11.3 DHCP, DNS, Time, VLANs and AAA

Northbridge’s new APs associate voice badges in seconds. Users still open tickets that say “Wi-Fi is down.” One morning the guest portal is blank. Another morning EHR laptops associate and sit on 169.254.x.x. A third morning 802.1X fails because AP clocks are in 2019 and RADIUS certificates look unborn. CWNA-109 Objective 4.5 is the wired and IP scaffolding under the air: DHCP, DNS, time, VLANs, authentication services, ACLs, and wired capacity. Domain 6 will ask you to troubleshoot these faults; this section teaches you to design and recognize them so you do not blame SNR for a dead DHCP helper.

This OpenExamPrep section is independent CWNA-109 study material by OpenExamPrep. It does not claim CWNP approval, partnership, or exact equivalence with CWNP training.

DHCP (Objective 4.5.1)

Clients. Each wireless VLAN needs a pool, a mask, a default gateway, DNS options, a lease time sized for the mobility pattern, and enough addresses for peak association count plus roam remnants. A lecture hall that peaks at 200 guests needs more than 50 leases. DHCP relay / IP helper on the Layer 3 gateway forwards Discover packets when the server is not on that VLAN. Option 82 (DHCP relay information) appears in some campus designs so the server can pick a pool by switch port or AP circuit; treat it as awareness, not a CWNP-mandated option number list.

APs. Lightweight or cloud APs often take an address from a management VLAN pool so they can reach a controller or cloud. Static addressing is valid; DHCP is common at scale. If the AP never gets an address, it never joins, and the SSID never appears — which still looks like “Wi-Fi is down.”

Controller discovery. Besides a pre-provisioned IP or local Layer 2 discovery, many architectures put a vendor-specific DHCP option (Option 43 is a widely used example; the payload is vendor-specific, not a universal IEEE field) or a DNS name that APs resolve to find the controller. Objective 4.5.1 groups these jobs: client addressing, AP addressing, and/or controller discovery. When an AP boots forever in “discovering,” check DHCP options and DNS before you replace radios.

Trap: the station shows associated and authenticated, but has no usable IP. That is DHCP (pool exhausted, helper missing, wrong VLAN, rogue server, or ACL dropping UDP/67–68), not a coverage hole. Another trap: a too-short lease that forces renewals during voice calls, or a too-long lease that holds addresses after 200 guests leave.

DNS (Objective 4.5.2)

Clients need DNS to reach applications. 802.11 association does not replace name resolution. A laptop can have a perfect IP and still look offline if Option 6 pointed at a dead resolver, if split-horizon DNS does not include the EHR hostname, or if a guest ACL allowed DHCP but blocked UDP/53.

APs need DNS too: controller hostnames, NTP servers referenced by name, cloud dashboards, firmware URLs, and sometimes captive-portal redirection hosts. An AP with a static IP and empty DNS settings can join a controller by raw IP and still fail later when a certificate CRL or image fetch uses a hostname.

Captive portals are DNS-sensitive. Phones probe well-known URLs. If you hijack all DNS too aggressively, or if you fail to allow the portal hostname, the OS never draws the login page. mDNS / Bonjour across VLANs is a separate campus design (printer discovery); do not confuse it with recursive DNS for the Internet.

Trap: “Wi-Fi connected, Internet broken” with a valid IP and gateway ping — start with DNS, not with a new survey.

Time synchronization: NTP and SNTP (Objective 4.5.3)

Network Time Protocol (NTP) and Simple NTP (SNTP) set clocks on APs, controllers, RADIUS servers, and syslog collectors. SNTP is a simpler client mode; the design point is a reachable time source, not the full NTP stratum graph.

Wrong time breaks:

• Certificate validity (not-yet-valid or expired), so 802.1X, HTTPS management, and captive-portal TLS fail
• Log correlation across APs and RADIUS (you cannot reconstruct a roam)
• Some Kerberos / EAP methods and fast-roam token lifetimes
• Scheduled firmware and configuration windows

Northbridge once found every clinic AP 18 months slow after a DHCP option pointed NTP at a decommissioned host. Badges associated on Open authentication SSIDs; the 802.1X SSID failed. The heatmap was perfect.

Point APs and controllers at internal NTP (or a documented public pool if policy allows), allow UDP/123, and monitor offset. Do not leave factory clocks.

VLANs for segmentation (Objective 4.5.4)

The air is one medium; the wired edge is where you split trust. Typical SSID-to-VLAN maps: employee, voice, guest, IoT/scanners, AP management. Trunk the AP (or controller) port. Do not put guests untagged on the native VLAN that also carries AP management.

Dynamic VLANs from RADIUS (commonly Tunnel-Private-Group-ID in campus designs) let one SSID drop clinicians and contractors onto different VLANs after 802.1X. That is still a VLAN design: the switch and controller must allow those VLAN IDs, or the station authenticates and then black-holes.

Voice on its own VLAN eases QoS marking and keeps scanner broadcast domains away from badges. Guest on its own VLAN makes the ACL in 4.5.6 writable. Overlapping IP space across sites is a WAN problem; overlapping VLAN IDs on a mis-trunked AP is a local outage.

Authentication services: RADIUS and LDAP (Objective 4.5.5)

802.1X on the WLAN uses three roles: supplicant (client), authenticator (AP or controller), authentication server (usually RADIUS). LDAP is typically the identity store RADIUS queries, not the on-the-air EAP protocol. Designers still must provide LDAP reachability, bind accounts, and certificates if LDAPS is used.

RADIUS needs a shared secret matching the authenticator, reachability (commonly UDP/1812 authentication and UDP/1813 accounting — older deployments may still use 1645/1646), sensible timeouts, and a backup server. If RADIUS is down, the SSID can beacon while every EAP attempt fails. That is not an RF outage. CoA (Change of Authorization) appears in guest/BYOD workflows when a portal or NAC wants to reassign VLAN or ACL mid-session; awareness is enough on CWNA-109.

Place RADIUS so roam latency stays inside voice budgets (section 11.1). A RADIUS round-trip across a congested WAN will drop badges even when local SNR is 30 dB.

ACLs for segmentation (Objective 4.5.6)

VLANs separate broadcast domains; access control lists enforce who may talk after routing. Guest ACL pattern (illustrative, not a CWNP template): permit DHCP, permit DNS, permit the portal, permit HTTP/HTTPS to the Internet, deny RFC1918 and AP management. Employee ACLs may block IoT from initiating into EHR. Controller role-based firewalls and switch ACLs are both in scope as segmentation tools.

ACL order matters. A wide allow-any before a deny-internal never fires the deny. A deny-all that forgot DHCP recreates the “associated, no IP” ticket. Log drops during commissioning.

Wired network capacity (Objective 4.5.7)

RF can deliver hundreds of megabits per radio. The access switch, uplinks, and WAN must keep up.

• AP uplink speed: a dual-band Wi-Fi 6 AP on a 100 Mbps or duplex-mismatched port becomes the bottleneck. Multi-gig (2.5G/5G) appears where radio aggregate exceeds 1G; know the awareness that uplink rating matters, not a vendor SKU list.
• Oversubscription: forty APs on 1G access ports feeding a 10G uplink is a 4:1 access-to-uplink ratio if all radios busy — sometimes acceptable, sometimes not during grand rounds plus guest WAN.
• WAN / Internet: guest traffic leaves the campus. A 50 Mbps circuit behind 200 portal users is a capacity miss that still looks like WLAN failure.
• Jumbo frames awareness: some controller tunnels (for example CAPWAP-style encapsulations in many architectures) add headers. If the path MTU is 1500 and inner frames plus tunnel exceed that, you get fragmentation or silent drops. Enabling jumbo frames on one switch and not the next is a classic mismatch. Jumbo frames are not mandatory for every WLAN; you must know they exist and that MTU inconsistency is a supporting-network fault.
• Speed/duplex mismatches and PoE budget also starve APs; PoE sizing is Objective 4.1, but a brown-out AP is still a wired-capacity cousin.

The exam trap: the WLAN looks down when DHCP, DNS, or NTP is the fault

Walk this order when a Northbridge user says the wireless network failed:

1. Is the station associated? If no, then RF, SSID, or security mismatch (later domains) lead.
2. Does it have a DHCP lease on the correct VLAN? If no, helper, pool, ACL, or trunk.
3. Does DNS resolve a known host? If no, Option 6, ACL, or split DNS.
4. For 802.1X or captive HTTPS: is the clock sane, and is RADIUS answering?
5. Only then retune power, channels, or “add an AP.”

Objective 4.5 is how you keep those services in the design so Domain 6 has less to fix.

On the exam

• DHCP serves clients, APs, and discovery, not only laptops.
• DNS is required on both sides of the air.
• NTP/SNTP failures impersonate security outages.
• VLANs + RADIUS/LDAP + ACLs are the segmentation stack.
• Wired uplinks and MTU can cap a perfect heatmap.
• Associated ≠ working.

Key Takeaways

• Design every SSID with a pool, a resolver, a clock, a VLAN, and an ACL that still allows onboarding.
• Controller discovery is a network service, not magic inside the radio.
• Blame RF last when IP, names, time, or AAA are unproven.