 2, 802.11ax): the AP transmits to multiple clients simultaneously on the same channel; requires channel sounding and client support.

OFDMA (802.11ax): resource units (RUs) split the channel in frequency; improves efficiency in dense environments and reduces latency for small frames.

BSS Coloring (802.11ax): tags frames with a color so overlapping BSSs can ignore each other's transmissions, reducing CCA sensitivity and improving spatial reuse.

TWT (Target Wake Time, 802.11ax): the AP schedules client wake times, saving battery for IoT devices and reducing contention.

Rate limiting and per-SSID bandwidth: configure committed/peak rates per client or SSID to prevent a single user from consuming the cell.

Channel and power planning tools: use WLAN Planner heat maps, verify SNR > 25 dB and RSSI > -65 dBm at the cell edge, and avoid co-channel overlap greater than 20%.

VRRP: master advertises with priority (default 100, higher wins); preemption is configurable. The virtual IP is the CAPWAP AC address APs use.

HSB channel: a dedicated backup link (direct connect or through a switch) syncs AP sessions, STA entries, and keys. Latency on this link affects failover time.

Dual-link backup vs VRRP: dual-link requires the AP to be configured with two AC addresses; VRRP hides the failure behind a virtual IP. Both can be combined.

Mobility group: ACs in a mobility group share STA information so clients can roam between ACs without re-authentication; requires consistent security profiles.

AC pool (VAC): APs are distributed across member ACs; if a member fails, its APs rejoin other members. Capacity planning must account for the loss of one member.

CAPWAP failover timers: echo interval, retransmit count, and tunnel detection determine how quickly an AP detects a dead AC and switches to the backup.

License backup: HA pairs need sufficient licenses on both nodes; a standby without licenses cannot take over the full AP load.

Upgrade strategy in HA: upgrade standby, fail over, upgrade former active, verify AP sessions and client connectivity after each step.

AP onboarding debug flow: check AP IP, AC reachability (ping), CAPWAP discovery (option 43/DNS/broadcast), DTLS handshake, join request/response, config delivery, and Run state.

display capwap statistics shows control/data packet counts and errors; rising retransmits indicate link or MTU issues.

Client association debug: display station assoc-info, display station statistics, and display station roam-history show RSSI, rate, and roam events.

DHCP issues: pool exhaustion, wrong gateway, missing option 43, or VLAN not trunked to the AP. Verify with display ip pool and client-side ipconfig.

RADIUS issues: shared secret mismatch, unreachable server, wrong NAS-IP, or certificate problems. Check display radius statistics and server logs.

Interference diagnosis: use spectrum analysis, check channel utilization (display ap radio), retry rate, and noise floor. High utilization with low throughput suggests CCI or a rogue AP.

Upgrade compatibility: AC and AP versions must match; auto-update pushes AP firmware from the AC. Keep a rollback image and upgrade off-peak.

WLAN Planner: import floor plan, set wall attenuation, AP model, and power; output coverage heat map and AP count. Validate with a site survey after deployment.

Direct forwarding: client traffic exits the AP's local uplink; the access switch must have the service VLAN and gateway. The AC only handles control and roaming.

Tunnel forwarding: client traffic is encapsulated in CAPWAP to the AC; the AC has the service VLAN gateway. Simpler VLAN design but higher AC bandwidth.

CloudCampus onboarding: AP gets IP via DHCP, resolves the cloud controller (option 43 or DNS), registers with a registration code or SN, and downloads config.

IoT integration: APs can host BLE/Zigbee modules; 802.11ah supports long-range low-power IoT. Plan separate SSIDs/VLANs for IoT isolation.

Location services: RSSI trilateration needs at least 3 APs; 802.11mc FTM improves accuracy to 1-2 m. Calibrate fingerprints per floor.

Guest/portal: separate SSID, isolated VLAN, portal server reachability, ACL to block internal subnets, and rate limiting per user.

High-density design: 5 GHz/6 GHz preference, 20 MHz channels, band steering, load balancing, airtime fairness, and per-SSID quotas.

Wired redundancy: link aggregation on AC uplinks, VRRP for AC gateway, redundant CAPWAP paths, and spanning-tree tuning to avoid loops.

2.4 GHz band: 2400-2483.5 MHz, 13-14 channels, 5 MHz spacing, 20 MHz channel width means only 3 non-overlapping channels (1, 6, 11).

5 GHz band: UNII-1 (5150-5250), UNII-2 (5250-5350, DFS), UNII-2e (5470-5725, DFS), UNII-3 (5725-5850). DFS channels require radar detection.

6 GHz (802.11ax/Wi-Fi 6E): 5925-7125 MHz, many 20 MHz channels, no DFS in most regions; preferred for high-density.

Modulation and coding: BPSK, QPSK, 16-QAM, 64-QAM, 256-QAM (802.11ac), 1024-QAM (802.11ax). Higher order needs higher SNR.

MIMO: spatial streams multiply throughput; 802.11n supports up to 4, 802.11ac up to 8, 802.11ax up to 8. MIMO requires multipath and independent antennas.

Beamforming: 802.11ac/ax explicit beamforming uses channel sounding (NDP) to steer energy toward the client; improves SNR and rate at range.

CSMA/CA vs CSMA/CD: WLAN cannot detect collisions, so it avoids them with random backoff and ACKs. Hidden nodes need RTS/CTS.

Throughput estimation: PHY rate x (1 - overhead) x spatial streams; protocol overhead (preamble, ACK, backoff) typically leaves 50-60% of PHY rate as UDP throughput.

CAPWAP discovery methods: DHCP option 43, DNS (AC domain name), broadcast on the local subnet, and static AC address on the AP. Order is configurable.

CAPWAP control tunnel: DTLS handshake (certificates or pre-shared), join request with AP MAC/SN/model, join response with AC info, config request/response, then Run.

Data tunnel: UDP 5247, optional DTLS. In direct forwarding, data does not enter the tunnel; only control and management traffic go to the AC.

AP whitelist: MAC or SN based; unauthenticated APs stay in a pending state. Auto-discovery can be enabled for plug-and-play.

AC source interface: must be reachable and stable; a loopback is preferred. Changing it forces APs to re-establish tunnels.

MTU and fragmentation: CAPWAP adds overhead; ensure the path MTU supports the encapsulated frames, or enable fragmentation to avoid drops.

AP firmware: the AC pushes the AP image (auto-update) if versions mismatch; the AP reboots and rejoins after the update.

NAT traversal: APs behind NAT need the AC to support CAPWAP NAT traversal; the AP's mapped address is used for the data tunnel.

802.11k neighbor report: the AP lists nearby APs with channel and BSSID, so the client scans fewer channels and roams faster.

802.11v BTM: the network sends a BSS Transition Management request suggesting a target AP; the client may accept or reject. Useful for sticky clients.

802.11r FT: pre-derives keys (PMK-R0, PMK-R1) so the client skips full 802.1X; roam time drops to tens of milliseconds. Requires a mobility domain.

FT over DS vs over the air: over-the-air (FT-OA) exchanges FT action frames directly; over-DS goes through the AC. Both need consistent R0KH/R1KH configuration.

Roaming triggers: RSSI threshold, retry rate, and load. The client decides; the network influences via 11k/v and power/coverage design.

Inter-AC roaming: requires a mobility group and shared keys; without it, the client must re-authenticate, causing a longer outage.

Sticky client mitigation: lower AP power, enable 11v, and use band steering; some ACs can force deauth of weak clients.

Roam verification: display station roam-history shows roam time, source and target AP, and reason. Target roam time is under 50 ms for voice.

WPA3-Personal: SAE replaces PSK; the handshake provides forward secrecy and resists offline dictionary attacks. SAE uses a commit/confirm exchange.

WPA3-Enterprise 192-bit: GCMP-256, SHA-384, ECDHE/ECDSA with 384-bit curves; for government and finance.

WPA2/WPA3 transition mode: allows both PSK and SAE clients on one SSID; weaker for security but useful for migration.

802.1X EAP methods: EAP-TLS (mutual certs), PEAPv0/EAP-MSCHAPv2 (server cert, password inner), EAP-TTLS, EAP-SIM/AKA.

RADIUS flow: AC sends Access-Request with User-Name, Calling-Station-Id, NAS-IP; server replies Access-Accept/Reject with attributes (VLAN, session timeout).

Dynamic VLAN: RADIUS Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-ID=VLAN ID. The VLAN must exist on the forwarding path.

Certificate validation: client checks server cert CN/SAN and CA chain; expired or mismatched certs cause EAP failures. Keep clocks synchronized (NTP).

PMF (802.11w): protects deauth/disassoc and robust management frames; required for WPA3 and recommended for WPA2.

WMM access categories: AC_VO (voice), AC_VI (video), AC_BE (best effort), AC_BK (background). Each has its own AIFSN, CWmin/CWmax, and TXOP.

EDCA defaults: Voice AIFSN=2, CWmin=3, CWmax=7; Video AIFSN=2, CWmin=7, CWmax=15; Best Effort AIFSN=3, CWmin=15, CWmax=1023; Background AIFSN=7, CWmin=15, CWmax=1023.

DSCP to AC mapping: EF (46) to Voice, AF41 (34) to Video, 0 to Best Effort, CS1 to Background. Map consistently on AC, AP, and upstream.

TXOP limits: voice/video get bounded TXOPs; a TXOP of 0 means one frame per contention win. Long TXOPs improve throughput but add jitter.

WMM admission control: voice/video can require admission before association; prevents over-subscription of the voice AC.

Airtime fairness: schedule by airtime, not frames, so low-rate clients do not starve high-rate ones.

Call admission control (CAC): limits the number of voice clients per AP based on airtime budget; rejects new calls when the budget is exhausted.

QoS verification: check DSCP marking on the AC, WMM mapping on the AP, and queue statistics; mismatched mapping causes voice degradation.

VRRP master election: higher priority wins (default 100); preemption enabled by default in some implementations. The virtual IP is the CAPWAP AC address.

HSB sync: AP sessions, STA entries, and keys are synchronized over a dedicated link; failover time depends on sync latency and CAPWAP timers.

Dual-link backup: the AP is configured with primary and backup AC addresses; on tunnel failure it tries the backup. No VRRP needed.

Mobility group: ACs share STA info for inter-AC roaming; requires consistent security profiles and keys.

AC pool (VAC): multiple ACs form one logical AC; APs are load-balanced and fail over within the pool. Capacity must survive one member loss.

CAPWAP timers: echo interval (default 25 s) and retransmit count determine failure detection; tune for faster failover.

License backup: both HA nodes need licenses for the full AP load; a standby without licenses cannot take over.

Upgrade in HA: upgrade standby, fail over, upgrade former active, verify AP sessions and client connectivity.

AP not online: check IP, AC reachability, discovery (option 43/DNS/broadcast), DTLS handshake, join request/response, whitelist, and firmware compatibility.

display ap all shows AP state, IP, AC, and model; display capwap statistics shows control/data counters and errors.

Client association: display station assoc-info, display station statistics, and display station roam-history show RSSI, rate, and roam events.

DHCP issues: pool exhaustion, wrong gateway, missing option 43, VLAN not trunked. Verify with display ip pool and client ipconfig.

RADIUS issues: shared secret mismatch, unreachable server, wrong NAS-IP, certificate problems. Check display radius statistics and server logs.

Interference: spectrum analysis, channel utilization, retry rate, noise floor. High utilization with low throughput suggests CCI or a rogue AP.

WLAN Planner: import floor plan, set wall attenuation, AP model, power; output heat map and AP count. Validate with a site survey.

Upgrade: AC and AP versions must match; auto-update pushes AP firmware. Keep a rollback image and upgrade off-peak.

Direct forwarding: client traffic exits the AP's local uplink; the access switch must have the service VLAN and gateway. The AC handles control and roaming.

Tunnel forwarding: client traffic is encapsulated in CAPWAP to the AC; the AC has the service VLAN gateway. Simpler VLAN design but higher AC bandwidth.

CloudCampus: AP gets IP via DHCP, resolves the cloud controller (option 43 or DNS), registers with a registration code or SN, and downloads config.

IoT integration: APs can host BLE/Zigbee modules; 802.11ah supports long-range low-power IoT. Use separate SSIDs/VLANs for isolation.

Location services: RSSI trilateration needs at least 3 APs; 802.11mc FTM improves accuracy to 1-2 m. Calibrate fingerprints per floor.

Guest/portal: separate SSID, isolated VLAN, portal server reachability, ACL to block internal subnets, and rate limiting per user.

High-density design: 5 GHz/6 GHz preference, 20 MHz channels, band steering, load balancing, airtime fairness, and per-SSID quotas.

Wired redundancy: link aggregation on AC uplinks, VRRP for AC gateway, redundant CAPWAP paths, and spanning-tree tuning to avoid loops.

802.11 frame types: management (beacon, probe, auth, assoc, deauth), control (RTS, CTS, ACK, block ACK, PS-Poll), and data.

MAC header fields: Frame Control, Duration/ID, Address 1-4, Sequence Control, QoS Control, HT Control. Address fields depend on To DS/From DS bits.

Beacon interval default 100 TU (102.4 ms); DTIM period controls how often multicast/broadcast is buffered for power-save clients.

Association process: probe, authentication (open or shared), association request/response, then 4-way handshake for WPA2/WPA3.

Hidden node: RTS/CTS reserves the medium; CTS-to-self is a lighter alternative. RTS threshold controls when RTS is used.

Fragmentation: splits frames to reduce retransmission cost in noisy environments; fragmentation threshold is configurable.

Block ACK: aggregates acknowledgments for A-MPDU; improves efficiency for high-throughput traffic.

Power save: PS-Poll and U-APSD (WMM power save) let clients sleep and wake for buffered frames, extending battery life.

AP boot: power on, load firmware, get IP (DHCP or static), discover AC (option 43, DNS, broadcast, static), establish CAPWAP control tunnel.

DTLS handshake: certificate or PSK-based; a certificate mismatch or expired cert blocks the tunnel.

Join request: AP sends MAC, SN, model, and software version; AC validates against whitelist and version compatibility.

Config delivery: AC pushes WLAN config (SSID, security, VLAN) to the AP; the AP applies it and moves to Run state.

Firmware update: if the AP version mismatches, the AC pushes the image; the AP reboots and rejoins.

Whitelist: MAC or SN based; unauthenticated APs stay pending. Auto-discovery enables plug-and-play.

AC source interface: must be reachable and stable; a loopback is preferred. Changing it forces re-establishment.

NAT traversal: APs behind NAT need CAPWAP NAT traversal support on the AC.

Roam triggers: RSSI threshold, retry rate, and load. The client decides; the network influences via 11k/v and coverage design.

802.11k neighbor report reduces scan time; 802.11v BTM suggests a target AP; 802.11r FT pre-derives keys for fast roam.

Inter-AC roaming requires a mobility group and shared keys; without it, the client re-authenticates, causing a longer outage.

Sticky client mitigation: lower AP power, enable 11v, and use band steering; some ACs can force deauth of weak clients.

Roam verification: display station roam-history shows roam time, source and target AP, and reason. Target roam time is under 50 ms for voice.

Cell overlap: 15-20% overlap at the cell edge ensures seamless roaming without excessive co-channel interference.

Band steering: suppress or delay 2.4 GHz probe responses for dual-band clients; do not block 2.4-only clients.

Voice roaming: enable 11r, 11k, 11v, and WMM; verify PMK caching and consistent security profiles across APs.

Portal authentication: client gets an IP, is redirected to a portal page, credentials are validated (local or RADIUS), then the AC opens the ACL.

Portal flows: CHAP/PAP portal, Portal 2.0/3.0 with HTTPS and token-based redirect; Portal 3.0 supports third-party and social login.

MAC authentication: the AC sends the client MAC as username and password (or a configured password) to RADIUS; useful for printers and IoT.

MAC auth bypass: combine with portal for devices without browsers; the AC falls back to MAC auth when portal fails.

RADIUS attributes: User-Name, Calling-Station-Id, NAS-IP-Address, Tunnel-Type/Medium/Private-Group-ID for dynamic VLAN.

Portal server reachability: the AC must reach the portal server; a wrong URL or unreachable server breaks the redirect.

ACL: before authentication, only DHCP/DNS/portal traffic is allowed; after authentication, the ACL is opened.

Security best practice: isolate guest VLAN, rate-limit per user, and block internal subnets via ACL.

Airtime fairness: schedule by airtime, not frames, so low-rate clients do not starve high-rate ones.

A-MPDU aggregation: multiple MPDUs in one PPDU, acknowledged by block ACK; max aggregate size is bounded by TXOP and buffer.

MU-MIMO: the AP transmits to multiple clients simultaneously; requires channel sounding and client support.

OFDMA (802.11ax): resource units split the channel in frequency; improves efficiency in dense environments.

BSS Coloring (802.11ax): tags frames so overlapping BSSs can ignore each other's transmissions, improving spatial reuse.

TWT (802.11ax): the AP schedules client wake times, saving battery for IoT and reducing contention.

Rate limiting: configure committed/peak rates per client or SSID to prevent a single user from consuming the cell.

Channel and power planning: verify SNR > 25 dB and RSSI > -65 dBm at the cell edge; avoid co-channel overlap greater than 20%.

AC virtualization (VAC): multiple physical ACs form one logical AC; APs are load-balanced across members and fail over within the pool.

VAC capacity: plan for the loss of one member; each member must be sized to carry the redistributed AP load.

Mobility group: ACs share STA info for inter-AC roaming; requires consistent security profiles and keys.

HSB sync: AP sessions, STA entries, and keys are synchronized over a dedicated link; failover time depends on sync latency.

CAPWAP timers: echo interval (default 25 s) and retransmit count determine failure detection; tune for faster failover.

License backup: both HA nodes need licenses for the full AP load; a standby without licenses cannot take over.

Upgrade in HA: upgrade standby, fail over, upgrade former active, verify AP sessions and client connectivity.

VRRP vs VAC: VRRP hides failure behind a virtual IP; VAC pools ACs for scale and resilience. They can be combined.

AP not online: check IP, AC reachability, discovery (option 43/DNS/broadcast), DTLS handshake, join request/response, whitelist, and firmware compatibility.

display capwap statistics shows control/data counters and errors; rising retransmits indicate link or MTU issues.

Client association: display station assoc-info, display station statistics, and display station roam-history show RSSI, rate, and roam events.

DHCP issues: pool exhaustion, wrong gateway, missing option 43, VLAN not trunked. Verify with display ip pool and client ipconfig.

RADIUS issues: shared secret mismatch, unreachable server, wrong NAS-IP, certificate problems. Check display radius statistics and server logs.

Interference: spectrum analysis, channel utilization, retry rate, noise floor. High utilization with low throughput suggests CCI or a rogue AP.

Upgrade: AC and AP versions must match; auto-update pushes AP firmware. Keep a rollback image and upgrade off-peak.

WLAN Planner: import floor plan, set wall attenuation, AP model, power; output heat map and AP count. Validate with a site survey.

CloudCampus: AP gets IP via DHCP, resolves the cloud controller (option 43 or DNS), registers with a registration code or SN, and downloads config.

IoT integration: APs can host BLE/Zigbee modules; 802.11ah supports long-range low-power IoT. Use separate SSIDs/VLANs for isolation.

Location services: RSSI trilateration needs at least 3 APs; 802.11mc FTM improves accuracy to 1-2 m. Calibrate fingerprints per floor.

Guest/portal: separate SSID, isolated VLAN, portal server reachability, ACL to block internal subnets, and rate limiting per user.

High-density design: 5 GHz/6 GHz preference, 20 MHz channels, band steering, load balancing, airtime fairness, and per-SSID quotas.

Wired redundancy: link aggregation on AC uplinks, VRRP for AC gateway, redundant CAPWAP paths, and spanning-tree tuning to avoid loops.

Direct forwarding: client traffic exits the AP's local uplink; the access switch must have the service VLAN and gateway.

Tunnel forwarding: client traffic is encapsulated in CAPWAP to the AC; the AC has the service VLAN gateway. Simpler VLAN design but higher AC bandwidth.

Autonomous AP (fat AP): full configuration and forwarding locally; no AC. Suitable for small deployments.

Centralized (fit AP + AC): APs hold no service config; the AC delivers config and handles control. CAPWAP tunnels connect them.

Split MAC: 802.11 management and control are handled by the AC; real-time functions (beacons, ACKs, encryption) stay on the AP.

Cloud-managed: APs register to a cloud controller over the internet; tenant-based management and plug-and-play onboarding.

Direct vs tunnel forwarding: direct forwarding exits the AP locally; tunnel forwarding encapsulates to the AC. Choice affects VLAN design and AC bandwidth.

CAPWAP: control on UDP 5246 (DTLS), data on UDP 5247. Discovery via option 43, DNS, broadcast, or static AC address.

AP onboarding states: boot, IP, discovery, DTLS, join, config, Run. Failures at each state have distinct causes.

Capacity planning: AC capacity is limited by AP count, client count, and throughput; HA pairs must each carry the full load after failover.

RADIUS: authentication on UDP 1812, accounting on UDP 1813 (legacy 1645/1646). Shared secret must match on AC and server.

802.1X roles: supplicant (client), authenticator (AP/AC), authentication server (RADIUS). EAP methods: EAP-TLS, PEAP, EAP-TTLS, EAP-SIM/AKA.

EAP-TLS: certificate both sides; PEAP/EAP-TTLS: server cert, inner MS-CHAPv2. Certificate expiry or wrong CA chain breaks authentication.

PKI: a CA issues AC/AP and server certificates; EAP-TLS requires client certificates. Keep clocks synchronized (NTP).

Dynamic VLAN: RADIUS Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-ID=VLAN ID. The VLAN must exist on the forwarding path.

PMF (802.11w): protects deauth/disassoc and robust management frames; required for WPA3 and recommended for WPA2.

WPA3-Enterprise 192-bit: GCMP-256, SHA-384, ECDHE/ECDSA with 384-bit curves; for government and finance.

RADIUS flow: AC sends Access-Request with User-Name, Calling-Station-Id, NAS-IP; server replies Access-Accept/Reject with attributes.

Channel planning: 2.4 GHz uses 1/6/11 with 20 MHz only; 5 GHz prefers 20/40 MHz and avoids DFS channels where radar is present.

Transmit power: lower AP power reduces co-channel interference and encourages roaming; target -65 to -70 dBm RSSI at cell edge with 15-20% overlap.

CCI comes from APs on the same channel; ACI from overlapping spectrum. CCI is managed by channel reuse distance; ACI by non-overlapping channels.

Air interface control: limit low-rate clients (disable 1/2/5.5/11 Mbps) to shrink cell size and improve airtime efficiency.

Interference sources: microwave ovens, Bluetooth, cordless phones (2.4 GHz), radar (DFS 5 GHz), and rogue APs. Use spectrum analysis and WIDS/WIPS.

WMM: four access categories (Voice, Video, Best Effort, Background) with different AIFSN, CWmin/CWmax, and TXOP.

DSCP to AC mapping: EF (46) to Voice, AF41 (34) to Video, 0 to Best Effort, CS1 to Background. Map consistently on AC, AP, and upstream.

Airtime fairness: schedule by airtime, not frames, so low-rate clients do not starve high-rate ones.