Cisco 350-401: Wireless Infrastructure and Mobility — Study Guide

By Laurynas Brazys · 15 August 2026 · #cisco #350-401 #certification #exam-prep #study-guide

Part of the Cisco CCNP Enterprise 350-401 ENCOR — Study Guide. Practice with verified answers in the Cisco exam hub, or take timed practice tests on ExamRoll.io.

Overview

Enterprise wireless connects users, devices, and IoT at scale while preserving security, performance, and operational visibility. Designing and operating it well requires understanding architectures, control/data-plane behavior, RF engineering, onboarding and segmentation, mobility mechanisms, QoS for real-time apps, and a disciplined lifecycle. This section provides design reasoning, operational guidance, and common failure modes for modern Cisco-centric deployments, including traditional controller-based, cloud-managed, and fabric-enabled wireless.

Architectures, Roles, and Control/Data Planes

Wireless architectures differ in where control and policy live and how traffic is handled:

• Autonomous APs: Each AP makes all decisions and bridges traffic locally. Pros: simple for very small sites, no controller dependency. Cons: poor scalability, fragmented policy/visibility, manual RF coordination, limited fast roaming. Failure modes: inconsistent configs, channel overlap, slow security feature adoption.

• Controller-based (on-prem WLC): APs run a split-MAC model and form CAPWAP tunnels to a Wireless LAN Controller. The WLC centralizes control-plane functions (AP join, configuration, 802.11 management, RRM), and can central-switch data (tunnel user traffic to WLC) or local-switch it at the edge (FlexConnect). Pros: scale, consistent policy, fast roaming, RRM. Trade-offs: WLC sizing and HA required; central switching adds latency and hairpin risk.

• Cloud-managed: APs or wireless gateways are managed by a cloud controller; data may remain local or traverse cloud gateways depending on design. Pros: simplified ops, easy multi-site management. Trade-offs: dependency on Internet for management; be clear on where data egresses.

• Embedded controllers: A controller function hosted inside an AP or switch (for example, embedded wireless controller on Catalyst APs). Pros: branch autonomy, fewer appliances. Trade-offs: scale/feature ceilings compared to full WLCs, alignment of code and capabilities across sites.

WLC and AP roles

• WLC: Central policy and RF control; maintains AP database; runs Radio Resource Management (RRM) to compute channel/power; terminates CAPWAP control; may terminate data when central switching is used; enforces QoS, ACLs, and AAA policy.
• AP: Executes radios, beacons SSIDs, handles 802.11 MAC in split-MAC (timing-critical functions at AP), converts 802.11 frames to 802.3 for forwarding. In SD-Access wireless, fabric APs are part of the overlay and are typically in local mode and directly connected to a fabric edge.

CAPWAP, control vs data

• Control path: AP-to-WLC CAPWAP control is always present. Ensure MTU accommodates CAPWAP + IPsec if used; PMTU black holes can cause AP instability.
• Data path options:
  • Central switching: User frames tunnel to WLC, then bridge/route. Simplifies segmentation but can add latency and bottlenecks.
  • Local switching (FlexConnect): Data exits at AP’s switch port site-locally; policy pushed centrally. Useful for branches. Requires careful VLAN consistency and DHCP/ACL design.
  • Fabric-enabled SSID (SD-Access): AP converts 802.11 to 802.3 and encapsulates into VXLAN toward the fabric edge; end-to-end policy and segmentation ride in the overlay.

Common join failures and mitigations

• AP certificate or time mismatch: Use NTP for WLC and APs; verify MIC/SSC trust; avoid deep inspection that breaks DTLS.
• Regulatory domain mismatch: Align country codes and allowed channels.
• CAPWAP reachability: Permit UDP/5246–5247, ensure NAT traversal if applicable, and validate jumbo/MTU.

RF Fundamentals and WLAN Constructs

Bands and channels

• 2.4 GHz: Three non-overlapping 20 MHz channels (1, 6, 11). Long range, high interference (Bluetooth, microwaves). Limit or disable in dense, performance-sensitive designs.
• 5 GHz: Many 20 MHz channels across UNII-1/2/2e/3/4 with DFS considerations. Preferred for capacity and VoWLAN. DFS events can trigger channel changes—monitor for false positives and radar adjacency.
• 6 GHz (Wi‑Fi 6E): Large contiguous spectrum; 20/40/80/160 MHz with no legacy clients. WPA3 and Protected Management Frames (PMF) are mandatory. Automated Frequency Coordination may apply outdoors.

Channel width trade-offs

• 20 MHz: Highest concurrency and reuse; best in dense enterprise.
• 40/80/160 MHz: Higher peak throughput per client but fewer unique channels; risky in high-density; may exacerbate co-channel contention.

Power and TPC

• Keep AP transmit power near client power to avoid sticky clients; allow RRM TPC to reduce power where cells overlap. Excess power increases contention and hidden-node problems.

Interference types

• Co-channel interference: Too few unique channels or overpowered cells.
• Adjacent-channel interference: Overlapping width or misaligned channels.
• Non-802.11 interferers: Bluetooth, DECT, microwaves, cameras. Use spectrum analysis/CleanAir-equivalent to locate and mitigate.

SSID, BSSID, and WLAN profiles

• SSID is the network name; each SSID per radio spawns a unique BSSID. Too many SSIDs increase beacon/overhead; target 4–6 or fewer.
• WLAN profile ties SSID to security, QoS, and policy profile. Map to VLAN/VRF or to overlay segmentation (for example, SGTs) depending on architecture.

Client onboarding sequence

• Discovery/scanning → Authentication/association → Key management (4-way handshake or SAE) → DHCP/DNS → captive portal/CoA if guest.
• Common pitfalls: disabled low data rates can break legacy clients; DHCP or DNS failure looks like WLAN failure; MAC randomization may impact NAC/profiling.

Security, Segmentation, and Onboarding

WPA2, WPA3, and 802.1X

• WPA2-Enterprise: 802.1X with AES-CCMP; mature and widely supported.
• WPA3-Personal: SAE replaces PSK to mitigate offline dictionary attacks.
• WPA3-Enterprise: 802.1X with PMF required; 192-bit mode for high-assurance use cases.
• PMF (802.11w): Mandatory for WPA3; strongly recommended for WPA2. Mismatches cause association failures—use transition modes judiciously.

RADIUS and policy

• Use redundant RADIUS servers; enable session-timeout and Change of Authorization for post-connect policy changes; prefer EAP-TLS for certificate-based identity.
• Dynamic policy: Assign VLAN, dACL, SGT, or QoS per user via RADIUS attributes; in fabric, prefer group-based policies over VLAN sprawl.

Guest access and anchoring

• Central web authentication with a guest anchor WLC in a DMZ isolates guest traffic. Clients associate to a foreign WLC/AP; a mobility tunnel anchors traffic to the DMZ WLC for egress. Failure modes: anchor reachability loss causes guest outage; ensure mobility groups are correctly defined and NAT/firewall rules allow mobility control/data.

Wireless segmentation options

• VLAN per SSID or dynamic VLANs via RADIUS.
• VRF and SGTs for scalable segmentation; in SD-Access, VXLAN carries VN/SGT in the fabric overlay, decoupling SSIDs from L2 constraints.
• IoT: Use MPSK/Identity PSK or EAP-TLS where possible; isolate with ACL/SGT and rate-limit.

Short, useful configuration examples (Catalyst 9800 syntax)

Define RADIUS and 802.1X list: radius server ISE1 address ipv4 10.10.10.10 auth-port 1812 acct-port 1813 key 0 MySecretKey ! aaa new-model aaa group server radius ISE server name ISE1 ! aaa authentication dot1x DOT1X-LIST group ISE

Create an 802.1X WLAN and map policy: wlan CORP 10 CORP security wpa akm dot1x security pmf optional no shutdown ! wireless profile policy CORP-POLICY vlan 20 aaa-override ! wireless tag policy CORP-TAG wlan CORP policy CORP-POLICY

Mobility, QoS, Design, Monitoring, and Lifecycle

Roaming and mobility groups

• Intra-controller roaming: Fast and transparent when all APs share the same WLC and mobility group; opportunistic PMK caching/OKC and 802.11r reduce re-auth time.
• Inter-controller roaming: Requires mobility groups so WLCs share client context; a roam may be L2 (same subnet) or L3 (different subnet) with mobility tunnels maintaining IP continuity.
• 802.11k/v/r: k provides neighbor reports, v assists BSS transition, r speeds key establishment (FT over-the-air/over-the-DS). Enable for real-time voice only if client base supports it; mixed support can lead to association failures.
• SD-Access wireless: APs are part of the fabric overlay; user traffic is VXLAN-encapsulated toward fabric edges. Roams between APs on different access switches remain seamless via the fabric control plane.

Wireless QoS and real-time apps

• WMM access categories: Voice, Video, Best Effort, Background. Map DSCP to UP appropriately; mark upstream and preserve markings over CAPWAP/VXLAN.
• Call Admission Control (TSPEC/ACM): Prevent oversubscription of voice AC; enable on SSIDs carrying voice and tune per AP cell.
• Multicast optimization: Convert to unicast or use 802.11ac/ax enhancements; avoid low basic rates that force slow multicast.
• Wi‑Fi 6/6E features: OFDMA improves latency by scheduling resource units; BSS Coloring reduces contention in spatial reuse; tune target wake time for IoT power savings.

AP placement, coverage, and capacity

• Coverage targets: For data, −67 dBm minimum with SNR ≥25 dB; for voice, often −65 dBm and packet loss <1%. Overlap 15–20% at cell edges on 5 GHz; avoid coverage holes in stairwells/elevators.
• Capacity planning: Size for client count and application airtime, not just RSSI. Prefer 20 MHz channels, disable or limit 2.4 GHz in dense spaces, and set minimum basic rates to 12–24 Mbps to reduce airtime beacons while ensuring compatibility.
• Antennas: Select patterns that fit the environment; use directional antennas for aisles/warehouses; match EIRP to regulatory limits.
• Site surveys: Predictive modeling for initial design; pre-deployment validation; active/post-deployment surveys to verify real performance. Re-survey after layout or inventory changes.

Wireless monitoring and troubleshooting

• Telemetry: Stream WLC/AP metrics to your NMS; enable syslog; use assurance platforms for client journey analytics (association, authentication, DHCP, DNS).
• Spectrum analysis: Identify non-802.11 interference and DFS events; track duty cycles.
• Per-client triage:
  • Association/authentication: Check security settings, PMF, 802.11r compatibility, and certificate trust (for EAP-TLS).
  • IP layer: DHCP options, scope exhaustion, relay helpers, and DNS reachability.
  • Mobility: Sticky clients due to power asymmetry; validate 802.11k/v neighbor lists; excessive RRM changes disrupting sessions.
  • Data path: CAPWAP/VXLAN MTU and fragmentation; ACLs or firewall blocking RADIUS/CoA or mobility control.
• Common failure modes: too many SSIDs causing high beacon airtime; DFS channel changes dropping real-time calls; RADIUS timeouts due to asymmetric routing; guest portal redirect blocked by HTTPS interception.

Secure wireless lifecycle management

• Image and config governance: Standardize WLC/AP code; use staged and rolling AP upgrades; maintain N+1 controller HA.
• Certificates and PKI: Automate 802.1X EAP-TLS enrollment with SCEP/EST; monitor expirations; secure CAPWAP/DTLS ciphers; rotate RADIUS secrets.
• Policy hygiene: Regularly review SSIDs, disable unused ones, rotate PSKs or migrate to MPSK/EAP-TLS; audit dACL/SGT policies; minimize exception rules.
• RRM hygiene: Constrain DCA/TPC ranges; lock channels/power where needed (high-density auditoriums); baseline RF and compare after changes.
• Backups and testing: Schedule configuration backups; synthetic client tests for onboarding and captive portal; chaos testing for controller failover and anchor mobility.

Practical Problem Scenario

Contoso Financial is migrating a 12-floor headquarters to Wi‑Fi 6E, consolidating four legacy SSIDs, enabling certificate-based access, and supporting softphone voice and trader video with minimal disruption. The wired campus is an SD-Access fabric; guest traffic must egress a DMZ, and the firm has frequent AP join issues during maintenance windows.

Approach

1. Rationalize SSIDs and define WLAN profiles

• Create three SSIDs: CORP (802.1X EAP‑TLS), GUEST (open with web auth), and IOT (MPSK).
• Rationale: Fewer SSIDs reduce airtime overhead; distinct security modes map to clear policy. WPA3/PMF on CORP and IOT improves resilience; GUEST uses captive portal for ease of use.

2. Implement certificate-based 802.1X with resilient RADIUS

• Integrate WLC with redundant ISE nodes; enforce EAP‑TLS; enable CoA and dynamic policy (SGT and VLAN override).
• Rationale: EAP‑TLS eliminates shared secrets and supports per-user segmentation. CoA allows post-auth role changes (for example, posture compliant).

3. Enable fabric-enabled SSIDs for CORP and IOT; anchor GUEST to DMZ WLC

• Tag APs as fabric APs; map SSIDs to virtual networks/SGTs; ensure VXLAN toward fabric edges. Configure mobility anchors for GUEST to a DMZ WLC pair.
• Rationale: Fabric preserves policy end-to-end without VLAN sprawl; anchoring isolates guest and simplifies Internet egress and compliance.

4. Design RF with 6 GHz primary, 5 GHz secondary, minimal 2.4 GHz

• Use 20 MHz channels in dense office areas; limit to 40 MHz only in low-density zones; disable 2.4 GHz except in break rooms and IoT areas. Constrain DCA to non-DFS where radar is prevalent; set TPC to match typical client power (14–17 dBm EIRP).
• Rationale: Maximizes concurrency and minimizes contention; avoids DFS-driven call drops; power symmetry reduces sticky clients.

5. Prepare fast, reliable roaming for voice and trading apps

• Enable 802.11k/v globally and 802.11r on CORP after validating client compatibility; tune neighbor list thresholds; enable CAC for voice with TSPEC.
• Rationale: Assisted roaming reduces handoff latency; CAC prevents airtime oversubscription that would degrade MOS.

6. Harden AP join and controller resilience

• Verify NTP and certificate trust; increase CAPWAP MTU if needed; allow CAPWAP/DTLS through firewalls; deploy N+1 WLC with AP join load-balance and HA SSO.
• Rationale: Time and trust are common join blockers; proper HA prevents mass AP flaps during maintenance.

7. Execute a phased site survey and validation

• Predictive design followed by floor-by-floor active surveys; lock channels/power in trading floors; set minimum basic rates to 12–24 Mbps; measure SNR, MCS, and latency under load.
• Rationale: Validates real RF conditions; reduces RRM churn in critical zones; enforces performance baselines.

8. Implement QoS end-to-end

• Map DSCP-to-UP and preserve markings in CAPWAP/VXLAN; enable voice CAC; convert multicast video streams to unicast where feasible.
• Rationale: Ensures consistent priority and bounded latency/jitter for real-time apps.

9. Monitor and iterate using assurance and spectrum tools

• Stream telemetry from WLC/APs; create dashboards for client onboarding stages; alert on DFS events and RRM changes; use spectrum analysis to locate interferers.
• Rationale: Shortens mean time to innocence and identifies RF or AAA bottlenecks quickly.

10. Institutionalize secure lifecycle practices

• Standardize on a tested WLC/AP code; schedule rolling AP upgrades; rotate PSKs on IOT quarterly; monitor certificate expirations; quarterly policy/RRM reviews.
• Rationale: Prevents drift, reduces exposure, and sustains performance as the environment evolves.

← IP Services · All domains · Network Virtualization →

Practice these questions → · Timed practice on ExamRoll.io →