WLC Deployment — Autonomous, Centralized, Cloud, and FlexConnect

The four deployment models

1. Autonomous (standalone) APs

Each AP is a mini-controller. Config lives on the AP. Common in home / SOHO or very small SMB.

• Pros: no controller cost, no WAN dependency.
• Cons: no roaming across APs, per-AP management, no centralized policy.

CCNP mentions it exists. Nobody deploys it in the enterprise.

2. Centralized (CUWN / CAPWAP local mode)

• APs join a central Wireless LAN Controller (WLC) via CAPWAP tunnel (UDP 5246 control, 5247 data).
• WLC handles authentication, roaming, QoS, RRM.
• Client traffic is tunneled inside CAPWAP back to the WLC, then breaks out onto the wired network.

Pros: consistent policy everywhere. Best security. Central log / troubleshoot. Layer-3 roaming is seamless. Cons: every packet crosses the WAN to the WLC. If the WLC is at HQ, branch traffic hairpins.

3. FlexConnect (branch-optimized)

Same WLC control plane, but the AP is smart enough to bridge client traffic locally at the branch:

• Connected mode — WLC is reachable. AP uses WLC-configured policies but forwards user traffic straight to the local VLAN.
• Standalone mode — WLC is unreachable. AP keeps running with the last known config, allowing users to keep working (usually with locally-authenticated SSIDs or cached AAA).

Per-SSID choice: some SSIDs FlexConnect-bridge locally (guest, corporate data), some tunnel back centrally (voice, corporate high-security).

4. Cloud-managed

• Meraki: APs (MR series) phone home to the Meraki cloud. Config through the Meraki dashboard. No on-prem controller.
• Catalyst 9800-CL: virtualized WLC running in Azure/AWS. Same IOS-XE control plane as a physical 9800, deployed as a VM in the cloud.

Pros: no controller sizing, elastic. Great for distributed deployments. Cons: internet reachability required for management (client data still bridges locally in FlexConnect-equivalent modes).

5. Embedded Wireless Controller (EWC) — worth knowing

One of the 9100-series APs runs a lightweight WLC internally. Handles up to ~200 APs. Great for medium-sized single-site deployments without paying for a dedicated 9800.

CAPWAP quick facts

• UDP 5246 — control channel. Encrypted (DTLS).
• UDP 5247 — data channel. Optionally DTLS-encrypted.
• Discovery — AP finds WLC via DHCP option 43 (primary), DNS (secondary), broadcast (fallback), Cisco Discovery Protocol (uncommon).
• AP join — AP downloads config + firmware from WLC. Reboots if firmware differs.

Local mode vs FlexConnect vs Mesh vs Sniffer

The AP itself has an operating mode:

• Local — standard CAPWAP AP.
• FlexConnect — branch mode with local data forwarding.
• Mesh — APs form a mesh to backhaul.
• Sniffer — AP dedicates its radio to packet capture for troubleshooting.
• Monitor — radio only listens (no client service). Used for WIPS.
• Rogue Detector — connects to a wired trunk to detect rogue APs by comparing wireless-heard MACs to wired-seen MACs.

RRM — Radio Resource Management

The WLC’s control loop:

• DCA (Dynamic Channel Assignment) — picks channels per AP to minimize CCI.
• TPC (Transmit Power Control) — turns each AP’s power up/down for even coverage.
• Coverage Hole Detection — spots areas where clients see poor signal.
• CleanAir / Spectrum — identifies non-Wi-Fi interference.

Turn RRM off manually only if you have a very specific static plan; otherwise let it work.

Common exam / real-world mistakes

1. Local mode across a WAN. Every packet tunnels. WAN becomes a bottleneck. Move to FlexConnect for branches.
2. Skipping DHCP option 43. APs at a remote site can’t find the WLC → they never join. Option 43 tells them the WLC IP.
3. Layer-3 roaming without mobility groups. Two WLCs in different subnets: roaming client switches AP → controller-to-controller mobility tunnel must exist (mobility group configured on both).
4. Forgetting FlexConnect ACLs. Local traffic doesn’t traverse the WLC → WLC ACLs don’t apply. Configure FlexConnect ACLs pushed to the AP itself.
5. CAPWAP MTU issue. CAPWAP adds ~50 bytes. If WAN MTU is 1500 and clients send 1500-byte frames, fragmentation. Enable Path MTU Discovery, or lower client MTU.

Cheat strip

Autonomous     each AP standalone. SOHO. No roaming.
Centralized    APs tunnel CAPWAP back to WLC. Local mode.
FlexConnect    APs bridge locally at branch. Per-SSID choice.
Cloud          Meraki / Catalyst 9800-CL. No on-prem WLC.
EWC            one AP runs internal WLC. Medium site.

CAPWAP     UDP 5246 (ctrl, DTLS)  |  UDP 5247 (data, optional DTLS)
Discovery  DHCP opt 43 > DNS > broadcast

AP modes   local | flexconnect | mesh | sniffer | monitor | rogue-detector
RRM        DCA (channel) + TPC (power) + coverage hole + CleanAir