The CAPWAP Protocol Explained for CCNA
CAPWAP is an encapsulation protocol that connects Lightweight APs to a WLC, creating two UDP tunnels: one for control messages and one for client data.
What is CAPWAP?
**CAPWAP (Control and Provisioning of Wireless Access Points)** is a standard protocol (RFC 5415) that replaces the older Cisco proprietary LWAPP. It provides a secure tunnel between a Lightweight AP (LAP) and a Wireless LAN Controller (WLC), enabling the LAP to download its firmware and configuration.
Control and Data Tunnels
CAPWAP establishes two distinct UDP tunnels: - **CAPWAP Control (UDP 5246):** Transmits management and configuration data between the AP and WLC. This tunnel is **encrypted** (usually DTLS). - **CAPWAP Data (UDP 5247):** Encapsulates client traffic originating from the wireless network to the WLC. By default, this tunnel is **unencrypted**, though DTLS can be enabled on newer hardware.
AP Join Process
When an AP boots, it must find a WLC. The CAPWAP AP state machine involves: 1. **Discovery:** AP sends CAPWAP Discovery Requests (Layer 3 broadcast, DNS, or DHCP Option 43). 2. **Join:** AP selects a WLC and sends a Join Request. 3. **Image & Config:** AP downloads the correct OS image and configuration from the WLC. 4. **Run:** The AP enables its radios and starts serving clients.
❓ Frequently Asked Questions
What UDP ports does CAPWAP use?
CAPWAP uses UDP port 5246 for Control traffic and UDP port 5247 for Data traffic.
Is CAPWAP traffic encrypted?
CAPWAP Control traffic is always encrypted using DTLS. CAPWAP Data traffic is typically unencrypted by default but can be optionally encrypted.
How does an AP find a WLC?
An AP can discover a WLC via local broadcast, DHCP Option 43, or DNS resolution (CISCO-CAPWAP-CONTROLLER).