Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Understanding Wireless Mesh


WLAN mesh allows an access point to communicate with the network using a radio link to route network traffic toward its destination. This is an alternative to using wired links for each access point. Mesh networking is useful when you need to provide wireless coverage to an area where wired network connection is not practical. Instead, the remote access point uses a wireless link to another access point to provide access to the rest of the network. See Figure 1 where the mesh has one access point wired to a switch and two access points that are not hard-wired.


WLAN mesh is supported only for access points with dual radios.

This topic describes:

Example Mesh Topology With One Access Point Wired

Many mesh options and topologies are available. In this example, the mesh has one wired access point and all other access point connections are wireless as shown in Figure 1.

Figure 1: Example Mesh Topology
Example Mesh Topology

Why Use Mesh?

WLAN mesh is useful when running an Ethernet cable to a location is either inconvenient, expensive, or impossible.

How Does Mesh Work?

As shown in Figure 1, there are three components in a mesh deployment:

  • Mesh Portal—any access point providing a wireless signal to another access point. There will always be one mesh portal connected to a wired network. Additional access points with two radios can perform the optional role of both mesh access point and mesh portal access point.


    An access point must have two radios if it performs the dual role of both mesh access point and mesh portal access point. The wired access point gets power from the switch—additional portal access points need their own power. (The access points can be using PoE without a network connection.)

  • Mesh AP—a wireless access point without a wired connection (untethered). Clients associated with a mesh access point have the same connectivity to the network they would have when associated to a wired access point.


    An access point must have two radios if it performs the dual role of both mesh access point and mesh portal access point.

  • Mesh Link—a Layer 2 transparent bridge with a mesh portal and a mesh access point as endpoints.

Once mesh is configured, the mesh portal access points beacon a mesh services SSID on the radio used for the mesh link, which is also commonly called the backhaul. When a mesh access point is booted, it finds access points beaconing a mesh SSID, selects the mesh portal access point with the greatest signal strength (RSSI value), and then establishes a secure connection to the mesh portal SSID. Once this connection is established, the access point can offer services configured by the controller. If, after 60 seconds, no link is established, the remote mesh access point reboots. If the remote access point fails to connect to the mesh access point it has chosen, it tries another, and so on until it has tried all mesh access points. If all attempts to connect fail, the remote access point tries each access point again and repeats until it connects or reboots after 60 seconds.

Planning a Mesh Portal

The following recommendations provide the most stable mesh services on a wireless network:

  • Dedicate one radio to client services and one radio to mesh services. We recommend that you dedicate the 802.11a radio (radio 2) to mesh services and the 802.11g radio (radio 1) to client services.

  • Dedicate the entire mesh portal access point to mesh services if you anticipate a need for the additional bandwidth.

  • Limit the physical length of the mesh link to 3/8ths of a mile (1.09 km) or less if you have configured MSS 6.0.4 or earlier. Later versions of MSS can support distances up to 1 mile (1.6 km) for Mesh Links, depending on the RF characteristics of the access points and their antennae, location and configuration.

  • For the best performance, minimize the number of mesh access points that connect to a mesh portal and avoid multi-hop mesh deployments. Never exceed a mesh width of 10 mesh portal access points or a mesh depth of four mesh access points per mesh portal access point.

How Do I Set Up and Configure Mesh?

Mesh requires a dedicated mesh SSID (named in a WLAN Service profile), a dedicated Radio profile, and access points configured for untethered mesh operation. You configure access points for mesh while they are connected to a controller, then untether them and place them into the mesh location.

If you offer client service from the mesh portal, you must use dual-radio access points so that one radio can be used for mesh link communications (using the SSID reserved for this purpose) while the other radio is used for client associations.

How Do I Configure a Mesh Access Point?

Before a Mesh access point can be installed in a location untethered from the network, it must be connected to a controller and preconfigured for mesh services, including the mesh services SSID, and the pre-shared key for establishing the connection between the mesh access point and the mesh portal. For directions, see Configuring Wireless Mesh and Bridging.


When using external antennas in conjunction with mesh configurations, enable mesh mode before configuring the external antenna. After adding and configuring the external antenna, reboot the access point.

Mesh access points must be configured for local switching—see Understanding Local Switching on Access Points.

Security Between a Mesh AP and the Mesh Portal AP

Security is configured as part of the mesh WLAN Service profile, where the required pre-shared key (PSK) authentication and PSK key are set up in the mesh SSID. The PSK key must match the one you configure on the mesh access points.