Cloud Monitoring for Catalyst Controllers

The Cloud Monitoring for Catalyst Controllers feature helps to monitor Wireless Controllers using the Meraki dashboard. Currently, this feature is in a limited customer beta and is not supported by Cisco TAC.

For more information on this feature, see Cloud Monitoring for Catalyst.

For further help, contact the following mailerlist: c9800-dashboard-monitoring@external.cisco.com

Modified Trustpoints for Secure Unique Device Identity (SUDI) Certificates

From Cisco IOS XE 17.9.5 onwards, the following changes have been introduced for trustpoints:

• Trustpoint names for existing SUDI certificates

  If your device supports Cisco Manufacturing CA III certificate and is not disabled, the trustpoint names are as follows:

  • For Cisco Manufacturing CA III certificate, the trustpoint name has changed from CISCO_IDEVID_SUDI to CISCO_IDEVID_CMCA3_SUDI

  • For Cisco Manufacturing CA SHA2 certificate, the trustpoint name has changed from CISCO_IDEVID_SUDI_LEGACY to CISCO_IDEVID_CMCA2_SUDI

  If your device does not support Cisco Manufacturing CA III certificate or if the certificate is disabled using no platform sudi cmca3 command, the trustpoint names are as follows:

  • For Cisco Manufacturing CA SHA2 certificate, the trustpoint name has changed from CISCO_IDEVID_SUDI to CISCO_IDEVID_CMCA2_SUDI

  • For Cisco Manufacturing CA certificate, the trustpoint name has changed from CISCO_IDEVID_SUDI_LEGACY to CISCO_IDEVID_CMCA_SUDI

• Hardware SUDI certificates

  • If your device supports High Assurance SUDI CA certificate, this certificate is loaded under CISCO_IDEVID_SUDI trustpoint.

  • If your device does not support High Assurance SUDI CA certificate, ACT2 SUDI CA certificate is loaded under CISCO_IDEVID_SUDI trustpoint.

• show wireless management trustpoint command output

  If Cisco Catalyst 9300 Series Switch is used with a Cisco Catalyst 9800 Series Wireless Controller for wireless deployments, the trustpoint name in the output of show wireless management trustpoint command is updated to the modified trustpoint name as mentioned previously.

  The following example shows a sample output of show wireless management trustpoint command. Note that if your device does not support Cisco Manufacturing CA III certificate or if the certificate is disabled, the Trustpoint Name in the following output displays CISCO_IDEVID_CMCA2_SUDI.

  
  Device# show wireless management trustpoint
  Trustpoint Name  : CISCO_IDEVID_CMCA3_SUDI
  Certificate Info : Available
  Certificate Type : MIC
  Certificate Hash : <SHA1 - hash>
  Private key Info : Available
  FIPS suitability : Not Applicable

• show ip http server status command output

  If you configure the trustpoint for the HTTP server as CISCO_IDEVID_SUDI, the output of show ip http server status command displays the operating trustpoint along with the configured trustpoint.

  The following example shows a sample output of show ip http server status command with both the configured and the operating trustpoint names. Note that if your device does not support Cisco Manufacturing CA III certificate or if the certificate is disabled, the operating trustpoint in the following output displays CISCO_IDEVID_CMCA2_SUDI.

  
  Device# show ip http server status
  …
  HTTP secure server trustpoint: CISCO_IDEVID_SUDI
  HTTP secure server operating trustpoint: CISCO_IDEVID_CMCA3_SUDI

ROW Support for UAE Country

From this release, ROW domain country code United Arab Emirates (AE) is supported on Cisco Catalyst IW9167E Heavy Duty Access Points.

Product Analytics

This feature allows for the collection of non-personal usage device systems information for Cisco products, which helps in continuous product improvements. This feature is supported on the Cisco Catalyst 9800 Series Wireless Controllers (9800-80, 9800-40, 9800-L, and 9800-CL). You can use the the pae command to enable or disable this feature.

The following commands are introduced as part of this feature:

• pae

• show product-analytics kpi

• show product-analytics report

• show product-analytics stats

Important: Cisco is constantly striving to advance our products and services. Knowing how you use our products is key to accomplishing this goal. To that end, Cisco will collect device and licensing Systems Information through Cisco Smart Software Manager (CSSM) for product and customer experience improvement, analytics, and adoption. Cisco processes your data in accordance with the General Terms and Conditions, the Cisco Privacy Statement and any other applicable agreement with Cisco. To modify your organization’s preferences for device and licensing systems information, use the paecommand. See Cisco Catalyst 9800 Series Wireless Controller Command Reference → pae.

Additional information on this feature can be found here .

Cisco Catalyst IW9167E Heavy Duty Access Point

Cisco Catalyst IW9167E Heavy Duty Access Point is supported from this release and can operate as a Wi-Fi 6 AP or Cisco Ultra-Reliable Wireless Backhaul.

Site Load Balancing

This feature allows you to specify a site load for better load balancing.

For more information, see the Chapter Enhanced Site Tag-Based Load Balancing.

Support for KVM/SUSE version 15 SP3 with Cisco Catalyst 9800-CL in Private Cloud

Limited support to SDA Wireless deployments for Cisco Catalyst 9800-CL running on KVM/SUSE version 15 SP3.

Wave 1 Access Points

Support for the following Wave 1 APs are reintroduced from this release.

• Cisco Aironet 1570 Series Access Point

• Cisco Aironet 1700 Series Access Point

• Cisco Aironet 2700 Series Access Point

• Cisco Aironet 3700 Series Access Point

For more information on support for Wave 1 APs, see the FAQ.

AP Fallback to Controllers Using AP Priming Profile

This feature helps to configure primary, secondary, and tertiary controllers for a group of APs matching regular expression (regex) or for an individual AP using priming profiles.

The following commands are introduced:

• primary (ap prime)

• secondary (ap prime)

• tertiary (ap prime)

• priming-override

• profile (prime-filter)

• wireless profile ap priming

• show ap filters active type priming

• show ap filters all type priming

• show wireless profile ap priming all

• show wireless profile ap priming summary

For more information, see the Chapter AP Fallback to Controllers Using AP Priming Profile.

Country Compliance Support for Cisco Catalyst 9136 Series Access Points and Cisco Catalyst 916x Series Access Points

An additional 75 countries are supported in Cisco Catalyst 916x Series Access Points and Cisco Catalyst 9136 Series Access Points.

For more information about the list of countries that are supported, see the Chapter Regulatory Compliance Domain.

IPv6 Address Tracking for Wireless Clients

Until Cisco IOS XE 17.9.1, the controller supported a maximum of eight IPv6 addresses per wireless client. After eight IPv6 addresses were learnt for a wireless client, the controller dropped that wireless client's data traffic coming with new IPv6 source addresses.

However, in Cisco IOS XE 17.9.2, the controller allows data traffic of the wireless clients coming with new IPv6 source addresses even after eight addresses have been learnt for respective wireless clients. The controller continues to learn new IPv6 addresses of the wireless clients from the wireless clients' control traffic (IPv6 NS/NA and DHCPv6), but keeps track of only a maximum of eight addresses (the latest) per wireless client.

The following command is supported:

wireless ipv6 nd ns-forward

For more information, see the Chapter IPv6 Client IP Address Learning.

Support for Cisco Catalyst 9162I Series Wi-Fi 6E Access Points

From Cisco IOS XE Cupertino 17.9.2, Cisco Catalyst 9162I Series Wi-Fi 6E Access Points are supported.

Support for Terminal Doppler Weather Radar Channels 120, 124, 128 for -E Regulatory Domain

Terminal Doppler Weather Radar (TDWR) channels 120, 124, and 128 for the -E regulatory domain are supported in the following APs:

• Cisco Catalyst 9124 Series Access Points

• Cisco Catalyst 9130 Series Access Points

UNII-3 Band on ROW Regulatory Domain for UK Cisco Catalyst 9136I and Cisco Wireless 916xI Access Points

From Cisco IOS XE Cupertino 17.9.2, UNII-3 channels are enabled for the country code GB under the -ROW domain on the Cisco Catalyst 9136I and Cisco Wireless 916xI access points. The maximum Tx power on these non-Dynamic Frequency Selection (DFS) channels is 23dBm.

This feature is enabled automatically after you upgrade to Cisco IOS XE Cupertino 17.9.2. Use the show controllers dot11Radio command to verify the channel list information after the upgrade.

Wi-Fi Protected Access 3 Simultaneous Authentication of Equals Hash-to-Element Support with Identity PSK

From Cisco IOS XE Cupertino 17.9.2, the iPSK passphrase is supported for SAE H2E authentication in local mode. During client SAE authentication, the Identity Preshared Key (iPSK) passphrase configured in the client authorization policy in the RADIUS server replaces the one in WLAN profile. Hence, the use of unique preshared keys for individuals is considered as a more secure and granular authentication scheme than using a common key for all the users in WLAN. If iPSK passphrase is not configured in the authorization policy, SAE H2E falls back to the passphrase in the WLAN profile.

For more information, see the Chapter Wi-Fi Protected Access 3.

VMware vSphere vMotion Support

VMware vSphere vMotion is supported on the Cisco Catalyst 9800 Wireless Controller for Cloud. For more information, see https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-wireless-controllers-cloud/218438-verify-support-vmware-vsphere-vmotion-wi.html#anc6 and https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-cl-wireless-controller-cloud/nb-06-cat9800-cl-wirel-cloud-dep-guide-cte-en.html.

802.11r Fast Transition for SAE (FT-SAE) Authenticated Clients

From this release, the Fast Transition supports SAE-based Fast Roaming along with PMK caching.

The following command is introduced:

• security wpa akm ft sae

For more information, see the chapter 802.11r BSS Fast Transition.

Access Points Survey Mode Support in Cisco Catalyst 9136 Series Access Points, Cisco Catalyst 9164 Series Wi-Fi 6E Access Points, and Cisco Catalyst 9166 Series Wi-Fi 6E Access Points

In this release, you can use the ap-type survey command to switch the AP to the survey mode. The AP GUI is also enhanced to support the survey mode.

This feature is supported on Cisco Catalyst 9136 Series APs, Cisco Catalyst 9164 Series Wi-Fi 6E APs, and Cisco Catalyst 9166 Series Wi-Fi 6E APs.

For more information, see the chapter Access Points Survey Mode.

Authentication and Accounting Support for Both Radius and TACACS+ Servers for Standby Unit in an SSO Pair

From this release, Authentication and Accounting is supported on RADIUS and TACACS+ servers for standby HA unit using RMI interface:

• RADIUS Accounting

• TACACS+ Authentication

• TACACS+ Accounting

For more information, see the chapter Redundancy Management Interface.

BLE Concurrent Scanning and Beaconing

From this release, BLE concurrent scanning and beaconing is supported on Cisco Catalyst Wi-Fi 6 APs in basic mode or Cisco IOx mode. The BLE radio on an AP can stop a scan for beacon transmission, and return to the scan after completing the beacon transmission.

For more information, see the chapter Cisco Hyperlocation.

Chargeable User Identity in RADIUS Accounting

Chargeable User Identity (CUI) is a unique identifier for a client visiting a network. This attribute can be used as an alternative for the client’s username as part of the authentication process.

The following command is introduced:

• access-session wireless cui-enable

For more information, see the chapter RADIUS Accounting.

Cisco AI-Enhanced RRM Supports Wi-Fi 6E

From this release, the Cisco's AI-Enhanced RRM feature in Cisco DNA Center supports Wi-Fi 6E.

For more information, see the chapter Radio Resource Management.

CleanAir Pro Scanning Support in 2.4-GHz and 5-GHz Bands

The CleanAir Pro Scanning feature monitors and reports the different categories of non-Wi-Fi interference in the 2.4-GHz and 5-GHz bands.

The following commands are introduced:

• ap dot11 6ghz cleanair

• ap dot11 cleanair alarm air-quality

• ap dot11 cleanair alarm device cont-tx

• ap dot11 cleanair alarm unclassified

For more information, see the chapter CleanAir.

Concurrent Radio Support for Workgroup Bridge Wireless Clients on Cisco Catalyst Access Points

From this release onwards, Workgroup Bridge supports one radio for uplink (backhaul) connectivity and another radio for serving wireless clients. This feature is supported on Cisco Catalyst 9105 APs, Cisco Catalyst 9115 APs, and Cisco Catalyst 9120 APs.

The following commands are introduced on the AP console:

• configure ssid-profile ssid dtim-period

• configure dot11Radio wlan add

• configure dot11Radio wlan delete

• configure dot11Radio channel

• configure dot11Radio beacon-interval

• configure radius address port

• configure qos profile

• configure ssid-profile ssid qos profile

For more information, see the chapter Workgroup Bridges.

Configuring mDNS Location-Based Filtering Using Location Group

From this release, the AP grouping for mDNS is extended to include AP locations.

The following commands are introduced:

• wireless rule application mdns

• group-method

For more information, see the chapter Multicast Domain Name System.

Configuring the AP Console

This feature allows you to configure the AP console from the controller.

The following command is introduced:

• console

For more information, see the chapter Configuring the AP Console.

Flexible Radio Assignment Support in Cisco Catalyst 9166I Series Wi-Fi 6E Access Points

From this release onwards, the dual-band radio in Cisco Catalyst 9166I Series Wi-Fi 6E Access Points offers the ability to serve either in 5-GHz or 6-GHz band, as monitor or sniffer on the same AP.

The following commands are introduced:

• ap fra 5-6ghz

• ap fra 5-6ghz freeze

• ap fra 5-6ghz interval

• ap dot11 6ghz rf-profile

• client-aware-fra

• show ap fra 5-6ghz

For more information, see the chapter Cisco Flexible Radio Assignment.

High Availability Deployment for Application Centric Infrastructure (ACI) Network

This feature avoids interleaving traffic between the old and new active controller using the following functionalities:

• Bringing down the Wireless Management Interface (WMI) faster.

• Disabling fast switchover notifications.

The following commands are introduced:

• no redun-management fast-switchover

• redun-management garp-retransmit burst

• no redun-management garp-retransmit initial

For more information, see the chapter High Availability.

Interim Accounting

From this release, the no accounting-interim command is introduced under the policy profile to disable interim accounting.

For more information, see the chapter Interim Accounting.

Link Layer Discovery Protocol Support in Standby Controller

From this release, the Link Layer Discovery Protocol (LLDP) process is supported in both active and standby controllers.

The following commands are introduced:

• lldp run

• lldp holdtime

• lldp reinit

• lldp timer

• lldp tlv-select

• show lldp

• show lldp neighbors

• show lldp neighbors detail

• show lldp errors

• show lldp traffic

For more information, see the chapter Link Layer Discovery Protocol.

Logging Web UI-Based Configuration Changes in TACACS+ Server

This feature logs all the configuration changes made in the controller's UI.

For more information, see the chapter Web UI Configuration Command Accounting in TACACS+ Server.

Management Mode Migration in Cisco Catalyst 916x Series Wi-Fi 6E Access Points (CW9164 and CW9166)

From this release onwards, in Cisco Catalyst 916x APs (CW9164 and CW9166) you can migrate management modes between DNA Management Mode (controller based) and Meraki Management Mode, depending on the requirement.

The following commands are introduced:

• ap name management-mode meraki

• clear ap meraki stats

• show ap management-mode meraki capability summary

• show ap management-mode meraki failure summary

• show ap management-mode meraki change summary

For more information, see the chapter Management Mode Migration in Cisco Catalyst 916x Series Wi-Fi 6E Access Points.

Mesh Backhaul RRM Support

From this release onwards, RRM DCA runs on mesh backhaul in auto mode, when you configure the wireless mesh backhaul rrm auto-dca command. For APs that do not have dedicated (RHL) radios, DCA is triggered by running commands in privileged EXEC mode. Mesh RRM DCA runs in the background for RHL radio enabled APs.

The following commands are introduced:

• ap dot11 rrm channel-update mesh

• ap dot11 rrm channel-update mesh bridge-group

• ap name dot11 rrm channel update mesh

• show wireless mesh rrm dca status

• wireless mesh backhaul rrm auto-dca

For more information, see the chapter Mesh Access Points.

Mutual Authentication for gRPC Telemetry

A new gRPC TLS profile that contains a pair of trustpoints was added to the telemetry configuration so that a client ID certificate can be specified for mutual authentication. This new profile can be used instead of the trustpoint containing the server CA certificate when configuring the receiver profile. The trustpoint containing the server CA certificate is now configured as part of the gRPC TLS profile.

For more information, see the Programmability Configuration Guide.

Quality of Service Gaps and Fixes in Cisco Catalyst 9800 Series Wireless Controllers

This feature addresses the gaps in the existing metal policy implementation with reference to RFC 8325.

With this enhancement, the existing hard-coded policy-maps and class-maps associated with each metal policy is modified as per RFC 8325, so that upstream and downstream ceiling is achieved.

For more information, see the chapter Quality of Service.

Regulatory Domain Reduction

From Cisco IOS XE Cupertino 17.9.1, more countries are added to the Rest of the World (RoW) domain.

For more information, see the chapter Regulatory Compliance Domain.

Rogue Detection Enhancements on Cisco Catalyst 9164 and 9166 Series Wi-Fi 6E Access Points

In this release, the rogue detection and containment functionality is enhanced to handle dual 5-GHz configuration on Cisco Catalyst 9164 Series Wi-Fi 6E APs and Cisco Catalyst 9166 Series Wi-Fi 6E APs.

Rogue Full Scale Quotas and Priorities

The Rogue Full Scale Quotas and Priorities feature helps you to improve the scalability, performance, manageability, and serviceability of rogue APs.

The following commands are introduced:

• wireless wps rogue scale quota

• wireless wps rogue scale priority

• wireless wps rogue scale mode hybrid

For more information, see the chapter Managing Rogue Devices.

RUM Report Throttling

For all topologies where the product instance initiates communication, the minimum reporting frequency is throttled to one day. This means the product instance does not send more than one RUM report a day.

The affected topologies are: Connected Directly to CSSM, Connected to CSSM Through CSLU (product instance-initiated communication), CSLU Disconnected from CSSM (product instance-initiated communication), and SSM On-Prem Deployment (product instance-initiated communication).

This resolves the problem of too many RUM reports being generated and sent for certain licenses. It also resolves the memory-related issues and system slow-down that was caused by an excessive generation of RUM reports.

You can override the reporting frequency throttling, by entering the license smart sync command in privileged EXEC mode. This triggers an on-demand synchronization with CSSM or CSLU, or SSM On-Prem, to send and receive any pending data.

RUM report throttling also applies to the Cisco IOS XE Amsterdam 17.3.6 and later releases of the 17.3.x train, and Cisco IOS XE Bengaluru 17.6.4 and later releases of the 17.6.x train. From Cisco IOS XE Cupertino 17.9.1, RUM report throttling is applicable to all subsequent releases.

Site-Based Rolling AP Upgrade in N+1 Networks

The Site-Based Rolling AP Upgrade in an N+1 Network feature allows you to perform a staggered upgrade of APs in each site in an N+1 deployment.

The following commands are introduced:

• ap upgrade staggered iteration completion

• ap upgrade staggered iteration error

• ap upgrade staggered iteration timeout

• show ap upgrade site

For more information, see the chapter Site-Based Rolling AP Upgrade in an N+1 Network.

Site-Based Rolling AP Upgrade using Netconf/YANG Models

From Cisco IOS XE Cupertino 17.9.1, you can use NETCONF/YANG models to configure site-based APSP and N+1 hitless software upgrade.

For more information, see the Programmability Configuration Guide at: https://www.cisco.com/c/en/us/support/ios-nx-os-software/ios-xe-17/products-installation-and-configuration-guides-list.html

For more information on the YANG models, see the Cisco IOS XE Programmability Configuration Guide and YANG Data Models on Github at: https://github.com/YangModels/yang/tree/master/vendor/cisco/xe.

You can contact the Developer Support Community for NETCONF/YANG features at:

https://developer.cisco.com/

Support 6-GHz radio for Canada

In this release, Canada (CA) is added to the list of countries supporting 802.11 6-GHz radio band.

Support for Cisco Catalyst 9164I Series Wi-Fi 6E Access Points and Cisco Catalyst 9166I Series Wi-Fi 6E Access Points

From this release onwards, Cisco Catalyst 9164I Series Wi-Fi 6E Access Points and Cisco Catalyst 9166I Series Wi-Fi 6E Access Points are supported.

Support for RFC 5580 Location Attributes in the Controller

This feature uses the RFC 5580 location attributes to convey location-related information for authentication and accounting exchanges.

The following commands are introduced:

• radius-server attribute wireless location delivery out-of-band

• location civic-location identifier

• location geo-location identifier

• location operator identifier

• location civic-location-id

• location geo-location-id

• location operator-id

• radius-server attribute wireless location civic-location-id

• radius-server attribute wireless location geo-location-id

• radius-server attribute wireless location operator-id

For more information, see the chapter Configuring RFC 5580 Location Attributes.

VLAN Group to Support DHCP and Static IP Clients

The VLAN Group to Support DHCP and Static IP Clients feature aims to handle the network access of clients whose static IP address is not a part of the VLAN's IP list.

For more information, see the chapter VLAN Groups.

Walkme for Usage and Troubleshooting

The following new workflows have been implemented:

• AP Join troubleshooting: A collection of workflows that takes you through various troubleshooting commands to find out why AP join has failed.

• FlexConnect workflow: A collection of workflows that show how to configure FlexConnect.

Wireless Rogue Channel Width Support

In this release, the Wireless Rogue Channel Width feature is supported.

Rogue channel width changes are implemented at the TDL level. Because the telemetry child table cannot be accessed by Cisco DNA Center because of the TDL limitation, all radio band information is now available in the top-level table. Telemetry data can be validated through the SSH Netconf console to check the correct radio band with channel width values.

TrustSec Support in Cisco Catalyst Wi-Fi 6 Access Points

From this release onwards, Cisco Catalyst Wi-Fi 6 Access Points support TrustSec feature with the controller.

Zero Wait Dynamic Frequency Selection

When an access point (AP) moves to Dynamic Frequency Selection (DFS) channel, a service outage can occur. This feature helps to avoid service outages in regulatory domains. As of now, the US and Europe are the only supported domains. For more information, see the chapter Dynamic Frequency Selection.

802.11r Fast Transition for SAE Authenticated Clients

• Configuration > Tags & Profiles > WLANs

Additional Client Information on Client 360 View

• Monitoring > Wireless > Clients > 360

Configuring the AP Console

• Configuration > Tags & Profiles > AP Join

Flexible Radio Assignment Support in Cisco Catalyst 9166I Series Wi-Fi 6E Access Points

• Configuration > Radio Configurations > RRM > FRA

Management Mode Migration in Cisco Catalyst 916x Series Wi-Fi 6E Access Points (CW9164 and CW9166)

• Configuration > Wireless > Migrate to Meraki Management Mode

Site-based Rolling AP Upgrade in N+1 Networks

• Administration > Software Management