Datagram Transport Layer Security

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

Datagram Transport Layer Security is a TLS-based protocol that provides cryptographic protection for datagram-oriented communications such as UDP traffic.

Datagram Transport Layer Security (DTLS) provides encryption for CAPWAP communications between lightweight access points (LWAPs) and a wireless LAN controller (WLC). It is based on TLS but uses UDP instead of TCP. section 19.2.2

Understand DTLS through the two CAPWAP tunnels:

• The control tunnel carries LWAP–WLC management communication and is encrypted by default. section 19.2.2
• The data tunnel carries wireless-client traffic between the LWAP and WLC and is not encrypted by default. section 19.2.2
• Data-tunnel encryption can be enabled when additional security is required. section 19.2.2

Wireless controller tunnel

An LWAP tunnels client traffic to the WLC through CAPWAP, while the WLC manages the LWAP through a separate control tunnel. DTLS protects the control tunnel by default; administrators can additionally protect the data tunnel. section 19.3 section 19.2.2

Figure 19.8 CAPWAP creates two tunnels between each LWAP and the WLC: a control tunnel and a data tunnel. The control tunnel uses UDP port 5246, and the data tunnel uses UDP port 5247.

Use the tunnel diagram to distinguish CAPWAP control traffic on UDP port 5246 from data traffic on UDP port 5247. section 19.2.2

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes

Defines DTLS through CAPWAP tunnel roles, encryption defaults, and UDP transport, but does not detail handshake or cipher internals.

Examples

Uses CAPWAP control and data tunnels between lightweight access points and wireless LAN controllers.

What it assumes

Assumes familiarity with wireless LAN controllers, lightweight access points, CAPWAP, tunnels, TLS, and UDP.

What you can do after

Evaluate CAPWAP security by identifying which tunnel is encrypted by default and when data-tunnel encryption is needed.

How it connects

Connects TLS, UDP, CAPWAP, LWAPs, WLCs, wireless clients, and control and data tunnels.

liveBookmanning.com

Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Related concepts

• TLSalternative to · Transport Layer Security (TLS) is a cryptographic protocol that protects network communications through confidentiality, integrity, and authentication of communicating endpoints.
• CAPWAP control tunnelused by · A CAPWAP control tunnel is an encrypted-by-default tunnel that carries configuration and management communications between a lightweight access point and a wireless LAN controller.

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.