5 Wireless Networking Fundamentals

WLAN components and traffic paths

A wireless local area network (WLAN) connects devices over radio rather than through an individual Ethernet cable. In a typical infrastructure WLAN, wireless clients communicate through an access point (AP), which connects them to the wired network.

A client, also called a station, is a device such as a phone or laptop with a Wi-Fi adapter. An AP provides wireless connectivity and bridges client traffic to the network. APs may be managed individually or by a wireless LAN controller (WLC).

The distribution system connects APs and carries traffic toward switches, routers, and services such as DHCP and authentication servers. It may be wired or wireless. An AP’s wired switch port may carry one or more VLANs, and a WLAN can be mapped to a VLAN. As a result, a client can connect successfully but still fail to reach the expected network if the VLAN, trunk, or DHCP configuration is wrong.

Wireless network names and coverage

A Basic Service Set (BSS) is a group of clients served by one AP radio. Multiple connected BSSs can form an Extended Service Set (ESS), allowing clients to move between APs while using the same WLAN name and compatible security settings.

The Service Set Identifier (SSID) is the Wi-Fi network name selected by the user. It identifies a WLAN, not one particular AP, so multiple APs can advertise the same SSID. The BSSID identifies a particular BSS and commonly corresponds to an AP radio’s wireless MAC address.

Discovery and association

Clients discover WLANs from AP advertisements called beacons or by sending probe requests. They then authenticate and associate with an AP.

A hidden SSID is not strong security: it can still be discovered, and hiding it may complicate client connections. Use strong authentication and encryption instead.

Access-point operating modes

AP mode names and capabilities vary by vendor and product; the labels are not universal standards. Check the AP’s documentation to understand what a given mode does.

• Autonomous (standalone): The AP is configured and managed directly.

• Controller-based / local: A WLC manages the AP, which commonly tunnels client traffic to the controller.

• FlexConnect (or local switching): A controller-managed AP can, when configured, switch client traffic onto the local wired network. Some functions may continue locally during a controller-link outage.

• Bridge or mesh: APs use a wireless link to connect network segments or provide backhaul where cabling is unavailable.

• Monitor: The AP’s radios scan or monitor the air instead of serving ordinary client traffic.

Wireless security choices

Choose WLAN security according to the network’s requirements and clients’ capabilities.

• WPA3-Personal uses a shared passphrase and SAE authentication.

• WPA3-Enterprise uses enterprise authentication such as 802.1X. Enterprise authentication typically relies on a RADIUS server, and 802.1X enables centralized enterprise authentication.

• WPA2-Personal with AES/CCMP may be needed for compatible older devices when WPA3 is unavailable.

• Avoid WEP, original WPA, and TKIP; these are legacy options.

For a guest WLAN, use suitable access controls or network separation so guests do not receive unrestricted access to internal systems. WPA3-Personal and WPA3-Enterprise serve different authentication needs.

Systematic connectivity troubleshooting

Troubleshoot from the wireless link outward, changing one thing at a time. Work through the checks in order so that failures at different layers can be distinguished.

1. Check the client and signal. Confirm Wi-Fi is enabled, the adapter works, and the client is within usable coverage. Test near the AP to distinguish a coverage problem from a configuration problem.

2. Check the WLAN selection. Verify the correct SSID and, where applicable, band. Confirm the AP is operating and advertising the intended WLAN.

3. Check authentication. Compare the client’s security mode and credentials with the WLAN configuration. Enterprise clients may also require valid credentials, certificates, or a reachable authentication service.

4. Check addressing. After association, confirm the client received an appropriate IP address, subnet mask, default gateway, and DNS settings. A missing or self-assigned address often points to DHCP, VLAN, or relay-path problems.

5. Check the wired path. Verify the AP uplink, switch port, and VLAN mapping. If a VLAN is carried over a trunk, confirm the required VLAN is allowed and correctly configured end to end.

6. Check reachability in order. Test the default gateway, then an external IP address, then a hostname. If the gateway works but hostnames fail, investigate DNS. If association itself fails, focus first on signal, SSID, compatibility, or security settings.

7. For intermittent or slow service, check interference, channel use, AP placement, and whether nearby obstacles or competing networks are weakening or disrupting the radio link.