Step 1

Click the menu icon () and choose Design > Network Settings > Device Credentials.

Step 2

From the left hierarchy tree, choose Global.

Step 3

In the CLI Credentials area, click Add.

Step 4

Enter information in the following fields:

Step 5

Click Save.

Step 6

If you are changing existing credentials, choose whether you want to update the credentials now or schedule it for later.

Step 1

Click the menu icon () and choose Design > Network Settings > Device Credentials.

Step 2

From the left hierarchy tree, choose Global.

Step 3

In the SNMP Credentials area, click Add.

Step 4

For the Type, click SNMP v2c and enter the following information:

Step 5

Click Save.

Step 6

If you are changing existing credentials, choose whether you want to update the credentials Now or schedule it for later.

Step 1

Click the menu icon () and choose Design > Network Settings > Device Credentials.

Step 2

From the left hierarchy tree, choose Global.

Step 3

In the SNMP Credentials area, click Add.

Step 4

For the Type, click SNMP v3 and enter the following information:

Step 5

Click Save.

Step 6

If you are changing existing credentials, you are prompted to update the new credentials on devices now or schedule the update for a later time.

• To update the new credentials now, click the Now radio button and click Apply.
• To schedule the update for a later time, click the Later radio button, define the date and time of the update and click Apply.

  Note	Use the Time Zone check box to indicate whether you want the update to happen according to the site time zone or according to a specified time zone.

Step 1

Click the menu icon () and choose Design > Network Settings > Device Credentials.

Step 2

From the left hierarchy tree, choose Global.

Step 3

In the HTTPS Credentials area, click Add.

Step 4

Enter the following information:

Step 5

Click Save.

Step 6

If you are changing existing credentials, choose whether you want to update the credentials Now or schedule it for later.

Step 1

Click the menu icon () and choose Design > Network Settings > Device Credentials.

Step 2

From the left hierarchy tree, choose Global.

Step 3

Click Manage Credentials, check the check box for the device credential that you want to change, and choose Actions > Edit.

Step 4

In the Edit Credentials dialog box, make the required changes, and click Save.

Step 5

In the credential tile, click Apply.

Step 6

In the Apply Credentials dialog box, choose whether you want to update the credentials Now or schedule it for later.

Step 7

To view the status of the credential change, choose Provision > Network Devices > Inventory.

Step 1

Click the menu icon () and choose Design > Network Settings > Device Credentials.

Step 2

From the left hierarchy tree, choose the required site.

Step 3

Click Manage Credentials.

Step 4

Select the credentials that you want to associate with the selected site and then click Assign.

Step 1

Click the menu icon () and choose Design > Network Settings > Device Credentials.

Step 2

From the left hierarchy tree, choose either Global or the required area, building, or floor.

Step 3

Click Manage Credentials.

Step 4

From the Add drop-down list, choose a type of credential, for example, CLI, HTTP(S) Read, SNMPv3, and so on.

Step 5

In the Add New Credentials window, do the following:

Step 6

Choose the credential that you want to assign and click Assign.

Step 7

To apply the credentials, do any one of the following:

Step 8

In the Apply Credentials dialog box, choose whether you want to update the credentials Now or schedule it for later.

Step 9

To view the status of your task, do any one of the following:

Step 10

To edit the credentials, do the following:

Step 11

To reschedule the Start time of a credential application, do one of the following:

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

In the SSID table, hover your cursor over Add, and choose Enterprise.

Step 5

In the Wireless SSID workflow, complete the Basic Settings setup:

1. If the Sensor toggle button is available, ensure that it’s disabled.

2. In the Wireless Network Name (SSID) field, enter a unique name for the wireless network.

3. In the WLAN Profile Name field, enter a name for the WLAN profile.

   Based on the WLAN profile name, Cisco DNA Center automatically generates the policy profile name for Cisco Catalyst 9800 Series Wireless Controller.

4. In the Wireless Option settings, click one of the following radio buttons:

   • Triple band operation (2.4 GHz, 5 GHz, 6GHz): The WLAN is created for 2.4 GHz, 5 GHz, and 6 GHz, and band select is disabled.

   • Triple band operation with band select: The WLAN is created for 2.4 GHz, 5 GHz, and 6 GHZ, and band select is enabled.

   • 5GHz only: The WLAN is created for 5 GHz, and band select is disabled.

   • 2.4GHz only: The WLAN is created for 2.4 GHz, and band select is disabled.

   • 6GHz only: The WLAN is created for 6 GHz, and band select is disabled.

5. From the Primary Traffic Type drop-down list, choose one of the following options:

   • VoIP (Platinum): QoS on the wireless network is optimized for wireless voice and data traffic.

   • Video (Gold): QoS on the wireless network is optimized for video traffic.

   • Best Effort (Silver): QoS on the wireless network is optimized for wireless data traffic only.

   • Non-real Time (Bronze): QoS on the wireless network is optimized for low-bandwidth usage.

6. In the SSID STATE settings, click the toggle buttons to enable or disable the following settings:

   • Admin Status: Use this toggle button to turn on or turn off the radios on the APs. When the Admin Status is disabled, the APs remain associated with the wireless controller and are accessible, and the APs still require licenses.

   • Broadcast SSID: Use this toggle button to enable or disable the visibility of the SSID to all the wireless clients within range.

Step 6

Complete the Security Settings setup:

1. For Level of Security, choose the encryption and authentication type for the network. The sites, buildings, and floors inherit settings from the Global hierarchy. You can override the level of security at the site, building, or floor level.

   • Enterprise: You can configure both WPA2 and WPA3 security authentication by checking the respective check boxes. By default, the WPA2 check box is enabled.

     Note

     Wi-Fi Protected Access (WPA2) uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). WPA3 is the latest version of WPA, which is a suite of protocols and technologies that provide authentication and encryption for Wi-Fi networks. WPA3-Enterprise provides higher-grade security protocols for sensitive data networks.

   • Personal: If you choose Personal, enter the passphrase key in the Pass Phrase field. This key is used as the pairwise master key (PMK) between the clients and authentication server.

     Note

     WPA3-Personal brings better protection to individual users by providing more robust password-based authentication, making the brute-force dictionary attack much more difficult and time-consuming. For WPA2-Personal, you can override a preshared key (PSK) at the site, building, or floor level. If you override a PSK at the building level, the subsequent floors inherit the new settings. For information, see Preshared Key Override.

   • Open Secured: From the Assign Open SSID drop-down list, choose an open SSID to redirect the clients to an open-secured SSID. The open-secured policy provides the least security.

     Note	Fast Transition is not applicable for open-secured SSID. Since open-secured SSID depends on open SSID, you must have enabled anchor on open SSID before enabling it on open-secured SSID.

   • Open: The open policy provides no security. It allows any device to connect to the wireless network without any authentication.

2. For Authentication, Authorization, and Accounting Configuration, click Configure AAA to add and configure the AAA servers for the enterprise wireless network SSID.

   For more information, see Configure AAA Server for an Enterprise Wireless Network.

3. Check one or more of the following check boxes:

   • Fast Lane: Check this check box to enable fastlane capabilities on the network.

     Note	By enabling fastlane, you can set the iOS devices to receive an optimized level of wireless connectivity and enhanced QoS.

   • Identity PSK (for Personal Layer 2 Security): Check this check box to enable unique preshared keys that can be created for individuals or groups of users in the SSID.

   • MAC Filtering: Check this check box to enable MAC-based access control or security on the wireless network.

     Note	When MAC filtering is enabled, only the MAC addresses that you add to the wireless LAN are allowed to join the network.

   • Deny RCM Clients: Check this check box to deny clients with randomized MAC addresses.

   • Enable Posture: Check this check box to enable posture assessment. The Pre-Auth ACL List Name drop-down list appears when you enable posture. Posture is a service in Cisco Identity Services Engine (Cisco ISE) that allows you to check the state, also known as posture, of all the endpoints that are connecting to a network for compliance with corporate security policies. This allows you to control clients' access to protected areas of a network.

   • Pre-Auth ACL List Name: From the drop-down list, choose the ACL list name that you already created to map with the SSID.

     Note	AAA configuration is mandatory for posturing. Click Configure AAA to add AAA servers for the enterprise wireless network SSID.

4. Click Next.

Step 7

Complete the Advance Settings setup:

1. For Fast Transition (802.11r):

   • Choose Adaptive, Enable, or Disable mode.

     Note	802.11r allows wireless clients to quickly roam from one AP to another AP. Fast transition ensures less disrupted connectivity when a wireless client roams from one AP to another AP.

   • Check the Over the DS check box to enable fast transition over a distributed system.

2. For MFP Client Protection, choose Optional, Required, or Disabled.

   Note

   Management Frame Protection (MFP) increases the security of management frames. It provides security for the otherwise unprotected and unencrypted 802.11 management messages that are passed between APs and clients. MFP provides both infrastructure and client support. By default, Optional is selected. If you choose Required, the clients are allowed to associate only if the MFP is negotiated (that is, if WPA2 is configured on the wireless controller, and the client is also configured for WPA2 and supports CCXv5 MFP).

3. For 11K:

   • Neighbor List: Check this check box to configure all the 11k-capable clients to request a neighbor report about the known neighboring APs that are candidates for roaming.

     Note

     To facilitate roaming, a 11k-capable client that is associated with an AP sends a request to a list of neighboring APs. The request is sent in the form of an 802.11 management frame, which is known as an action frame. The AP responds with a list of neighbor APs on the same WLAN with the Wi-Fi channel numbers. The response is also an action frame. The client identifies the AP candidates for the next roam from the response frame.

   • Session Timeout: Check this check box to set the maximum time for a client session to remain active before reauthorization.

     Note	By default, Session Timeout is enabled with a timeout of 1800 seconds.

   • Client Exclusion: Check this check box to set the client exclusion timer.

     Note	When a user fails to authenticate, the wireless controller excludes the client from connecting. The client is not allowed to connect to the network until the exclusion timer expires. By default, Client Exclusion is enabled with a timeout of 180 seconds.

4. For 11v BSS Transition Support:

   • BSS Max Idle Service: Check this check box to set the idle period timer value. The idle period timer value is transmitted using the association and reassociation response frame from APs to the client.

     Note	The BSS Max idle period is the time frame during which an AP doesn’t disassociate a client because of nonreceipt of frames from the connected client.

   • Client User Idle Timeout: Check this check box to set the user idle timeout for a WLAN.

     Note	If the data sent by the client is more than the threshold quota specified as the user idle timeout, the client is considered to be active and the wireless controller begins another timeout period. By default, Client User Idle Timeout is enabled with a user idle timeout of 300 seconds.

   • Directed Multicast Service: Check this check box to enable directed multicast service.

     Note	By default, Directed Multicast Service is enabled. Using the Directed Multicast Service (DMS), the client requests APs to transmit the required multicast packets as unicast frames. This allows clients to sleep for a longer time and saves the battery power.

5. For Radius Client Profiling, use this toggle button to enable or disable RADIUS profiling on a WLAN.

   Note	At least one AAA or PSN server is required to enable this feature.

6. (Optional) For NAS-ID:

   1. From the NAS-ID Opt drop-down list, choose the required type of network access server identifier (NAS ID).

      To specify a custom script for the NAS ID, choose Custom Option from the NAS-ID Opt drop-down list and enter the custom script in the corresponding Custom Script for Opt field. You can enter up to 31 alphanumeric characters, special characters, and spaces for the custom script. Cisco DNA Center doesn't support the special characters ? " < and trailing spaces for the custom script.

      Note	Cisco DNA Center supports NAS ID with custom script only for Cisco Catalyst 9800 Series Wireless Controllers that run Cisco IOS XE Release 17.7 or later.

   2. (Optional) Click + to add another NAS ID. You can add up to three NAS IDs.

      Note	Cisco DNA Center applies only one NAS ID for Cisco AireOS Wireless Controllers. You can overwrite the NAS ID at the site-level from the Design > Network Settings > Wireless window.

7. Configure CCKM: Use this toggle button to enable CCKM as the authentication key management option in Cisco DNA Center.

   • Timestamp Tolerance: This field is visible only if you enable CCKM. Enter the CCKM tolerance level. CCKM tolerance level is not applicable for the Cisco AireOS Wireless Controller platform.

   Note	You can configure CCKM only if SSID has Layer 2 security as Enterprise in WPA2 or WPA2+WPA3.

8. Click Next.

Step 8

Complete the Associate SSID to Profile setup:

1. From the left pane, select a profile and click Associate Profile.

   If you don’t have a profile, click Add Profile and configure the profile settings. For information, see Create SSIDs for an Enterprise Wireless Network.

2. Click Next.

Step 9

In the Summary window, review the configuration settings. (To make any changes, click Edit.)

Step 10

Click Save.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

From the SSID table, in the Action column, click Configure AAA against an SSID for which you want to configure the AAA server.

Step 5

From the Configure Authentication and Authorization Server drop-down list of the Configure AAA Server slide-in pane, you can either search for a server IP address by entering its name in the Search field or choose the AAA IP address.

Step 6

Click + to add an Additional Server.

Step 7

From the Additional Server drop-down list, choose the server IP address.

Step 8

To use the AAA server for accounting, check the Copy Same Servers for Accounting check box.

Step 9

To configure a different accounting server for an SSID, do the following:

1. From the Configure Accounting Server drop-down list, you can either search for a server IP address by entering its name in the Search field or choose the accounting server IP address.

2. Click + to add an Additional Server.

   Note	You can configure a maximum of six accounting servers for an SSID of enterprise wireless network for Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9000 Series Switches.

3. From the Additional Server drop-down list, choose the server IP address.

Step 10

Click Configure.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

In the SSID table, hover your cursor over Add, and choose Guest.

Step 5

In the Wireless SSID workflow, complete the Basic Settings setup:

1. In the Wireless Network Name (SSID) field, enter a unique name for the wireless network.

2. In the WLAN Profile Name field, enter a name for the WLAN profile.

   Based on the WLAN profile name, Cisco DNA Center automatically generates the policy profile name for Cisco Catalyst 9800 Series Wireless Controller.

3. In the Wireless Option setting, click one of the following radio buttons:

   • Triple band operation (2.4 GHz, 5 GHz, 6GHz): The WLAN is created for 2.4 GHz, 5 GHz, and 6 GHz, and band select is disabled.

   • Triple band operation with band select: The WLAN is created for 2.4 GHz, 5 GHz, and 6 GHZ, and band select is enabled.

   • 5GHz only: The WLAN is created for 5 GHz, and band select is disabled.

   • 2.4GHz only: The WLAN is created for 2.4 GHz, and band select is disabled.

   • 6GHz only: The WLAN is created for 6 GHz, and band select is disabled.

4. From the Primary Traffic Type drop-down list, choose one of the following options:

   • VoIP (Platinum): QoS on the wireless network is optimized for wireless voice and data traffic.

   • Video (Gold): QoS on the wireless network is optimized for video traffic.

   • Best Effort (Silver): QoS on the wireless network is optimized for wireless data traffic only.

   • Non-real Time (Bronze): QoS on the wireless network is optimized for low-bandwidth usage.

5. In the SSID STATE settings, click the toggle buttons to enable or disable the following settings:

   • Admin Status: Use this toggle button to turn on or turn off the radios on the APs. When the Admin Status is disabled, the APs remain associated with the wireless controller and are accessible, and the APs still require licenses.

   • Broadcast SSID: Use this toggle button to enable or disable the visibility of the SSID to all the wireless clients within range.

Step 6

Complete the Security Settings setup:

1. For the L2 Security setting, choose the L2 encryption and authentication type:

   • Enterprise: You can configure either the WPA2 or the WPA3 security authentication type by checking the respective check boxes. By default, the WPA2 check box is enabled.

     Note

     Wi-Fi Protected Access (WPA2) uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). Fast transition is applicable for enterprise WPA2 SSID. WPA3 security authentication is the latest version of WPA, which is a suite of protocols and technologies that provide authentication and encryption for Wi-Fi networks. WPA3-Enterprise provides higher grade security protocols for sensitive data networks.

   • Personal: You can configure both WPA2 and WPA3 or configure WPA2 and WPA3 individually by checking the respective check boxes.

     Note

     WPA3-Personal security authentication brings better protection to individual users by providing more robust password-based authentication. This makes the brute-force dictionary attack much more difficult and time-consuming. Enter the passphrase key in the Pass Phrase field. This key is used as the pairwise master key (PMK) between the clients and the authentication server.

   • Open Secured: From the Assign Open SSID drop-down list, choose an open SSID to associate with the open SSID. Associating secures the open SSID. You must have an open SSID created before associating it with the open secured SSID.

     Note	Fast Transition is not applicable for open-secured SSID. Since open-secured SSID depends on open SSID, you must have enabled anchor on open SSID before enabling it on open-secured SSID.

   • Open: The open policy provides no security. It allows any device to connect to the wireless network without any authentication.

2. For the L3 Security setting, choose the L3 encryption and authentication type:

   • Web Policy: Provides a higher level of L3 security.

     For Authentication Server, configure these authentication server settings:

     Authentication Server Type	Description
     Central Web Authentication	Use AAA server for central web authentication (CWA). (Optional) If you choose Cisco ISE for CWA, from the What kind of portal are you creating today? drop-down list, choose the type of portal you want to create: Self Registered: The guests are redirected to the self-registered guest portal to register by providing information to automatically create an account. HotSpot: The guests can access the network without providing any credentials. (Optional) If you choose Cisco ISE for CWA, from the Where will your guests redirect after successful authentication? drop-down list, choose where you want to redirect the guests after successful authentication: Success Page: The guests are redirected to an Authentication Success window. Original URL: The guests are redirected to the URL that they had originally requested. Custom URL: The guests are redirected to the custom URL that is specified here. Enter a redirect URL in the Redirect URL field.
     Web Authentication Internal Web Authentication External	Web authentication or Web Auth is a Layer 3 security method that allows a client to pass Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) traffic only until they have passed some form of authentication. For web authentication internal, the client is redirected to a page that is constructed by the Cisco Wireless Controller. For web authentication external, the client is redirected to the specified URL. Enter a redirect URL in the Web Auth Url field.
     Web Passthrough Internal Web Passthrough External	Web passthrough is a solution that is used for guest access and requires no authentication credentials. In web passthrough authentication, wireless users are redirected to the usage-policy page when they use the internet for the first time. After accepting the policy, users are allowed to use the internet.

   • Open: There is no security at the Layer 3 level and any device can connect to the SSID.

3. If you choose Web Authentication Internal, Web Authentication External, Web Passthrough Internal, or Web Passthrough External, for Timeout Settings for sleeping clients settings, choose the authentication for sleeping clients:

   • Always authenticate: Enables authentication for sleeping clients.

   • Authenticate after: Enter the duration for which sleeping clients are to be remembered before reauthentication becomes necessary. The valid range is from 10 minutes through 43200 minutes, and the default duration is 720 minutes.

   Note

   Clients with guest access and web authentication are allowed to sleep and wake up without having to go through another authentication process through the login page. You can configure the duration for which the sleeping clients are to be remembered for before reauthentication becomes necessary. The valid range is from 10 minutes through 43200 minutes; the default is 720 minutes. You can configure the duration on a WLAN and on a user group policy that is mapped to the WLAN. The sleeping timer becomes effective after the idle timeout. If the client timeout is less than the time configured on the sleeping timer of the WLAN, the lifetime of the client is used as the sleeping time.

4. For Authentication, Authorization, and Accounting Configuration, click Configure AAA to add and configure the AAA servers for the guest wireless network SSID.

   For more information, see Configure AAA Server for a Guest Wireless Network.

5. Check one or more of the following check boxes:

   • Fast Lane: Check this check box to enable fastlane capabilities on the network.

     Note	By enabling fastlane, you can configure the iOS devices to receive an optimized level of wireless connectivity and enhanced QoS.

   • Identity PSK (for Personal L2 Security): Check this check box to enable unique preshared keys that can be created for individuals or groups of users in the SSID.

   • MAC Filtering: Check this check box to enable MAC-based access control or security in the wireless network.

     Note	When MAC filtering is enabled, only the MAC addresses that you add to the wireless LAN are allowed to join the network.

   • Deny RCM Clients: Check this check box to deny clients with randomized MAC addresses.

6. Click Next.

Step 7

Complete the Advance Settings setup:

1. For Fast Transition (802.11r):

   • Choose Adaptive, Enable, or Disable mode.

     Note	802.11r allows wireless clients to quickly roam from one AP to another AP. Fast transition ensures less disrupted connectivity when a wireless client roams from one AP to another AP.

   • Check the Over the DS check box to enable fast transition over a distributed system.

2. For MFP Client Protection, choose Optional, Required, or Disabled.

   Note

   Management Frame Protection (MFP) increases the security of management frames. It provides security for the otherwise unprotected and unencrypted 802.11 management messages that are passed between APs and clients. MFP provides both infrastructure and client support. By default, Optional is selected. If you choose Required, the clients are allowed to associate only if the MFP is negotiated (that is, if WPA2 is configured on the wireless controller, and the client is also configured for WPA2 and supports CCXv5 MFP).

3. For 11K:

   • Neighbor List: Check this check box for all the 11k-capable clients to request a neighbor report about the known neighboring APs that are candidates for roaming.

     Note

     To facilitate roaming, a 11k-capable client that is associated with an AP sends a request to a list of neighboring APs. The request is sent in the form of an 802.11 management frame, which is known as an action frame. The AP responds with a list of neighbor APs on the same WLAN with the Wi-Fi channel numbers. The response is also an action frame. The client identifies the AP candidates for next roam from the response frame.

   • Session Timeout: Check this check box to set the maximum time for a client session to remain active before reauthorization.

     Note	By default, Session Timeout is enabled with a timeout of 1800 seconds.

   • Client Exclusion: Check this check box to set the client exclusion timer.

     Note	When a user fails to authenticate, the wireless controller excludes the client from connecting. The client is not allowed to connect to the network until the exclusion timer expires. By default, Client Exclusion is enabled with a timeout of 180 seconds.

4. For 11v BSS Transition Support:

   • BSS Max Idle Service: Check this check box to set the idle period timer value. The idle period timer value is transmitted using the association and reassociation response frame from the APs to the client.

     Note	The BSS Max idle period is the timeframe during which an AP doesn’t disassociate a client because of nonreceipt of frames from the connected client.

   • Client User Idle Timeout: Check this check box to set the user idle timeout period for a WLAN.

     Note	If the data sent by the client is more than the threshold quota specified as the user idle timeout period, the client is considered to be active and the wireless controller refreshes for another timeout period. By default, Client User Idle Timeout is enabled with a user idle timeout of 300 seconds.

   • Directed Multicast Service: Check this check box to enable directed multicast service.

     Note	By default, Directed Multicast Service is enabled. Using the Directed Multicast Service (DMS), the client requests APs to transmit the required multicast packets as unicast frames. This allows clients to sleep for a longer time and saves the battery power.

5. (Optional) For NAS-ID:

   1. From the NAS-ID Opt drop-down list, choose the required type of network access server identifier (NAS ID).

      (Optional) To specify a custom script for the NAS ID, choose Custom Option from the NAS-ID Opt drop-down list and enter the custom script in the corresponding Custom Script for Opt field. You can enter up to 31 alphanumeric characters, special characters, and spaces for the custom script. Cisco DNA Center doesn't support the special characters ? " < and trailing spaces for the custom script.

      Note	Cisco DNA Center supports NAS ID with custom script only for Cisco Catalyst 9800 Series Wireless Controllers that run Cisco IOS XE Release 17.7 or later.

   2. (Optional) Click + to add another network access server identifier. You can add up to three NAS IDs.

      Note	Cisco DNA Center applies only one NAS ID for Cisco AireOS Controllers. You can overwrite the NAS ID at the site-level from the Design > Network Settings > Wireless window.

6. Click Next.

Step 8

Complete the Associate SSID to Profile setup:

1. Click a profile from the left pane.

2. If you don’t have a profile, click Add Profile and then configure the profile settings:

   • Profile Name: Enter a name for the wireless profile.

   • (Optional) WLAN Profile Name: Enter a name for the WLAN profile.

     Based on the WLAN profile name, Cisco DNA Center automatically generates the policy profile name for Cisco Catalyst 9800 Series Wireless Controller.

     Note

     When an SSID is associated with a network profile, Cisco DNA Center uses this WLAN profile name during provisioning. If you need to associate an SSID with multiple network profiles, we recommend that you enter a unique WLAN profile name for the SSID across all network profiles to prevent provisioning failure.

   • Fabric: Specify whether the SSID is fabric or nonfabric.

     Note

     A fabric SSID is a wireless network, which is a part of Software Defined-Access (SD-Access). SD-Access is a solution that automates and simplifies configuration, policy, and troubleshooting of wired and wireless networks. With fabric SSID, it’s mandatory to have SD-Access. Nonfabric is a traditional wireless network that doesn’t require SD-Access.

     For a nonfabric SSID, choose the following:

     • Interface: From the Interface Management drop-down list, choose an interface or click the plus icon to add a new wireless interface.

       Note	This is the VLAN ID that is associated with the wireless interface.

     • VLAN Group: From the VLAN Group Name drop-down list, choose a VLAN group or click the plus icon to add a VLAN group.

   • Do you need Anchor for this SSID?: Choose whether the SSID is an anchor or not.

     If you choose Yes, from the Select Anchor Group drop-down list, choose an anchor group for the SSID. For more information about anchor groups, see Create an Anchor Group.

   • Flex Connect Local Switching: Check this check box to enable local switching for the WLAN. When you enable local switching, any FlexConnect AP that advertises this WLAN is able to locally switch data packets.

     Note	If you have enabled Flex Connect Local Switching for an SSID, then all the APs on that particular floor where the network profile is mapped switch to FlexConnect mode.

3. Click Associate Profile to choose the profile.

4. Click Next.

Step 9

In the Summary window, review the configuration settings. (To make any changes, click Edit.)

Step 10

To save the SSID settings, click Save.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

From the SSID table, in the Action column, click Configure AAA of SSID for which you want to configure the AAA server.

Step 5

From the Server drop-down list of the Configure AAA Server slide-in pane, you can either search for a AAA IP address by entering its name in the Search field or choose AAA IP address.

Step 6

Click + to add an Additional Server.

Step 7

From the Additional Server drop-down list, choose the server IP address.

Step 8

(Optional) To delete a server or an additional server, click the delete icon next to each server.

Step 9

Click Configure.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

In the SSID table, click SSID Scheduler.

Step 4

In the SSID Scheduler window, click Add.

Step 5

In the Create Scheduler slide-in pane, do the following:

1. Enter a unique name for the SSID scheduler that you want to create.

2. Click Client Deny radio button for denying clients from joining SSID.

3. Click Enable SSID to schedule SSID broadcasting.

4. Choose the Scheduler Type Daily, Weekly, or Monthly and complete the required settings.

5. From the Time Zone drop-down list, choose the time zone.

6. Click Save.

   The created SSID scheduler appears in the SSID Scheduler table.

Step 6

To edit the SSID scheduler, do the following:

1. From the SSID Scheduler table, choose the SSID scheduler and click Edit.

2. In the Edit SSID Scheduler slide-in pane, make the required changes and click Save.

Step 7

To delete the SSID scheduler, choose the SSID scheduler and click Delete.

Step 8

To view the details of SSID scheduler, choose the SSID scheduler and click Scheduler History.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

In the Access Points Authentication for Plug n Play (PnP) area, complete the following:

1. Choose an authentication method:

   • NO-AUTH: By default, this authentication method is selected.

   • EAP-TLS: Extensible Authentication Protocol-Transport Level Security (EAP-TLS) is an authentication method designed to mitigate several weaknesses of EAP. EAP-TLS provides many of the benefits that PEAP provides but differs from it in the lack of support for legacy authentication methods.

   • EAP-PEAP: EAP-Protected Extensible Authentication Protocol (EAP-PEAP) provides mutual authentication, ensures confidentiality and integrity to vulnerable user credentials, protects itself against passive (eavesdropping) and active (man-in-the-middle) attacks, and securely generates cryptographic keying material. PEAP is compatible with the IEEE 802.1X standard and RADIUS protocol.

     If you select EAP-PEAP, enter the user name and password. A certificate is generated and applied during the PnP claim process.

   • EAP-FAST: EAP-Flexible Authentication via Secure Tunneling (EAP-FAST) is an authentication protocol that provides mutual authentication and uses a shared secret to establish a tunnel. The tunnel is used to protect weak authentication methods that are based on passwords. The shared secret, referred to as a Protected Access Credentials (PAC) key, is used to mutually authenticate the client and server while securing the tunnel.

     If you select EAP-FAST, enter the user name and password. A certificate is generated and applied during the PnP claim process.

2. Enter the Username and Password.

3. Click Save.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

From the Wireless Interfaces table, click +Add.

Step 5

Configure the wireless interface settings in the Create a Wireless Interface slide-in pane:

1. In the Interface Name field, enter the dynamic interface name.

2. In the VLAN ID field, enter the VLAN ID for the interface.

Step 6

Click Save.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

For the VLAN Group table, click Add.

Step 4

Enter a valid VLAN Group Name, select single or multiple interfaces from the list, and click Save.

Step 5

In the Edit Network Profile page, the VLAN group is associated with the SSID.

Step 6

To add more SSIDs to the VLAN group, click Add SSID.

Step 7

Choose Interface or VLAN group.

Step 8

Click the add icon to create a new interface or VLAN group.

Step 9

Click Save.

Step 10

In Configure Interface and VLAN, you can view the list of interface names, interface groups names, and other parameters required to configure the interface and VLAN.

Step 11

Click the menu icon () and choose Provision > Network Devices > Inventory.

Step 12

Select the device.

Step 13

From the Actions drop-down menu, choose Provision > Provision Device.

Step 14

Review the details in the Assign Site, Configuration, Model Configuration, Advanced Configuration, and Summary screens. From each screen, click Next to advance to the next screen.

Step 15

Click Deploy.

Step 16

Choose Now and click Apply.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

In the Wireless Radio Frequency Profile area, hover your cursor over Add, and choose Basic RF Profile.

Step 5

In the Profile Name field of the Create Wireless Radio Frequency Profile window, enter the RF profile name.

Step 6

Configure the following for the 2.4 GHz radio type:

1. Under Parent Profile, select High, Medium (Typical), Low, or Custom. (The Data Rate and Tx Configuration fields change depending on the parent profile selected. For example, if you select High, it populates the profile configurations available in the device for 2.4-GHz. If you change any settings in the populated Data Rate and Tx Configuration, the Parent Profile automatically changes to Custom.) Note that a new RF profile is created only for the selected custom profiles.

   Note	Low, Medium (Typical), and High are the default RF profiles. If you select a default RF profile, the respective RF profile on the device is used and the new RF profile is not created on Cisco DNA Center.

2. DCA Channel dynamically manages channel assignment for an RF group and evaluates the assignments on a per-AP radio basis.

   • Check the Select All check box to select DCA channels 1, 6, and 11. Alternatively, check the individual check boxes next to the channel numbers.

   • Click Show Advanced to select the channel numbers under the Advanced Options.

   • Check the Select All check box to select DCA channels that are under Advanced Options, or check the check box next to the individual channel numbers. The available channel numbers are 2, 3, 4, 5, 7, 8, 9, 10, 12, 13, and 14.

     Note	You must configure these channels globally on Cisco Wireless Controller.

3. Use the Supported Data Rate slider to set the rates at which data can be transmitted between an access point and a client. The available data rates are 1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, and 54.

4. Under Tx Power Configuration, set the power level and power threshold for an AP.

   • Power Level: To determine whether the power of an AP needs to be reduced. Reducing the power of an AP helps mitigate co-channel interference with another AP on the same channel or in close proximity. Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm to 30 dBm and the default is -10 dBm.

   • Power Threshold: Is the cutoff signal level used by Radio Resource Management (RRM) to determine whether to reduce the power of an AP. Use the Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmit power rates. The range is from -50 dBm to 80 dBm and the default threshold is -70 dBm.

   • RX SOP: Receiver Start of Packet Detection Threshold (RX SOP) determines the Wi-Fi signal level, in dBm, at which an AP's radio demodulates and decodes a packet. From the RX SOP drop-down list, choose High, Medium, Low, or Auto threshold values for each 802.11 band.

5. In the Max Client field, enter the maximum client limit value. The valid range is from 0 through 500.

   Note

   Maximum client limit is not supported on the Cisco AireOS Wireless Controller. If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7 or later and earlier than Cisco IOS XE Release 17.9, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9 or later, the maximum client limit is 500.

Step 7

Configure the following for the 5 GHz radio type:

1. From the Parent Profile drop-down list, choose High, Medium (Typical), Low, or Custom. (The Data Rate and Tx Configuration fields change depending on the parent profile selected. For example, if you select High, it populates the configurations available in the device for 2.4 GHz. If you change any settings in the populated Data Rate and Tx Configuration fields, the Parent Profile automatically changes to Custom.) A new RF profile is created only for select custom profiles.

   Note	Low, Medium (Typical), and High are the default RF profiles. If you select a default RF profile, the respective RF profile that is already present in the device is used and the new RF profile is not created on Cisco DNA Center.

2. From the Channel Width drop-down list, choose one of the channel bandwidth options: Best, 20 MHz, 40 MHz, 80 MHz, or 160 MHz.

3. Check the Zero Wait DFS check box to allow APs with 5-GHz radio band to switch to a new channel without any waiting time.

   Note	Cisco DNA Center supports Zero wait DFS for Cisco Wireless Controllers running Cisco IOS XE Release 17.9.1 and later.

4. Set the DCA Channel to manage channel assignments:

   Note	You must configure the channels globally on Cisco Wireless Controllers.

   • UNII-1 36-48: The channels available for UNII-1 band are 36, 40, 44, and 48. Check the UNII-1 36-48 check box to include all channels, or check an individual check box.

   • UNII-2 52-144: The channels available for UNII-2 band are 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, and 144. Check the UNII-2 52-144 check box to include all channels, or check an individual check box.

   • UNII-3 149-165: The channels available for UNII-3 band are 149, 153, 157, 161, and 165. Check the UNII-3 149-165 check box to include all channels, or check an individual check box.

5. Use the Data Rate slider to set the rates at which data can be transmitted between an access point and a client. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

6. Under Tx Power Configuration, set the power level and power threshold for an AP.

   • Power Level: Determines whether the power of an AP needs to be reduced. Reducing the power of an AP helps mitigate co-channel interference with another AP on the same channel or in close proximity. Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm to 30 dBm and the default is -10 dBm.

   • Power Threshold: Is the cutoff signal level used by Radio Resource Management (RRM) to determine whether to reduce the power of an AP. Use the Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmit power rates. The range is from -50 dBm to 80 dBm and the default threshold is -70 dBm.

   • RX SOP: Receiver Start of Packet Detection Threshold (RX SOP) determines the Wi-Fi signal level in dBm at which an AP's radio demodulates and decodes a packet. From the RX SOP drop-down list, choose High, Medium, Low, or Auto threshold values for each 802.11 band.

7. In the Max Client field, enter the maximum client limit value. The valid range is from 0 through 500.

   Note

   Maximum client limit is not supported on the Cisco AireOS Wireless Controller. If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7 or later and earlier than Cisco IOS XE Release 17.9, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9 or later, the maximum client limit is 500.

Step 8

Configure the following for the 6 GHz radio type:

1. Set the DCA Channel to manage channel assignments.

   • Check the Select All check box to include all DCA channels, or check an individual check box to select an individual DCA channel.

   • Click Show Advanced to select the remaining DCA channel numbers.

     • UNII-5 1-93

     • UNII-6 97-113

     • UNII-7 117-185

     • UNII-8 189-233

   Note	You must configure channels globally on Cisco Wireless Controller.

2. Use the Supported Data Rate slider to set the rates at which data can be transmitted between an access point and a client. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

3. In the Mandatory Data Rates area, check the check box next to the individual data rates. You can choose up to two data rates. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

4. Under Tx Power Configuration, set the power level and power threshold for an AP.

   • Power Level: Determines whether the power of an AP needs to be reduced. Reducing the power of an AP helps mitigate co-channel interference with another AP on the same channel or in close proximity. Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm to 30 dBm and the default is -10 dBm.

   • TPC Power Threshold: Is the cutoff signal level used by Radio Resource Management (RRM) to determine whether to reduce the power of an AP. Use the Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmit power rates. The range is from -50 dBm to 80 dBm and the default threshold is -70 dBm.

   • RX SOP: Receiver Start of Packet Detection Threshold (RX SOP) determines the Wi-Fi signal level in dBm at which an AP's radio demodulates and decodes a packet. From the RX SOP drop-down list, choose High, Medium, Low, or Auto threshold values for each 802.11 band.

5. In the Max Client field, enter the maximum client limit value. The valid range is from 0 through 500.

   Note

   Maximum client limit is not supported on the Cisco AireOS Wireless Controller. If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7 or later and earlier than Cisco IOS XE Release 17.9, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9 or later, the maximum client limit is 500.

Step 9

Click Save.

Step 10

To mark a profile as the default RF profile, check the Profile Name check box and click Mark Default.

Step 11

In the Warning window, click OK.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

In the Wireless Radio Frequency Profile area, click the Basic RF Profile tab.

Step 5

Check the check box next to the basic profile name that you want to edit.

Step 6

From the Action drop-down list, choose Edit/View.

Step 7

In the Edit Wireless Radio Frequency Profile window, configure the basic RF profile settings. For more information, see Create a Wireless Radio Frequency Profile.

Step 8

Click Save.

Step 9

To delete a basic RF profile, check the check box next to the basic RF profile name.

Step 10

From the Action drop-down list, choose Delete and then click Yes.

Step 11

To mark a basic RF profile as the default, check the check box next to a basic RF profile name.

Step 12

From the Action drop-down list, choose Mark Default and then click Yes.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

In the Wireless Radio Frequency Profile area, from the Add drop-down list, choose AI RF Profile.

Step 5

In the Profile Name field of the Create AI Radio Frequency Profile window, enter the RF profile name.

Step 6

Expand Basic Settings.

Step 7

In the Radio Frequency Settings area, check the 2.4 GHz, 5 GHz, or 6 GHz check box.

Step 8

In the Busy Hours area, define the start and end time of the site time zone.

Step 9

In the Busy Hour Sensitivity area, click the Low, Medium, or High radio button to define the threshold of Radio Resource Management (RRM) sensitivity for the busy hours interval.

Step 10

In the Enable RF Settings area, click the toggle buttons under the 2.4 GHz, 5 GHz, or 6 GHz columns to enable or disable the radio band for the respective RF setting.

Step 11

Expand Advanced and click the 2.4 GHz toggle button.

1. In the DCA Channel area, check the Select All check box to select DCA channels 1, 6, and 11. Alternatively, check the individual check boxes next to the channel numbers.

2. In the Advanced Options area, check the Select All check box to select all the DCA channels.

3. Click Show Advanced to select the remaining channel numbers.

4. Check the check box next to the individual channel numbers. The channel numbers that are available for the profile are 2, 3, 4, 5, 7, 8, 9, 10, 12, 13, and 14.

5. Use the Supported Data Rate slider to set the rates at which data can be transmitted between an AP and a client. The available data rates are 1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, and 54.

6. In the Mandatory Data Rates area, check the check box next to the individual data rates. You can choose up to two data rates. The available data rates are 1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, and 54.

7. Check the Enable 802.11b data rates check box to enable the 802.11b data rates. This action also enables the 802.11b supported data rate check box in the Mandatory Data Rates area.

8. In the Tx Power Configuration area, set the following:

   • Power Level: Determines whether the power of an AP needs to be reduced. Reducing the power of an AP helps mitigate co-channel interference.

   • Power Threshold: Is the cutoff signal level used by RRM to determine whether to reduce the power of an AP.

   • RX SOP: Receiver Start of Packet Detection Threshold (RX SOP) determines the Wi-Fi signal level, in dBm, at which an AP's radio demodulates and decodes a packet.

9. Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm through 30 dBm and the default is -10 dBm.

   • Use the Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmit power rates. The range is from -50 dBm through 80 dBm and the default threshold is -70 dBm.

   • From the RX SOP drop-down list, choose High, Medium, Low, or Auto threshold values for each 802.11 band.

10. In the Max Client field, enter the maximum client limit value. The valid range is from 0 through 500.

    Note

    If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7 or later and earlier than Cisco IOS XE Release 17.9, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9 or later, the maximum client limit is 500.

Step 12

In the Advanced area, click the 5 GHz toggle button.

1. Check the Zero Wait DFS check box to allow APs with 5GHz radio to switch to a new channel without any waiting time.

   Note	Cisco DNA Center supports Zero wait DFS for Cisco Wireless Controllers running Cisco IOS XE Release 17.9.1 and later.

2. Use the DBS Max Width slider to set the channel width of the AI RF profile.

   The available channel width options are 20 MHz, 40 MHz, 80 MHz, or 160 MHz.

   The Auto Channels Logic area displays the color-coded channel logics for the channel widths.

   You can select DBS Max Width only when DBS is enabled.

   When you disable the DBS, Cisco DNA Center allows you to select channel width.

3. Set the DCA Channel to manage the following channel assignments:

   • UNII-1 36-48: The channels available for UNII-1band are 36, 40, 44, and 48.

   • UNII-2 52-144: The channels available for UNII-2band are 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, and 144.

   • UNII-3 149-165: The channels available for UNII-3 band are 149, 153, 157, 161, and 165.

4. Check the Select All check box to include all DCA channels, or check an individual check box to select an individual DCA channel.

5. Click Show Advanced to select the remaining DCA channel numbers.

   • Check the UNII-1 36-48 check box to include all channels, or check an individual check box.

   • Check the UNII-2 52-144 check box to include all channels, or check an individual check box.

   • Check the UNII-3 149-165 check box to include all channels, or check an individual check box.

6. Use the Supported Data Rate slider to set the rates at which data can be transmitted between an AP and a client. The available data rates are 1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, and 54.

7. In the Tx Power Configuration area, set the Power Level, Power Threshold, and RX SOP.

8. Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm through 30 dBm and the default is -10 dBm.

9. Use the Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmit power rates. The range is from -50 dBm through 80 dBm and the default threshold is -70 dBm.

10. From the RX SOP drop-down list, choose High, Medium, Low, or Auto threshold values.

11. In the Max Client field, enter the maximum client limit value. The valid range is from 0 through 500.

    Note

    If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7 or later and earlier than Cisco IOS XE Release 17.9, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9 or later, the maximum client limit is 500.

Step 13

In the Advanced area, click the 6 GHz toggle button.

1. Use the DBS Width slider to set the minimum and maximum channel width of the AI RF profile.

   The available channel width options are 20 MHz, 40 MHz, 80 MHz, or 160 MHz.

   The Auto Channels Logic area displays the color-coded channel logics for the channel widths.

   You can select DBS Width only when DBS is enabled.

2. Set the DCA Channel to manage the following channel assignments:

   • UNII-5 1-93

   • UNII-6 97-113

   • UNII-7 117-185

   • UNII-8 189-233

3. Check the Select All check box to include all DCA channels, or check an individual check box to select an individual DCA channel.

4. Click Show Advanced to select the remaining DCA channel numbers.

   • Check the UNII-5 1-93 check box to include all channels, or check an individual check box.

   • Check the UNII-7 117-185 check box to include all channels, or check an individual check box.

   • Check the UNII-8 189-233 check box to include all channels, or check an individual check box.

5. Use the Supported Data Rate slider to set the rates at which data can be transmitted between an AP and a client. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

6. In the Tx Power Configuration area, set the Power Level, TPC Power Threshold, and RX SOP.

   • Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm through 30 dBm and the default is -10 dBm.

   • Use the TPC Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmit power rates. The range is from -50 dBm through 80 dBm and the default threshold is -70 dBm.

   • From the RX SOP drop-down list, choose High, Medium, Low, or Auto threshold values.

7. In the Max Client field, enter the maximum client limit value. The valid range is from 0 through 500.

   Note

   If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7 or later and earlier than Cisco IOS XE Release 17.9, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9 or later, the maximum client limit is 500.

Step 14

Click Save.

Step 1

Click the menu icon () and choose Workflows > Configure AI RF Profile.

Step 2

In the Assign AI RF Profiles window, click Let’s Do it to go directly to the workflow.

Step 3

The Configure AI RF Profile window appears.

Step 4

In the Select Locations to Assign AI RF Profiles window, select the locations where you want to assign the AI-enabled RF profiles. You can either search for a site by entering its name in the Find Hierarchy field, or expand Global and choose the sites.

Step 5

In the Select AI RF Profiles to assign window, the Building table lists AI RF profiles based on Location, Floors, Current RF Profiles, and Replace with AI RF Profiles.

1. In the Building table, check the check box next to a location to choose an AI RF profile.

2. Based on the location, choose an AI-enabled RF profile from the drop-down list under Replace with AI RF Profiles to replace with the current AI RF profile.

3. If the AI RF profile is not created, click the three dots under the Action column to create a new AI RF profile, or copy the current RF profile and AI settings.

4. You can also create an AI RF profile from the Create a new AI RF Profile to apply link in the Select AI RF Profiles to assign window. For more information, see Create an AI Radio Frequency Profile.

Step 6

In the Details of selected AI RF Profile window, review the AI Settings, Common Settings, and Assignment details of the AI-enabled RF profiles.

Step 7

In the Summary window, review the Task Details, Select Locations to Assign AI RF Profiles, and Select AI RF Profiles to assign.

Step 8

In the Deploy the AI RF Profiles window, choose whether you want to deploy profiles Now or schedule it for later.

Step 9

Click Continue.

Step 10

Click the menu icon () and choose Activities > Tasks.

Step 11

In the Tasks window, click the task link.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

In the Wireless Radio Frequency Profile area, click the AI RF Profile tab.

Step 5

Click the three dots under the Action column for an AI RF profile.

Step 6

From the drop-down list, choose Assign Location.

Step 7

You can either search for a site by entering its name in the Search field, or expand All Sites to choose the sites.

Step 8

Review the confirmation and click Confirm to assign the chosen sites to the AI-enabled RF profile.

Step 9

Click Assign.

Step 10

(Optional) Click the backup link to download a .csv file to your local machine.

Step 11

Click Confirm.

Step 12

In the subsequent confirmation window, click Confirm.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

In the Wireless Radio Frequency Profile area, click the AI RF Profile tab.

Step 5

Click the three dots under the Action column for an AI RF profile.

Step 6

From the drop-down list, choose Unassign Location.

Step 7

Check the check box next to a site to unassign an AI RF profile.

Step 8

Click the Select from available RF Profiles radio button to select an available RF profile that you want to assign to the chosen location.

Step 9

From the Select RF Profile to Replace drop-down list, choose an RF profile.

Step 10

Click Upload a CSV with RF settings back to upload a backup of the RF settings from your local machine.

Step 11

Click Choose a file to import the CSV file, or drag and drop the CSV file to the drag and drop area.

Step 12

Review the Confirm RF Settings for Selected Locations window and click Confirm.

Step 13

Click Unassign.

Step 14

In the confirmation window, click Continue.

Step 15

Click the menu icon () and choose Activities > Tasks > to view upcoming, in progress, completed, and failed unassign location to AI RF profile tasks.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

Check the check box next to the basic RF profile name that you want to upgrade to an AI RF profile.

Step 5

From the Action drop-down list, choose Upgrade to AI.

Step 6

In the confirmation window, click Yes.

Step 7

In the Edit AI RF Profile window, configure the AI RF profile settings. For more information, see Create an AI Radio Frequency Profile.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose Global.

Step 4

In the Anchor Group table, click Add.

Step 5

In the Anchor Group Name field of the Anchor Group slide-in pane, enter the anchor group name.

Step 6

To add a managed wireless controller as an anchor, click Add Managed WLC and do the following in the Add Managed WLC dialog box:

1. Check the check box next to the name of the devices that you want to add as anchors.

   To search for a device, in the Search Table search field, enter either the partial name or the full name of the device and press Enter.

2. Click Add.

Step 7

(Optional) To add an external wireless controller as an anchor, click Add External WLC and do the following in the Add External WLC dialog box:

1. In the Device Name field, enter the device name.

2. From the Device Series drop-down list, choose a device series.

3. In the Peer IP Address field, enter the peer IP address.

4. (Optional) In the NAT IP Address field, enter the Network Address Translation (NAT) IP address.

5. In the MAC Address field, enter the MAC address of the device.

6. In the Mobility Group Name field, enter the mobility group name.

7. (Optional) In the Hash field, enter the hash for the Cisco Catalyst 9800 Series Wireless Controller.

   Note	This field is available for only the Cisco Catalyst 9800-CL Wireless Controllers.

8. Click Add.

Step 8

(Optional) To add an existing external wireless controller as an anchor, click Add Existing External WLC and do the following in the Add Existing External WLC dialog box:

1. Check the check box next to the name of the devices that you want to add as anchors.

   To search for a device, in the Search Table search field, enter either the partial name or the full name of the device and press Enter.

2. Click Add.

Step 9

(Optional) To set the priority for an anchor, from the Priority Order drop-down list, choose the priority for the anchor wireless controller.

Step 10

Click Save.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the SSID table, hover over and choose Enterprise.

Step 4

Toggle the Sensor field and click Next.

Step 5

Click Next.

Step 6

In the Wireless Profiles screen, check a profile from the Profiles table.

Step 7

In Fabric, select Yes and click Save.

Step 8

Click Finish.

Step 9

Click the menu icon () and choose Provision > Network Devices > Inventory.

Step 10

Check a device and from the Actions drop-down menu, choose Provision > Provision Device.

Step 11

Review the details under Assign Site, Configuration, Model Configuration, Advanced Configuration, and Summary. Click Next after each screen.

Step 12

Click Deploy.

Step 13

Choose Now and click Apply.

Step 1

Click the menu icon () and choose Assurance > Manage > Sensors.

Step 2

Hover your cursor over the Settings tab and choose Backhaul Settings.

Step 3

You can add and manage backhaul SSIDs by doing the following:

1. Click + Add Backhaul.

   The Create Sensor Backhaul SSID Assignment window appears with two areas: Wired Backhaul and Wireless Backhaul.

2. In the Settings Name field, enter a name for the backhaul SSID.

3. In the Wired Backhaul area, configure the following:

   • Level of Security: Displays the encryption and authentication type used by the selected SSID. The available security options are:

     • 802.1x EAP: Standard used for passing Extensible Authentication Protocol (EAP) over wired LAN.

     • Open: No security or authentication is used.

   • EAP Method: If you choose 802.1x EAP, you must choose one of the following EAP methods for user authentication from the drop-down list:

     • EAP-FAST: Enter the username and password in the fields provided.

     • PEAP-MSCHAPv2: Enter the username and password in the fields provided.

     • EAP-TLS: Choose Enroll Using Certificate Bundle or Enroll Using SCEP.

       If you choose Enroll Using Certificate Bundle, click the drop-down arrow under Certificate Bundle, click + Add New Certificate Bundle, and enter the username and certificate bundle password.

     • PEAP-TLS: Choose Enroll Using Certificate Bundle or Enroll Using SCEP.

       If you choose Enroll Using Certificate Bundle, click the drop-down arrow under Certificate Bundle, click + Add New Certificate Bundle, and enter the username and certificate bundle password.

4. In the Wireless Network Name (SSID) area, select the wireless network (SSID) and configure the following.

   • Level of Security: Displays the encryption and authentication type used by the selected SSID. The available security options are:

     • WPA2 Enterprise: Provides a higher level of security using Extensible Authentication Protocol (EAP) (802.1x) to authenticate and authorize network users with a remote RADIUS server.

     • WPA2-Personal: Provides a good security using a passphrase or a preshared key (PSK). This allows anyone with the passkey to access the wireless network.

       If you select WPA2 Personal, enter the passphrase in the Passphrase text box.

     • PSK Format: The available preshared key formats are:

       • ASCII: Supports ASCII PSK passphrase.

       • HEX: Supports 64-character HEX key PSK password.

     • Open: No security or authentication is used.

5. Click Save.

Step 4

You can edit the existing backhaul configurations by doing the following:

1. Check the check box of the backhaul configuration.

2. Hover your cursor over the Actions drop-down list and choose Edit.

Step 5

You can delete a backhaul configuration by doing the following:

1. Check the check box of the backhaul configuration.

2. Hover your cursor over the Actions drop-down list and choose Delete.

Step 1

Click the menu icon () and choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, choose the required site:

Step 4

In the Native VLAN ID field, enter a value for the VLAN ID. The valid range is from 1 through 4094.

Step 5

For the AAA Override VLAN settings, enter a VLAN ID and VLAN name mapping in the corresponding VLAN ID and VLAN Name fields. To add more mappings, click the Add icon.

Step 6

Click Save.