CAPWAP (Control and Provisioning of Wireless Access Points) establishes tunnels between lightweight access points (LWAPs) and a wireless LAN controller (WLC). It supports split-MAC architecture: the LWAP handles real-time wireless interactions, while the WLC centralizes management and translates wireless client traffic into Ethernet frames for the correct VLAN. section 19.2.2 section 19.3
CAPWAP uses two separate tunnels for each LWAP-to-WLC relationship:
- The data tunnel carries traffic to and from wireless clients. section 19.2.2
- The control tunnel carries LWAP management and configuration communications with the WLC. section 19.2.2
- The control tunnel is encrypted by default; the data tunnel is unencrypted by default but can be encrypted. section 19.2.2
- CAPWAP uses DTLS, which provides TLS encryption over UDP; the control tunnel uses UDP port 5246 and the data tunnel uses UDP port 5247. section 19.2.2
An LWAP normally connects to the wired LAN through an access port in the management VLAN rather than an autonomous AP’s trunk port. CAPWAP uses that management VLAN for the tunnels, while the WLC performs SSID-to-VLAN translation. FlexConnect can instead allow local switching between SSIDs and VLANs. section 19.2.2
Basic CAPWAP topology
In a simple deployment, AP1 operates as an LWAP, WLC1 controls it, and a switch provides the management VLAN, DHCP, NTP, and default-gateway services. AP1 tunnels client traffic to WLC1, which translates the wireless frames into Ethernet frames. section 21.1
