Modern Cisco wireless is controller-based: the access points are deliberately dumb, and a Wireless LAN Controller is the brain they all tunnel back to. This is how that architecture actually works — how a lightweight AP finds and joins its controller over CAPWAP, the Catalyst 9800 tag model that configures the whole fleet at once, and FlexConnect for branches.
The whole point of the lightweight architecture is configure the fleet, not the device. A lightweight AP holds no SSID, no key, no VLAN mapping of its own — it boots, finds a Wireless LAN Controller, builds a CAPWAP tunnel to it (a control channel plus, in the default mode, a data tunnel), and downloads everything. Swap a dead AP for a new one of the same model and it inherits the config automatically. One controller — a hardware Catalyst 9800, the virtual 9800-CL, or an embedded controller on a switch — drives dozens or hundreds of APs from one place.
Two things to internalise: how the AP discovers the WLC (it's not magic — DHCP option 43, DNS, or subnet broadcast), and the 9800's tag model, which is how you push config to groups of APs at once. Autonomous APs (IOS on the AP) still exist for one-off tiny sites, but they're the exception now — the lightweight model is what real Cisco wireless is. It's the direct analogue of MikroTik centralised CAPsMAN, versus a lone standalone AP.
01
Before any wireless works, the AP has to discover and join the WLC. This is the step that fails silently on a fresh deployment, so understand the discovery order.
A factory lightweight AP boots, gets an IP via DHCP, then hunts for a controller in this order: a DHCP option 43 value (the WLC's management IP, handed out by your DHCP server), a DNS lookup of CISCO-CAPWAP-CONTROLLER.<domain>, then a local subnet broadcast. Any one that resolves gives it the WLC address; it builds the CAPWAP tunnel, the WLC checks it's allowed to join, pushes an image if versions differ, then the config. Get discovery right and the AP "just appears" on the controller.
# On the DHCP server for the AP's VLAN, hand out the WLC mgmt IP in option 43. # On IOS DHCP, sub-option f1 + hex of the controller address(es): R1(config)# ip dhcp pool AP-VLAN R1(dhcp-config)# option 43 hex f104.0a0a.0002 # f1 04 = 1 WLC, 0a0a0002 = 10.10.0.2 # (MikroTik/other DHCP servers set the same option 43 payload.) # Then on the WLC, confirm the AP joined: WLC# show ap summary # the AP appears here once CAPWAP is up
Two failure modes dominate fresh joins. Discovery: the AP is on a different subnet from the WLC and there's no option 43 / DNS record, so it never learns the controller address — it just sits there. Fix the discovery path for the AP's VLAN. Time/certs: CAPWAP is authenticated with certificates, and if the AP's or WLC's clock is wildly wrong (or an AP's cert expired on very old gear), the join fails with a TLS error. Make sure NTP is right on the WLC. Check show ap join stats — it tells you exactly which phase failed.
02
On the controller you define reusable building blocks and bind them with tags stamped onto APs. Three objects get you on the air: a WLAN, a policy profile, and a policy tag.
# 1. WLAN: the SSID + security. WLC(config)# wlan CORP-WLAN 1 CORP WLC(config-wlan)# security wpa psk set-key ascii 0 S3cr3t-WiFi-Key WLC(config-wlan)# security wpa wpa2 ; no shutdown # 2. Policy profile: where clients land (VLAN) + behaviour. WLC(config)# wireless profile policy CORP-POLICY WLC(config-wireless-policy)# vlan 10 ; no shutdown # 3. Policy tag binds WLAN -> policy; stamp it on APs (or a whole group). WLC(config)# wireless tag policy CORP-TAG WLC(config-policy-tag)# wlan CORP-WLAN policy CORP-POLICY WLC(config)# ap 00aa.bbcc.ddee policy-tag CORP-TAG
The 9800 uses three tag types and together they're the fleet-management magic: the policy tag (which WLANs/policies an AP runs), the RF tag (radio/RF profile — power, channels), and the site tag (which controller/flex settings and AP-join profile). Define them once, stamp them on groups of APs, and a new AP that joins inherits everything the moment you apply its tags. It feels heavy for a single SSID but it's exactly why one engineer can run a 200-AP campus — the same "configure the fleet" idea as MikroTik CAPsMAN provisioning rules.
03
By default a lightweight AP tunnels all client data back to the WLC (central switching). For a branch with its WLC in a distant datacentre, that's a terrible path. FlexConnect lets the AP switch client traffic locally while still being centrally managed.
# In central switching, a guest at the branch hairpins to HQ's WLC and back # just to reach the branch printer. FlexConnect switches it locally instead. WLC(config)# wireless profile flex BRANCH-FLEX WLC(config-wireless-flex-profile)# native-vlan-id 1 WLC(config)# wireless profile policy CORP-POLICY WLC(config-wireless-policy)# no central switching # switch client data at the AP WLC(config-wireless-policy)# no central dhcp # Bind BRANCH-FLEX via the site tag on the branch APs. Bonus: FlexConnect # APs can keep serving known SSIDs even if the WAN to the WLC drops.
04
Map each SSID to its own VLAN — guest/staff/IoT segmented, exactly like wired — then confirm APs joined, WLANs are up, and clients land where they should.
WLC(config)# wlan GUEST-WLAN 2 GUEST WLC(config-wlan)# security wpa psk set-key ascii 0 Guest-Pass ; security wpa wpa2 ; no shutdown WLC(config)# wireless profile policy GUEST-POLICY WLC(config-wireless-policy)# vlan 20 ; no shutdown # isolated guest VLAN # --- Verify --- WLC# show ap summary # APs joined (CAPWAP up), model, uptime WLC# show ap join stats # first stop when an AP won't join WLC# show wireless client summary # clients, their WLAN + assigned VLAN
Takeaways
show ap join stats and the WLC's NTP.NOCTIS designs controller-based wireless on Cisco (Catalyst 9800) and MikroTik across Crete — clean CAPWAP joins, VLAN-segmented SSIDs, FlexConnect branches, and roaming that works — managed as one fleet.
Book a Discovery Call →