Other meanings of Wireless LAN
Computer networking
A wireless LAN controller (WLC) is a network device that centrally manages wireless access points (APs) in a large-scale deployment, handling tasks such as configuration, authentication, roaming, and radio frequency (RF) management. By offloading processing from individual APs, WLCs enable seamless client roaming, consistent security policies, and efficient traffic forwarding across the network.1
A wireless LAN controller acts as a central brain for a wireless network, shifting the intelligence from individual access points to a dedicated appliance, virtual machine, or cloud service.1 In a controller-based architecture, lightweight access points (LWAPs) rely on the WLC for authentication, encryption key management, and roaming decisions. This design simplifies network management: instead of configuring each AP separately, an administrator can apply global policies, monitor RF conditions, and push firmware updates from a single console. The controller also handles client traffic forwarding—either locally (bridged) or tunneled back to the controller—depending on the deployment model. Most enterprise WLCs support features such as load balancing, band steering, and rogue AP detection, all coordinated centrally.
The concept of centralized wireless control emerged in the early 2000s as Wi-Fi deployments grew beyond single APs. Early approaches used proprietary protocols, but the IEEE 802.11 working group standardized the Control and Provisioning of Wireless Access Points (CAPWAP) in RFC 5415 (2009).2 CAPWAP created a common framework for WLC-AP communication, splitting the MAC layer: time-sensitive functions (Beacon transmission, ACK) stay on the AP, while management and control operations move to the controller. Cisco’s introduction of the 2000 Series WLC in 2003 and later the Aironet series popularized the model. By the 2010s, vendors began offering virtual WLCs (vWLC) running on hypervisors, and cloud-managed solutions like Cisco Meraki shifted the controller to the cloud, enabling zero-touch provisioning.3
The core of WLC operation is the Split-MAC architecture, where the controller handles 802.11 management frames, authentication, and association, while the AP transmits beacons and processes data frames. CAPWAP encapsulates control and data traffic between AP and controller using UDP (ports 5246 and 5247).2 The controller maintains a database of associated clients, their security parameters, and roaming history. For seamless roaming, the WLC can forward client context to adjacent controllers via the Inter-Controller Protocol (IAPP) or using vendor-specific mechanisms. In large campuses, multiple WLCs can be deployed in a mobility group, allowing clients to roam without re-authentication. Some controllers also support clustering, where multiple units share a configuration and failover seamlessly.
WLCs can be deployed as physical appliances, virtual machines, or cloud-managed services. Physical controllers are typically rack-mounted devices with dedicated hardware for packet processing. Virtual WLCs (vWLC) run on VMware, Hyper-V, or KVM, offering flexibility at lower cost, but may have throughput limitations.4 Cloud-managed controllers (e.g., Cisco Meraki, Aruba Central) deliver the control plane as a SaaS platform, enabling remote management of geographically distributed APs. A less common but notable model is the embedded wireless controller—a switch or router with integrated WLC functionality, popular in small-to-medium businesses. Each model has trade-offs in latency, scalability, and administrative overhead. The choice often depends on the size of the deployment, required redundancy, and budget.
Beyond basic management, WLCs can perform advanced RF spectrum analysis and interference detection, often using dedicated radios on the APs to scan the air for non-Wi-Fi sources (e.g., microwaves, Bluetooth).5 Some controllers support hyperlocation—precise client tracking using fine timing measurement (FTM) and multiple APs, achieving accuracy below one meter. Another edge case is the tunneled versus direct forwarding mode: in tunnel mode, all traffic passes through the controller, which can inspect and enforce policies (useful for guest networks), but creates a bottleneck; in direct mode, traffic bypasses the controller, improving performance but limiting visibility. A lesser-known feature is band steering, where the WLC encourages dual-band clients to use the 5 GHz band to reduce congestion on 2.4 GHz. Also, WLCs often serve as a RADIUS proxy, offloading authentication to external servers while maintaining session state.
Wireless LAN controllers centralize security enforcement, including rogue AP detection, denial-of-service (DoS) mitigation, and client isolation. The WLC can triangulate rogue APs by correlating signal strength reports from multiple APs, and then block them or alert administrators. It also handles encryption key management, ensuring that each client gets a unique pairwise transient key (PTK) after authentication. For wireless intrusion prevention (WIPS), some controllers integrate with dedicated sensors or use in-band scanning. A vulnerability in the WLC itself—such as a firmware backdoor or a misconfigured management interface—can expose the entire wireless network. Therefore, controllers should be placed in a secure management VLAN, accessed via out-of-band management or encrypted protocols (SSH, HTTPS), and regularly patched.
Help improve the encyclopedia. Reports go straight to the site manager.