Describe physical infrastructure connections of WLAN components (AP, WLC, access/trunk ports, and LAG)

This objective asks a practical question: when you cable up APs and a WLC, which switch ports should be access ports, which should be trunks, and how should the controller be connected for redundancy?

Connecting access points

Lightweight AP in local mode: access port. Every client frame is tunneled inside CAPWAP to the WLC, so the only traffic on the AP’s Ethernet port is CAPWAP (UDP 5246/5247) to and from the AP’s own IP address. That is a single VLAN, the AP management VLAN, so the port is an access port. Enable PortFast because an AP is an end host from STP’s point of view.

SW1(config)# vlan 100
SW1(config-vlan)# name AP-MGMT
SW1(config-vlan)# exit
SW1(config)# interface gigabitethernet0/10
SW1(config-if)# description AP-FLOOR2-EAST
SW1(config-if)# switchport mode access
SW1(config-if)# switchport access vlan 100
SW1(config-if)# spanning-tree portfast
! PoE is on by default; this just confirms it
SW1(config-if)# power inline auto

Lightweight AP in FlexConnect mode with local switching: trunk port. When the AP drops client traffic directly on the branch switch, it needs to tag each SSID’s traffic with its VLAN, so the port becomes a trunk. The native VLAN of the trunk should be the AP’s management VLAN because the AP’s own CAPWAP traffic is sent untagged.

Autonomous AP or Meraki AP with multiple SSIDs: trunk port. Same reason; the AP bridges each SSID to a VLAN. An autonomous AP with a single SSID can use an access port.

SW1(config)# interface gigabitethernet0/11
SW1(config-if)# description AP-AUTONOMOUS-LOBBY
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport trunk native vlan 100
SW1(config-if)# switchport trunk allowed vlan 100,110,120
SW1(config-if)# spanning-tree portfast trunk

Power over Ethernet for APs

APs are almost always powered over the Ethernet cable using PoE, which lets you mount them on ceilings with no power outlet nearby. The switch (or a mid-span injector) is the PSE (power sourcing equipment); the AP is the PD (powered device). Standards and budgets per port:

Modern Wi-Fi 6/6E APs with multiple radios often need PoE+ (802.3at) to run all radios at full power; on 802.3af some APs disable a radio or reduce transmit power. CDP and LLDP-MED let the AP negotiate exactly how much power it needs. Verify with show power inline:

SW1# show power inline
Module   Available     Used     Remaining
          (Watts)     (Watts)    (Watts)
------   ---------   --------   ---------
1           370.0       60.4       309.6
Interface Admin  Oper       Power   Device              Class Max
                            (Watts)
--------- ------ ---------- ------- ------------------- ----- ----
Gi0/10    auto   on         30.0    AIR-AP4800-B-K9     4     30.0
Gi0/11    auto   on         30.0    C9120AXI-B          4     30.0
Gi0/12    auto   off        0.0     n/a                 n/a   30.0

Connecting the WLC

The WLC sits at the other end of every CAPWAP tunnel and must place client traffic onto many VLANs, so it connects to the switch on a trunk port. The controller has several logical interfaces that live on that trunk:

Each dynamic interface is tagged with its VLAN on the trunk. The management interface is often untagged (native VLAN) but can be tagged.

LAG on the WLC

A controller serving thousands of clients needs more bandwidth and more resilience than a single link. WLCs support LAG (link aggregation), which is the wireless-world name for an EtherChannel. All the WLC’s distribution system ports are bundled into one logical link to the switch, and the switch side is a port channel in trunk mode.

Important details for the exam:

• AireOS WLCs support only static LAG (channel-group N mode on). They do not run LACP or PAgP, so the switch side must be on as well.
• Catalyst 9800 WLCs (IOS-XE) support LACP and PAgP in addition to on, so mode active works with them.
• When LAG is enabled on an AireOS WLC, it applies to all ports; the controller cannot run LAG on some ports and not others. Enabling or disabling LAG requires a WLC reboot.
• The switch load-balances frames across the bundle; the WLC treats it as one interface.

Switch configuration toward an AireOS WLC:

CORE1(config)# interface range tengigabitethernet1/0/1 - 2
CORE1(config-if-range)# description LAG-TO-WLC1
! AireOS controllers only support static LAG, so mode on
CORE1(config-if-range)# channel-group 3 mode on
CORE1(config-if-range)# exit
CORE1(config)# interface port-channel 3
CORE1(config-if)# switchport mode trunk
CORE1(config-if)# switchport trunk native vlan 100
CORE1(config-if)# switchport trunk allowed vlan 100,110,120,130

CORE1# show etherchannel summary | include Po3
3      Po3(SU)         -         Te1/0/1(P)  Te1/0/2(P)

The - in the Protocol column confirms a static bundle.