Light Weight Access Point Registration Process with Cisco WLC

This is a 4 step process. They are Getting an IP address, Finding WLCs, Selecting WLCs & Registering with the Primary WLC.. Simple like that.. In Light Weight mode, APs act as end point dumb devices to Wireless LAN Controllers. What they just need is to find a WLC to build it's tunnel (CAPWAP) to transport user traffic where they will be handled as required..

Step 01: Getting an IP address

AP can be assigned an IP address in 2 methods..
1. Static assignment
2. DHCP

If it is not configured statically, it will send a DHCP discover to find a DHCP server to get an IP address along with other network details.. Nothing amazing here as this is what any end point will do when it is plugged in to a network..


Step 02: Finding WLCs

There are 2 WLC discovery methods in Cisco APs; L2 discovery & L3 discovery..
L2 discovery happens first..

Note:- 

LWAPP & CAPWAP are 2 Light Weight mode protocols which allows APs to join with WLCs. LWAPP stands for Light Weight Access Point Protocol and CAPWAP stands for Control And Provisioning Wireless Access Point. Both accomplishes same task in different ways. CAPWAP seems to do it in a better more secure way. LWAPP is older and only supports in few old platforms.

1. Layer 2 Discovery (supports only on few old platforms using LWAPP)
2. Layer 3 Discovery (supports on all platforms with both LWAPP or CAPWAP)

Steps of L3 Discovery :-

(i). CAPWAP Discovery request broadcast on local subnet (IP broadcast).

(ii). CAPWAP Discovery request sent to controller IP addresses learnt via OTAP feature.

When the feature called OTAP (Over the air provisioning) is configured on a controller, APs that are already been joined to the controller advertise their known controller addresses in neighbor messages that are sent over the air. New APs attempting to discover controllers receive these messages and unicast a discovery request to each controller. WLCs unicast discovery response to APs after receiving these messages.

(iii). CAPWAP discovery request sent to all locally stored WLC IP addresses.

APs maintain a list of WLC IPs previously learnt in its NVRAM. They send unicast messages to these IP addresses. WLCs unicast discovery response to APs after receiving these messages.

(iv). CAPWAP discovery request sent to IP addresses learnt from DHCP option 43.

DHCP option 43 is the IP of the WLC.. You can configure this in DHCP server settings.

(v). CAPWAP discovery request sent to IP addresses learnt from DNS address
CISCO-CAPWAP-CONTROLLER.localdomain

If a WLC gets a discovery request from any above step, it sends a unicast response to AP.
AP runs all these steps to create a list of WLCs. This is called the WLC hunting algorithm.

WLC Hunting Algorithm :-

1. If L2 discovery is supported, send a discovery request in an Ethernet broadcast
2. If L2 discovery is not supported or step 1 fails to find a WLC, proceed to L3 discovery
3. If L3 discovery fails to find  a candidate WLC, reboot and return to step 1


Step 03: Selecting WLCs

WLCs embed the following important information in the LWAPP/CAPWAP Discovery response
1. The controller sysName - hostname of WLC
2. The controller type - platform
3. The controller AP capacity and its current AP load
4. The master controller flag
5. The AP manager IP address

The AP uses this information to make a controller selection

1. If the LAP has been previously configured with primary, secondary and tertiary controller, the LAP will attempt to join these first (specified using the controller sysName)
2. Attempt to join a WLC configured as a master controller
3. Attempt to join a WLC with the greatest excess capacity


Step 04: Registering with the Primary WLC

1. AP sends a join request first..
Join request contains X.509 certificate of AP which WLC validates.

2. WLC sends a join response then..
Join response indicates AP is registered and contains X.509 certificate of WLC which AP validates.

After the joining is complete, following things happen between the WLC & AP..
- Sync firmware on WLC & LAP if it is not matching
- WLC provisions the LAP with configuration parameters (SSID, Security, QoS, etc)

Now the registration is complete. If the primary controller fails, it will register with the secondary controller available in his list..