5

I am learning about Autonomous and Lightweight APs at the moment and I came across this slide from a course that I follow.

enter image description here

This specific line

enter image description here

I know that this problem can be solved by using Lightweight APs and a WLC.

However, how is it with wired devices? The access layer switches will also connect to multiple wired devices and those devices will most likely be in different VLANs, so again, trunks will have to get configured and those VLANs will, again, stretch across the network infrastructure.

1
  • 4
    Much of that slide is FUD. APs don't have to use trunks/vlan, and a great many "not small" orgs use simple freestanding autonomous APs. Enterprise wide VLANs can be cumbersome if there aren't any central management systems. (if you're that large and don't use one, that's on you.)
    – Ricky
    Commented Dec 25, 2022 at 19:41

2 Answers 2

9

That is actually overly broad. There is nothing technically wrong with VLANs being used over a large network area as long as the network is designed properly. In modern networks, you can use more advanced Spanning-Tree (Per VLAN RSTP, etc.) to overcome a lot of issues in traditional spanning-tree implementations and you can use things like Overlay networks to provide a VLAN that can be implemented in many different locations via being overlayed on top of a layer 3 routed WAN. This allows the use of a single VLAN or multiple VLANs that cover much larger physical and logical areas without having to configure the VLAN on everything in between the locations and pass it as a traditional layer 2 broadcast domain.

Lightweight access points and WLC do not address layer 2 design issues such as large implementations of spanning-tree, etc. In fact, they depends on the layer 2 network and layer 3 networks being stable and consistent and require that those networks provide the access required by the client devices on the access point as any standalone access point would.

The defining feature of lightweight access points is that they lack the integrated full management capability of standalone access points and depend on a centralized management platform or controller (WLC) to implement things like basic configuration (channel config, transmit levels, etc.) as well as the more advanced features like authentication and encryption config, VLAN tagging, and client and traffic optimization (802.11r and 802.11k etc.).

Lightweight access points do not relieve the network of the need to be designed properly to provide transport for the client devices to the desired network services. Wired networks have the same issues: any given wired network switch needs to be able to provide the required access that the client devices in that location will need.

6

However, how is it with wired devices? The access layer switches will also connect to multiple wired devices and those devices will most likely be in different VLANs, so again, trunks will have to get configured and those VLANs will, again, stretch across the network infrastructure.

Not necessarily. If you design your network as a tree, then each layer-2 access switch connects to two layer-3 distribution switches (that route between the distribution switches) where traffic can be routed between VLANs, and at the layer-3 distribution switches you can add some security between the VLANs.

One Cisco best practice is to only connect access switches to distribution switches and actually restrict any VLAN to a single access switch. You can trunk as many VLANs as you like to an access switch, but those VLANs do not extend to any other access switch. You can route from any VLAN to any other VLAN on the same or any other access switch, or you can restrict routing between any VLANs at the layer-3 routing point. This offers some natural protection from routing loops, but you still run spanning tree as a failsafe.

You could even take this a step further by using layer-3 switches as access switches and route between the access and distribution switches. That allows a much faster failover than spanning tree in the event of a loss of connection between an access switch and one of the distribution switches.

Not the answer you're looking for? Browse other questions tagged or ask your own question.