Wireless

Course at a glance

• 18 lessons in 6 units.
• Format: self-paced lessons with Cisco WLC configurations, packet captures, and video.
• Last updated: October 2026.

What is a Wireless LAN?

A wireless LAN (WLAN) connects devices to the network with radio waves instead of cables. The IEEE describes wireless LANs in the 802.11 standards, and the Wi-Fi Alliance certifies equipment and created the Wi-Fi Protected Access (WPA) certifications. Wireless clients associate with an access point (AP), which offers a wireless network with an SSID and connects it to the wired network. All traffic goes through the AP, also between two wireless clients.

Wireless is different from a wired network. It’s half-duplex, since everyone sends and receives on the same channel, so devices use CSMA/CA to avoid collisions. Coverage, interference, and the number of clients per AP decide how well your network performs. And because anyone in range can receive the signal, we need strong authentication and encryption to keep data private and protect it from changes.

At home, a single wireless router with an autonomous AP does everything. Enterprise networks have hundreds or thousands of APs, so we manage them centrally with a Wireless LAN Controller (WLC) or from the cloud. Lightweight APs tunnel their traffic to the WLC with CAPWAP, which makes it possible to configure SSIDs, security, and RF settings in one place, and to let users roam between APs without losing their connection.

Wireless Learning Roadmap

This roadmap follows the course units. Each topic has a short explanation and links to the lessons where we cover it in detail.

Wireless Fundamentals

We start with the basics of wireless networks and how they differ from wired networks. Wireless LANs use the 2.4 GHz and 5 GHz bands. On 2.4 GHz, only channels 1, 6, and 11 don’t overlap, while 5 GHz has many more channels, some of which require DFS (Dynamic Frequency Selection) because they are shared with radar. The 802.11 standard describes service sets: an IBSS connects devices directly without an AP, a BSS is a single AP with its clients, and an ESS combines multiple APs so clients can roam.

Cisco Wireless Architectures

An autonomous AP has all the intelligence on board, so you configure each AP individually. With the split-MAC architecture, lightweight APs keep the real-time functions and a WLC takes care of management, and all traffic between them goes through a CAPWAP tunnel. Depending on the deployment model, you place the WLC in a central location, as a virtual machine in a private cloud, or embedded in a switch stack. A lightweight AP serves clients in local mode, but other AP modes let it run as a dedicated monitor, FlexConnect AP at a branch, or remote sniffer.

Cisco WLC Configuration

We start with the basic WLC configuration: the WLC connects to a switch with a trunk that carries the management VLAN and a VLAN for each wireless network. Once the APs have joined the WLC, you configure your SSIDs, security, and RF settings once on the controller instead of on every AP. We build a network with a WPA2 pre-shared key, and look at how WLCs based on IOS XE, like the Catalyst 9800, use profiles and tags to apply different settings to groups of APs.

Wireless Security

Wireless security is about authentication, encryption, and integrity. The original 802.11 standard only had open authentication and WEP, and WEP is broken, so you’ll learn about the authentication methods we use today. For encryption and integrity, TKIP was a temporary fix for older hardware, and AES with CCMP replaced it. The Wi-Fi Alliance certifies equipment for WPA, WPA2, and WPA3, each with a personal mode that uses a pre-shared key and an enterprise mode that uses 802.1X and a RADIUS server. WPA3 replaces the 4-way handshake with SAE (Simultaneous Authentication of Equals) for authentication with a pre-shared key, which protects against offline dictionary attacks.

WPA Authentication and Encryption

WPA doesn’t use a single key for everything. It uses a key hierarchy, with different keys to encrypt unicast and multicast or broadcast traffic and to check its integrity. The client and AP derive these keys with the 4-way handshake, which uses EAPOL-Key frames. EAPOL carries EAP messages in Ethernet or 802.11 frames, and is also what 802.1X uses to authenticate clients with an authentication server.

Wireless Design: High Client Density

In a theater, stadium, or conference room, coverage is not the problem; capacity is. Clients share the airtime on a channel, so in a high client density design, we want smaller cells with fewer clients per AP. You can get there with lower transmit power, a higher mandatory data rate, the right antennas, and enough cell overlap. 5 GHz is usually the better choice for high density because it has many more non-overlapping channels than 2.4 GHz.

Ready to master wireless?

Get access to all 18 wireless lessons and every other course on NetworkLessons.com.

Sign up