Wireless Networking

A wireless LAN (WLAN) carries LAN frames over radio. An access point (AP) links wireless stations to the wired network, called the distribution system. A home wireless router combines several jobs in one box; a business AP usually connects to a separate Ethernet switch.

Names, radios and service sets

The SSID is the network name, up to 32 bytes long. A basic service set (BSS) is one logical AP interface and its associated clients. Its BSSID is a 48-bit MAC-style address. One radio can offer several SSIDs, each with a separate BSSID. An extended service set (ESS) groups BSSs with the same SSID and connected LAN so clients can move between APs; ESSID means that shared name.

For example, 12 APs offering "Staff" on two radios provide 24 BSSIDs for that SSID. A client can keep seeing "Staff" while its BSSID changes during a roam. The name identifies the service; the BSSID identifies the particular BSS.

Joining happens in stages

1. Discover: listen for beacon frames or send probe requests. A common beacon interval is 100 time units, about 102.4 ms.
2. Authenticate at 802.11: WPA2 uses an open-system exchange; WPA3-Personal uses SAE.
3. Associate: request membership of a BSS and receive the AP's response.
4. Establish keys: Enterprise clients first complete 802.1X/EAP authentication; the four-way handshake then establishes working encryption keys.
5. Use IP: after secure access is ready, request DHCP settings and reach network services.

Seeing an SSID therefore tells you nothing yet about DHCP. A client can associate successfully but fail the later key exchange or address request.

Taking turns on the air

Wi-Fi shares a half-duplex channel. CSMA/CA means listening, waiting for a clear channel and using a random backoff before sending. Unicast delivery uses acknowledgments; missing acknowledgments lead to retries. Modern radios can acknowledge groups of frames together. OFDMA and MU-MIMO let an AP serve multiple clients in one transmission, but the channel's airtime remains shared.

A low-rate client takes longer to send the same data. A same-channel repeater must receive and retransmit it, roughly halving available throughput in a simple single-radio design. Signal bars show received level, not the airtime left for useful traffic.

Two clients may both hear an AP without hearing each other. These hidden nodes can transmit together and collide at the AP. RTS/CTS reserves airtime before data, reducing collisions while adding overhead.

The wired and security connections

The AP bridges 802.11 frames to Ethernet, usually mapping SSIDs to VLANs. Hiding an SSID does not secure this link: discovery and association traffic can reveal the name. MAC filtering is also weak because addresses are visible and changeable; private randomized addresses can break address lists.

A Wi-Fi generation describes a set of radio capabilities. A frequency band describes where the radio operates. Choosing a newer AP helps only when clients, channels and the wired network can use its features.

Match names to standards

The IEEE develops 802.11 standards; the Wi-Fi Alliance certifies interoperability and supplies generation names.

Wi-Fi 6E means 802.11ax extended into 6 GHz. It is not a separate IEEE amendment. The older a, b and g standards have no official numbered generation names.

How the rate increases

MIMO sends separate spatial streams using multiple antenna chains. The usable stream count is limited by both ends: a two-stream laptop cannot receive four streams just because the AP supports them. Wider channels carry more symbols in parallel but take more spectrum. QAM places more bits in each symbol: 64-QAM with n, 256-QAM with ac, 1024-QAM with ax and 4096-QAM with be. Denser modulation needs a cleaner signal, so it is most useful close to an AP.

Wi-Fi 6 adds OFDMA, dividing a channel into resource units for several clients, and bidirectional MU-MIMO, sending separate streams to different clients. Target wake time schedules wake periods for battery devices. Wi-Fi 7 adds multi-link operation (MLO) so compatible devices can use multiple links, including links in different bands. Its combined rate depends on the links available.

PHY rate is not application throughput

A two-stream Wi-Fi 6 laptop on an 80 MHz channel can show a 1,201 Mbps PHY rate. Headers, acknowledgments, contention and other users all consume part of that capacity. Near the AP on a quiet channel, application throughput commonly reaches about half to two-thirds of that rate; distance, retries and load reduce it further.

A Wi-Fi 5 laptop joining a Wi-Fi 7 AP still uses a Wi-Fi 5 link on 5 GHz. A b or g client needs 2.4 GHz. A Wi-Fi 6 client needs 6E capability to use 6 GHz. Check the actual adapter and driver, not just the product's age.

Check features beyond the generation label

Other amendments identify particular functions: 802.11e provides QoS/WMM; h adds DFS/TPC; i underpins WPA2; w protects management frames; k supplies neighbor reports; v provides BSS transition suggestions; r shortens roaming key setup; s defines mesh operation. IEEE 802.11bn is under development with reliability as its focus.

An AP upgrade also needs enough PoE and uplink bandwidth. A 1 Gbps switch port can limit aggregate traffic from a fast radio; some APs need 2.5 or 5 Gbps ports. Disable obsolete low data rates only after checking that required clients and coverage still work.

The best band depends on where the client works, what its radio supports and how crowded the air is. A farther-reaching signal can be useful for a sensor while a smaller, cleaner cell is better for a busy office.

Compare the available spectrum

The 2.4 GHz allocation is 2.400–2.4835 GHz. The 5 GHz band contains several separate usable ranges; the equipment's country setting determines what is available. In the US, indoor rules also extend into 5.850–5.895 GHz. Do not treat a memorized channel count as the installation's allowed list.

The US 6 GHz allocation is 5.925–7.125 GHz, totaling 1,200 MHz. The EU allocation is 5.945–6.425 GHz, totaling 480 MHz. These provide 59 and 24 ordinary 20 MHz channels respectively. Some countries have not authorized 6 GHz Wi-Fi.

Why reach differs

Wavelength follows $\lambda =c\mathrm{/}f$: about 12.3 cm at 2.437 GHz, 5.5 cm at 5.5 GHz and 4.6 cm at 6.5 GHz. For equal antenna gains and distance, higher frequency produces more free-space loss. Most walls also attenuate higher frequencies more strongly. That makes 2.4 GHz useful through more obstacles, while 5 and 6 GHz usually need closer AP spacing.

Frequency alone does not determine speed. Wider usable channels and less contention often make 5 or 6 GHz faster. Near a cell edge, however, a strong 2.4 GHz link may outperform a weak 5 GHz link. Survey both directions using the actual client class.

Keep scarce airtime available

Bluetooth, microwave ovens, neighboring WLANs and many IoT radios share 2.4 GHz. Keep 20 MHz channels there and reserve capacity for equipment that cannot move. In many business networks, 5 GHz carries most staff traffic because client support is broad and more channels are available.

Only Wi-Fi 6E and Wi-Fi 7 clients can use 6 GHz. A tri-band AP can offer one SSID across all three bands, but the client still needs the correct radio, operating-system and driver support. In 6 GHz, use WPA3 or Enhanced Open with protected management frames; WPA2 and unencrypted open operation are not allowed. Clients discover networks through information advertised on lower bands or through preferred scanning channels.

Apply the choice to a mixed site

A warehouse has 2.4 GHz-only scanners and Wi-Fi 6E office laptops. Keep a 2.4 GHz service for the scanners. Offer staff service on 5 and 6 GHz and verify that those cells cover the office at the required signal and SNR.

Band steering encourages capable clients onto a higher band, for example by delaying 2.4 GHz probe responses. The client makes the final choice. Aggressive steering at the edge of 5 GHz coverage can delay a connection, so confirm results from client statistics. Wi-Fi 7 MLO can maintain more than one supported link, but it does not give a legacy client a new band.

Channel numbers name center frequencies, not slices only one number wide. The occupied channel width determines whether neighboring APs can use the air independently.

Read a channel number

In 2.4 GHz, the center frequency in MHz is $2407+5n$, where n is the channel number. Channels 1, 6 and 11 have centers at 2412, 2437 and 2462 MHz. Numbers step by 5 MHz, but a normal channel occupies about 20 MHz, or 22 MHz for 802.11b. That is why channels 1 and 3 overlap.

Use 1, 6 and 11 at 20 MHz for the common 2.4 GHz plan. These centers are 25 MHz apart. Partly overlapping channels create adjacent-channel interference: receivers cannot reliably decode the unwanted transmission and coordinate access. Same-channel neighbors can normally hear and take turns, although that still reduces capacity.

In 5 GHz, the center in MHz is $5000+5n$. Channel 36 is 5180 MHz. Ordinary 20 MHz channels step by four numbers: 36, 40, 44 and 48 are four different channels.

Bond channels deliberately

Bonding roughly doubles the peak rate with each doubling of width. It also roughly halves the number of independent channels. Wider reception collects more noise: doubling width adds about 3 dB to the noise floor, so 80 MHz collects about 6 dB more noise than 20 MHz under otherwise equal conditions.

For an illustrative allowed list of 36–64 and 100–140, there are 19 channels at 20 MHz. Standard bonded blocks provide nine at 40 MHz, leaving channel 140 unused, or four at 80 MHz: 36–48, 52–64, 100–112 and 116–128. Twelve mutually audible APs would reuse each 80 MHz block three times. A 40 MHz plan gives them more separate airtime.

Choose a width for the site

Use 20 MHz in 2.4 GHz. In dense 5 GHz layouts, start with 20 or 40 MHz; 40 or 80 MHz can suit less crowded sites with sufficient channels. In 6 GHz, 80 MHz or wider can be useful, but count the local channels before choosing. A speed setting that looks good for one laptop may reduce total capacity across a hall.

The 6 GHz center formula in MHz is $5950+5n$. Ordinary 20 MHz channels are 1, 5, 9 and so on through 233 in the US. Preferred scanning channels (PSCs) occur every 80 MHz: 5, 21, 37 and so on through 229. The EU's lower band has six: 5, 21, 37, 53, 69 and 85. Using a PSC as the primary channel helps discovery.

Reuse in three dimensions

Assign different channels to APs that hear each other, including APs above and below. Where too many 2.4 GHz radios share the same three channels, disable surplus radios or use them for monitoring. Controller or cloud radio management can assign channels and power automatically; validate its choices with measurements, including neighboring networks that the organization cannot control.

License-exempt spectrum still has rules. Set an AP's regulatory domain to its installation country so the radio offers the correct channels, power and indoor or outdoor modes. A different country setting is not a valid way to unlock channels.

Channels and power are regional

US 2.4 GHz equipment normally uses channels 1–11; European equipment can use 1–13. Japan permits channel 14 for 802.11b only. The 1, 6, 11 plan also helps visiting clients that cannot use channels 12 or 13.

For ordinary US 2.4 GHz point-to-multipoint operation, the familiar limits are up to 1 W conducted power and 36 dBm EIRP with the applicable antenna restrictions. The EU/ETSI example is 20 dBm EIRP, or 100 mW. EIRP includes antenna gain: replacing an antenna can require reducing transmitter power. Select the correct antenna model in the AP settings.

Protect radar users

802.11h supplies dynamic frequency selection (DFS) and transmit power control (TPC) for radar-shared 5 GHz spectrum. DFS channels require a listening period before use. The FCC channel-availability check is normally 60 seconds; European weather-radar channels 120–128 can require 10 minutes.

If radar is detected, the AP must leave the channel within 10 seconds and avoid it for at least 30 minutes. A restart can therefore delay service, and a radar event can interrupt clients while the AP changes channel. TPC allows power reduction. Check client support and recurring radar events before relying on DFS capacity.

Separate 6 GHz device classes

US standard-power operation uses U-NII-5 and U-NII-7. Automated frequency coordination (AFC) uses device location to protect fixed microwave links and determines permitted operation. LPI equipment is for indoor use. VLP supports low-power portable operation indoors and outdoors, subject to the class's operating restrictions; the FCC expanded VLP across the full US 6 GHz band in 2025. The EU examples apply only to 5.945–6.425 GHz; EU LPI excludes road vehicles and VLP excludes drones.

Apply both power limits

A power spectral density (PSD) limit caps power per MHz. Total power also has a separate ceiling:

For a US LPI AP, 20 MHz permits about 5 + 13 = 18 dBm, while 80 MHz permits about 5 + 19 = 24 dBm. At 320 MHz, the result reaches the 30 dBm total cap. For EU LPI, 20 MHz already gives about 10 + 13 = 23 dBm, so wider channels do not raise total power beyond 23 dBm.

Use the current regulator and vendor country-support information when installing equipment. The legal maximum is a ceiling; set working power to meet coverage and capacity needs while preserving the client's return path.

A radio measurement becomes useful when you know what it measures. Power, a power change and signal quality use related decibel units, but they answer different questions.

Convert power without mixing units

dBm is power relative to 1 mW:

The reverse conversion is $P_{\text{mW}}={10}^{P_{\text{dBm}}\mathrm{/}10}$. Useful anchors are 1 mW = 0 dBm, 10 mW = 10 dBm, 100 mW = 20 dBm and 1 W = 30 dBm.

A dB value is a ratio: +3 dB approximately doubles power; −3 dB halves it; +10 dB multiplies it by ten. Reducing 20 dBm by 3 dB gives about 17 dBm, or 50 mW. Reducing it by 10 dB gives 10 dBm, or 10 mW. Add gains and losses in dB to a power in dBm. To combine two power amounts, first add their milliwatts: two 20 dBm powers total 200 mW, about 23 dBm, not 40 dBm.

Compare signal with noise

Received signal strength is often displayed as RSSI in negative dBm. Closer to zero is stronger: −45 dBm is stronger than −75 dBm. Some vendors instead report RSSI as an index or percentage, so compare like measurements.

The noise floor is background RF energy, often around −90 to −95 dBm on a quiet 20 MHz channel. Signal-to-noise ratio (SNR) is the difference:

A −65 dBm signal and −92 dBm noise give 27 dB SNR. A strong signal can still have poor SNR if the noise is also strong. Common design targets are at least 20 dB SNR for data and 25 dB for voice, with about −70 dBm signal for data and −67 dBm for voice/video. They are planning targets to validate with the applications and clients; links near −80 dBm are often unreliable.

Estimate the path loss

For unobstructed free space:

Use kilometers and MHz in this form. At 2,437 MHz, 10 m gives about 60.2 dB loss and 20 m about 66.2 dB. Doubling distance adds about 6 dB. At 5,500 MHz, the 10 m path loses about 67.2 dB.

Walls add loss: drywall may cost about 3 dB, clear glass 2–4 dB, brick 6–10 dB and concrete 10–20 dB. Coated glass and metal can block much more. Measure the actual building. Absorption removes energy; reflection bounces it; refraction bends it between materials; diffraction bends it around edges; scattering spreads it. Multiple paths can cause fading, while MIMO can use suitable path differences for spatial streams.

Check both directions

A link budget adds transmit power and antenna gains, then subtracts losses. With 20 dBm EIRP, 80 dB path loss and a 3 dBi receiving antenna, received power is −57 dBm. A phone sending 15 dBm EIRP back over the same path to a 4 dBi AP antenna arrives at −61 dBm. Raising only AP power improves the downlink; it leaves this return path unchanged.

An antenna directs radio energy into a pattern. Its gain improves some directions by reducing energy in others; it does not create extra transmitter power.

Read gain and beamwidth

dBi compares gain with an ideal antenna that radiates equally in every direction. dBd compares it with a dipole; 0 dBd equals 2.15 dBi. A directional antenna's beamwidth is the angle between the points 3 dB below its peak. More gain generally means a narrower beam.

A higher-gain omni flattens its vertical pattern. It can reach farther horizontally yet leave weak coverage below a high mounting point. Ceiling APs have model-specific patterns, often aimed down toward users, so use the mounting instructions and radiation plots for that AP.

An open office often suits ceiling APs. A long aisle may suit a panel aimed along it. In a large seating area, aimed cells help divide users among channels. A building-to-building link needs directional antennas at both ends.

Calculate the radiated power

Use dBm for transmitter power, dB for loss and dBi for antenna gain. With 17 dBm at the radio, 2 dB cable loss and 6 dBi gain, EIRP is 21 dBm, about 126 mW. If the regional ceiling were 20 dBm, reduce transmitter power to 16 dBm. Raising gain by 1 dB without reducing power would exceed that ceiling by another 1 dB.

The antenna also improves reception in its favored direction. That helps a return link in a way that increasing AP transmitter power alone cannot.

Match polarization and radio chains

Polarization is the direction of the electric field. Match both ends of a point-to-point link, such as vertical to vertical. Crossed polarizations can lose 20 dB or more. Indoor reflections mix polarization, but correct antennas and mounting still matter.

A 4×4:4 radio has four transmit chains, four receive chains and up to four spatial streams. Fit every required connector with the specified matching antennas. Transmit beamforming adjusts the phases of signals so they reinforce each other toward a client; the antenna does not physically turn.

Clear space around an outdoor path

Visible line of sight is not enough for a reliable point-to-point link. Objects near the direct line can intrude into the first Fresnel zone, where reflected paths affect the received signal. Keep at least 60% of that zone clear.

At the midpoint, its radius in meters is approximately:

For 1 km at 5.5 GHz, the radius is about 3.7 m. Sixty percent is about 2.2 m, so trees and roof edges need that clearance around the direct line at the midpoint. Check the rest of the route too; the zone narrows toward each endpoint.

Coverage asks whether a device can exchange frames at a location. Capacity asks whether all the active devices can get enough airtime there. A useful WLAN design answers both questions before choosing AP locations.

Turn requirements into targets

List service areas, client types, device counts and applications. A scanner needs different service from a voice handset. Design the edge of a cell around the weakest important client, including its transmit power and stream count. A survey laptop with a better antenna can make a poor phone location look acceptable.

Typical voice/video targets are at least −67 dBm and 25 dB SNR; general data may use about −70 dBm. Measure secondary coverage too: a second AP at the target level supports roaming and resilience. About 15–20% overlap is a starting rule of thumb, but the signal measurements and roaming tests decide whether a particular layout works.

Work out active demand

A 150-seat lecture hall has two devices per person, with 60% active at once. First calculate 150 × 2 = 300 devices. Then 300 × 0.6 = 180 active devices. At a planning allowance of 30 active devices per 5 GHz radio, 180 ÷ 30 = 6 radios are needed. At 2 Mbps per active device, aggregate demand is 180 × 2 = 360 Mbps.

The allowance of 30 is a planning input, not a guaranteed AP limit. Check whether the radios can carry the application demand at the expected data rates. Give those radios suitable separate channels; six mutually audible radios on one channel still share that channel's airtime.

Make cells fit the site

In dense areas, moderate power and narrower channels make smaller cells that can reuse channels. Match AP power to client capability. A phone around 15 dBm may hear a maximum-power AP from a location where its own transmissions cannot reach back reliably.

One powerful AP also gives every user one pool of airtime and creates a single failure point. Several carefully placed APs distribute demand and provide alternate coverage. Adding APs without a channel and power plan can instead increase contention.

Mount APs with a clear view of users, in the manufacturer's orientation. Avoid metal cabinets, ducts, pillars and metal ceiling tiles between the AP and users. Consider floors above and below: stagger locations and channels where cells pass through floor openings or lightweight construction. In a warehouse, consider full shelves as well as an empty building.

Provide the wired capacity and power

Check the Ethernet channel stays within the 100 m copper limit and that the switch port is fast enough. A high-capacity AP may need a multigigabit uplink.

Delivered power at the AP is lower because of cable loss. Check the AP's required PoE class and the switch's total budget. An underpowered AP may disable radios or streams instead of simply turning off. Outdoor installations also need appropriate weather protection, grounding and lightning protection.

Record each AP's location, antenna, power, channel and cabling plan. Validate the installed design against the same application and client requirements used to size it.

A site survey turns a WLAN plan into evidence about a building. Choose the survey method for the question you need answered, then record measurements at known locations.

Use the right method

A predictive model needs wall materials and attenuation values. A wrong floor-plan scale or missing wall can shift the predicted cell boundaries. Check the building on a walk-through: note mounting points, cable routes, ceiling heights, metal shelving and unusual materials. An AP-on-a-stick survey is especially useful where the structure is difficult to model.

A passive survey reveals the organization's APs and nearby networks without joining them. An active survey tests the actual service, including retries and delays. A spectrum analyzer can reveal microwave or video-sender energy that an ordinary Wi-Fi adapter cannot decode. These methods answer different questions and can be used together.

Collect measurements that match the users

Calibrate the plan with a known distance before walking. Measure the whole service area, including corners, stairs and expected roaming routes. Keep measurements at the height devices are used and walk steadily so samples match their positions on the map. Record every band in use.

Use a survey adapter similar to the important clients, or apply a justified measurement offset. A high-performance laptop alone may overstate a handheld scanner's coverage. Where stock, people or movable walls change conditions, include the expected busy arrangement in the survey plan.

Read the legend before the colors

A heat map colors a floor plan by one measurement. It may show signal, SNR, data rate, secondary coverage or the count of audible same-channel APs. A green signal map cannot tell you that channel contention is low unless that is what its legend measures.

Suppose the meeting-room target is −67 dBm and measurements show −75 dBm. The shortfall is 8 dB. Check whether a new wall, mounting position or antenna pattern explains it. Move or add an AP, or reshape the cell with the correct antenna, then repeat the client test. Raising AP power alone leaves the client's return transmitter unchanged.

Validate the installation

After mounting and configuring APs, run a validation survey against the original targets. Test applications while walking between cells, not just while standing under an AP. Keep a report with requirements, AP positions and heights, antennas, channels, power settings and results.

Repeat validation after major changes, such as new shelving, walls or neighboring tenants. A quick Wi-Fi analyzer is useful for checking SSID, BSSID, channel and signal, but a full survey adds location-based evidence across the entire service area.

WLAN architecture separates two questions: who manages the AP, and where client frames go. A centrally managed AP can still send client traffic directly onto a local VLAN.

Compare the management models

Autonomous APs suit a small site but become harder to keep consistent as the number grows. A controller or cloud dashboard applies shared security, firmware and radio settings across many APs.

In a split-MAC controller design, the AP does time-sensitive radio work: beacons, acknowledgments, queuing and over-the-air encryption. The controller manages policies, roaming, security and radio resource management. The exact split depends on the platform.

Follow an AP to its controller

A lightweight AP can discover a WLC through DHCP option 43, a configured address, local broadcast or DNS such as CISCO-CAPWAP-CONTROLLER. It builds CAPWAP tunnels across the IP network. Control uses UDP 5246 with DTLS encryption; data uses UDP 5247 with optional tunnel encryption. Radio encryption and data-tunnel encryption are separate protections.

Because CAPWAP is routed, the AP and WLC can be on different subnets. In central switching, client frames travel through the tunnel to the controller. The client VLANs therefore leave the network at the controller, not at the AP switch port.

Keep branch traffic local when needed

Cisco FlexConnect can bridge client traffic onto branch VLANs while retaining central management. Local switching can preserve local access when the WAN fails, but authentication must also remain available: a locally switched SSID that requires an unreachable central RADIUS server may not admit new clients.

A controller can be centralized in a data center, embedded in an AP or switch, or run as a virtual machine in a cloud. This last option is a cloud-hosted controller; it is distinct from dashboard management. In a typical cloud-managed WLAN, the cloud handles configuration and monitoring while user frames stay local. APs usually retain their last configuration during a cloud outage; check product behavior and licensing terms when choosing a system.

Recognize Cisco AP modes

Local mode serves clients through the WLC and briefly scans other channels. Monitor mode scans for security and location work without serving clients. Sniffer mode sends captured frames from a channel to an analyzer. Rogue detector watches wired MAC information. SE-Connect dedicates the AP to spectrum work. Bridge/Mesh provides wireless backhaul, and Flex+Bridge combines mesh and FlexConnect functions. Mode availability depends on the AP and controller platform.

A campus may choose controllers with backup WLCs for central policies and voice roaming. A chain of branches may choose cloud management or FlexConnect to avoid a controller at each site. A local-mode AP depends on controller contact to serve clients, so plan controller resilience as well as AP coverage.

The AP's traffic path determines its switch-port configuration. First decide whether client frames are tunneled to a controller or leave the AP directly onto VLANs.

Match the port to the forwarding mode

A local-mode lightweight AP with centrally switched traffic normally needs an access port in its management VLAN. Its client frames are inside CAPWAP packets, so the physical AP port does not need each client VLAN.

A locally switching AP needs a trunk when it carries multiple VLANs. Suppose AP management uses VLAN 10, "Staff" uses VLAN 20 and "Guest" uses VLAN 30. Allow all three VLANs on the AP trunk. Match the AP and switch on whether VLAN 10 is native and untagged or explicitly tagged.

If VLAN 30 is absent from that trunk, guests may still associate and complete radio security. Their DHCP broadcasts cannot reach the right network, so they receive no lease. This is a wired forwarding fault even though the symptom appears on Wi-Fi.

Identify the controller connections

Cisco AireOS terminology distinguishes the service port for out-of-band management, distribution system ports for AP, management and client traffic, a redundancy port between a high-availability pair and a console port for initial setup. Controller interfaces map WLANs to client VLANs. Distribution ports commonly connect to switch trunks; the service port is not a substitute client-data connection.

Link aggregation (LAG) combines distribution links for aggregate bandwidth and resilience. One flow normally stays on one member, so a bundle does not multiply the speed of every individual flow. AireOS uses static EtherChannel with mode on; newer controllers such as Catalyst 9800 can use LACP. Match the controller and switch's supported aggregation mode.

Check power before higher layers

Check the AP's required PoE class, each switch port's capability and the total switch budget. Twenty-four AP ports budgeted at 30 W each require 720 W of switch-side PoE capacity. A switch with enough physical ports may still have too little power. Underpowered APs can lose radio features, producing a capacity problem that resembles bad RF design.

Protect management and allow dependencies

Use the console for initial local setup, SSH for remote CLI and HTTPS for web management. Telnet and HTTP expose sensitive management traffic. Central device administration commonly uses TACACS+ on TCP 49; WLAN access commonly uses RADIUS on UDP 1812 for authentication and 1813 for accounting. Traditional RADIUS does not encrypt the whole packet; the EAP method separately protects credentials during an Enterprise login.

Allow required traffic through intervening ACLs: CAPWAP UDP 5246/5247, DHCP UDP 67/68 and DNS port 53, plus the chosen authentication services.

For an AP that cannot join, check power and link, management VLAN, DHCP address, controller discovery, routing, CAPWAP reachability, and then country settings, certificates and time. Each check establishes a dependency needed by the next stage.

A controller WLAN profile ties the visible network name to its VLAN, radio bands and security policy. Create it while disabled, check the settings together, then enable it and test from a client.

Create the service and security settings

A profile has an internal name, a WLAN ID, an SSID, an enabled status and a client interface or VLAN mapping. The profile name helps administrators; clients see the SSID. Choose which bands advertise the service.

For a WPA2-Personal example, create WLAN ID 2, profile and SSID "Office", mapped to VLAN 20. Select WPA2 with AES-CCMP, choose PSK key management and enter a strong 8–63 character passphrase. Leave TKIP disabled. Apply the configuration and enable the WLAN. A test client should appear on "Office" with a VLAN 20 address, gateway and DNS settings, and should reach an allowed service.

WPA3-Personal instead selects SAE and requires protected management frames. Enterprise profiles select 802.1X and the correct RADIUS servers. A captive portal is a separate Layer 3 web-authentication setting; it does not replace radio encryption.

Give traffic suitable treatment

WMM provides the access categories voice, video, best effort and background. Cisco controller profiles call these Platinum, Gold, Silver and Bronze respectively, with Silver the default best-effort profile. WMM is needed for modern high data rates. QoS gives traffic suitable priority during contention; it cannot create extra airtime or fix missing coverage.

Advanced settings include session timeout, client exclusion after repeated failures, client limits, DHCP-required mode, peer-to-peer blocking, band steering, load balancing and allowed data rates. Change them for a measured requirement. For example, DHCP-required mode can block intentionally static clients; a short session timeout can make reauthentication failures appear as periodic disconnections.

Make roaming consistent

For simple same-subnet roaming, neighboring APs offer the same SSID, security and VLAN. The client decides when to move. 802.11k supplies neighbor information; 802.11v suggests a better BSS; 802.11r shortens key setup for a fast transition. They help the client find and use a better AP, but cannot repair a coverage hole.

Some older clients fail when fast transition is required. Test the client inventory and use supported adaptive settings or a separate compatibility service where needed. With different client subnets, controller mobility support is needed to preserve connectivity as a roaming device keeps its address. The same SSID alone does not provide that support.

Keep SSID overhead under control

In traditional operation, each SSID has its own BSS and periodic beacons, often at a low mandatory data rate. Unused SSIDs still spend airtime. Multiple BSSID operation can advertise several BSSs in one beacon, especially in 6 GHz, but more SSIDs still add management work and configuration.

A common guideline is three or four SSIDs per radio. For many user groups, one Enterprise SSID with RADIUS-assigned VLANs scales better than a separate name for every team. Verify the assigned VLAN and access policy with a representative account from each group.

Radio frames can be received beyond a room's walls. Wireless security needs to control access, protect the contents of frames and detect alteration. Different security modes provide these protections in different ways.

Recognize obsolete and current modes

WPA2, based on 802.11i, arrived in 2004 and became required for Wi-Fi certification in 2006. WEP and TKIP also prevent modern 802.11n-and-later high rates. Choosing obsolete encryption for one old device can therefore weaken security and performance.

Understand the Personal-mode difference

WPA2-Personal derives key material from the shared passphrase and SSID. Captured handshake information allows offline password guesses. A long random passphrase reduces this risk. Someone who knows that passphrase and captures another client's handshake can also derive that client's keys; the existence of per-client working keys does not provide privacy from other password holders.

WPA3-Personal uses simultaneous authentication of equals (SAE). Password guessing requires live interaction, and passive capture does not permit the same offline guessing process. It also provides forward secrecy: revealing the password later does not unlock previously recorded sessions. Users may still share one password, so SAE does not create individual user accounts.

Protect management frames

Protected management frames (PMF) protect selected management traffic, including deauthentication and disassociation, against forgery after protection is established. WPA3 requires PMF. This does not encrypt every management frame; discovery still has to work before a client has keys.

WPA3-Enterprise uses 802.1X and offers an optional 192-bit security mode with stronger suites, such as GCMP-256. WPA2-Personal and WPA3-Personal commonly both use CCMP-128 for data, so WPA3's gains are not simply a longer data key. Newer suites, including Wi-Fi 7 configurations, can use GCMP-256.

Migrate without overstating protection

Transition mode accepts WPA2-PSK and WPA3-SAE clients on one SSID with the same passphrase. Legacy clients retain WPA2's weaknesses. Use it on 2.4 or 5 GHz during migration, then move to WPA3-only when the inventory supports it. Six GHz does not allow WPA2 or transition mode and requires PMF.

Enhanced Open, based on OWE, encrypts each client's radio traffic without a password. It protects against passive listening, but it does not authenticate the user or prove that the AP is the intended one. It is useful for public networks whose access policy is handled separately.

Disable WPS and avoid relying on hidden SSIDs or MAC lists. If an IoT device supports only WPA2, give it a separate VLAN with only its needed access. This preserves compatibility without granting that device broad access to the business network.

Personal security uses a shared password. Enterprise security checks an identity through 802.1X, allowing an organization to revoke one person's access without changing every other device.

Choose the access model

WPA2-Personal derives a PSK from a password; WPA3-Personal uses that password through SAE. Both are simple to administer at small sites, but a common password spreads and is hard to revoke for just one person. Some vendors offer per-device keys to reduce that problem.

802.1X has three roles: the supplicant on the client, the authenticator on the AP or controller and the authentication server, usually RADIUS connected to a directory. The authenticator controls access and relays authentication messages; it is not the database of every user's password.

Follow the exchange

1. The client associates with the Enterprise WLAN.
2. The supplicant and authenticator exchange EAP over LAN, or EAPOL, across the wireless link.
3. The authenticator carries the EAP conversation to the RADIUS server in Access-Request messages, normally on UDP 1812.
4. The client and server complete the selected EAP method. The server returns Access-Accept when the identity is accepted and may supply a VLAN or role.
5. Key material supports the four-way handshake between client and AP. Encrypted access starts, followed by DHCP.

RADIUS accounting commonly uses UDP 1813 to record sessions. Per-user accounts let administrators disable one login, investigate activity and apply different access roles on one SSID.

Select an EAP method

EAP-TLS is a strong common choice for managed devices because each receives a client certificate. PEAP and EAP-TTLS can suit existing account systems but still depend on checking the server certificate. Validate both its trusted certificate authority and expected server name. A familiar SSID is not evidence that a server is genuine.

Make the server and controller agree

Configure the RADIUS server address, ports and shared secret on the authenticator. Register that AP or controller as a RADIUS client on the server with the matching secret. This infrastructure secret is separate from an employee's password and from a Personal WLAN passphrase.

An expired server certificate can affect every validating client. A wrong clock on one laptop affects that laptop's certificate checks. Failed directory authorization differs again from a server that never receives requests. Compare client, controller and RADIUS logs to find the failed exchange.

802.1X authenticates access; WPA2 or WPA3 supplies radio encryption using the established keys. The word Enterprise names that authentication model. Services such as eduroam use this model to let participating users authenticate through their home institutions while visiting another site.

Guest Wi-Fi needs separate decisions about access, privacy and reachability. A login page handles access policy; encryption protects the radio link; VLANs and firewall rules control where guests can go.

Build the boundary

Map the guest SSID to a separate VLAN, or tunnel guest traffic to an anchor controller in a DMZ. Apply firewall rules that block internal networks while allowing the intended internet access and required supporting services. A VLAN separates broadcast domains; an ACL or firewall enforces which routed destinations are reachable.

Turn on client isolation to stop guest devices reaching one another. This serves a different purpose from blocking internal subnets. Rate limits prevent a few users from consuming all the internet connection, while suitable DHCP leases help avoid address exhaustion as visitors leave and new ones arrive.

Understand what the portal does

A captive portal is a web page that appears before ordinary access is granted. It may request terms acceptance, a voucher, a login or sponsor approval. Operating systems often detect the restricted network and launch the page. Controllers commonly call it Layer 3 web authentication.

Completing this page does not turn an open radio link into an encrypted one. HTTPS protects the application session to the website, but it is a separate layer from Wi-Fi encryption. Choose the WLAN's radio security explicitly.

Work through a guest design

A hotel offers "Hotel-Guest" on VLAN 50. Enhanced Open encrypts radio traffic, and a portal checks room number and surname for access. Client isolation blocks guest-to-guest traffic. Firewall policy blocks the hotel's internal ranges, such as 10.0.0.0/8, while allowing intended internet service.

A 10 Mbps per-device limit controls demand. A one-day session timeout and a suitably short DHCP lease release access and addresses as guests depart. Test from two guest devices and from a staff device: guests should reach the internet after portal completion, fail to reach internal systems, and fail to reach one another. Check these as separate tests so one successful result does not hide another missing control.

Apply the same boundary principle to IoT and BYOD devices. Put them in an appropriate VLAN or role and permit only the destinations they need. A camera that uploads to one service does not need access to payroll servers.

A user who reports slow Wi-Fi may have a strong signal and almost no free airtime. Collect measurements before adjusting channels or power so the fix addresses the actual limit.

Compare the main symptoms

Record signal level, noise floor, SNR, channel utilization, retry rate and client data rate. Channel utilization measures how much time the channel is busy; retry rate measures how much traffic must be sent again. Compare affected and unaffected areas and the times when users see the fault.

These are diagnostic clues. Confirm the cause with matching measurements before making a permanent change.

Separate CCI from ACI

With co-channel interference (CCI), audible stations on the same channel normally take turns. The practical cost is contention and reduced available airtime. Narrower channels, smaller cells, a wider channel pool and disabling surplus 2.4 GHz radios can improve reuse. Adding APs on the same audible channel can make the problem worse.

Adjacent-channel interference (ACI) comes from partly overlapping channels, such as 1 and 4 in 2.4 GHz, or from very strong nearby-channel signals. Frames are corrupted because receivers cannot coordinate with the unwanted signal. Use 20 MHz channels 1, 6 and 11, reduce excessive power and separate nearby radios appropriately.

Find non-Wi-Fi energy

A Wi-Fi analyzer reports decodable WLANs; a spectrum analyzer sees other RF energy too. Microwave ovens can produce bursts near 2.45 GHz, Bluetooth hops across 2.4 GHz, and wireless video or other IoT equipment can occupy channels. Match the energy pattern to when the suspected source operates. Move, replace or remove the source, or move clients to an unaffected channel or band.

For lunchtime slowness near a kitchen, compare measurements with the oven running and stopped. If upper-band bursts match the problem, move dual-band clients to 5 GHz and test a cleaner 2.4 GHz channel for remaining devices.

Fix coverage and special cases

New stock, walls, metalwork, poor mounting or incorrect antennas can create weak areas. Survey the affected route and move, add or re-aim APs. Raising only AP power leaves the client's uplink unchanged and can spread contention farther.

High retries with good AP signal may indicate hidden nodes: clients on opposite sides of the cell cannot hear one another. RTS/CTS, smaller cells or fewer clients per radio can help. For abrupt channel changes, inspect DFS logs and remove repeatedly affected channels from the site's permitted plan while preserving regulatory protections.

Start with the scope: one device, one location, one SSID or the whole WLAN. Ask when the failure started and what changed, then follow the client from discovery to application access.

Find the first stage that fails

1. SSID visibility: check the client's supported bands, driver, enabled radio, advertised WLAN and coverage. A 2.4 GHz-only scanner cannot see a 5/6 GHz-only service.
2. Authentication and association: check security compatibility. A WPA2-only client cannot join WPA3-only service; unsupported PMF or fast-transition requirements can also block joining.
3. Key establishment: a wrong WPA2 password usually fails the four-way handshake. A wrong WPA3-Personal password fails SAE earlier, before association.
4. Addressing: check the client VLAN, DHCP scope and relay.
5. Application access: check gateway, DNS, firewall policy and portal completion.

For Enterprise authentication, examine RADIUS reachability, the shared secret, user authorization and certificates. An expired server certificate affects all clients that validate it; a bad client clock can affect only that device. Repeated failed attempts can trigger a temporary exclusion, so check the controller's client state too.

Use the address as evidence

An IPv4 address in 169.254.0.0/16 commonly indicates that automatic link-local addressing followed a failed DHCP attempt. Association and encryption can both be working. Check the SSID-to-VLAN mapping, allowed VLANs on a local-switching trunk, relay configuration and available DHCP leases.

If the client has the intended address, test its gateway first. Compare access by IP address with access by name to investigate DNS. Check whether the portal still needs completion. Changing the wireless password does not repair an exhausted DHCP pool.

Investigate repeated drops and roaming

Match disconnect timestamps and reason codes to controller logs. Look for weak edge coverage, interference, DFS, session reauthentication, aggressive steering or client driver and power-saving faults.

A sticky client stays with a distant AP even when a better one is available. The client decides when to roam. Reduce excessive cell overlap, review low mandatory data rates, and use 802.11k/v assistance with supported clients. For voice drops while walking, test secondary coverage at the target level and verify 802.11r compatibility. Inconsistent security or an unsupported subnet change can break service even when signal is good.

Check limits beyond the radio

If every client on one AP is slow, inspect its Ethernet port speed, errors and PoE status. A damaged cable can negotiate at 100 Mbps and cap a fast Wi-Fi radio. Compare a local throughput test with an internet test to separate WLAN and upstream limits.

On Windows, netsh wlan show interfaces reports the current SSID, BSSID, channel and security. On macOS, use Wireless Diagnostics or sudo wdutil info where supported. On Linux, iw dev wlan0 link uses the actual interface name; nmcli dev wifi lists nearby services. Pair these client observations with AP/controller logs, make one targeted change and retest the original symptom.