A CAPWAP data tunnel carries traffic to and from wireless clients associated with a lightweight access point (LWAP). The LWAP encapsulates client frames and sends them through the wired LAN to the wireless LAN controller (WLC), which translates them into Ethernet frames tagged for the appropriate VLAN. section 19.2.2 section 19.3
Key operational facts include:
- Represents a virtual communication pathway rather than a separate physical link; encapsulation adds headers while packets still traverse the wired LAN. section 19.2.2
- Exists alongside a CAPWAP control tunnel: the data tunnel carries client traffic, while the control tunnel carries LWAP-WLC management communications. section 19.2.2
- Remains unencrypted by default; DTLS encryption can be enabled for additional security. DTLS provides TLS-style encryption over UDP. section 19.2.2 section 19.3
Client frame forwarding
A laptop or smartphone associated with an LWAP sends traffic through the CAPWAP data tunnel to the WLC. The WLC maps the client’s SSID to the appropriate VLAN and forwards an Ethernet frame into that VLAN. section 19.2.2
