OEAP feature in Cisco wireless LAN controller

Question

First of all thank you everyone for helping me out and thank you for such a wonderful platform like this; it's been a boon to someone as novice like me.

Now my question is: I read about the Cisco's OEAP feature in wireless LAN controller, and I am confused if this feature needs a VPN to be set in both office and remote site, or does it work without a VPN as well? From the article, I understood there is no need for a VPN, but my client insists the only way to get this done is via VPN.

This is where I got the information: Configuring OfficeExtend Access Points

Answer 1

You are both somewhat right. In general, there are two reasons to use a VPN from a remote location:

1. Security. Encrypt traffic over the internet. This is always a good idea.
2. Reachability. If you're still using IPv4 (like everybody else), you're probably using private (RFC1918) addresses at one or both locations. The VPN will tunnel traffic across the internet so that hosts using private addresses can reach eachother without using NAT.

Both these points can be addressed by the OEAP without using a VPN, but this will require some additional steps.

1. Security. All traffic between access point and controller (CAPWAP tunnel) can be encrypted, but this might not be enabled by default. Also, if you want to authenticate the OEAPs properly, you might need to set up a proper PKI. Depending on the security policy at your company, this might or might not be enough.
2. Reachability. The OEAP needs to be able to reach the controller. This can be done by forwarding UDP ports 5246 and 5247 to the controller. If the controller uses a private IPv4 address, support for NAT must be enabled on the controller.

Check out CIsco's documentation for more details.