WLAN Networking and CAPWAP Principles
Domain 2 covers fit AP-AC architecture, CAPWAP tunnel setup and the onboarding steps that turn a powered AP into a managed radio.
Architecture
Fit APs hold little configuration; the AC supplies service and radio settings. In tunnel forwarding, user traffic is encapsulated to the AC; in local forwarding, traffic exits at the AP. CAPWAP uses UDP 5246 for control and UDP 5247 for data. Control is protected by DTLS; data DTLS is optional.
Discovery and join
An AP first gets an IP address and default gateway, then discovers ACs by static configuration, DHCP option 43, DNS or Layer 2 broadcast. It establishes DTLS, sends a Join Request, and the AC checks AP identity and license. If the AP image differs, the AC pushes an image, the AP reboots, then downloads configuration and enters the run state.
Onboarding design
The AP management VLAN must have DHCP and a route to the AC source interface. Firewalls must permit the CAPWAP ports. NTP and certificates matter when DTLS is used.
Worked example: an AP in VLAN 100 receives 192.168.100.10/24, but the AC is 10.10.10.5 on another subnet and DHCP has no option 43. Broadcast discovery stops at the router, so the AP never joins. Add DHCP option 43 or a DNS entry pointing to the AC, then verify UDP 5246/5247 and the AP license.
Traps: confusing control and data ports; expecting broadcast discovery across a routed network; ignoring AP license exhaustion; assuming data is always DTLS-encrypted.