WLANs Tab
The WLAN tab on the menu bar enables you to create, configure, and delete wireless local area networks (WLANs) on your Cisco WLC. Use the left navigation pane to access specific WLAN parameters.
You can access the following pages from the WLANs tab:
When you choose WLANs and click the blue arrow adjacent the profile, you can access the following options:
WLANs
Click WLANs to navigate to the WLANs page.
This page shows a summary of the wireless local area networks (WLANs) that you have configured on your network. From this page, you can add, remove, enable, disable, or edit WLANs.
Note
The total number of WLANs appears in the upper right corner of the page. If the list of WLANs spans multiple pages, you can access these pages by clicking the page number links.
The Cisco UWN (Unified Wireless Network) solution can control up to 512 WLANs for lightweight access points. Each WLAN has a separate WLAN ID (1 through 512), a separate profile name, and a WLAN SSID (Service Set IDentifier), and it can be assigned with unique security policies. All Cisco WLCs publish up to 16 WLANs to each connected access point, but you can create up to 512 WLANs and then selectively publish these WLANs (using access point groups) to different access points to better manage your wireless network.
Note All OfficeExtend access points should be in the same access point group, and that group should contain no more than 15 WLANs. A Cisco WLC with OfficeExtend access points in an access point group publishes up to 15 WLANs to each connected OfficeExtend access point because it reserves one WLAN for the personal SSID, but for Cisco OEAP 600, this is not applicable.
Note The Cisco OEAP 600 Series access point supports only two WLANs and one RLAN, and the WLAN ID must be from 1 to 8.
You can associate up to 16 WLANs with each access point group and assign specific access points to each group. Each access point advertises only the enabled WLANs that belong to its access point group. The access point does not advertise disabled WLANs in its access point group or WLANs that belong to another group. See the AP Groups page for more information on access point groups.
WLAN List Filter
Click the Change Filter link to display the Search WLANs dialog box to create or change filter parameters. Click Clear Filter to remove the filter and display the entire WLAN list.
You can create a filter to display the list of WLANs by profile name, SSID, status, or a combination of SSID and status.
The current filter parameters are displayed in the Current Filter field.
Note When you enable the Profile Name filter, other filter options are disabled. When you enable the SSID or the Status filter, the Profile Name filter is disabled.
The Search WLANs dialog box enables you to search configured WLANs based on the following filters:
WLAN Information Table
Click WLANs from the left navigation menu to view the WLAN page. The WLANs page displays a summary of the configured WLANs.
This table describes the WLAN parameters.
|
|
|
|---|---|
Click the WLAN ID to modify the selected WLAN characteristics. The Editing WLANs page appears.
To view mobility anchor settings, click the blue arrow adjacent the profile and choose Mobility Anchors.
To enable or disable a WLAN from the WLANs page, select the check box to the left of the WLAN or WLANs, choose Enable Selected or Disable Selected from the drop-down list, and click Go.
To delete a WLAN, do one of the following:
- Click the blue arrow adjacent the profile and choose Remove. You are prompted to confirm the removal of the selected WLAN.
- Select the check box for the WLAN or WLANs, choose Remove Selected from the drop-down list, and select Go. You are prompted to confirm the removal of the selected WLAN.
- Click Go to select an option from the drop-down list.
Creating New WLANs
To configure a new WLAN for a wired guest LAN, choose Create New from the drop-down list and click Go to navigate to the New WLAN page.
This table describes the WLAN > New parameters.
Creating a WLAN
Step 1 Choose a WLAN type (Guest LAN, WLAN, or Remote LAN) from the drop-down list.
Note The WLANs that are not assigned to the access points are denoted with an asterisk (*) symbol.
Note To connect wired clients to a corporate network via an Office Extended AP, choose Remote LAN from the WLAN Type drop-down list. Once a user creates a remote LAN, it shows up on the list page as a distinct WLAN type.
Note Remote LANs should be removed from a Cisco WLC’s configuration before moving to a code base that does not support the remote LAN functionality. The remote LAN is called a WLAN in releases earlier than Cisco WLC Release 7.0.116.0, which may cause an undesirable or unsecured WLAN being broadcast on the wireless network. Remote LANs are supported only in Cisco WLC Release 7.0.116.0 and later.
Step 2 Enter a profile name for the WLAN in the Profile Name text box.
Step 3 Enter a text name for the WLAN in the WLAN SSID text box. (This is the SSID broadcast name for the WLAN.)
Note The SSID field is not available for Guest LANs and Remote LANs.
Step 4 Choose the ID number for the WLAN from the WLAN ID drop-down list.
Step 5 Click Apply to bring up the Editing WLANs page, where you can continue configuring the WLAN.
Once created, the selected WLAN type shows up in the list page as a distinct WLAN type: guest LAN, WLAN, or remote WLAN.
Click Apply to send data to the Cisco WLC, but the data is not preserved across a power cycle; these parameters are stored temporarily in volatile RAM.
Creating a Remote LAN
This section describes configuring remote LANs.
You must remove all the remote LANs from the configuration of the Cisco WLC before moving to a release that does not support the remote LAN functionality. The remote LAN is called a WLAN in releases earlier than Cisco WLC Release 7.0.116.0, which may cause an undesirable or unsecured WLAN being broadcast on the wireless network. Remote LANs are supported only in Cisco WLC 7.0.116.0 and later.
Note Only four clients can connect to an OEAP 600 series access point through a remote LAN port. This number does not affect the fifteen limit imposed for the Cisco WLC WLANs. The Remote LAN client limit supports connecting a switch or hub to the Remote LAN port for multiple devices or connecting directly to a Cisco IP phone that is connected to that port. Only the first four devices will be able to connect until one of the devices is idle for more than one minute.
Step 1 Choose WLANs to open the WLANs page.
This page lists all of the WLANs and remote LANs currently configured on the Cisco WLC. For each WLAN, you can see its WLAN/Remote LAN ID, profile name, type, SSID, status, and security policies.
The total number of WLANs appears in the upper right-hand corner of the page. If the list of WLANs spans multiple pages, you can access these pages by clicking the page number links.
Note If you want to delete a WLAN, click the blue arrow adjacent the WLAN and choose Remove, or select the check box to the left of the WLAN, choose Remove Selected from the drop-down list, and click Go. A message appears asking you to confirm your decision. If you proceed, the WLAN is removed from any access point group to which it is assigned and from the access point’s radio.
Step 2 Create a new WLAN by choosing Create New from the drop-down list and clicking Go. The WLANs > New page appears.
Step 3 From the Type drop-down list, choose Remote LAN to create a remote LAN.
Step 4 In the Profile Name text box, enter up to 32 alphanumeric characters for the profile name to be assigned to this WLAN. The profile name must be unique.
Step 5 From the WLAN ID drop-down list, choose the ID number for this WLAN.
Step 6 Click Apply to commit your changes. The WLANs > Edit page appears.
Note You can also open the WLANs > Edit page from the WLANs page by clicking the ID number of the WLAN that you want to edit.
Step 7 Use the parameters on the General, Security, and Advanced tabs to configure this remote LAN. See the sections in the rest of this chapter for instructions on configuring specific features.
Step 8 On the General tab, select the Status check box to enable this remote LAN. Be sure to leave it unselected until you have finished making configuration changes to the remote LAN.
Note You can also enable or disable remote LANs from the WLANs page by selecting the check boxes to the left of the IDs that you want to enable or disable, choosing Enable Selected or Disable Selected from the drop-down list, and clicking Go.
Step 9 Click Apply to commit your changes.
Step 10 Click Save Configuration to save your changes.
Editing WLANs
To edit your WLAN settings, choose WLANs and click the Profile name to navigate to the WLANs > Edit page. For new WLANs, create a new WLAN as described in Creating New WLANs page, and then click Apply to navigate to this page.
This page enables you to edit the configurable parameters for a WLAN.
General Tab
This table describes the General tab parameters.
|
|
|
|---|---|
Type of LAN that is configured in the WLANs > New page: WLAN, Guest LAN, or Remote LAN. |
|
WLAN that you want to enable or disable. The default is enabled. |
|
Security policies for a WLAN that you set from the Security tab. Note This field appears when you choose WLAN as the Type in the WLANs > New page. |
|
WLAN radio policy to apply to All (802.11a/b/g), 802.11a only, 802.11g only, 802.11b/g only, or 802.11a/g only. This setting requires that the selected bands be enabled on the 802.11a/n/ac Global Parameters and 802.11a/n/ac Client Roaming pages. Note This field appears only when you choose WLAN as the Type in the WLANs > New page. |
|
Limited to the nonservice port and nonvirtual interface names configured on the Interfaces page. Note This field appears only when you choose WLAN as the Type in the WLANs > New page. |
|
Check box that you can select to enable the multicast VLAN feature. The default option is none. Note The Multicast Interface field appears only after you enable the Multicast VLAN feature text box. Note You have to configure the multicast VLAN feature only once if you want to use the multicast feature. |
|
Guest LAN’s ingress interface. By default, None is selected. |
|
Remote LAN’s or guest LAN’s egress interface. By default, management is selected. Note This field is available only for remote LANs and guest LANs. |
|
Network Access Server identifier. The NAS-ID is sent to the RADIUS server by the controller (as a RADIUS client) using the authentication request, which is used to classify users to different groups. You can enter up to 32 alphanumeric characters. Beginning in Release 7.4 and later releases, you can configure the NAS-ID on the interface, WLAN, or an access point group. The order of priority is AP Group NAS-ID > WLAN NAS-ID > Interface NAS-ID. |
Security Tab
Important Limitations and Guidelines:
- CCX is not supported on the Cisco OEAP 600 access points and all elements related to CCX are not supported.
- Layer 2 security is not supported on guest LANs.
- Only the following options are supported for Cisco OEAP 600 Series access points: None, WPA+WPA2, Static WEP, and 802.1X (only for remote LANs).
- Beginning in Release 7.4 and later releases, the controller performs both web authentication (WebAuth) and 802.1X authentication in the same WLAN. The clients are initially authenticated with 802.1X. After a successful authentication, the client must provide the WebAuth credentials. After a successful WebAuth authentication, the client is moved to the run state.
– 802.1x authentication can be performed using AAA or a local database.
– Only the anchor controller must have both dot1x and WebAuth configured.
– Both anchor and foreign controller must be configured for dot1x.
This table describes the Layer 2 tab parameters.
|
|
|
|
|---|---|---|
| For information on these settings, see the Layer 2 WPA + WPA2 Parameters topic. |
||
WEP 802.1X data encryption type. For information on these settings, see the Layer 2 802.1X Parameters topic. |
||
Static WEP encryption parameters. For information on these settings, see the Layer 2 Static WEP Parameters topic. |
||
Both Static WEP and 802.1X parameters. For information on these settings, see the Layer 2 Static WEP Parameters and Layer 2 802.1X Parameters topics. |
||
Cisco Key Integrity Protocol (CKIP). Functional on AP Models 1100, 1130, and 1200, but not AP 1000. Aironet IE needs to be enabled for this feature to work. CKIP expands the encryption keys to 16 bytes. For information on these settings, see the Layer 2 CKIP Parameters topic. |
||
Both None and Extensible Authentication Protocol Passthrough parameters. If EAP-Passthrough on the WLAN is enabled, the WLAN might be exposed to security attacks on the network. |
||
| MAC address filtering. You can locally configure clients by their MAC addresses in the Adding MAC Filters page. Otherwise, configure the clients on a RADIUS server. |
||
| MAC authentication failover to Dot1x authentication for the WLAN. The prerequisites for the failover to work are as follows: The failover does not work with Radius NAC feature. If MAC authentication is successful and the client sends an EAP start request to start 802.1X authentication, the client must pass 802.1X authentication to send data traffic, or the client is deauthenticated. When MAC Auth fails, the client authenticates using 802.1X or it is deauthenticated. If MAC Auth passes, then the client authenticates using 802.1X if required (for Static WEP Clients) depending on the client configuration. |
||
|
|
||
| Check box to enable or disable a fast transition between access points. |
||
| Check box to enable or disable a fast transition over a distributed system. |
||
| Time in seconds after which a fast transition reassociation times out. |
||
This table describes the Layer 2 WPA + WPA2 parameters.
This table describes the Layer 2 802.1X parameters.
|
|
|
|---|---|
|
Note The third-party AP WLAN (17) can only be configured with 802.1X encryption. Drop-down configurable 802.1X parameters are not available for this WLAN. |
This table describes the Layer 2 Static WEP parameters.
|
|
|
|---|---|
| Note One unique WEP key index can be applied to each WLAN. Because there are only four WEP key indexes, only four WLANs can be configured for static WEP Layer 2 encryption. |
|
This table describes the Layer 2 CKIP parameters.
This table describes the Layer 3 Tab (for WLAN) parameters.
|
|
|
|
|---|---|---|
Setting that indicates that no Layer 3 security is selected. |
||
Setting to enable IPsec. Check software availability and client hardware compatibility before implementing IPsec. Note You must have the optional VPN/Enhanced Security Module (crypto processor card) installed to enable IPsec. Verify that it is installed on your Cisco WLC using the Inventory page. |
||
VPN pass-through that you can enable or disable. Note This option is not available on Cisco 5500 Series Controllers. However, you can replicate this functionality on the Cisco 5500 Series Controllers by creating an open WLAN using an ACL. For information on these settings, see Layer 3 VPN Pass-Through Parameters . |
||
| Check box that you can select to enable Web Policy. Note The Cisco WLC forwards DNS traffic to and from wireless clients prior to authentication if there is no explicit deny rule for DNS traffic in the Pre-Auth ACL. Note Web Policy cannot be used with IPsec or VPN pass-through options. The following parameters are displayed:
|
||
| IPv4 or IPv6 ACLs to be used for traffic between the client and the Cisco WLC. Refer to the Access Control Lists topic for more information. |
||
| Drop-down list from which you can choose the FlexConnect ACL for external web authentication in locally switched WLANs. For more information about creating FlexConnect ACLs, see Adding Access Control Lists. Note The FlexConnect ACLs that are specific to an AP have the highest priority. The FlexConnect ACLs that are specific to WLANs have the lowest priority. |
||
| Check box that you can select to enable support for sleeping clients. This feature is not applicable for remote LANs and guest LANs. |
||
| Maximum amount of time after the idle timeout, in hours, before a sleeping client is forced to reauthenticate. The range is from 1 to 720. The default value is 12. This field is enabled only when you select the Sleeping Client check box. Also, the clients need not provide the login credentials when they move from one Cisco WLC to another (if Cisco WLCs are in the same mobility group) between the sleep and wake up times. |
||
| Setting that is displayed if you choose Authentication. Select this check box to override the global authentication configuration set on the Web Login Page. |
||
| Setting that is displayed if you choose Web Policy and Over-ride Global Config. – – – |
||
| Setting that is displayed if you choose Passthrough. If you choose this option, you are prompted to specify your e-mail address when you try to connect to the network. |
||
This table describes the Layer 3 Tab (for Guest LAN and Remote LAN) parameters.
|
|
|
|
|---|---|---|
Prompts you for your username and password while connecting the client to the network. |
||
Enables you to access the network directly without entering the username and password. |
||
| IPv4 or IPv6 ACLs to be used for traffic between the client and the Cisco WLC. See the Access Control Lists topic for more information. |
||
| Check box that you enable to override the global authentication configuration set on the Web Login Page. |
||
| Setting that is displayed if you selected Over-ride Global Config. – – – |
||
| Setting that is displayed if you selected Web Passthrough. If you choose this option, you will be prompted for your e-mail address while connecting to the network. |
||
This table describes the Layer 3 VPN Pass-Through parameters.
|
|
|
|---|---|
This table describes the AAA servers parameters.
|
|
|
|
|---|---|---|
| RADIUS Server Overwrite Interface that you can enable or disable. The default is disabled. When you enable the RADIUS Server Overwrite Interface, the client authentication request is sent through the dynamic interface that is set on the WLAN. The Cisco WLC sources all RADIUS traffic to a WLAN using the dynamic interface configured on the WLAN. Note You cannot enable the Radius Server Overwrite Interface when a diagnostic channel is enabled. |
||
| RADIUS Server Client Interface that you can enable or disable on the WLAN. The default is disabled. When you enable the RADIUS Server Client Interface, the RADIUS server packets pass through the same VLAN as the data traffic of the client. |
||
|
|
|
|
RADIUS server (configured from the RADIUS Authentication Servers page) that you choose from the drop-down lists. If this server is chosen, it will be the default RADIUS authentication server for the specified WLAN and overrides the RADIUS server that is configured for the network. You can choose up to three RADIUS servers, which are tried in priority order. |
RADIUS accounting server that you can enable or disable. The default is Enabled. Choose a RADIUS server (configured from the RADIUS Accounting Servers page) from the drop-down lists. If this server is chosen, it is the default RADIUS accounting server for the specified WLAN and overrides the RADIUS server that is configured for the network. You can choose up to six RADIUS servers, which are tried in priority order. |
|
| If you select the Interim Update check box, the statistical usage information about the client is sent in the interim interval that you specify. By default, the statistical information is sent every 600 seconds (10 minutes).
Note |
||
| LDAP server (configured from the LDAP Servers page) that you can choose from the drop-down list. You can choose up to three LDAP servers, which are tried in a priority order. |
||
Local EAP Authentication1 |
Local EAP authentication that you can enable or disable. The default is disabled. |
|
EAP Profile Name 1 |
EAP profile name (configured from the Local EAP Profiles page). |
|
| Order in which user credentials are retrieved from the back-end database servers. Highlight the desired database from the left box. Use the left and right arrows and the Up and Down buttons to move the desired database to the top of the right box. If you select the RADIUS NAC feature for authentication, the priority for web authentication must only contain RADIUS. |
||
|
|
QoS Tab
Note The Cisco OEAP 600 Series access point does not support CAC. Therefore, we recommend that you do not enable 7920 AP CAC and 7920 Client CAC parameters.
You can override the defined values in the QoS profile when you specify some or all of the rate-limiting parameters in the QoS tab.
This table describes the QoS parameters.
|
|
|
|---|---|
Quality of Service Level, set on the Editing QoS Profile page:
VoIP clients should be set to Platinum, Gold, or Silver, while low-bandwidth clients can be set to Bronze. Note Media Session Snooping is supported only for Platinum QoS profiles. |
|
Check box that you can select to view the classification of applications based on the Network Based Application Recognition (NBAR) deep packet inspection technology. To view all the supported applications, choose WIRELESS > Application Visibility and Control > Applications. To view all classified applications, choose Monitor > Applications and click the WLAN ID to navigate to the Monitor > Clients page. |
|
Drop-down list from which you can choose an Application Visibility and Control (AVC) profile for the WLAN. To configure a new AVC profile, choose WIRELESS > Application Visibility and Control > Applications and click New. You can configure only one AVC profile per WLAN and each AVC profile can have up to 32 rules. Each rule states a Mark or a Drop action for one application, which allows you to configure up to 32 application actions per WLAN. You can configure up to 16 AVC profiles on a controller and associate an AVC profile with multiple WLANs. Only WLANS on local mode access points, or centrally switched on FlexConnect access points can have applications recognized by NBAR. |
|
Drop-down list from which you can choose a NetFlow monitor for the WLAN. To configure a new NetFlow monitor, choose WIRELESS > Netflow > Monitor and click New. |
|
|
|
|
| Note When you set the Per-User Bandwidth Contracts parameters to 0 (OFF), the traffic allowed is unlimited and is restricted by only other 802.11 limitations. The values that you set override the values configured in the QoS profile page. |
|
|
Note The values that you set override the values configured in the QoS profile page. |
|
|
|
|
|
|
|
WMM Policy2 |
|
7920 AP CAC 1 |
Cisco 7920 AP CAC that you can enable or disable. Use this setting if you want the WLAN to support the newer version of the software on your Cisco 7920 phones. In newer versions, the CAC limit is advertised by the access points. |
7920 Client CAC 1 |
Cisco 7920 client CAC. Use this setting if you want the WLAN to support the older version of the software on your Cisco 7920 phones. In older versions, the CAC limit is set on the client. |
|
|
|
|
|
|
The following QoS policies can be applied for each of the Lync policies: Note WLAN QoS must meet or exceed Lync policy QoS settings in order for Lync priorities to achieve the configured levels. |
|
|
2.This option is not available for guest LANs and Remote LAN. |
Policy Mapping Tab
This table describes the policy-mapping parameters.
Advanced Tab
Do not enable Coverage Hole Detection and Aironet IE for the Cisco OEAP 600 Series access point.
This table describes the advanced parameters.
|
|
|
|---|---|
AAA Override for global WLAN parameters that you can enable or disable. When AAA Override is enabled, and a client has conflicting AAA and Cisco WLC WLAN authentication parameters, client authentication is performed by the AAA server. As part of this authentication, the operating system moves clients from the default Cisco WLAN Solution WLAN VLAN to a VLAN returned by the AAA server and predefined in the Cisco WLC interface configuration (only when configured for MAC filtering, 802.1X, and/or WPA operation). In all cases, the operating system also uses QoS, DSCP, 802.1p priority tag values, and ACLs provided by the AAA server, if they are predefined in the Cisco WLC interface configuration. (This VLAN switching by AAA Override is also referred to as Identity Networking.) If the Corporate WLAN primarily uses a Management Interface assigned to VLAN 2, and if AAA Override returns a redirect to VLAN 100, the operating system redirects all client transmissions to VLAN 100, regardless of the physical port to which VLAN 100 is assigned. When AAA Override is disabled, all client authentication defaults to the Cisco WLC authentication parameter settings, and authentication is only performed by the AAA server if the Cisco WLC WLAN does not contain any client-specific authentication parameters. The AAA Override values may come from a RADIUS server, for example. |
|
Coverage hole detection (CHD) on this WLAN that you can enable or disable. By default, CHD is enabled on all WLANs on the Cisco WLC. You can disable CHD on a WLAN. When you disable CHD on a WLAN, a coverage hole alert is still sent to the Cisco WLC, but no other processing is done to mitigate the coverage hole. This feature is useful for guest WLANs where guests are connected to your network for short periods of time and are likely to be highly mobile. Note For the Cisco OEAP 600 Series access point, do not enable Coverage Hole Detection. |
|
Session timeout that you can enable or disable. Maximum time in seconds for a client session before requiring reauthorization. |
|
Support of Aironet IEs on a per WLAN basis that you can enable or disable. The default is disabled. This option is not available for guest LANs and remote LANs. Note For the Cisco OEAP 600 Series access point, do not enable Aironet IE. |
|
Diagnostic channel support on the WLAN that you can enable or disable. The default is disabled. This option is not available for guest LANs and remote LANs. |
|
Access Control List (ACL) that overrides the ACL configured for the interface on this WLAN. ACLs are configured on the Access Control Lists page.
|
|
List the layer 2 ACL that needs to be applied to the WLAN. ACLs are configured on the Access Control Lists page. |
|
Peer-to-peer blocking settings that you can choose.
Note Traffic is never bridged across VLANs in the Cisco WLC.
For FlexConnect local switching WLANs, the settings are as follows: |
|
Timeout in seconds for disabled client machines that you can enable or disable. Client machines are disabled by their MAC address and their status can be observed on the Client Details page. A timeout setting of 0 indicates that administrative control is required to re-enable the client. The default is enabled and the timeout setting configured as 60 seconds. |
|
Maximum clients allowed per Cisco WLC. You can set a limit to the number of clients that can connect to a WLAN. This feature is useful in scenarios where you have a limited number of clients that can connect to a Cisco WLC. For example, consider a scenario where the Cisco WLC can server up to 256 clients on a WLAN that can be shared between enterprise users (employees) and guest users. You can set a limit on the number of guest clients that can access a given WLAN. The number of clients that you can configure per WLAN depends on the platform that you are using. The range is from 1 to 200. The number of clients that you can configure for a specific platform is as follows: Note The maximum number of clients per WLAN feature is supported only for access points that are in connected mode. Note This feature is not supported when you use FlexConnect local authentication and is not applicable for remote and guest LANs. |
|
Check box that you enable to configure static IP client tunneling support on a WLAN. The following restrictions apply when configuring Static IP tunneling in coordination with other features on the same WLAN:
Note Dynamic anchoring of static IP clients cannot be configured with FlexConnect local switching. |
|
Drop-down list from which you can choose a Wi-Fi Direct Clients Policy for a WLAN. Devices that are Wi-Fi Direct capable can connect directly to each other quickly and conveniently to do tasks such as printing, synchronization, and sharing of data. Wi-Fi Direct devices may associate with multiple peer-to-peer (P2P) devices and with infrastructure WLANs concurrently. Use the Cisco WLC to configure the Wi-Fi Direct Clients Policy, on a per WLAN basis, where you can allow or disallow the association of Wi-Fi devices with infrastructure WLANs, or disable the Wi-Fi Direct Clients Policy for WLANs. Note Wi-Fi Direct Clients Policy is applicable to WLANs that have APs in local mode only. |
|
Maximum number of clients that are allowed to connect to an AP. |
|
Timeout for idle client sessions for a WLAN. This value overrides the global timeout value. The range is from 15 to 100000 seconds. The default value is 300 seconds. |
|
Threshold data sent by the client during the idle timeout for the client session. If the client send traffic less than the defined threshold, the client is removed on timeout. The range is from 0 bytes to 10 MB. The default value is 0 bytes. |
|
Enable this to match any incoming EAP request from clients that contain relam with the realm configured on RADIUS authentication and accounting servers. |
|
|
|
|
Assign a defer priority for the channel scan by clicking on the priority argument. The valid range for the priority is 0 to 7. The priority is 0 to 7 (this value should be set to 6 on the client and on the WLAN). |
|
Assign the channel scan defer time in milliseconds. The valid range is 100 (default) to 60000 (60 seconds). This setting should match the requirements of the equipment on your wireless LAN. |
|
|
|
|
FlexConnect local switching that you can enable or disable. Any remote access point that advertises this WLAN, instead of tunneling to the Cisco WLC, can locally switch data packets. Note In a network architecture where the WLAN is configured in FlexConnect local switching mode, if the client and Cisco WLC are in the same VLAN, a ping action will fail. Ping actions from the client to the Cisco WLC will work if both the client and Cisco WLC are on different VLANs. Note The FlexConnect Local Switching text box must be enabled to enable local authentication. |
|
FlexConnect local authentication that you can enable or disable. |
|
Client IP address learning (this option is available when you enable FlexConnect Local Switching) that you can enable or disable. Note If the client is configured with Fortress Layer 2 encryption, the Cisco WLC cannot learn the client IP address and will periodically drop the client. Disable this option so that the Cisco WLC maintains the client connection without waiting to learn the client IP address. |
|
VLAN central switching that you can enable or disable on the WLAN. You must enable FlexConnect local switching and an AAA override on the WLAN. When you enable VLAN central switching, the access point bridges the traffic locally if the AAA override VLAN for the client is configured on the local IEEE 802.1Q link. If the AAA override VLAN is not configured on the access point, the AP tunnels the traffic back to the Cisco WLC and the Cisco WLC bridges the traffic to the corresponding VLAN. |
|
Check box to maintain the association table centrally on the controller. Disable this check box to maintain the association table locally on the AP. |
|
|
|
|
|
|
|
Check box to enable or disable assisted roaming prediction optimization for the WLAN. |
|
Check box to enable or disable 802.11k neighbor list for the WLAN. |
|
Check box to enable or disable a dual-band 802.11k neighbor list for the WLAN. |
|
|
|
|
When Override is selected, you can enter the IPv4 address of a DHCP server to be used by overriding the Primary/Secondary DHCP servers specified within the interface configuration. |
|
Requires all WLAN clients to obtain an IP address from the DHCP Server. Note DHCP address assignment (Required) is not supported for wired Guest LANs. Note DHCP Server override is applicable only for the default group. |
|
|
|
|
|
|
|
Disabled, Optional, or Required. The client MFP will only be active for a session if the client supports Cisco Compatible eXtensions (CCX) MFP, and if WPA2 is negotiated with the client. If Optional is selected, clients that do not negotiate MFP will be allowed to associate. If Required is selected, only clients that successfully negotiate MFP will be allowed to associate. This option is not available for guest LANs and remote LANs. Note The Cisco OEAP 600 Series access point does not support MFP. Note This check box represents the status of the Cisco MFP and not the status of 802.11w, introduced in Release 7.4 |
|
|
|
|
| Delivery Traffic Indication Map (DTIM) Period. Number of beacon intervals that elapse between the transmission of beacon frames that contain a TIM element whose DTIM Count field is 0. Valid values are from 1 to 255; the default value is 1. This option is not available for guest LANs and remote LANs. |
|
|
|
|
Enables SNMP NAC or RADIUS NAC. Cisco Identity Services Engine (ISE) is a next-generation, context-based access control solution that provides the functions of Cisco secure Access Control System (ACS) and Cisco Network Admission Control (NAC) in one integrated platform. Cisco ISE can be used to provide advanced security for your deployed network. It is an authentication server that you can configure on your Cisco WLC. When a client associates to the Cisco WLC on a RADIUS NAC-enabled WLAN, the Cisco WLC forwards the request to the ISE server. The ISE server validates the user in the database and on successful authentication, the URL and pre-AUTH ACL is sent to the client. The client then moves to the “Posture Required” state and is redirected to the URL returned by the ISE server. The NAC agent in the client triggers the posture validation process. On a successful posture validation by the ISE server, the client is moved to the RUN state. This feature enables you to create a RADIUS NAC-enabled WLAN with open authentication and MAC filtering. If you are using local web authentication with RADIUS NAC, the Layer 3 web authentication must also be enabled. Both internal and external web authentication are supported. The following restrictions apply:
Note Do not swap AAA server indexes in a live network. This action might result in clients being disconnected and having to reconnect to the RADIUS server and log messages to be appended to the ISE server logs. When clients move from one WLAN to another, the Cisco WLC retains the client’s audit session ID if it returns to the WLAN before the idle timeout occurs. As a result, when clients join back to the Cisco WLC before the idle timeout session expires, they are immediately moved to the RUN state. The clients are validated if they reassociate with the Cisco WLC after the session timeout. Suppose you have two WLANs, where WLAN 1 is configured on a Cisco WLC (WLC1) and WLAN2 configured on another Cisco WLC (WLC2) and both are RADIUS NAC-enabled. The client first connects to WLC1 and moves to the RUN state after posture validation. Assume that the client now moved to WLC2. If the client connects back to WLC1 before the PMK expires for this client in WLC1, the posture validation is skipped for the client. The client directly moves to the RUN state bypassing posture validation as the Cisco WLC retains the old audit session ID for the client that is already known to ISE. |
|
When deploying RADIUS NAC in your wireless network, do not configure a primary and secondary ISE server. Instead, we recommend that you configure HA between the two ISE servers. Having a primary and secondary ISE setup will require a posture validation to happen before the clients move to the RUN state. If HA is configured, the client is automatically moved to the RUN state in the fallback ISE server. Cisco WLC software configured with RADIUS NAC does not support change of authorization (CoA) on the service port. |
|
|
Note Client Load Balancing and Client Band Select is not available for the Cisco OEAP 600. |
|
Client radio band that you can enable or disable. Note Band Select is configurable only when the radio policy is set to All in the General Tab. |
|
|
|
|
Passive clients that you can enable or disable on your WLAN. Passive clients are wireless devices such as scales and printers that are configured with a static IP address. These clients do not transmit any IP information such as IP address, subnet mask, and gateway information when they associate with an access point. As a result, when passive clients are used, the Cisco WLC will never know the IP address unless they use DHCP. Cisco WLC currently act as a proxy for ARP requests. On receiving an ARP request, the Cisco WLC responds with an ARP response instead of passing the request directly to the client. This has two advantages:
Since the wireless Cisco WLC does not have any IP-related information about passive clients, it cannot respond to any ARP requests. The current behavior does not allow the transfer of ARP requests to passive clients. Any application that tries to access a passive client results in a failure. This feature enables ARP requests and responses to be exchanged between wired and wireless clients. This feature when enabled allows the Cisco WLC to pass ARP requests from wired to wireless clients until the desired wireless client gets to RUN state. Note This feature is supported only on the Cisco 5500 Series Controllers. Note Passive clients are not supported with AP groups and FlexConnect centrally switched WLANs. This feature works on the multicast-multicast mode of multicast operation. |
|
|
|
|
Access points that you can enable or disable to detect the establishment, termination, and failure of Session Initiation Protocol (SIP) voice calls and then report them to the Cisco WLC and PI. See the Radio Statistics page to see the VoIP statistics for your access point radios. See the SNMP Trap Logs page to see the traps generated for failed calls. |
|
Reanchoring of roamed voice clients that you can enable or disable. This feature allows the voice client to get anchored on the best suited and nearest available Cisco WLC. In the case of inter Cisco WLC roaming, it avoids the use of tunnels to carry traffic between the foreign Cisco WLC and the anchor Cisco WLC, which removes unnecessary traffic from the network. The ongoing call during roaming is not affected and it continues without any problem. The traffic passes through proper tunnels that are established between the foreign Cisco WLC and the anchor Cisco WLC. When the call ends, disassociation occurs and the client gets reassociated to a new Cisco WLC. By default, this feature is disabled. Note The ongoing data session may be affected due to dissociation and reassociation. Note This feature is supported for TSPEC-based calls and non-TSPEC-SIP based calls only when admission control is enabled. Note You can reanchor roaming of voice clients for each WLAN. Note This feature is not recommended for use on the Cisco 792x phone. |
|
To enable or disable CAC that is based on Key Telephone System (KTS) for the WLAN. KTS-based CAC is a protocol that is used in NEC MH240 wireless IP telephones. You can configure the Cisco WLC to support CAC on KTS-based SIP clients, to process bandwidth request message from such clients, to allocate required bandwidth on the AP radio, and to handle other messages that are part of the protocol. When a call is initiated, the KTS-based CAC client sends a Bandwidth Request message to which the Cisco WLC responds with a Bandwidth Confirm message indicating whether the bandwidth is allocated or not. The call is allowed only if the bandwidth is available. If the client roams from one AP to another, then the client sends another Bandwidth Request message to the Cisco WLC. Bandwidth allocation depends on the medium time calculated using the data rate from the Bandwidth Request message and the packetization interval. For KTS-based CAC clients, G.711 codec with 20 milliseconds as packetization interval is used for computing the medium time. The Cisco WLC releases the bandwidth after it receives the bandwidth release message from the clients. When the client roams to another AP, the Cisco WLC takes care of releasing the bandwidth on the previous AP and allocates bandwidth on the new AP, in both intra Cisco WLC and inter Cisco WLC roaming scenarios. The bandwidth is released if the client is dissociated or if there is inactivity for 120 seconds. The Cisco WLC does not inform the client when the bandwidth is released for the client due to inactivity or dissociation of the client.
|
|
|
|
|
Check box to enable or disable DHCP profiling of all the clients that are associated with the WLAN. When you enable DHCP profiling, the Cisco WLC collects the DHCP attributes of clients for profiling. |
|
Check box to enable or disable HTTP profiling of all the clients that are associated with the WLAN. When you enable HTTP profiling, the Cisco WLC collects the HTTP attributes of clients for profiling. |
|
|
|
|
Drop-down list from which you can choose the PMIP NAI Type as Hexadecimal or Decimal. |
|
Drop-down list from which you can choose a PMIP profile. You can configure the PMIP profile irrespective of the mobility type. |
|
|
|
|
Check box to enable or disable mDNS snooping on the WLAN. To check if global mDNS snooping is enabled, choose CONTROLLER > mDNS > General. mDNS snooping works on guest LANs and not on remote LANs. |
|
Drop-down list from which you can choose the mDNS profile for the WLAN. Clients receive service advertisements only for the services associated with the profile. |
|
Click Apply to send data to the Cisco WLC, but the data is not preserved across a power cycle; these parameters are stored temporarily in volatile RAM.
Deleting WLANs
Click the WLANs tab. This displays the list of WLANs. Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose Remove to delete the WLAN, Remote LAN, or Guest LAN. When you delete the WLAN, it will be removed from the AP group too.
Mobility Anchors
Click the WLANs tab. This displays the list of WLANs. Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose Mobility Anchors to navigate to the Mobility Anchors page.
This page lists the Cisco WLCs that have already been configured as mobility anchors and shows the current state of their data and control paths. Cisco WLCs within a mobility group communicate among themselves over a well-known UDP port and exchange data traffic through an Ethernet-over-IP (EoIP) tunnel. Cisco WLCs send mpings and epings. Mpings test the mobility control packet reachability over the management interface over mobility UDP port 16666 and epings test the mobility data traffic over the management interface over EoIP port 97. The Control Path field shows whether mpings have passed (up) or failed (down), and the Data Path field shows whether epings have passed (up) or failed (down). If the Data Path field shows “down,” the mobility anchor cannot be reached and is considered failed.
Mobility anchors can also be used to provide geographic load balancing, because WLANs can be used to represent a particular section of the building such as engineering, marketing, and so on.
This table describes the mobility anchor parameters.
Creating a Mobility Anchor
Step 1 Click the WLANs tab. This displays the list of WLANs.
Step 2 Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose Mobility Anchors to navigate to the Mobility Anchors page.
Step 3 Choose a Cisco WLC IP address from the Switch IP Address (Anchor) drop-down list. From Release 8.0, the controller supports both IPv4 and IPv6.
Step 4 Click Mobility Anchor Create.
The selected Cisco WLC now becomes an anchor for the WLAN.
Note A Cisco 2000 Series Wireless LAN Controller cannot be designated as an anchor for a WLAN. However, a WLAN created on a Cisco 2000 Series Wireless LAN Controller can have a Cisco 4100 Series Wireless LAN Controller and Cisco 4400 Series Wireless LAN Controller as its anchor.
Removing a Mobility Anchor
Step 1 Click the WLANs tab. This displays the list of WLANs.
Step 2 Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose Mobility Anchors to navigate to the Mobility Anchors page.
Step 3 Click the blue arrow adjacent the corresponding Mobility Anchor and choose Remove.
802.11u
Click the WLANs tab. This displays the list of WLANs. Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose 802.11u to navigate to the 802.11u page.
This page lists the 802.11u configuration options available for the selected WLAN. You can configure a WLAN to enable interworking with external networks such as hotspots or other public Wi-Fi.
IEEE 802.11u is an extension to the IEEE 802.11 standard to improve the ability of devices to discover, authenticate, and use nearby Wi-Fi access points. IEEE 802.11u enables automatic WLAN offload for 802.1X devices at the hotspot of mobile or roaming partners.
This table describes the 801.11u parameters.
This table describes the OUI parameters.
Click Add to add the OUI details.
This table describes the domain list parameters.
Click Add to add the Domain List parameters.
This table describes the realm list parameters.
This table describes the cellular network parameters.
|
|
|
|---|---|
Mobile country code in Binary Coded Decimal (BCD) format. The country code should be 3 characters. |
|
Mobile network code in BCD format. The network code can be 2 or 3 characters. |
Click Add to add the Cellular Network Information.
Click Apply to send data to the Cisco WLC, but the data is not preserved across a power cycle; these parameters are stored temporarily in volatile RAM.
HotSpot 2.0
Click the WLANs tab. This displays the list of WLANs. Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose Hotspot 2.0 to navigate to the HotSpot 2.0 page.
Hotspot 2.0 improves the ability of Wi-Fi devices to discover and securely connect to public Wi-Fi hotspots which enables easier roaming between public Wi-Fi networks.
You can enable or disable a hotspot by choosing the appropriate option from the HotSpot2 Enable drop-down list.
This table describes the HotSpot parameters.
This table describes the operator parameters.
Click Add to add the operator name.
This table describes the port config parameters.
Foreign Maps
Click the WLANs tab. This displays the list of WLANs.
Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose Foreign Maps to navigate to the Foreign Controller Interface Mapping page.
Whenever a wireless client connects to a wireless network (WLAN), the client is placed in a VLAN that is associated with the WLAN. Release 7.0 and prior releases of the Cisco WLC software enabled you to associate one VLAN with a WLAN. Each VLAN required a single IP subnet. As a result, a WLAN required a large subnet to accommodate more clients. In a large venue such as an auditorium, a stadium, or a conference where there may be numerous wireless clients, having only a single WLAN to accommodate many clients might be a challenge.
The VLAN select feature enables you to use a single WLAN that can support multiple VLANs. Clients can get assigned to one of the configured VLANs. This feature enables you to map a WLAN to a single or multiple interfaces using interface groups. Wireless clients that associate to the WLAN get an IP address from a pool of subnets identified by the interfaces using a MAC based hashing algorithm. This feature also extends the current AP Group where AP groups can override an interface or interface group in a WLAN by an interface. This feature also provides the solution to guest anchor restrictions where a wireless guest user on a foreign location can get an IP address from multiple subnets based on their foreign locations or foreign Cisco WLCs from the same anchor Cisco WLC.
When a client roams from one Cisco WLC to another, the foreign Cisco WLC sends the VLAN information as part of the mobility announce message. Based on the VLAN information received, the anchor decides whether the tunnel should be created between the anchor Cisco WLC and the foreign Cisco WLC. If the same VLAN is available on the foreign Cisco WLC, the client context is completely deleted from the anchor and the foreign Cisco WLC becomes the new anchor Cisco WLC for the client.
As part of VLAN select feature, the mobility announce message carries an additional vendor payload that contains the list of VLAN interfaces that are mapped to a WLAN. This list helps the anchor to decide on a Local->Local type of handoff.
Note VLAN Select applies to wireless clients only.
This table describes the foreign map parameters.
|
|
|
|---|---|
Interface/interface group name that is mapped to a foreign switch. |
|
Information about the MAC address of the foreign Cisco WLC to this interface/interface group. |
|
Creating a Foreign Cisco WLC Interface Mapping
Step 1 Click the WLANs tab. This displays the list of WLANs.
Step 2 Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose Foreign Maps to navigate to the Foreign Controller Interface Mapping page.
Step 3 From the Foreign Controller MAC Address drop-down list, choose a foreign Cisco WLC MAC address.
Step 4 From the Interface/Interface Group Name drop-down list, choose the interface/interface group name to be mapped to a foreign switch.
Removing Foreign Maps
Step 1 Click the WLANs tab. This displays the list of WLANs.
Step 2 Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose Foreign Maps to navigate to the Foreign Controller Interface Mapping page.
Step 3 Click the blue arrow adjacent the corresponding Foreign Controller and choose Remove.
Service Advertisement
Click the WLANs tab. This displays the list of WLANs.
Click the blue arrow adjacent the corresponding WLAN, and from the drop-down list that is displayed, choose Service Advertisement to navigate to the Service Advertisement page.
This page allows you to configure the Mobility Service Advertisement Protocol (MSAP) parameters on a WLAN. MSAP is used primarily by mobile devices that are configured with a set of policies for establishing network services. Service advertisements use MSAP to provide services to mobile devices prior to association to a Wi-Fi access network. This information is conveyed in a service advertisement.
This table describes the MSAP parameters.
Configuring Dynamic Anchoring for Clients with a Static IP Address
You might need to configure static IP addresses for wireless clients. When these wireless clients move in a network, they try to associate with other Cisco WLCs. If the clients try to associate with a Cisco WLC that does not support the same subnet as the static IP, the clients fail to connect to the network. You can now enable dynamic tunneling of clients with static IP addresses. Using this feature, clients with static IP addresses can be associated with other Cisco WLCs where the client’s subnet is supported by tunneling the traffic to another Cisco WLC in the same mobility group. This feature enables you to configure your WLAN so that the network is serviced even though the clients use static IP addresses.
The following sequence occurs when a client with a static IP address tries to associate with a Cisco WLC:
1. When a client associates with a Cisco WLC, such as WLC-1, it performs a mobility announcement. If a Cisco WLC in the mobility group responds (such as WLC-2), the client traffic is tunneled to the Cisco WLC WLC-2. As a result, WLC 1 becomes foreign and WLC-2 becomes the anchor.
2. If none of the Cisco WLCs responds, the client is treated as a local client and authentication is performed. The IP address for the client is updated either through orphan packet handling or ARP request processing. If the client’s IP subnet is supported in the Cisco WLC (WLC-1), the client remains as a local client and traffic for this client is serviced by this Cisco WLC (WLC-1).
3. If the Cisco WLC (WLC-1) cannot service the client IP subnet, it sends a static IP client announcement. If a Cisco WLC in the mobility group responds (such as WLC2), the client is tunneled to WLC2. If there are multiple Cisco WLCs in the mobility group that respond to the static IP client announcement, the first Cisco WLC with a 50 percent or less load is selected for tunneling. If there are no Cisco WLCs with a 50 percent or less load, the Cisco WLC with the least load is selected.
4. If the maximum number of clients per WLAN is configured, the percentage load is calculated by using the following formula:
– (total clients present in that WLAN/maximum clients supported in that WLAN) x 100.
– (total clients present in the WLC/maximum clients supported) x 100.
5. Once the acknowledgement is received, the client traffic is tunneled between the anchor and the Cisco WLC (WLC-1).
Note If a WLAN is configured with an interface group and any of the interfaces in the interface group support the static IP client subnet, the client is assigned to that interface. This situation occurs in the local or remote (static IP anchor) Cisco WLC. For native IPv6 clients, that is clients with only IPv6 addresses, in the interface group, static IP is not supported.
Note A security level 2 authentication is performed only in the local (static IP foreign) Cisco WLC, also known as the exported foreign Cisco WLC.
Note If AAA is used for authentication, the VLAN override is ignored if static IP tunneling is required. You must configure the local Cisco WLC with the correct AAA server where this client entry is present.
The following restrictions apply when configuring static IP tunneling with other features on the same WLAN:
- Auto anchoring mobility (guest tunneling) cannot be configured for the same WLAN.
- FlexConnect local authentication cannot be configured for the same WLAN.
- The DHCP required option cannot be configured for the same WLAN.
Note Dynamic anchoring of static IP clients cannot be configured with FlexConnect local switching.
Configuring Dynamic Anchoring of Static IP Clients
Step 1 Choose WLANs to open the WLANs page.
Step 2 Click the ID number of the desired WLAN on which you want to enable dynamic anchoring of IP clients. The WLANs > Edit page appears.
Step 3 Choose the Advanced tab to open the WLANs > Edit (Advanced) page.
Step 4 Enable dynamic anchoring of static IP clients by selecting the Static IP Tunneling check box.
Step 5 Click Apply to commit your changes.
Configuring the Maximum Number of Clients Per WLAN
You can set a limit to the number of clients that can connect to a WLAN. This feature is useful in scenarios where you have a limited number of clients that can connect to a Cisco WLC. For example, consider a scenario where the Cisco WLC can server up to 256 clients on a WLAN that can be shared between enterprise users (employees) and guest users. You can set a limit on the number of guest clients that can access a given WLAN. The number of clients that you can configure per WLAN depends on the platform that you are using. The range is from 1 to 200.
Step 1 Choose WLANs to open the WLANs page.
Step 2 Click the ID number of the WLAN for which you wish to limit the number of clients. The WLANs > Edit page appears.
Step 3 On the Advanced tab, set the Maximum Allowed Clients text box.
Click Apply to send data to the Cisco WLC, but the data is not preserved across a power cycle; these parameters are stored temporarily in volatile RAM.
AP Groups
Choose WLAN > Advanced > AP Groups to navigate to the AP Groups page. This page displays a summary of the AP groups configured on your network. This page enables you to add, remove, or view details of an AP group.
After you create up to 512 WLANs on the Cisco WLC, you can selectively publish them (using access point groups) to different access points to better manage your wireless network.
After all access points have joined the Cisco WLC, you can create up to 150 access point groups and assign up to 16 WLANs to each group. Each access point advertises only the enabled WLANs that belong to its access point group. The access point does not advertise disabled WLANs in its access point group or WLANs that belong to another group.
Note The Cisco WLC creates the default-group access point group and automatically populates it with the first 16 WLANs (WLANs with IDs 1 through 16, or fewer if 16 WLANs are not configured). This default group cannot be modified (you cannot add WLANs to it and you cannot delete WLANs from it). It is dynamically updated whenever the first 16 WLANs are added or deleted. If an access point does not belong to an access point group, it is assigned to the default group and uses the WLANs in that group. If an access point joins the Cisco WLC with an undefined access point group name, the access point keeps its group name but uses the WLANs in the default-group access point group.
Note If you clear the configuration on the Cisco WLC, all of the access point groups disappear except for the default-group access point group.
Note The OEAP 600 Series access point supports a maximum of two WLANs and one remote LAN. If you have configured more than two WLANs and one remote LAN, you can assign the 600 Series access point to an AP group. The support for two WLANs and one remote LAN still applies to the AP group if the 600 Series OEAP is in the default group. The WLAN/remote LAN IDs must be less than 8.
To remove an AP group, click the blue arrow adjacent the gruop and choose Remove.
An error message appears if you try to delete an access point group that is used by at least one access point. Before you can delete an AP group, move all APs in this group to another group. The access points are not moved to the default-group access point group as in previous releases.
- To see the APs, click the AP group name, and choose the APs tab.
- To move APs, click the AP group name, choose the APs tab, check the check box to the left of the AP name, or select the AP name check box to select all APs, and click the Add APs.
Prohibit One VLAN for Local Switching by FlexConnect
Choose an interface for Prohibit Local Switching from the drop-down list in the interface list page. Click Apply to prohibit local switching of the interface by the Cisco WLC. Click New to select another VLAN for the same action.
Creating a New AP Group
Step 1 On the WLAN > AP Groups page, click Add Group to display the Add New AP Group area.
Step 2 In the AP Group Nam e text box, enter the name of the AP group.
Step 3 In the Description text box, enter a brief description of the AP group.
Step 4 Click Add to add the AP group.
Editing AP Groups
Choose WLAN > Advanced > AP Groups and then click an AP group name to navigate to this page.
General Tab
Note AP 3600 with the 802.11ac module advertises only the first eight WLANs on the 5-GHz radios.
This table describes the general AP parameters.
WLANs Tab
Click Add New to assign a WLAN to an access point group.
This table describes the WLAN parameters.
Click the blue arrow adjacent the corresponding WLAN and choose one of the following options:
- NAC Enable / NAC Disable —Changes the SNMP NAC state.
- Policy-Mapping —Configures the policies for the WLAN.
You can configure a maximum of 16 policies. In the AP Group > Policy Mappings page, you can configure a priority index and a policy. To define new policies, choose Security > Local Policies > New.
RF Profile Tab
This table describes the RF profile parameters.
|
|
|
Drop-down list from which you can choose an RF profile for APs with 802.11a radios. |
|
Drop-down list from which you can choose an RF profile for APs with 802.11b radios. |
Click Apply to apply the RF profile selected for the APs.
Note Applying an RF profile results in a reboot of all the APs associated with the AP Group.
APs Tab
This table describes the AP parameters.
802.11u Tab
This table describes the 802.11u parameters.
Feedback