Alright, it is time to review our wireless.
So we are going to combine both our architectural conversations and security
conversations into
this review.
Meaning we not only need to understand the architecture of wireless as well as
the security
of wireless but also how to configure it all in iOS and iOS Xe.
And so definitely bookmarked this skill for review later because this will be a
great
opportunity to come back before taking the exam to make sure that we understand
all of WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all of
the foundational principles of wireless all the way up to the configuration of
our SSID
along with our security parameters.
So as always as we are going through these quizzes make sure you pause the
video to answer
the question yourself and identify any areas of weakness.
The source skill is at the bottom of each question so you can go back and
review that skill as
much as needed if we do identify areas that we maybe aren't as strong in.
So let's go ahead and start off with 8 questions in this quiz.
First up what AP mode of operation allows for scanning many channels for RF WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
First up what AP mode of operation allows for scanning many channels for RF
data.
So this concept of AP modes this is very important in the Cisco lightweight
architecture.
Cisco allows for all 5 of these modes of operation as well as a bridge mode
that includes mesh.
But either way the answer to this question is simply going to be monitor mode
right there
in the middle.
So what are these modes of operation?
Well again we can go back and review if needed but just very quickly local mode
of operation
this is going to be our normal mode. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this is going to be our normal mode.
Most of our APs should be in local mode it's referring to the fact that our APs
are locally
configured ideally connecting to a local wireless LAN controller.
FlexConnect this is when we connect an access point remotely and we might worry
about a
flex connect AP losing its connection to the wireless LAN controller usually
because there's
a wide area network in the way that might not be fully stable or fully reliable WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a wide area network in the way that might not be fully stable or fully reliable
and
we just lack the redundancy as much as anything.
So we've configured the access point for flex connect and if we do lose this
connection
to the wireless LAN controller then the access point stays online.
Just keep in mind in the real world that this isn't particularly useful if the
entire
network is out here and we lost our connection anyways it's primarily going to
be useful
when we've got some kind of router at the site with a dedicated internet
circuit because
at that point wireless clients could still go through the flex connect AP and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at that point wireless clients could still go through the flex connect AP and
get out
to the internet.
So it's just a matter of thinking through what exactly we're gaining.
Monitor mode is the one we're talking about here the idea is that the access
point will
be able to sniff all of the well I shouldn't use the word sniff because that
sniff remote
but we can monitor and scan all of the different channels.
So a access point that is servicing stations is locked to a single channel for
the most
part.
I might choose channel 36 it's locked to that channel because all of these WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I might choose channel 36 it's locked to that channel because all of these
wireless stations
are trying to communicate on why on state channel 36.
And so if there is a rogue device out here on channel 40 this access point is
not really
going to be able to see it.
Now every now and again a local mode AP can switch channels and to listen for
what's
going on but again the focus is going to be over here on all of these channel
36 clients.
Whereas a monitor mode AP importantly does not service clients. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Whereas a monitor mode AP importantly does not service clients.
These wireless stations are not going to connect for data instead I'm going to
listen to channel
36 and then listen to channel 40 and then listen to channel 44 and keep cycling
all of
these channels around and around and around to provide as much RF data as
possible.
But very importantly no clients are serviced on monitor mode sniff remote is
sort of like
monitor mode except importantly well how is it similar well there's no clients
that's
how it's similar otherwise it's pretty different it's going to be locked to a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
how it's similar otherwise it's pretty different it's going to be locked to a
specific channel
so like channel 36 and we're going to be listening in specifically for packet
captures.
We have to lock to a channel because otherwise we're not going to hear all of
the packets
that are being exchanged and so this is usually not something we're going to
install out into
the network it's usually a little bit more intended for specific use cases and
then bridge
and mesh is going to be for connecting to our remote locations such as classic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and mesh is going to be for connecting to our remote locations such as classic
traditional
wireless bridges so that was a very quick overview of the different modes of
operation
but this is a fundamental concept we must be comfortable with when it comes to
Cisco's
lightweight architecture.
Alright question two what antenna type can be used to reach very long distances
usually
for connecting to towers so we're talking about maybe a pair of towers out here
we're
going to connect something that allows for long range communication well the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
going to connect something that allows for long range communication well the
answer to
this question is going to be a grid antenna which is more or less a dish
antenna the big
difference is that a grid antenna looks something like this where it's a
wireless grid that still
catches wireless signals but allows for like wind to pass through it so it's
less likely
to get blown down or have problems getting pushed by the wind.
So a grid and a dish these are our longest range antennas very quickly an omnid
irectional
is that circular overhead it looks like a circle at least from the side as we WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is that circular overhead it looks like a circle at least from the side as we
've talked
about it looks a little bit more like that donut shape that's pretty poor
representation
there we go something along those lines but it's supposed to cover the area
around evenly
hence the word omnie there.
Patch and panel these are parts are two different types of planar antennas
these are semi directional
usually intended for hallways where we're broadcasting out in a straight line
and not
so much worrying about the space behind the antenna and then a sector antenna WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so much worrying about the space behind the antenna and then a sector antenna
this is
we think about maybe cellular antennas naturally cellular and Wi-Fi are very
different in a
lot of ways but the concept here is that we cover client area from a tower by
aiming
down and so typically we're going to install an array of sector antennas but
again that's
not even though we might mount it on a pole or a small tower and in an area it
's not going
to service very long distances like great in dish antennas.
Alright question number three place these options in the order used by WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Alright question number three place these options in the order used by
lightweight APs
to discover a wireless LAN controller so remember part of the lightweight
architecture the idea
here is we're going to have a centralized controller somewhere and I just want
to be
able to pull an access point out of a box and plug it into the network and have
it find
its wireless LAN controller and yeah I can manually configure it if I have to
but for
the most part we're trying to get away from unboxing a thousand access points
configuring
them and then deploying them I'd rather just pull them out of the box from WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
them and then deploying them I'd rather just pull them out of the box from
Cisco straight
from the delivery person whatever the situation is there and plug it in and
have it discover
the wireless LAN controller so we are going to go through a specific order here
but the
goal again is to enable automated discovery that scales with the network so
first of all
we're going to start with a broadcast we're just going to do a layer to
broadcast just
in case this is a small site just in case the wireless LAN controller happens WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in case this is a small site just in case the wireless LAN controller happens
to be
on the same VLAN the advantage here is we're going to discover local wireless
LAN controllers
before we go discovering remote wireless LAN controllers but next we're going
to attempt
to use DHCP option 43 and as we said earlier on in the course this is the one
that is highly
used in production real world networks the reason for that is the AP is going
to have
to get an IP address via DHCP in all likelihood yeah if we pulled it out of the
box we could
give it a static IP but that doesn't scale particularly well so we're going to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
give it a static IP but that doesn't scale particularly well so we're going to
use DHCP
in most cases anyways to get an address why not configure the DHCP server to
also handle
or hand the access point the wireless LAN controller address at the same time
we're going to have
to configure our DHCP server for this we get on here we configure option 43
with an IP address
that would be the wireless LAN controller address and as part of the DHCP
negotiation
the AP becomes aware of what that wireless LAN controller address is so it's WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the AP becomes aware of what that wireless LAN controller address is so it's
very flexible
and very scalable now third we're going to attempt to use DNS we're going to
resolve
that name sisco-capwap-controller.local and from here we would well naturally
as part
of the address we get a DNS server we will perform a resolution of that which
means
I actually have to configure the DNS entry here on my DNS server so it goes out
performs
resolution and it gets the IP address of the wireless LAN controller now lastly WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
resolution and it gets the IP address of the wireless LAN controller now lastly
if we have
to rely on manual configuration we can however again it doesn't scale very well
but this
is the order we want to start with broadcast go to DHCP then DNS then get to
the manual
configuration as a last resort.
Alright next up which type of roaming makes use of an anchor controller so
first and foremost
there is no such thing as a layer 3 intra controller roam so hopefully we flag WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
there is no such thing as a layer 3 intra controller roam so hopefully we flag
that pretty
quickly however let's walk through a couple of these other scenarios so
remember the situation
here we might have access points that are part of the same wireless LAN
controller and
then we might also have a different wireless LAN controller with an access
point and this
could be part of a layer 2 network so they're on the same VLANs but then we
might also have
a wireless LAN controller over here that has layer 3 segmentation so this is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a wireless LAN controller over here that has layer 3 segmentation so this is
routed out
to a different location potentially across the network core so to go through a
layer
3 network to another AP and our user here walking with their mobile device in
hand might
walk and roam across all of these access points so between these two access
points this would
be an intra layer 2 roam.
intra is an English not a word but I guess a there's a word for it but it goes WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
intra is an English not a word but I guess a there's a word for it but it goes
in front
of a word like a preface and prefix that's it and then it is intended to mean
within
so it's within the same controller here so intra layer 2 that is very seamless
we don't
need to worry about anchor controllers then if we go to another wireless LAN
controller
now we're talking about inter which is a prefix meaning different or between so
now
we're talking about between two different wireless LAN controllers but it's
still layer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
still layer
2.
Well we don't need an anchor controller any error at this point we can just
hand the information
off because my IP address stays the same.
The challenge is when we roam well say over here this is going to be an inter
layer 3
roam inter because it's between two wireless LAN controllers layer 3 because we
have to
pass this layer 3 boundary and now the problem is my IP address subnet lives
over here and
yet I am my wireless device M over here so any kind of packet coming in WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
yet I am my wireless device M over here so any kind of packet coming in
destined for
that IP address is going to get routed this way so now I need the anchor
controller so
my wireless LAN controller here will become an anchor controller it will
receive that
information or that packet and then send it over to my foreign controller so
that is
this whole concept so long story short what we need to do is take advantage of
the layer WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the layer
3 and that should say inter controller roam so there's a little bit of a test
there to
see if we're paying attention clearly I wasn't a little bit of copy paste error
there but
this should say inter controller roam and so yes there's no such thing as a
layer 3 intro
but there is such a thing as a layer 3 inter controller roam and that is going
to require
the use of an anchor controller so speaking of roaming we've got another
question here
about it wireless LAN controllers must be configured with what feature in order WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
about it wireless LAN controllers must be configured with what feature in order
to provide
seamless roaming between WLCs well we just talked about anchor controllers but
anchor controllers
aren't required for seamless roaming because we might do an inter layer 2 roam
and then
anchor controllers aren't involved the answer here is be the mobility group
those wireless
LAN controllers that we drew out on the previous quiz question these are all
going to be part
of the same mobility group we must configure them to be part of the mobility WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
of the same mobility group we must configure them to be part of the mobility
group which
allows them to hand off wireless clients from one AP to another when they
belong to those
different controllers alright we're over halfway done just three more questions
to go what type
of cap web tunnel is built from flex connect APs to the controller so remember
when an access
point comes online and let's say it's in local mode meaning that normal type of
mode that we
can expect to deploy for the most part the access point must form cap web
tunnels it's going to form WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
tunnels it's going to form
a control plane connection and a data plane connection this is why if we lose
connection to the
wireless LAN controller we lose all sense of wireless connectivity for that AP
however if we
have a flex connect access point where again we run the risk of losing
connection to the wireless
LAN controller we're only going to run a control plane tunnel the data plane
tunnel is not used in
this case so recall that let's say this connection online is online over here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this case so recall that let's say this connection online is online over here
this client connecting
to this AP gets tunneled to the wireless LAN controller and it has a trunk back
to the rest of the
network and so this client gets tunneled to the wireless LAN controller and
placed back onto the
network meaning this is its point of presence well over here this client isn't
going to be forwarded
through the data plane tunnel instead it's going to be dropped off here to the
local switch or
whatever this access point is plugged into via its trunk and it just changes WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
whatever this access point is plugged into via its trunk and it just changes
the way that the traffic
is handed off which is why we can hand this off to maybe a local internet
connection if the LAN
circuit goes down so the answer here when it comes to flex connect APs it's
going to form a control
plane tunnel only all right little question here on configuration so what are
the three primary
configuration elements in iOSXE that provide APs with configuration the quick WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
configuration elements in iOSXE that provide APs with configuration the quick
answer here is when
we're talking about our three primary configuration elements we're looking at
tags and so we must
configure a site tag and RF tag and a policy tag in order to fully configure an
AP now that said
the RF tag and the site tag these are optional there's nothing here that's
required we can rely on
default configuration settings but the policy tag is where we have our W-LAMs
and so if I don't
configure a policy tag I have no SSIDs so this part we're going to have to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
configure a policy tag I have no SSIDs so this part we're going to have to
configure and in a
basic environment that might be the only tag we have to configure and yet all
of the AP configurations
are coming from these three tags all right last question here what aspect of
configuration is
unique to AROS controllers so we just said in iOSXE we're going to use all of
these tags but on the
on the AROS side of things we're going to use AP groups the site tags and AP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on the AROS side of things we're going to use AP groups the site tags and AP
groups are sort of
the same thing with site tags being used for iOSXE and AP groups being for AROS
but that parallel
can break down a couple of different ways so we just think of it as a sort of
relationship
either way what we find is I've got a bunch of APs and I'm using AROS I want to
apply a
configuration like my SSIDs to all of these APs how do I do that well I bundle
all these together WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
all these together
in an AP group and I really map them to the AP group so at that point the APs
are mapped to the
AP group the W-LAMs and SSIDs are configured via the AP group and that brings
our configuration
into all of those APs so once again the goal of this quiz is to make sure that
we identify
areas of weakness if there's anything in here that caused any trip ups then be
sure to go back
and review the appropriate skill in order to make sure we've got it all down
otherwise we can move WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
otherwise we can move
on to wireless security