How is CAPWAP data traffic encapsulated for an Over-the-Top WLAN in Cisco SD-Access?

In Cisco SD-Access, for an Over-the-Top (OTT) WLAN, CAPWAP data traffic is encapsulated using VXLAN. This allows the wireless traffic to be carried over the underlay network, extending the Layer 2 segment across the Layer 3 fabric. VXLAN provides the necessary overlay encapsulation to tunnel the CAPWAP data plane between the Access Point (AP) and the Wireless LAN Controller (WLC), which might be located anywhere in the fabric. LISP (Locator/ID Separation Protocol) is used for host mobility and routing within SD-Access, not for encapsulating CAPWAP data. GRE (Generic Routing Encapsulation) is a general-purpose tunneling protocol but is not the chosen encapsulation for CAPWAP data in SD-Access OTT WLANs. IPsec is used for secure tunneling, primarily for control plane security or remote access VPNs, not for the data plane encapsulation of CAPWAP in this context.