What Is WAC?

Why Do We Need a WAC?

In the early stages of WLAN development, the Fat AP architecture was prevalent in small-scale WLANs due to its plug-and-play convenience. A Fat AP independently provides functions such as radio management, authentication and encryption, data forwarding, QoS scheduling, DHCP service, and routing. This all-in-one design is highly efficient when only a few APs are deployed. Administrators can easily log in to the web system of each AP to configure the parameters such as SSID, password, and channel.

However, as the network scale expands from corridor-level to campus-level (comprising hundreds or even thousands of APs), Fat APs may encounter the following challenges:

1. Cumbersome O&M: Administrators must manually configure each newly added AP. To globally modify an SSID or security policy, they need to log in to each AP interface individually. This process is time-consuming, error-prone, and makes configuration consistency difficult to guarantee.
2. Radio interference: Operating independently, Fat APs with static channels and power settings cannot detect real-time interference from neighboring devices. When adjacent AP coverage overlaps, co-channel interference causes frequent STA roaming and packet loss, compounded by the absence of coordination mechanisms among Fat APs.
3. Poor roaming experience: STA roaming between Fat APs relies on traditional Layer 2 roaming. This requires a cumbersome re-authentication process, resulting in latency of up to several hundred milliseconds and severely impacting latency-sensitive services.
4. Fragmented security policies: ACLs and user access policies are distributed across individual APs.

To address these challenges, the centralized "WAC + Fit AP" architecture is introduced. Going beyond basic centralization, this architecture decouples the control plane from the data plane.

• Fit APs are dedicated to delivering reliable, high-performance wireless connectivity, while all advanced features are centrally configured on the WAC.
• Acting as the "brain" of the WLAN, the WAC provides unified management for all Fit APs.

  For example, a WAC can connect to an authentication server to authenticate STAs. All AP functions, such as AP upgrade and login, can be configured on the WAC. Once an AP goes online, the WAC delivers configurations to it through the CAPWAP tunnel.

WAC + Fit AP architecture

The evolution from Fat APs to the "WAC + Fit AP" architecture is essentially a transition from device-level management to system-level services. The following table lists the core values of the WAC.

How Does a WAC Work?

The operation of a WLAN starts with the AP onboarding and the establishment of a CAPWAP tunnel with the WAC. Subsequently, STAs connect to the AP through scanning, authentication, and association. After successful connection, STA service data is forwarded across the AP, WAC, and wired network according to the configured forwarding mode (direct or tunnel forwarding), enabling wireless network connectivity and service access.

1. AP onboarding

After an AP powers on and starts up, it obtains an IP address through DHCP or static configuration, and then initiates a connection to the WAC. This process is the basis for centralized AP management on the WAC.

1. Discovery: The AP sends a Discovery Request message to scan for a WAC on the network. WACs respond with a Discovery Response message. Among them, the AP selects one for communication.
2. Datagram Transport Layer Security (DTLS) connection establishment: To secure the CAPWAP tunnel, the AP and WAC establish a DTLS connection to encrypt subsequent control and data packets.
3. Join: The AP sends a Join Request message carrying its hardware information (such as the MAC address, serial number, and model) to the WAC. The WAC verifies the AP's validity (for example, by matching the AP's SN against the SN whitelist or performing MAC address authentication). Upon successful verification, the WAC responds with a Join Response message and allocates resources to the AP.
4. Configuration delivery: After the tunnel is established, the WAC delivers the pre-configured WLAN service configurations (such as SSIDs, radio parameters, and security policies) to the AP through a Configuration Update message. The AP then applies the configurations to activate wireless services.

2. STA access

When a STA attempts to connect to the WLAN, the WAC performs access authentication to ensure network security.

1. Association: After discovering the SSID, the STA sends an Association Request message to the AP. The AP then forwards this request to the WAC through the CAPWAP control tunnel.
2. Authentication: The WAC initiates the authentication process based on the configured authentication mode (such as 802.1X, MAC address, or Portal authentication).
3. Authorization and onboarding: The authentication server returns a successful authentication result along with authorization attributes (such as the VLAN, QoS, and ACL). The WAC creates a user entry for the STA based on these attributes and instructs the AP to grant the STA network access.

3. STA data forwarding

Depending on service requirements, the WAC supports two data forwarding modes, determined by whether data packets traverse the WAC.

• Tunnel forwarding (centralized forwarding):
  • Upon receiving a data frame from a STA, the AP encapsulates it into a CAPWAP data packet and sends the packet to the WAC through the CAPWAP data tunnel.
  • The WAC then decapsulates the CAPWAP packet and performs Layer 2 or Layer 3 forwarding.
  • The downlink process is the reverse of the uplink process. The WAC encapsulates data frames and transmits them to the AP, which decapsulates and delivers them to the STA over the air interface.
  • Advantages and disadvantages: This forwarding mode centralizes service management, ensuring high security while facilitating QoS and security policy enforcement. However, it imposes a heavy processing load on the WAC and introduces longer forwarding paths.
• Direct forwarding (local forwarding):
  • Upon receiving a data frame from a STA, an AP forwards it locally based on the VLAN and interface configurations, bypassing the WAC.
  • Control packets (such as 802.1X authentication packets) are still sent to the WAC through the CAPWAP tunnel for processing.
  • Advantages and disadvantages: This forwarding mode significantly offloads traffic from the WAC and improves forwarding efficiency. However, centralized traffic management and control are relatively limited since service data bypasses the WAC.

STA data forwarding

Standalone WAC vs. Native WAC

During the WLAN deployment, you can deploy either a dedicated WAC device (that is, a standalone WAC) or a switch/router with integrated WAC functionality.

A switch with integrated WAC capabilities is known as a native WAC, which delivers both wired switching and wireless controller functions.