A from-zero Huawei WLAN bring-up on one AC and one FIT AP: initializing the AC's management and DHCP services, bringing the AP online over Layer 2 discovery or DHCP relay with Option 43 across a routed access layer, choosing direct or tunnel forwarding, building the SSID and security profile, and the command that confirms the AP actually joined before you call it done.
By the AtlasCommTech engineering team — 13 years of carrier & enterprise network deployments · Updated July 2026
Five moves, in an order that isn't arbitrary — get AP onboarding wrong and nothing downstream of it works.
A WLAN deployment built on a Huawei AC (WAC) and FIT APs isn't one configuration step, it's a sequence where each step depends on the one before it. The AC needs its management VLAN, DHCP service and CAPWAP source interface in place before an AP can even discover it — and until an AP shows up in a normal (nor) state, no SSID, VLAN or security profile bound to it does anything at all. Get the AP onboarding method wrong for the topology in front of you — Layer 2 broadcast discovery when the access layer is actually routed, for instance — and the AP simply never appears.
Below is the configuration this is based on — a Huawei AC (WAC) with a directly connected FIT AP behind a PoE access switch, onboarding over Layer 2 discovery, plus the DHCP-relay-with-Option-43 variant for when APs sit behind a routed (Layer 3) access layer instead — through to the SSID, security profile and the verification command that confirms an AP actually joined before anything else is trusted.
One AC, a PoE access switch, one FIT AP — management and service traffic split onto separate VLANs from the first trunk port.
Diagram labels are kept in English for engineering clarity.
Addressing
| Item | Value (this example) |
|---|---|
| AP management VLAN 2 — gateway on the AC | 192.168.2.0/24 · Vlanif2 = 192.168.2.1 |
| Wireless service VLAN 3 — SSID employee | 192.168.3.0/24 · Vlanif3 = 192.168.3.1 |
| CAPWAP tunnel source interface on the AC | Vlanif2 |
| AC ↔ egress router interconnect — VLAN 10 | AC 192.168.10.2 · router 192.168.10.1 |
| Access-switch port facing the AP | Trunk, PVID 2, allow VLAN 2 & 3 |
AP Discovery — Two Ways to Reach the Same AC
| Method | When it's the right call |
|---|---|
| Layer 2 direct-connect discovery | AP broadcasts for the AC on its own management VLAN — no DHCP relay, no Option 43. Works when the AP sits directly behind the AC or a plain Layer 2 access switch in the same broadcast domain. |
| DHCP relay + Option 43 | An aggregation switch relays the AP's DHCP request to the AC's own address pool, where Option 43 sub-option 3 carries the AC's CAPWAP source address in ASCII. Required whenever the AP and the AC sit in different Layer 3 segments. |
Five moves: VLANs and trunking, DHCP and the CAPWAP source interface, AP authentication, the SSID/security/VAP profile with its forwarding mode, and the egress route.
<WAC> system-view
// switch from user view to system view
[WAC] vlan batch 2 3
// create the planned management VLAN and service VLAN
[WAC] interface ge 0/0/2
// enter the physical interface facing the AP
[WAC-GE0/0/2] port link-type trunk
[WAC-GE0/0/2] port trunk pvid vlan 2
// set the port's default VLAN to the AP management VLAN
[WAC-GE0/0/2] port trunk allow-pass vlan 2 3
// allow both the management and service VLANs through
[WAC-GE0/0/2] quit
[WAC] dhcp enable
[WAC] interface vlanif 2
[WAC-Vlanif2] ip address 192.168.2.1 255.255.255.0
[WAC-Vlanif2] dhcp select interface
// enable interface-based DHCP for the AP management segment
[WAC-Vlanif2] quit
[WAC] interface vlanif 3
[WAC-Vlanif3] ip address 192.168.3.1 255.255.255.0
[WAC-Vlanif3] dhcp select interface
[WAC-Vlanif3] dhcp server dns-list 114.114.114.114
[WAC-Vlanif3] quit
[WAC] capwap source interface vlanif 2
// this triggers a one-time prompt for the DTLS PSK, the FIT AP username/password,
// and the offline-management VAP PSK — all required before the source interface is accepted
Set the DTLS PSK(contains 8-32 plain-text characters...):
Confirm PSK:
Set the user name for FIT APs(...):admin
Set the password for FIT APs(...):
Confirm password:
Set the PSK of the global offline management VAP(...):
Confirm PSK:
Warning: Ensure that the management VLAN and service VLAN are different. Otherwise, services may
be interrupted.
Warning: Before an added device goes online for the first time, enable DTLS no-auth if it runs a
version earlier than V200R021C00 or enable DTLS certificate-mandatory-match if it runs
V200R021C00 or later.
[WAC] capwap dtls no-auth enable
// lets a brand-new AP join before it has DTLS credentials — disable this again once confirmed
Warning: This operation allows for device access in non-DTLS encryption mode even when DTLS is
enabled and brings security risks. Continue? [Y/N]:y
[WAC] wlan
[WAC-wlan] ap auth-mode no-auth
// simplest bring-up mode: any AP reaching the AC on this VLAN joins automatically
[WAC-wlan] display ap all
// State = nor confirms the AP joined normally
Total AP information:
nor : normal [1]
----------------------------------------------------------------------------------------------------
ID MAC Name Group IP Type State STA Uptime ExtraInfo
----------------------------------------------------------------------------------------------------
0 00e0-fc11-1111 area_1 default 192.168.2.208 AirEnginexxxx nor 0 4H:49M:11S -
----------------------------------------------------------------------------------------------------
[WAC-wlan] security-profile name employee
[WAC-wlan-sec-prof-employee] security wpa-wpa2 psk pass-phrase YsHsjx_202206 aes
[WAC-wlan-sec-prof-employee] quit
[WAC-wlan] ssid-profile name employee
[WAC-wlan-ssid-prof-employee] ssid employee
[WAC-wlan-ssid-prof-employee] quit
[WAC-wlan] vap-profile name employee
[WAC-wlan-vap-prof-employee] security-profile employee
[WAC-wlan-vap-prof-employee] ssid-profile employee
[WAC-wlan-vap-prof-employee] service-vlan vlan-id 3
// no forward-mode line here means direct forwarding — the default
[WAC-wlan-vap-prof-employee] quit
[WAC-wlan] ap-group name default
[WAC-wlan-ap-group-default] vap-profile employee wlan 1 radio all
[WAC-wlan-ap-group-default] quit
[WAC-wlan] quit
[WAC] vlan batch 10
[WAC] interface ge 0/0/1
// port facing the egress router
[WAC-GE0/0/1] port link-type access
[WAC-GE0/0/1] port default vlan 10
[WAC-GE0/0/1] quit
[WAC] interface vlanif 10
[WAC-Vlanif10] ip address 192.168.10.2 255.255.255.0
[WAC-Vlanif10] quit
[WAC] ip route-static 0.0.0.0 0.0.0.0 192.168.10.1
[WAC] returnWhen an aggregation switch sits between the AP and the AC, plain Layer 2 broadcast discovery can't reach the AC — Option 43 is what tells the AP where to look instead.
<L3> system-view
// aggregation switch, relaying AP DHCP requests toward the AC
[L3] interface vlanif 2
[L3-Vlanif2] dhcp select relay
[L3-Vlanif2] dhcp relay server-ip 192.168.20.2
// 192.168.20.2 is the AC's own interconnect address
[L3-Vlanif2] quit
<WAC> system-view
[WAC] dhcp enable
[WAC] ip pool ap
// global address pool serving AP requests relayed from the aggregation switch
[WAC-ip-pool-ap] network 192.168.2.0 mask 255.255.255.0
[WAC-ip-pool-ap] gateway-list 192.168.2.1
[WAC-ip-pool-ap] option 43 sub-option 3 ascii 192.168.20.2
// sub-option 3, ASCII — this is the AC's CAPWAP source address, in place of Layer 2 discovery
[WAC-ip-pool-ap] quit
[WAC] capwap source interface vlanif 20The DHCP-relay variant uses the same AP authentication, SSID and VAP-profile steps shown above — Option 43 only changes how the AP finds the AC in the first place.
The ones that turn a same-day WLAN bring-up into a half-day of staring at an AP that never reaches nor.
SYMPTOMConfiguring the CAPWAP source interface immediately walks you through a DTLS PSK, a FIT AP username and password, and an offline-management VAP PSK — skip any of it and the AC won't finish the command.
CAUSEThe AC enables DTLS encryption on the CAPWAP control tunnel by default. A brand-new AP has no security credentials yet, so it can't complete a DTLS-encrypted handshake on its own — it needs a non-authenticated window just long enough to receive them.
FIXEnable capwap dtls no-auth enable to let the first AP join, confirm it reaches nor, then run undo capwap dtls no-auth enable — leaving it enabled after go-live accepts any AP in non-DTLS mode, exactly the risk the source configuration's own warning calls out.
[WAC] capwap dtls no-auth enable
Warning: This operation allows for device access in non-DTLS encryption mode even when DTLS is
enabled and brings security risks. Continue? [Y/N]:ySYMPTOMThe first AP joins and shows State nor within moments of being connected — no MAC list, no SN list, nothing configured per device.
CAUSEno-auth mode lets any AP that can reach the AC over the management VLAN join automatically. There's no check on which physical AP it actually is.
FIXUse no-auth for initial bring-up in a controlled environment, then move to MAC-address or SN authentication before the network goes live somewhere you don't fully control physically.
SYMPTOMWireless service interrupts or AP management flaps intermittently after a new SSID's VLAN gets added to the same trunk.
CAUSEThe AC's own CAPWAP-source configuration step warns about this directly: management VLAN and service VLAN have to be different, or services may be interrupted. Mixing CAPWAP control frames with regular wireless client data on one VLAN is exactly what causes it.
FIXKeep AP management on its own VLAN (VLAN 2 in this example) and give every wireless service its own separate VLAN.
SYMPTOMAn AP behind a routed access layer gets an IP address from DHCP but never discovers the AC — it just sits there, never reaching nor.
CAUSEDHCP relay alone only gets the AP an address; it doesn't tell the AP where the AC's CAPWAP source address is. That has to travel inside Option 43, specifically sub-option 3, as an ASCII string of the AC's source IP. Get the sub-option number or the encoding wrong and the AP reads nothing usable from it.
FIXConfigure it exactly as option 43 sub-option 3 ascii
SYMPTOMIn the DHCP-relay variant, an AP occasionally fails to get a usable address, or an address conflict shows up on the management segment.
CAUSEThe interconnect interface between the aggregation switch and the AC lives in the same management VLAN as the APs. If that address isn't excluded from the pool serving APs, it can eventually be handed out to one.
FIXExclude it explicitly, exactly as the source configuration does: dhcp server excluded-ip-address
State nor in display ap all is necessary but not sufficient — confirm a real client can actually get an IP and reach the network too.
[WAC-wlan] display ap all
Total AP information:
nor : normal [1]
ExtraInfo : Extra information
P : insufficient power supply
Total: 1
----------------------------------------------------------------------------------------------------
ID MAC Name Group IP Type State STA Uptime ExtraInfo
----------------------------------------------------------------------------------------------------
0 00e0-fc11-1111 area_1 default 192.168.2.208 AirEnginexxxx nor 0 4H:49M:11S -
----------------------------------------------------------------------------------------------------This note is based on one directly connected AC + FIT AP deployment over Layer 2 discovery with direct forwarding, plus the DHCP-relay-with-Option-43 variant for a routed access layer. It doesn't cover the agile distributed (RU + central AP) architecture, VLAN pools, multiple management VLANs, or what happens once clients need to roam seamlessly between multiple APs — that's covered in our WLAN roaming configuration note. If you're deploying just one or two access points without a dedicated AC controller at all, see our small office network setup note instead.
Pulled from the same configuration cases this note is built on.
Layer 2 discovery is a broadcast within the AP's own management VLAN — no extra configuration needed as long as the AP and AC share that broadcast domain. DHCP relay with Option 43 is what replaces that broadcast once an aggregation switch sits in between: the relay gets the AP an address, and Option 43 sub-option 3 (in ASCII) tells it where the AC's CAPWAP source address actually is.
No. It's meant to simplify initial bring-up, not to be the permanent state — the source configuration's own guidance is explicit that it carries a security risk once the network is reachable by anything outside your control, and recommends MAC-address or SN authentication instead once you're past bring-up.
Direct forwarding is the default and the simplest choice when an AP's traffic can be switched locally where it lands. Tunnel forwarding (forward-mode tunnel under the VAP profile) sends that traffic back to the AC instead — which matters most once you need a client's IP address and session to survive moving between APs on different access-layer segments, covered in our WLAN roaming configuration note.
In order: that the CAPWAP source interface is actually configured and reachable, that the DTLS no-auth window is open if this is a brand-new AP, that the management VLAN is trunked all the way through to the AP with the right PVID, and — if the access layer is routed — that DHCP relay and the Option 43 sub-option 3 value are both correct.
Yes. Each SSID gets its own security-profile, ssid-profile and vap-profile, each with its own service-vlan, all bound to the same ap-group — or different ones, if different APs should offer different SSIDs.
Tell us your AP count, whether the access layer between them is routed, and how many SSIDs you need, and we'll help you size the VLANs and profiles correctly.