WLAN Design

On large- and medium-sized campus networks, the WLAN typically uses the "native WAC + Fit AP" architecture. Under this architecture, switches that support native WAC functionality serve as WACs to manage APs running in Fit mode, and wireless services on APs are not configured on iMaster NCE-Campus.

On such networks, the WAC (edge node in the distributed gateway solution) is usually deployed at the same location as the user gateway. In this case, VXLAN is recommended to be deployed across core and aggregation layers for the fabric network. If VXLAN is deployed across core and access layers, access switches function as edge nodes and also act as WACs to manage APs connected to them, which dramatically increases the WLAN configuration and maintenance workload. The subsequent WLAN planning in this section is also designed based on the scenario where VXLAN is deployed across core and aggregation layers.

Control packets between the WAC and APs are forwarded through a CAPWAP tunnel. APs forward service packets of wireless users to the wired side in tunnel forwarding (centralized forwarding) or direct forwarding (local forwarding) mode.

Tunnel Forwarding

In tunnel forwarding mode, an AP encapsulates the service packets of wireless users over a CAPWAP tunnel and sends them to the WAC. The WAC then forwards these packets to other networks. Figure 2-101 shows the traffic forwarding model in the distributed gateway solution where service packets of wireless users are forwarded through a CAPWAP tunnel.

In tunnel forwarding mode, switches on the links between the WAC and APs do not need to allow service VLANs, and interfaces on the switches do not need to be added to such VLANs. This facilitates centralized control and management. However, all service traffic of wireless users needs to be forwarded by the WAC, burdening the WAC. In the distributed gateway solution, if VXLAN is deployed across core and aggregation layers, aggregation switches function as edge nodes and provide the native WAC function. In this case, east-west service traffic of wireless users needs to pass through the aggregation switches, increasing the forwarding burden.

Figure 2-101 Service traffic model of wireless users (tunnel forwarding mode)

Direct Forwarding

In direct forwarding mode, an AP directly forwards users' service packets to other networks without encapsulating them over a CAPWAP tunnel. Figure 2-102 shows the traffic forwarding model in the distributed gateway solution where service packets of wireless users are forwarded in direct forwarding mode.

In direct forwarding mode, the east-west service traffic of local wireless users can be directly forwarded by the local access switch without passing through the WAC. However, switches on the links between the WAC and APs need to allow service VLANs, and interfaces on the switches need to be added to such VLANs, making it difficult to perform centralized control and management.

Figure 2-102 Service traffic model for wireless users (direct forwarding mode)

Table 2-53 compares the tunnel forwarding mode with the direct forwarding mode. In the virtualization solution for a large or midsize campus network, the tunnel forwarding mode that can provide centralized traffic management and control is recommended, irrespective of which gateway solution is selected. The subsequent WLAN planning following this section is also designed based on the tunnel forwarding mode.

Table 2-53 Forwarding mode comparison

Forwarding Mode	Application Scenario	Advantage	Disadvantage
Tunnel forwarding	Wireless user service traffic is processed and forwarded by the WAC in a centralized manner.	The WAC forwards service traffic in a centralized manner, ensuring high security and facilitating centralized traffic management and control.	Service traffic must be forwarded by the WAC, reducing packet forwarding efficiency and burdening the WAC.
Direct forwarding	Service traffic of wireless users is directly forwarded without passing through the WAC, saving AP-WAC link bandwidth.	Service traffic does not need to be forwarded by the WAC, which improves packet forwarding efficiency and reduces the burden on the WAC.	Service traffic cannot be managed and controlled in a centralized manner.

Different from the centralized gateway solution, in the distributed gateway solution, VXLAN is recommended to be deployed across core and aggregation layers for the fabric network, and policy association is deployed between the edge node and downstream devices. In this case, the edge node that functions as the WAC can establish CAPWAP tunnels with APs and enable the APs to join successfully.

Policy association moves the authentication control point up towards the aggregation or core layer. In this manner, devices at the aggregation or core layer can implement policy association with devices at the access layer through CAPWAP tunnels. This helps reduce the number of authentication control points configured and allows terminal access control at the access layer.

Figure 2-103 shows the principle diagram.

1. On iMaster NCE-Campus, choose Provision > Virtual Network > Fabric Management. On the Access Management tab page of a created fabric network, set the authentication control point to an edge node, and configure the management VLAN and management IP address for policy association based on the wireless management subnet plan. After the configuration is complete, a VLANIF interface is automatically created on the edge node. Then configure the DHCP address pool function on the VLANIF interface, which is also set as the CAPWAP source interface.
2. Select an interface connected to an access switch from the interfaces of the edge node, and set Connected Device Type to Extended access switch.
3. Then, the interface connected to the access switch is automatically added to the management VLAN and sends a protocol packet carrying the management VLAN information to the access switch. The interfaces on the access switch are also automatically added to the management VLAN.
4. In the interface list of the authentication enforcement point (access switch), select an interface connected to an AP, and set Connected Device Type to Extended AP.
5. Then, the interface connected to the AP uses the management VLAN ID as the default PVID. When the AP connects to the interface in untagged mode, packets are tagged with the default PVID.
6. Finally, the management channel between the edge node and AP is established. After the connected AP is authenticated, a CAPWAP tunnel is set up, and the AP successfully goes online on the edge node.

Figure 2-103 Principle diagram for edge nodes to assign management IP addresses to APs (VXLAN deployed across core and aggregation layers)

An AP group is used to configure and manage APs in batches so that the APs inherit the configurations of the group to which they belong.

You can create an AP group based on the following items:

• Physical location (For example, APs on the same floor can be added to the same AP group. This mode is preferred.)
• Device model
• IP or MAC address
• Serial number (SN)

Routes for wireless user subnets refer to the routes for communication between wireless user subnets and network service resources (such as DHCP servers), external networks, and wired user subnets in VNs. In the distributed gateway scenario, after receiving wireless user traffic from an AP over a CAPWAP tunnel, the edge node that functions as a WAC decapsulates CAPWAP packets and directly forwards the decapsulated packets to a particular VN, as illustrated in Figure 2-105.

Figure 2-105 Wireless user subnets connect to VNs, and unified wired and wireless access management is implemented

NAC Authentication Control Point Design

Network Access Control (NAC) solution is applicable to both wired and wireless users. In this solution, common authentication technologies include 802.1X, MAC address, and Portal authentication. Generally, access control is performed for wired users based on access interfaces of switches, and for wireless users based on SSIDs.

In the centralized gateway solution, if the edge node functions as the native WAC, the WLAN authentication control point sits on the edge node. As demonstrated in Figure 2-106, you need to perform two steps on the authentication control point in the distributed gateway solution:

1. Configure authentication, authorization, and accounting (AAA) profile resources on the WAC, including the RADIUS server template, Portal server template, and access authentication profiles. You are advised to create these profile resources through iMaster NCE-Campus and deliver them to the WAC during access management configuration for the fabric.
2. Associate the configured access authentication profiles with the corresponding SSIDs on APs. You can only log in to the web system of the WAC to configure wireless services on APs.

Figure 2-106 Configuration diagram for the WLAN authentication control point

The roadmap for selecting authentication modes for wireless users is the same as that for wired users. That is, you need to take into account different user roles or terminal types. For details, see "User Authentication Mode Design" in Access Control Design.

NAC is typically considered in conjunction with security policies to form combined network access control solutions suited to diverse scenarios. Table 2-56 lists WLAN security policies, recommended NAC authentication modes, and application scenarios.

WLAN roaming addresses the following issues:

• Retains users' IP addresses. After roaming, users can still access the initially associated network and continue its services.
• Avoids packet loss or service interruption caused by long-term authentication.

WLAN roaming is classified into the following types based on the STA roaming scope:

• Intra-WAC roaming
• Inter-WAC roaming at Layer 2 or Layer 3

In actual deployment, intra-WAC roaming is recommended. Inter-WAC roaming can be avoided through proper AP group management. For services with high latency requirements, such as automated guided vehicles (AGVs), in warehouses and factories, it is recommended that a separate SSID or VLAN be planned to implement Layer 2 roaming within the WAC.

In the native WAC scenario, if the number of STAs is greater than or equal to 40,000, a maximum of four native WACs can be deployed in each mobility group; if the number of STAs is less than 40,000, a maximum of 16 native WACs can be deployed in each mobility group.

In addition to the preceding basic roaming functions, Huawei WLAN supports the fast roaming function, including pairwise master key (PMK) fast roaming and 802.11r fast roaming. This function further reduces the handoff delay between APs. Table 2-57 shows the handover delay of STAs in different roaming modes.

802.11r fast roaming supports an enhanced roaming mechanism based on device-pipe synergy when working with Huawei terminals. This mechanism helps further reduce the roaming handover delay and packet loss rate. Therefore, you are advised to enable the machanism when enabling 802.11r fast roaming.

On a WLAN, especially on the 2.4 GHz frequency band, out-of-band interference and in-band co-channel/adjacent-channel interference exist. STAs of different brands, types, and models behave differently. For optimal access services, radio resources and user access need to be managed in a coordinated manner. The specific radio resource management (RRM) capabilities include:

• Radio calibration

  The radio calibration function can dynamically adjust channels and power of APs managed by the same WAC to ensure that the APs work at the optimal performance. It is recommended that scheduled radio calibration be configured so that APs perform radio calibration in off-peak hours, for example, between 00:00 am and 06:00 am.

• Band steering

  Most STAs support both the 2.4 GHz and 5 GHz frequency bands. Generally, the 2.4 GHz frequency band is selected by default, on which a smaller number of channels are available. The 2.4 GHz frequency band is usually crowded and heavily loaded, and suffers high interference. In contrast, the 5 GHz frequency band with multiple channels and low interference cannot be brought into full play. The band steering function enables an AP to steer STAs to the 5 GHz radio first, which reduces traffic load and interference on the 2.4 GHz radio and improves user experience. It is recommended that this function be enabled by default.

• Smart roaming

  Some outdated and dumb terminals have low roaming aggressiveness. As a result, they stick to the initially connected APs regardless of the long distance from the APs, weak signals, or low rates. The STAs do not roam to neighboring APs with better signals. Such STAs are generally called sticky STAs. The negative impact of sticky STAs is described as follows:

  • The service experience of a sticky STA is poor, and the STA is always associated with the poor-signal AP. As a result, the channel rate decreases significantly.
  • The overall performance of wireless channels is affected. A sticky STA may encounter frequent packet loss or retransmission caused by poor signal quality and low rates, and therefore occupies the channel for a long time. As a result, other STAs cannot obtain sufficient channel resources.

  Smart roaming enables STAs to roam to neighboring APs with better signals in a timely manner, improving user experience.

  • Performance improvement

    Smart roaming can direct poor-signal STAs to APs with better signals, improving user service experience and overall channel performance.

  • Load balancing

    Smart roaming ensures that each STA is associated with the nearest AP, achieving inter-AP load balancing. It is recommended that this capability be enabled.

• STA steering

  After a STA connects to an AP, the target AP selection algorithm is used to comprehensively measure the dual-band capability of the STA, AP load, and AP signal quality to steer the STA to the optimal AP. It is recommended that this capability be enabled.

Network planning is an important part of WLAN project implementation. The network planning design consists of the following parts:

• Network coverage design: Determine the requirements and principles for signal coverage.
• Network capacity design: Determine the bandwidth requirements of a single user based on the service model and STA behavior, and then determine the number of APs based on the AP capability.
• AP deployment design: Determine AP installation positions based on the deployment principles.
• AP channel planning: Properly plan channels for APs in neighboring areas to reduce co-channel and adjacent-channel interference.
• AP power supply and cabling design