Hi everyone, I assure you we're nearing the end of our wireless journey here for Encore.
We are hyper focused on what we might see in the Encore exam for wireless.
So let's go ahead and dive in to AP modes.
Now AP modes are how we're going to configure our access points, and this is where we're
going to dive into FlexConnect, Bridged, and other configurations for our APs that really
changes the behavior depending on what's happening with our connectivity to our wireless LAN
controllers.
So let's dive into some of these solutions.
Let me move myself to the other side so you can see what we're talking about.
These are the modes we're going to focus on.
There's other modes we're going to talk about, but right here, Local.
Remember Local means that we are 100% reliant on what?
We're 100% reliant on the wireless LAN controller being reachable.
I have to be able to connect to it.
FlexConnect is different.
FlexConnect means I have the ability to connect to the wireless LAN controller, yes, but if
it goes down, maybe my APs can work depending on the scenario, and that's a huge depending.
That's why it's called FlexConnect.
Sometimes you're connected, maybe your connection is not so reliable, so you want to set up
FlexConnect to your wireless LAN controller, so if you somehow lose reachability to that
wireless LAN controller, you want the people who are at least still connected to remain
connected on their wireless LAN, be able to use it somewhat.
Now there's some caveats here to whether or not users who are not authenticated and logging
on for the first time, what will happen in those cases, and I'm going to show you the
perfect matrix.
I'm going to give you those websites, and you will have to review those on your own,
but it's very, very important.
This is very, very important, and this is very, very important.
Let me underline those.
Remember what I said.
Whenever I underline something, you got to know it.
Bridge or Mesh mode is when I have an AP connected to another AP.
Let's put little antennas on a box here.
That's our AP, and let's put another AP here, but this one's actually connected up.
Let's say I have a Mesh where this AP is talking to this AP to get to this wireless LAN controller
over here.
When I do this, usually, usually, Mesh does not work with FlexConnect.
Does not happen.
That is not how this works, but I can use Flex plus Bridge mode, which is kind of like
a hybrid to make this work, right?
FlexConnect plus Mesh does not work, but if I change the word to Bridge, there's some
options to make it happen so that this kind of works.
Here's why this doesn't work is because I'm stuck on the VLAN that this AP is at, right?
I'm stuck with whatever configuration that AP has because I'm bridging through wireless.
I'm going, there's no CAPWAP tunnel here.
I'm doing a complete transfer Mesh network between one AP and another.
That's the problem with a Mesh network.
Now FlexBridge allows us a little bit of a configuration difference that allows this
Mesh to actually kind of work, okay?
So we'll go through that in a bit, and I'll show you, I'll give you the actual, I'll give
you a document.
That's what we'll do.
I'll give you a document in your supplemental learning stuff that has these two websites
on it for you.
I don't know why I forgot that, but it did.
These two websites that will give you access to this information, very important for your
learning process here.
All right, so let's dive in.
Local mode.
This is the default mode for lightweight APs.
If you don't change any settings, we're going with local mode.
Why is that?
Well, FlexConnect isn't something that we usually have to worry about.
Am I worried about my connection to my wireless LAN controller?
No, not usually.
If I have no connection to my wireless LAN controller, I usually have bigger problems
in a normal enterprise environment.
The other configurations are for special instances.
Maybe I have a microwave throw that gives me trouble between two sites and the wireless
LAN controller isn't always reachable.
We create two CAPWAP tunnels to the wireless LAN controller in local mode.
One is for data and one is for management.
So those management frames, different from the data frames, and they're kept separate.
AP directly connects to the wireless LAN controller.
That's what these CAPWAP tunnels are.
Remember, I told you these are point to point, essentially.
CAPWAP, do I have enough room?
I do.
So it is essentially a point to point connection.
Physically, no, it isn't.
Logically, yes, it is directly connected to the wireless LAN controller.
And this, we already said, this is reliable connectivity to your wireless LAN controller.
When you have this, you don't have to worry about anything else.
But the problem is, if it's not reliable, if I have no connection, I have no access
to the wireless LAN controller.
No ifs, ands, and buts.
Even if I'm already connected, and my client's already connected to the AP, if the AP loses
connectivity to that wireless LAN controller, I'm down.
That's the end of the story, okay?
Let's introduce our solution.
Well, maybe you don't have a super reliable connection to your wireless LAN controller.
Maybe you're in a microwave throw, and I know they say weather doesn't affect it, but let's
say there's a lot of scatter in the air.
Somebody's throwing up aluminum foil into the air between your microwave throw.
Maybe it's not reliable.
You need flex connecting bolts.
This allows the data track to be switched locally, if necessary.
I do not always need to go back to the controller.
Now there are special caveats to this.
I want you to look this up when we get there.
It allows wireless traffic to egrace the switch port of the access point.
We're not, notice this, wireless LAN controller does not have to move data.
I had to look up there for a second.
And this is the important part.
We're still managed by the wireless LAN controller, 100%.
But what I'm telling you is, if I have someone who's connected to that wireless LAN, and
I lose connectivity to the wireless LAN controller, because I'm locally switched, because I'm
moving data directly out into the local network, I do not necessarily lose connectivity.
I don't necessarily need that wireless LAN controller for everything.
We can still function if not connected.
Now it's important to understand that this has a huge asterisk next to it.
Can I do everything?
Absolutely not.
You are not going to be able to do everything.
So let's go ahead.
I'm going to jump to the website.
I'm going to give you, apparently I have to move it down.
Hang on, give me a second here.
I'll move this down and then pop this up.
There we go.
So this is the FlexConnect feature.
We're going to discuss the matrix.
I'm going to show, not the actual matrix, we're not going Neo here, but I'm going to
show you some of the different things that happen.
I want you to read this.
When we have WAN up with central switching, can I have open static WEP?
Will it work?
Yes.
WAN up local switching, open static WEP, will it work?
Yes.
So here you can go through the different scenarios on if something's up, what happens?
If my wide area network is up, do I still have this service?
Let's take a look at where no starts to happen.
If I have a rogue intrusion detection, yes, yes for WAN.
If the WAN is up, it works.
But if the WAN is down, it no longer works.
So this is important.
I need you to go through this and understand when FlexConnect is going to be up and when
FlexConnect is going to be down.
Some of the stuff I would like you to focus on is the security settings for sure, opportunistic
fast ROAM right here.
This is something I would definitely want you to know that when the wireless LAN is
up, that we can do fast ROAM.
When the WAN is down, we cannot.
Important to know, okay?
Mesh, Mesh LSC, not applicable.
What did we say FlexConnect didn't work with?
Mesh.
It's right there, unless we're working in bridge mode and we'll talk about that in a
second.
TLS support, trust sec, identity, pre-shared key, yes, yes, yes, as long as you're on version
8.5.
Triple A enforced policy, yes.
Triple A enforced policy and quota management, yes, including FlexBridge.
And no, if the WAN is up but local switching and authentication.
That does not work.
That's something I would like you to know as well.
And then no, if the wireless LAN is down.
Triple A enforced policy and quota management.
There is a lot here that you will get a ton of questions on FlexConnect.
I would like you to remember the ones I specifically mentioned.
And I would like you to go through that at least once and read through it.
And kind of go through it in your head and understand what's happening.
Okay, the WAN is down, the WAN area network is down.
I cannot reach my wireless LAN controller.
What does that mean for FlexConnect mode?
What can I do and what can't I do?
Very important.
This understanding that we went through will get you through a lot of those questions.
There's going to be a few on that matrix I showed you.
Please spend some time there.
So what about this bridge or mesh mode?
Now bridge or mesh mode is dedicated point-to-point or multipoint between networks.
This is to extend a network.
So let's say I have an AP here and I don't – I need to extend out to here.
And this is a building.
This is like a shop.
Let's say this is my shop and this is the actual office.
And this is 50 feet.
And I'm using a Yagi antenna.
We're going to throw all sorts of scenarios in here.
Boom, boom.
That's a mesh network really.
So that's what we're talking about.
We're bridging that area.
You know, switches used to be called bridges.
That's because they connected two things together.
Now we're connecting two things together using wireless.
That's a bridge or mesh connection.
Remember mesh mode – FlexConnect will not work on that unless we introduce Flex plus
bridge.
These are Flex features assigned to mesh APs.
So this is a different thing.
I got a website for you here as well.
So let's go ahead and take a look.
I'm going to go to my demo environment, drop off the screen for a second.
And this is the second site I'm going to give you.
This will be in the supplemental learning assets.
Please at the very least look through them.
Now FlexConnect and – FlexConnect and bridge mode work together.
Bridge mode allows functionality across mesh APs.
Look at this part.
This is what I want you to remember.
Currently, a control and provisioning wireless access CAPWAP AP can be configured and operate
in two different modes, FlexConnect and bridge.
Limitations are FlexConnect and mesh modes are incompatible.
I told you that.
We talked about that.
So what's the solution if I have a mesh environment and I still want FlexConnect mode?
I still want APs to work somewhat when they can't reach the wireless LAN controller.
Well, what I got to do is do FlexConnect plus bridge.
That's the configuration I need.
Okay.
Now, there are additional limitations here.
I want you to read through this document up to just right here.
It's not a big document.
This will give you an idea of what works and what doesn't work when you're in FlexConnect
mode and bridge mode because it changes a little bit.
Remember, we're kind of stuck on that AP's VLAN that we're mesh mode with, and that kind
of changes the dynamics of what we can do, what we can switch locally.
Because remember, FlexConnect mode is about switching locally.
So if I'm switching locally, I have to make sure that I understand that when I'm going
to that AP over that mesh interface, I'm going to be stuck there.
So this is a little different from just FlexConnect mode.
Adding bridge is going to put a little tiny bit more limitations on what you can do.
All right.
Let's go back to the slides.
Network management modes.
Okay.
Now, these are the ones that actually do management things, modes that provide utilities for us
as administrators.
First, we have monitor.
Monitor is basically in a passive mode where you're just going to be looking at traffic
or looking at what's going on.
There's a rogue detector.
Rogue detector is pretty fun.
It allows to specifically analyze traffic to ensure that you don't have any devices
that shouldn't be on your network.
We have SEConnect and Sniffer.
A Sniffer just sniffs the different traffic.
And we're going to dive into these in detail.
First, we're going to dive into monitor mode.
Now monitor mode, when you put an AP in monitor mode, we're not transmitting at all.
We are simply a receiver.
I misspelled that.
Receiver.
We're going to take traffic in and we're going to look at that traffic.
Why would we do this?
We would use this for intrusion detection, rogue access point.
A lot of people call this a rogue monitoring too.
If let's say you're on the exam and someone's asking about rogue devices, what would you
use to monitor them?
And you're looking for rogue device monitoring and you don't see it, monitor mode is 100%
accurate.
It's something I would choose there.
It is something that is used to monitor your wireless network to ensure that certain types
of traffic aren't being introduced into your environment.
Rogue access points and things like that being some of them.
Location-based services actually use it.
So if you ever had your device on and it says, oh, please turn on your wireless device for
a more accurate reading for where you are, this is 100% true.
They use those APs as kind of a pinpoint to see where you are in the environment.
This is like your phone and things like that.
Let's go on to our rogue detector.
Now this is dedicated rogue detector.
Remember a monitor, it's basically kind of like a monitor.
This is for wired and wireless environments.
The MAC address comparison of what we're expected to have on our network versus what's there.
AP can still broadcast SSIDs.
So although a rogue detector is a monitor, it can also move traffic.
So that's the difference between a monitor and a rogue detector.
It can still serve clients.
And all the wireless connections that are made to it are still valid.
They can move data as long as the AP is configured for it.
Rogue detectors have become more and more ingrained into our enterprise wireless APs.
We see it all the time.
If you use Meraki, the rogue detectors on every single AP you have.
In this day and age, with everybody pulling out pineapples, if you don't know what a pineapple
is, look it up.
Wireless pineapples are used to create rogue access points.
So this is a very important part of your security infrastructure, being able to detect rogue
devices in your environment, especially if they're trying to hand out SSIDs and pretend
to be a part of your enterprise infrastructure.
Very important.
SC Connect, this is dedicated connection for clean air.
So what we're looking at is we're looking at the different frequencies that are in my
air.
And I'm trying to make sure that in the spectra analysis, that I have clean channels to work
with.
The channels I'm planning to use, the frequencies that are going in the air all around me, I'm
using channels that do not have a lot of interference.
So I'm dedicated to trying to create an environment where my data moves cleanly through the air
and is not running into a bunch of interference, there's no problems or competing signals in
my area.
There are several ways we can use this.
Cisco Spectrum Expert, MetaGeek, we could use that.
What we're doing is we're using the AP's antenna, let's say that that's the antenna there.
We're using the AP's antenna to receive the different frequencies and then pipe that into
one of these applications so then we can look at what is actually going on in the air
around us.
And we really are trying to find interference, that's what it's all about.
Our next mode, our administrative mode we use, and our last one we're going to be discussing
here is a sniffer.
A sniffer is dedicated to sniffing traffic.
Wireshark is absolutely a sniffer, a snorter.
These different OmniPeak, these are all things that you've used, well maybe you haven't used,
that you've heard of being used to sniff traffic and that's all we're talking about.
But AP's can do it as well.
AP's can be used, just like we were in the last, to take all those signals but this time
we're not looking for interference, we're looking to take that information, feed it
down into Wireshark or OmniPeak and take a look at what traffic's being generated.
This is a great troubleshooting tool, it can be also used in the security sense a hundred
million percent.
But what we're trying to do here is analyze what's the traffic going on, what's causing
traffic disconnect, client disconnects, what's going on in our environment that may be causing
issues.
All right, so those are the different modes you're going to see in your environment.
Remember those two websites I gave you, it'll be in your supplemental learning assets.
Please, please, please at least read through one time, if not two, to kind of get an idea.
And if you're ever looking at it and going, well that doesn't make sense, remember that
like FlexConnect cannot connect back to the wireless LAN controller, there's limited connectivity,
there's limited functionality.
If I can't connect back to the wireless LAN controller, there's a lot I can't do, such
as I cannot authenticate a new user if I can't get back to the wireless LAN controller.
And then remember this as well when we talk about FlexConnect with BridgeMode, we're taking
that even further when we have a point-to-point connection, AP-to-AP, then that traffic goes
back to a wireless LAN controller.
I just added a level of complexity, so even less features are going to work there.
All right, that's all I had for this one.
We have a couple more of these to go.
Thank you for your time.
I'll talk to you soon.