Autonomous APs: self-contained wireless
An autonomous access point is a fully independent unit — it handles all wireless functions itself: beacon transmission, client authentication, client association, encryption, and forwarding. Each AP is configured individually via CLI or web GUI. This is manageable for one or two APs but becomes operationally painful with dozens or hundreds of devices.
Autonomous APs connect to the wired network as an access port (single VLAN) or with a trunk port for multiple SSIDs mapped to different VLANs. There is no central controller — each AP makes its own forwarding decisions. Roaming between autonomous APs requires the client to re-associate and potentially re-authenticate, which can cause noticeable connectivity gaps.
Autonomous APs are still used in small deployments where cost and simplicity matter more than centralized management. A SOHO router with built-in Wi-Fi is essentially an autonomous AP.
Lightweight APs and the split-MAC architecture
Lightweight APs (LAPs) split the wireless functions between the AP and a Wireless LAN Controller (WLC). This split-MAC architecture assigns time-sensitive functions (sending and receiving frames, encryption, beaconing) to the AP and management functions (authentication, association, roaming decisions, configuration) to the WLC.
This design enables centralized management: you configure SSIDs, security policies, QoS profiles, and RF settings once on the WLC, and it pushes those settings to all associated APs. Adding a new AP means it contacts the WLC, downloads its configuration, and starts serving clients — no individual AP configuration required.
Lightweight APs use the CAPWAP (Control and Provisioning of Wireless Access Points) protocol to communicate with the WLC. CAPWAP runs over UDP and creates two tunnels: a control tunnel (management traffic, encrypted with DTLS) and a data tunnel (client data frames forwarded to the WLC). In some deployments, the data tunnel is bypassed and the AP forwards client traffic locally (FlexConnect local switching).
WLC functions and AP discovery
The WLC is the central management point for the wireless network. It handles: AP configuration distribution, client authentication (802.1X/RADIUS integration), roaming between APs, RF management (transmit power, channel selection), QoS policy application, and WLAN security enforcement.
When a lightweight AP boots, it must discover and join a WLC. The discovery process uses several methods in order: (1) previously learned WLC IP in NVRAM, (2) local subnet broadcast, (3) DNS lookup for CISCO-CAPWAP-CONTROLLER, (4) DHCP option 43 (WLC IP delivered via DHCP), (5) OTAP (Over-the-Air Provisioning, deprecated). In production, DHCP option 43 or DNS are the most reliable methods.
Once the AP discovers the WLC, it forms the CAPWAP control tunnel, exchanges certificates for mutual authentication, receives its configuration, and starts serving clients. The AP registers to the WLC and appears in the WLC's AP inventory.
AP operational modes
Lightweight APs support multiple operational modes configurable from the WLC: Local mode is the default — the AP serves clients on its configured channels while also scanning other channels between beacon intervals for rogue AP detection. Monitor mode dedicates the AP to RF monitoring only — it scans all channels continuously for rogues, interference, and security threats, but serves no clients.
Sniffer mode configures the AP to capture all 802.11 frames on a channel and forward them to a packet capture tool (like Wireshark). FlexConnect (formerly Hybrid REAP) allows the AP to switch client traffic locally when the WLC connection is lost — important for branch offices over WAN links. Bridge mode connects two wired networks wirelessly (point-to-point or mesh). SE-Connect mode is used with Cisco CleanAir for spectrum analysis.