A CAPWAP control tunnel is a virtual communication pathway between a lightweight access point (LWAP) and a wireless LAN controller (WLC). It carries the communications the WLC uses to configure LWAPs and manage their operations. section 19.2.2
CAPWAP creates two separate tunnels between each LWAP and WLC:
- The control tunnel carries LWAP–WLC management and configuration communications. section 19.2.2
- The data tunnel carries traffic sent to and from wireless clients. section 19.2.2
- The control tunnel is encrypted by default, while data-tunnel encryption must be enabled separately; CAPWAP uses DTLS, which applies TLS over UDP. section 19.2.2
Centralized wireless control
An LWAP sends management communications through the control tunnel to the WLC, while client traffic uses the separate data tunnel. The WLC centralizes functions such as RF management, authentication, association, QoS, and security policy. section 19.2.2 section 19.3
