Skip to main content

How wireless is modeled

Forward models wireless at the forwarding layer. It represents how traffic moves between wireless clients, access points, controllers, and the wired network — SSID-to-VLAN mappings, CAPWAP tunnels, and the ACLs applied along the way. It does not model the RF layer: signal strength, channel assignment, roaming, and mobility domains are out of scope.

Controllers and access points​

A Cisco Catalyst 9800 WLC is modeled as a controller device. When its APs are modeled, Forward reads the controller's AP summary and creates one device per access point, named <controller>_<apName>. Each AP device carries its own model, OS version, and serial number, and shares the state collected from the controller.

Meraki MR access points are modeled as individual devices collected through the Meraki Dashboard, with their own interfaces, broadcast domains, ARP tables, and firewall ACLs.

Mist access points are modeled as individual devices collected through the Mist cloud, with their WxLAN micro-segmentation policy represented as ACLs. Mist support is a Tech Preview.

Aruba access points are not modeled as separate devices. The Aruba WLAN controller is modeled, and each ESSID appears as a tunnel interface that terminates on the controller; the APs' client traffic is represented on those controller interfaces rather than on standalone AP devices.

SSIDs and VLANs​

For every supported vendor, Forward maps each SSID to the VLAN that carries its traffic, resolving it from that vendor's configuration and state. The mechanism differs by vendor: Aruba reads the ESSID-to-VLAN association from the controller, and Mist takes the VLAN from the SSID configuration. On a Cisco WLC, Forward resolves the mapping through the configuration chain — AP, ESSID, SSID, wireless tag policy, wireless profile policy, VLAN — and supplements it with the per-client VLANs reported in the client summary, which captures dynamic (RADIUS/AAA) VLAN assignments.

Wireless clients​

A wireless client is modeled as a host attached to a device, with the SSID as its connected interface. Which device it attaches to follows the AP modeling:

  • Cisco (C9800), Meraki, and Mist — the client attaches to the individual AP device, on the SSID interface.
  • Aruba — because APs are not modeled as devices, the client attaches to the controller, on the ESSID interface (a tunnel that terminates on the controller). For an Instant AP, it attaches to the AP's VPN-link tunnel interface.

Associations are captured at snapshot time. A client that was not associated when the snapshot was taken does not appear until a later snapshot captures it.

Tunneled vs. locally switched SSIDs​

An SSID's traffic either tunnels to a central point before reaching the wired network, or is switched locally onto its VLAN at the point of attachment. Forward models both, and the modeling reflects each vendor's own scheme:

  • Cisco uses the terms Local mode (Central Switching) and FlexConnect (Local Switching). In Local mode the AP encapsulates client traffic in a CAPWAP tunnel to the WLC, which switches it onto the wired network — the dataplane passes through the controller, and Forward models the CAPWAP tunnel between AP and controller. In FlexConnect the AP switches traffic locally onto the SSID's VLAN, and the dataplane does not traverse the WLC. Forward surfaces the SSID's mode so you can see which applies.
  • Aruba models each ESSID as a tunnel that terminates on the controller, so tunneled ESSID traffic is represented on the controller (see Wireless clients above).
  • Meraki models per-SSID VPN tunnels on the MR when an SSID is configured to tunnel to a concentrator; otherwise the SSID is switched locally onto its VLAN.
  • Mist models each SSID as switched locally onto its VLAN: a client is tagged with its reported VLAN when the SSID has VLANs enabled, and left untagged otherwise. Mist tunneling to a concentrator is not modeled.

Access points in topology​

Modeled APs are bundled in the topology under the switch they connect to (for example, "APs @ Switch01") to keep the map readable. You can adjust or turn off this bundling — see Access point bundling.

Path analysis with wireless clients​

Where a path enters the model on the wireless side follows where the client host attaches:

  • Cisco (C9800), Meraki, and Mist — the path starts at the AP device, on the SSID interface. For Cisco, in Local mode it then crosses the CAPWAP tunnel to the controller; in FlexConnect it is switched locally onto the SSID's VLAN and does not traverse the controller.
  • Aruba — with no AP device, the path starts at the controller, on the ESSID (or Instant-AP VPN-link) interface.

Cisco, Meraki, and Mist APs all consume peripheral licenses, so an AP that isn't licensed is not in the model — and a wireless client on that AP then has no ingress point for a path. For Cisco this is decided before collection: without peripheral capacity the WLC's APs are never created. Meraki and Mist APs are always collected and are instead skipped at snapshot processing when they exceed the peripheral cap. Aruba APs are not modeled regardless, so their clients always enter at the controller. See Licensing.