Bridge vs Tunnel Wireless Networks
As we work our way through the Ultimate Network Guide. We are now at a point pf considering the rest out our architecture for the deployment. In this article we will dive deeper into what bridge mode and tunnel mode access points are, when they are applicable. And how you design your networks to accomodate.
What is a bridge mode AP or network?
An access point in bridge mode means that it trunks any required networks(vlans) required for the wireless network. AP's will be connected via ethernet to the local access switch. On the access switch we can choose weather to configure it as an access port ort trunk. Trunk ports allows use to permit multiple vlans on one uplink port. The advantage for this with APs in bridge mode is we can have network segmentation for the wireless networks as well as wired.
When and how to use bridge mode?
Bridge mode wireless networks are AP's are heavily favoured in a small/medium network architectures. Bridge mode works perfectly if the wireless network gateways reside in the same office in as the switches, AP's and clients. This is so we do not have to worry about the complexity of routing and can trunk our networks directly down to the access points. We also do not need to monitor the overlay tunnel.
Lots of gateway solutions these days can also act as the wireless LAN controller for the AP's also. This keeps the wireless solution very converged.
By trunking the vlans all the way down to the AP, we can configure various AAA methods to achieve or WLAN segemenation.
Bridge most requires the least mount of setup and knowledge, this makes it suitable for small IT teams to manage. But has limitations on scale as we rely on layer2 for network presentation.
What is a tunnel mode AP or network?
Unlike bridge mode AP's where the required networks need to be trunked all the way to the AP. Tunnel mode or networks allows wireless network designers to place the access point separated away from a wireless networks gateway over a routed network. The AP likely uses CAPWAP, LWAPP or GRE for the overlay tunnel - utilising the routed underlay. In 2026 CAPWAP is the protocol of choice due to secure DTLS encryption and native IPv6 support. Modern lightweight access points use CAPWAP
When and how to use tunnel mode?
Tunnel mode AP's and tunnel networks are mostly used in enterprise and larger networks. As previosuly discussed we would use a tunnel wireless network or access point when the WLAN gateways and clients are separated by a routed network
This makes tunnelled networks very scaleable. The same wireless lan controller can be used to manag multiple SSIDs in different geographical locations. All whats needed is for connectivity. Some modern SDA solutions support encapsulating dot1.q tags in a layer 3 packet. This allows vlan's to be extended over to the clients over a layaer 3 networks.
Utilising the routed underlay. Tunnel access points allows for duel homing to multiple switches. This providers greater throughput and redundancy vs bridged AP's contending with layer 2 loop prevention technologies.
The wider infrastructure needs to be considered when deploying a tunnel network. This includes permitting UDP/5246-5247 for CAPWAP tunnels through firewalls and access lists.