{"id":217,"date":"2018-03-21T12:43:50","date_gmt":"2018-03-21T11:43:50","guid":{"rendered":"http:\/\/netgab.net\/web\/?p=217"},"modified":"2018-03-21T13:26:56","modified_gmt":"2018-03-21T12:26:56","slug":"cisco-cuwn-over-a-wan-link-flexconnect-vs-local-mode","status":"publish","type":"post","link":"https:\/\/netgab.net\/web\/2018\/03\/21\/cisco-cuwn-over-a-wan-link-flexconnect-vs-local-mode\/","title":{"rendered":"Cisco CUWN over a WAN link (FlexConnect vs. local mode)"},"content":{"rendered":"

<\/span><\/span><\/span><\/span>As long as there is H-REAP or FlexConnect, I wondered if there are any differences between a local mode AP and a FlexConnect AP configured for central switching (over the WLC). Obviously there is, because there are some Cisco recommendations regarding this topic as:<\/p>\n

<\/span><\/span><\/span>“Cisco does not support deploying local mode APs using a centralized WLC over a wide area network. If remote APs need to be supported over a WAN, Cisco recommends implementing the FlexConnect architecture.”<\/span>
\n<\/i>(Source: Mobility Design Guide [1])<\/p>\n

<\/span><\/span><\/span>That means, if there is some kind of WAN (MAN as well?! \ud83d\ude42 ) between the WLC and AP you should deploy FlexConnect.<\/p>\n

<\/span><\/span><\/span>If there are requirements to deploy a centrally switched network at the WLC (because there is a centralized security infrastructure like firewalls), you can deploy FlexConnect central switching (default). But again, what are the actual functional differences between FlexConnect central switching\/central authentication and local mode APs? The most obvious aspect here is the split MAC architecture. In the default mode of operation (local mode) some 802.11 management tasks are performed directly by the AP, some are performed by the WLC. The split MAC architecture is explained here (https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/wireless\/controller\/8-5\/Enterprise-Mobility-8-5-Design-Guide\/Enterprise_Mobility_8-5_Deployment_Guide\/cuwn.html?bookSearch=true#45944).<\/p>\n

<\/span><\/span><\/span>So the theory is, that the split MAC functionality is altered for FlexConnect. To test this, I build a small test environment:<\/p>\n

\"\"<\/p>\n

 <\/p>\n

<\/span><\/span><\/span>I put a box between the AP and WLC to simulate WAN delay. This can simply be implemented using a Linux client with two interfaces. The Linux “bridge-utils [2]” are needed to bridge two network adapters together. This way a layer-3 transparent box can be placed in the traffic path. Of course the simulation itself would work without the “bridge-utils” as well, but by using “bridge-utils” you don’t have to care about routing. To simulate a round-trip time of 300ms, the one way delay of 150ms must be configured on each adapter<\/p>\n

<\/span><\/span><\/span>tc qdisc add dev <\/span><\/span> root netem delay 150ms<\/interface-name-1>
\n<\/span><\/span><\/span>tc qdisc add dev <\/span><\/span> root netem delay 150ms<\/interface-name-2><\/code><\/p>\n

<\/span><\/span><\/span>If I ping the AP from my central site (same site as the WLC), I can verify the results:
\n$ ping 172.16.255.149<\/code>
\nPING 172.16.255.149 (172.16.255.149) 56(84) bytes of data.<\/code>
\n64 bytes from 172.16.255.149: icmp_seq=1 ttl=255 time=300 ms<\/code>
\n64 bytes from 172.16.255.149: icmp_seq=2 ttl=255 time=300 ms<\/code>
\n64 bytes from 172.16.255.149: icmp_seq=3 ttl=255 time=300 ms<\/code><\/p>\n

 <\/p>\n

The following scenarios were tested.<\/p>\n\n\n\n\n\n\n\n\n\n
Scenario<\/td>\nAP mode<\/td>\nSSID settings<\/td>\n<\/span><\/span><\/span>WAN RTT<\/td>\n<\/tr>\n
1<\/td>\nLocal<\/td>\nCentral switching (default)<\/td>\n0 ms<\/td>\n<\/tr>\n
2<\/td>\n<\/span><\/span><\/span>FlexConnect<\/td>\nCentral switching \/ authentication (default)<\/td>\n0 ms<\/td>\n<\/tr>\n
3<\/td>\n<\/span><\/span><\/span>FlexConnect<\/td>\nLocal switching \/ central authentication<\/td>\n0 ms<\/td>\n<\/tr>\n
4<\/td>\nLocal<\/td>\nCentral switching (default)<\/td>\n300 ms<\/td>\n<\/tr>\n
5<\/td>\n<\/span><\/span><\/span>FlexConnect<\/td>\nCentral switching \/ authentication (default)<\/td>\n<\/span><\/span><\/span>300ms<\/td>\n<\/tr>\n
6<\/td>\n<\/span><\/span><\/span>FlexConnect<\/td>\nLocal switching \/ central authentication<\/td>\n300ms<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

<\/span><\/span><\/span>To verify the impact of the simulated delay, I captured on the wireless side to get the 802.11 management frames. To determine if the AP or WLC generated a certain type of management frame, the time between a request and the corresponding response frame must be considered.<\/p>\n