CCNA Wireless Principles and Client Connectivity: Bands, RF, Security and Troubleshooting

Wi-Fi uses three unlicensed bands, and the choice is a trade-off: lower frequencies travel further and pass through obstacles better, while higher frequencies offer more channels, more capacity and less congestion. At the same transmit power, a 2.4 GHz signal covers the largest area, a 5 GHz signal less, and a 6 GHz signal less again, because free-space path loss and absorption by walls and objects both rise with frequency.

The 802.11 amendments map onto these bands, which is how you know which clients can use which band:

Pick the band from the requirement in front of you. If the goal is the greatest coverage per AP for low-rate devices, 2.4 GHz wins. If the goal is capacity, 5 GHz is the default, and 6 GHz is the cleanest choice when every client supports it.

Plan channels so that neighbouring APs never partly overlap, and choose a width that leaves enough channels for every nearby AP to have its own. The rules differ per band.

2.4 GHz: channels 1, 6 and 11

2.4 GHz channel centres are only 5 MHz apart, but an 802.11 transmission is about 20-22 MHz wide. A channel therefore overlaps its neighbours up to four channels away, and the only set of three that do not overlap in the US (channels 1-11) is 1, 6 and 11. Any plan that puts neighbouring APs on channels fewer than five numbers apart places partly overlapping signals side by side, which causes adjacent-channel interference. Using 40 MHz in 2.4 GHz consumes two of the three channels, so 2.4 GHz stays at 20 MHz in any multi-AP design.

5 GHz: UNII sub-bands and DFS

Channels in the 5 GHz band are 20 MHz apart, so adjacent numbered channels (36, 40, 44, 48) do not overlap. In the US the band is divided into sub-bands:

Dynamic Frequency Selection (DFS) exists because UNII-2 and UNII-2e are shared with radar (weather, airport and military). An AP on a DFS channel must listen for radar; when it detects radar it must stop transmitting on that channel quickly, move to another channel and stay off the radar channel for a non-occupancy period (30 minutes under FCC rules). Clients disconnect or are re-steered during the move, so users see brief, repeated drops. The obligation is to vacate the channel itself: any change that leaves the AP transmitting on the radar channel does not satisfy DFS. Near an airport, keeping APs on UNII-1 and UNII-3 avoids the events: each of those sub-bands holds one 80 MHz block (36-48 and 149-161). On newer APs, where regulators permit it, the FCC's UNII-4 channels (169-177) extend UNII-3 enough for a second 80 MHz block; the classic CCNA plan stops at 165.

Channel width: per-client speed versus channel reuse

Wider channels bond adjacent 20 MHz channels into one: 40 MHz uses two, 80 MHz four, 160 MHz eight. That raises the peak data rate for capable clients, but every doubling of width halves the number of non-overlapping channels, and a wider receiver also hears more noise (about 3 dB more per doubling). The choice is spectrum per AP against the number of channels available for reuse; coverage is set by power, band and the environment.

High-density designs also tend to raise the minimum mandatory data rate, which shrinks cells and stops slow frames from hogging airtime.

6 GHz

The 6 GHz band (Wi-Fi 6E and later) adds 1200 MHz in the US: up to 59 non-overlapping 20 MHz channels, 14 at 80 MHz and 7 at 160 MHz. It has no legacy clients to slow it down, which is why it suits high-density, all-new-device deployments.

A radio signal weakens with distance and changes as it meets objects, and a client's experience depends on how strong the signal is compared with the background noise. Five behaviours describe what happens when the signal meets the environment:

Higher frequencies lose more to absorption and path loss, which is why 5 and 6 GHz cells are smaller. A survey of an empty venue overstates coverage for a full one, because people absorb RF energy.

dBm, RSSI, noise and SNR

Wi-Fi power is measured in dBm (decibels relative to 1 milliwatt). Received values are negative, and values closer to zero are stronger: -60 dBm is stronger than -70 dBm. Every 3 dB doubles (or halves) the power, and every 10 dB is a factor of ten.

• RSSI (received signal strength) is how loud the AP is at the client, in dBm.
• Noise floor is the background RF energy on the channel, in dBm.
• SNR (signal-to-noise ratio) in dB = RSSI (dBm) minus noise (dBm). Example: -64 - (-91) = 27 dB.

SNR, not RSSI alone, decides which data rates a client can sustain. A spot with RSSI -59 dBm and noise -81 dBm (SNR 22 dB) performs worse than one with -66 dBm and -97 dBm (SNR 31 dB), even though its signal is stronger. When RSSI stays steady but the noise floor climbs, SNR falls, which points to a new interference source rather than a coverage problem.

Cisco's design guidance for voice over Wi-Fi is a minimum signal of -67 dBm at the cell edge and an SNR of at least 25 dB. A reading must meet both: -72 dBm fails the signal target even if SNR were fine, and a 21 dB SNR fails the voice target even with a strong signal.

Four generations of Wi-Fi security appear in the exam topics, and each is defined by how it authenticates and which cipher protects data frames:

The WPA3-Enterprise 192-bit mode (aligned with the CNSA suite) uses GCMP-256 for data, with HMAC-SHA-384 and P-384 elliptic-curve suites. Clients must support that exact suite to join it; a client that supports only the ordinary 128-bit cipher cannot.

Protected management frames (PMF, 802.11w) encrypt and authenticate management frames such as deauthentication, so an attacker cannot easily kick clients off. PMF is optional in WPA2 and required in WPA3-only networks.

Each protocol comes in more than one mode, which decides who is authenticated and how. The next section compares the modes.

The modes differ in what proves a client may join: Personal uses one shared passphrase, Enterprise checks each user's own credentials against a server, and Enhanced Open authenticates nobody but still encrypts each client's traffic.

WPA3-Personal and SAE

Simultaneous Authentication of Equals (SAE) replaces the WPA2 pre-shared key exchange. With WPA2-PSK, an attacker who captures one four-way handshake can test passphrases offline at high speed. SAE's exchange reveals nothing that can be tested offline, so every guess needs a fresh live attempt, and past sessions stay protected if the passphrase later leaks (forward secrecy). The shared passphrase stays.

WPA2/WPA3-Personal transition mode advertises both PSK and SAE on one SSID with one passphrase: WPA3 clients choose SAE, WPA2-only clients keep PSK. It runs with PMF optional (capable), because many WPA2 devices do not support PMF; requiring PMF, or switching to WPA3-only, cuts those devices off.

Enterprise and 802.1X

Enterprise mode uses 802.1X with three roles: the supplicant (the client), the authenticator (the AP or wireless LAN controller) and the authentication server (RADIUS, often checking a directory). The client sends EAP credentials through the authenticator to RADIUS. Because each person has their own credentials, IT can disable one leaver without touching anyone else, which a shared passphrase cannot do. The property that matters is a credential unique to each person and verified by a server; an identifier that is shared or easily copied cannot single out one user. RADIUS is the AAA protocol used for network access such as WLAN logins (TACACS+, by contrast, is mainly used for administrator access to network devices).

Enhanced Open (OWE)

Opportunistic Wireless Encryption, certified as Wi-Fi Enhanced Open, keeps the tap-to-join experience of an open hotspot but runs a Diffie-Hellman exchange during association, so each client gets a unique key and passive eavesdroppers cannot read the traffic. It does not authenticate the network or the user: anyone can join, and a client cannot tell the genuine AP from an evil twin with the same SSID. A captive portal is different again: it controls access with a web sign-in but does not encrypt the air link.

6 GHz security rules

Wi-Fi 6E did not inherit legacy security. An SSID can be broadcast on 6 GHz only if it uses WPA3-Personal (SAE only), WPA3-Enterprise or Enhanced Open (OWE), always with PMF required; SAE on 6 GHz must also use the hash-to-element (H2E) method. WPA2-Personal, WPA2-Enterprise, WPA2/WPA3 transition modes and plain open networks are not permitted, so an SSID configured with any of them simply does not appear on the 6 GHz radios. The usual trade-off is a separate SSID for older WPA2-only clients.

Wireless interference comes from three sources: other Wi-Fi radios on the same channel, Wi-Fi radios on a partly overlapping channel, and non-802.11 devices transmitting in the same band. Each leaves a different signature, which is how you tell them apart.

CCI is the hardest to fix in 2.4 GHz: with only three clean channels, more radios only add contention, and off-plan channels add adjacent-channel interference on top. When 5 GHz already covers the floor, disabling the 2.4 GHz radio on some APs restores capacity.

Common non-802.11 sources

• Microwave ovens radiate around 2.45 GHz, inside the 2.4 GHz band, while they run: a classic midday slowdown near a kitchen that affects only 2.4 GHz clients.
• Bluetooth devices frequency-hop across the 2.4 GHz band.
• Older 2.4 GHz cordless phones, wireless video senders, baby monitors and some wireless cameras.
• Radar shares the 5 GHz DFS channels, which forces APs to leave them (see channel planning above).

Not every radio is a Wi-Fi problem: before blaming a device, check that it actually transmits inside the affected Wi-Fi band. Many cordless phones and RFID systems use frequencies outside 2.4, 5 and 6 GHz.

Each operating system shows the client's address, mask, default gateway and DNS servers through its own commands, and the same four facts decide whether the client can reach anything:

APIPA: 169.254.x.x means no DHCP

A Windows or macOS client set to obtain an address automatically that receives no DHCP offer assigns itself an Automatic Private IP Addressing (APIPA) link-local address from 169.254.0.0/16 (mask 255.255.0.0) with no default gateway. Windows labels it Autoconfiguration IPv4 Address. It can reach only other link-local hosts. Seeing it means the problem is the path to DHCP: the client's link or association, the VLAN the port or WLAN maps to, the trunk carrying that VLAN, or the DHCP server or relay. A Linux client managed by NetworkManager usually just shows no IPv4 address unless link-local addressing is enabled. (How DHCP servers and relays work is covered in the DHCPv4 lesson.)

The default gateway must be on the client's own subnet

A client sends anything off its subnet to its default gateway (Windows Default Gateway, macOS Router, Linux default via). Two faults break off-subnet traffic while local devices such as printers still work:

• No default route. On Linux, ip route shows only the connected subnet (192.168.77.0/24 dev wlan0 proto kernel scope link) with no default via line.
• A gateway outside the subnet. With 10.12.30.77/24, a gateway of 10.12.31.1 is not directly reachable; it must be an address inside 10.12.30.0/24. Correct whichever setting departs from the subnet plan rather than reshaping a correct address or mask to fit.

Competing default routes

A client with two connections can hold two default routes, and it uses the one with the lowest metric (no load balancing between them). NetworkManager gives wired connections metric 100 and Wi-Fi 600 by default, so plugging a laptop into a wired network that has no internet path sends all internet traffic to that network's gateway even though Wi-Fi stays connected. Fixes include telling the wired connection never to take a default route (ipv4.never-default yes) or raising its metric.

$ ip route
default via 10.20.0.1 dev eth0 proto dhcp metric 100
default via 192.168.77.1 dev wlan0 proto dhcp metric 600

Every OS stores a saved profile per wireless network (SSID, authentication type, cipher, key) and reports the security of the current connection; troubleshooting means comparing what the client is using with what the SSID now offers.

Apple removed the old airport command-line tool from current macOS releases, so use wdutil or system_profiler for the Security field; IP-configuration commands report addresses, not security. On macOS 14.4 and later these tools may hide the SSID and BSSID unless Terminal has Location Services permission, but they still show Security. On Linux, an SSID in transition mode reads WPA2 WPA3 in the SECURITY column: what a network advertises and what a client's profile is configured to use are different facts.

Typical security-parameter faults

• Passphrase rotated, profile not updated. NetworkManager reports Secrets were required, but not provided when the stored secret fails and no password prompt is available. Update it, for example nmcli connection modify Office wifi-sec.psk '<new passphrase>'.
• SSID moved to WPA3-only, profile still says WPA2-Personal. The saved profile requests WPA2-PSK, which the AP no longer offers, so the client fails even with the right passphrase while first-time devices succeed. The profile's security type is what has to change, and forgetting the network and joining again builds a fresh profile from what the AP now advertises.
• Enterprise password changed. With 802.1X, a fault that hits one user while colleagues on the same AP join points to that user's saved credentials (for example an old directory password stored for the Wi-Fi network), not to RADIUS. A fault in shared infrastructure, such as the controller-to-RADIUS link, affects every user at once.

Remember the cipher pairings when reading a profile: TKIP belongs to legacy WPA and is not valid with WPA3, while WPA2 and WPA3 use CCMP (or GCMP).

Troubleshoot a client from the bottom up, because each step depends on the one before: link or association, then authentication, then an IP address, then the default gateway, then name resolution. The first step that fails is where the fault is.

1. Link or association. Wired: is the link up at the expected speed and duplex (Get-NetAdapter, ifconfig en0, ip link or ethtool)? Cable and switch-port faults are covered in the interface and cable lesson. Wireless: netsh wlan show interfaces showing State : connected with a signal level means the client is associated.
2. Authentication. An Authentication value on a connected interface means the security handshake completed, so the passphrase, security settings and RF are working. Failures here are security-parameter faults (previous section).
3. IP address. A 169.254.x.x address after a successful association means no DHCP offer. If other SSIDs on the same APs work for the same laptop, the fault is that WLAN's own IP path: its VLAN mapping, the trunk carrying it, or its DHCP server or relay. DHCP only runs after association and authentication succeed.
4. Default gateway. Ping the gateway; check that it is inside the client's subnet and that the client actually has a default route with the expected metric.
5. Name resolution. If pinging a server's IP address works but its name fails (Windows: Ping request could not find host), no packet was sent: DNS failed. Check the DNS servers in ipconfig /all (or scutil --dns, resolvectl status) and test with nslookup.

Useful reachability tools on all three systems: ping, tracert (Windows) or traceroute (macOS, Linux) to see where packets stop, and nslookup to test DNS. Comparing with other users narrows the scope: if colleagues reach the same server by name, the server and its DNS records are fine and the fault is on this client.

Reading combined evidence