Wireless client reach — probe through the joined controller

• Services & wireless
• Advanced
• 12 min
• 2 steps
• Cisco IOS-XE-style

Open this lab in your browser →

Free · no install · no account

Scenario

Slices A–E built the controller-managed wireless model end-to-end. Slice F closes the operator-facing question: "from a wireless client on this AP, can I reach 10.30.0.5?" The CAPWAP tunnel is conceptually transparent at this layer of abstraction. From the wired network's perspective, a wireless client *lives* in the policy-profile's egress VLAN — the AP encapsulates client frames into CAPWAP-Data and the controller decapsulates them into that VLAN. So computing reach from a wireless client reduces to computing reach from any host in that VLAN. The resolver flow: 1. Look up the AP's apJoin.policyTag → fetch the controller's policy tag → first WLAN/policy entry. 2. Resolve the policy profile → take its vlan. 3. On the controller, find the interface named Vlan{N} (the SVI). Its first address is the gateway. 4. Allocate a free IP in the SVI's subnet — that's the synthetic client source. 5. Issue a probe: sendPing(controller, src=synthetic, dst=target) and emit a trace ID. What this slice ships: - The pure-function computeWirelessClientSource(sim, apId) resolver. - The CLI show wireless client-reach <ip> on the AP that prints the resolved hop info and issues the probe. - The probe rides the existing reach pipeline — no new packet types, no new edges in the topology graph. What this slice does *not* ship: actual CAPWAP-Data wire encap/decap. The frame goes from the controller out the SVI, not from the AP encapsulated. For most reach assertions this distinction doesn't matter — the SVI is where the wireless client effectively appears. If you need the wire-level encap (e.g. assessing access-list behaviour on the AP-controller path itself), that's the territory of a future slice that would extend the frame layer. Reach semantics: because the synthetic source has no real responder, we assess *one-way* reach (the probe arrives at the destination). Round-trip would require modelling a wireless-client device proper.

Topology

2 × router, 1 × wireless controller, 1 × switch, 1 × access point · Cisco IOS-XE-style

• ROUTER — router
• WLC1 — wireless controller
• HUB — switch
• AP1 — access point
• DEST — router

What you will do

1. Verify AP1 has joined WLC1. show capwap client summary should report phase: joined.

2. On AP1, run show wireless client-reach 10.30.0.5. The output should resolve VLAN 30, gateway 10.30.0.1/24, synthetic client 10.30.0.2, and emit a probe trace ID.

Open this lab in your browser →

More labs on this topic

• Configure a DHCP serverBeginner · 12 min
• WLAN — broadcast a basic SSIDBeginner · 10 min
• HSRP: configure first-hop redundancyIntermediate · 12 min
• NAT: PAT (overload) for an inside LANIntermediate · 14 min
• HSRP — interface tracking with priority decrementIntermediate · 12 min
• VRF-Lite — two customers on one routerIntermediate · 12 min

This lab in other languages

Reichweite des drahtlosen Clients – Sonde über den angeschlossenen ControllerAlcance del cliente inalámbrico: sonda a través del controlador unidoAlcance do cliente sem fio — investigue o controlador unidoPortée du client sans fil: sonde via le contrôleur jointवायरलेस क्लाइंट पहुंच - जुड़े हुए नियंत्रक के माध्यम से जांच करें无线客户端到达 — 通过连接的控制器进行探测Portata del client wireless: sondare il controller collegatoワイヤレス クライアント リーチ - 参加しているコントローラーを介してプローブします무선 클라이언트 연결 - 결합된 컨트롤러를 통한 프로브Доступ к беспроводному клиенту — проверка подключенного контроллераKablosuz istemci erişimi — birleştirilmiş denetleyici aracılığıyla taramaTiếp cận khách hàng không dây - thăm dò thông qua bộ điều khiển đã kết nối