Data Forwarding Mode

Tunnel Forwarding

In tunnel forwarding mode, APs encapsulate user data packets over a CAPWAP data tunnel and send them to an AC. The AC then forwards these packets to an upper-layer network, as shown in Figure 1.

Figure 1 Tunnel forwarding

Direct Forwarding

In direct forwarding mode, an AP directly forwards user data packets to an upper-layer network without encapsulating them over a CAPWAP tunnel, as shown in Figure 2.

Figure 2 Direct forwarding

Centralized Authentication in Direct Forwarding Mode

If direct forwarding is used, service data does not need to be forwarded by an AC. When user access authentication (for example, 802.1X authentication) is required on a wireless user access network and the access control point is deployed on an AC, user authentication packets cannot be managed by the AC in a centralized manner. This makes controlling users in a uniform manner difficult. In direct forwarding mode, user authentication packets can be forwarded to the AC over the CAPWAP tunnel, as shown in Figure 3.

Figure 3 Centralized authentication in direct forwarding mode

Soft GRE Forwarding

When carriers need to deploy a WLAN using the open security policy on the live network, they require that the legacy BRAS devices implement authentication and accounting for wireless users. The soft GRE forwarding mode allows a BRAS device to perform Portal or MAC address authentication, achieving unified authentication and accounting for wired and wireless users. In such scenarios, the AC is usually connected to the network in bypass mode and is only responsible for AP management and wireless service configuration. The AP forwards data packets from wireless users to BRAS devices over soft GRE tunnels. The BRAS devices then forwards the packets to upstream network devices.

Figure 4 shows how data packets are forwarded in soft GRE forwarding mode.

Figure 4 Soft GRE forwarding

Comparison of Tunnel Forwarding, Direct Forwarding, and Soft GRE Forwarding