AP connectivity, SSIDs, and autonomous/Split-MAC architecture

Physical infrastructure connections of WLAN components

A wireless network works best when it’s designed as part of the wired network, not as a separate add-on. That means planning how Access Points (APs) and Wireless LAN Controllers (WLCs) connect to switches, and when to use access ports versus trunk ports.

Access points (APs)

APs sit between wireless clients and the wired LAN. Your wireless devices connect to an AP over an RF signal, and the AP connects into the wired network (typically to an access-layer Ethernet switch).

• Bridging wireless to wired: An AP has both wireless and wired interfaces. It translates frames between the 802.11 wireless standard and the 802.3 wired Ethernet standard, bridging them at Layer 2.
• SSID (Service Set Identifier)

The Service Set Identifier (SSID) is a human-readable text string, up to 32 characters long, that identifies a wireless network. It’s the network’s “friendly name,” which helps users distinguish between wireless networks when choosing which one to join.

APs advertise SSIDs in beacon frames. Devices scanning for networks display the SSIDs they discover, so users can select the right one. SSIDs are not a security feature - they’re sent in clear text and are easy to discover.

There are several SSID-related terms you’ll see:

• With Basic Service Sets (BSSID), the SSID identifies a single AP’s network.
• With Extended Service Sets, the same SSID (ESSID) is configured across multiple APs, creating the appearance of one seamless network as clients roam between APs.

That consistency matters for mobility: clients can keep the same network configuration and IP addressing as they move through the coverage area.

A single AP can broadcast multiple SSIDs at the same time. Each SSID can be mapped to a different VLAN, creating separate logical wireless networks with different security policies, access controls, and purposes (for example: corporate, guest, and IoT). Keep in mind that all SSIDs on an AP share the same physical radio resources, so they still contend for airtime on the same channel.

SSIDs can also be “hidden” by configuring the AP not to include them in beacon frames, which forces users to type the network name manually. This provides minimal security benefit because the SSID still appears in other frame types and can be discovered by monitoring wireless traffic.

• VLAN mapping and Trunk ports: When an AP supports multiple SSIDs, it maps each SSID to a specific VLAN. To carry multiple VLANs to the AP, the switchport connected to the AP must be configured as a Trunk port. For example, if SSID “Corp_WiFi” maps to VLAN 10, SSID “Guest” maps to VLAN 20 and SSID “IoTDevices” maps to VLAN 30, the switchport connected to the AP must be a trunk port allowing VLANs 10, 20 and 30.

Image 250

Image Title - AP connected to a Trunk port on an Access Switch

• Management VLAN: APs need a management IP address for remote configuration and monitoring. This management address is typically placed in a dedicated management VLAN, and that VLAN must also be carried over the trunk link to the AP.
• Power over Ethernet (PoE): In most deployments, APs are powered using Power over Ethernet (PoE), which delivers electrical power and data over a single Ethernet cable. This reduces cabling and avoids needing a separate power outlet at the AP location. IEEE 802.3af (PoE) provides up to 15.4 watts, 802.3at (PoE+) provides up to 30 watts, and 802.3bt (PoE++ or UPOE) can deliver up to 60 or 100 watts, depending on the type. Modern high-performance APs with multiple radios typically require PoE+ or higher.

VoIP phones also use PoE for power, however, the Switch that they plug into must support PoE as well. The same goes for APs.

APs can operate in several architectures: Autonomous AP, Split-MAC or Cloud-Based

Autonomous AP architecture

An Autonomous AP is a self-contained device that functions independently. It includes both wired and wireless hardware, so it can connect wireless client traffic directly into the local wired network.

Wireless Routers that are used in the home or in SOHO networks are typically Autonomous APs. They are pretty much a combination of a Router and an Autonomous AP all-in-one, instead of having separate hardware for both purposes. This is ok for a home or SOHO network, since not as much processing power, throughput or separation of functions is required.

• Functionality: In Autonomous mode, the AP is the central point for wireless clients to access a wireless LAN. It advertises standalone BSSes and maps wireless SSIDs to VLANs at the Ethernet switch level.
• Data Path: Wireless client traffic passes through the AP to reach devices on the wired network. However, wireless clients connected to the same autonomous AP can communicate with each other without traversing the wired network (Ethernet switch).
• Management: Each autonomous AP requires individual configuration, including management IP address, SSIDs, VLANs, and RF parameters (e.g., channel and transmit power). A dedicated management VLAN is typically used for remote management access.
• Scalability challenges: As the network grows, managing many autonomous APs individually becomes difficult. Extending SSIDs and their VLANs across many APs often requires extending VLANs across trunk links from switch to switch, which can increase complexity and can lead to inefficient roaming.

Image 251

Image Title - APs operating in Autonomous AP mode.

APs typically connect to Access Layer Switches

Split-MAC architectures (WLC-based)

To address the limitations of autonomous APs - especially around centralized management, RF coordination, and security - many deployments move key functions to a Wireless LAN Controller (WLC). This is called a Split-MAC architecture because MAC-layer responsibilities are split between the AP and the WLC.

• Lightweight APs: In this model, APs are called lightweight (or “thin”) APs. They have reduced local intelligence and rely on a WLC for most operational decisions.
• CAPWAP tunnels: Lightweight APs establish secure Control And Provisioning of Wireless Access Points (CAPWAP) tunnels to the WLC. These tunnels carry:
  • control traffic (used to manage the AP)
  • data traffic (wireless client traffic) CAPWAP allows the AP and WLC to be logically and geographically separated, so they don’t need to be in the same broadcast domain (VLAN). Client traffic is encapsulated in CAPWAP and routed at Layer 3 between the AP’s IP address and the WLC’s IP address.

Image 252

Image Title - APs operating in Split-MAC mode connecting to a WLC