Requirements

There are no specific requirements for this document.

Components Used

This document is not restricted to specific software and hardware versions.

Conventions

Refer to Cisco Technical Tips Conventions for more information on document conventions.

Data Sheet

Refer to Cisco Flex 7500 Series Cloud Controller Data Sheet: http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/
ps11635/data_sheet_c78-650053.html

Platform Feature

Figure 2 Flex 7500 Rear View

Network Interface Ports

Note: LAG support for 2x10G interfaces allows active-active link operation with fast failover link redundancy. An additional active 10G link with LAG does not change the controller wireless throughput.

■2x10G interfaces.

■2x10G interfaces support optic cable with SFP product # SFP-10G-SR and SFP-10G-LR.

■Switch side SFP or X2 product should be of the same type SR or LR.

System MAC Addresses

Serial Console Redirect

The WLC 7500 enables console redirect by default at the baud rate of 9600, simulating Vt100 terminal with no flow control.

Inventory Information

The following is the WLC 7500 Console:

(Cisco Controller) >show inventory

Burned-in MAC Address............................ E4:1F:13:65:DB:6C

Maximum number of APs supported.................. 2000

NAME: "Chassis", DESCR: "Cisco Wireless Controller"

PID: AIR-CT7510-K9, VID: V01, SN: KQZZXWL

The Desktop Management Interface (DMI) table contains server hardware and BIOS information. The WLC 7500 displays BIOS version, PID/VID and Serial Number as part of inventory.

Note: Flex 7500 is currently shipped with VID=V02.

AP Base Count Licensing

AP Upgrade Licensing

Except for the base and upgrade counts, the entire licensing procedure that covers ordering, installation, and viewing is similar to Cisco's existing WLC 5508.

Refer to the WLC 7.3 configuration guide, which covers the entire licensing procedure.

Advantages of Centralizing Access Point Control Traffic

■Single pane of monitoring and troubleshooting.

■Ease of management.

■Secured and seamless mobile access to Data Center resources.

■Reduction in branch footprint.

■Increase in operational savings.

Advantages of Distributing Client Data Traffic

■No operational downtime (survivability) against complete WAN link failures or controller unavailability.

■Mobility resiliency within branch during WAN link failures.

■Increase in branch scalability. Supports branch size that can scale up to 100 APs and 250,000 square feet (5000 sq. feet per AP).

The Cisco FlexConnect solution also supports Central Client Data Traffic, but it is limited to Guest data traffic only. This next table describes the restrictions on WLAN L2 security types only for non-guest clients whose data traffic is also switched centrally at the Data Center.

Note: These authentication restrictions do not apply to clients whose data traffic is distributed at the branch.

For more information on Flexconnect external webauth deployment, please refer to Flexconnect External WebAuth Deployment Guide

For more information on HREAP/FlexConnect AP states and data traffic switching options, refer to Configuring FlexConnect.

FlexConnect Modes of Operation

For more information on FlexConnect Theory of Operations, refer to the H-Reap/FlexConnect Design and Deployment Guide.

WAN Requirements

FlexConnect APs are deployed at the Branch site and managed from the Data Center over a WAN link. The maximum transmission unit (MTU) must be at least 500 bytes.

Note: It is highly recommended that the minimum bandwidth restriction remains 12.8 Kbps per AP with the round trip latency no greater than 300 ms for data deployments and 100 ms for data + voice deployments.

For large deployments with scale for max APs per branch = 100 and max clients per branch = 2000.

Key Features

Adaptive wIPS, Context Aware (RFIDs), Rogue Detection, Clients with central 802.1X auth and CleanAir.

Test Results

For 100 APs, 2000 Clients, 1000 RFIDs, 500 Rogue APs, and 2500 Rogue Clients (Features above turned on):

Recommended BW = 1.54 Mbps

Recommended RTT latency = 400 ms

Test Results

For 100 APs, 2000 Clients, no rogue, and no RFIDs. (Features above turned off).

Recommended BW = 1.024 Mbps

Recommended Latency = 300 ms

Primary Design Requirements

■Branch size that can scale up to 100 APs and 250,000 square feet (5000 sq. feet per AP)

■Central management and troubleshooting

■No operational downtime

■Client-based traffic segmentation

■Seamless and secured wireless connectivity to corporate resources

■PCI compliant

■Support for guests

Figure 6 Wireless Branch Network Design

Overview

Branch customers find it increasingly difficult and expensive to deliver full-featured scalable and secure network services across geographic locations. In order to support customers, Cisco is addressing these challenges by introducing the Flex 7500.

The Flex 7500 solution virtualizes the complex security, management, configuration, and troubleshooting operations within the data center and then transparently extends those services to each branch. Deployments using Flex 7500 are easier for IT to set up, manage and, most importantly, scale.

Advantages

■Increase scalability with 6000 AP support.

■Increased resiliency using FlexConnect Fault Tolerance.

■Increase segmentation of traffic using FlexConnect (Central and Local Switching).

■Ease of management by replicating store designs using AP groups and FlexConnect Groups.

Infrastructure Multicast

It is not possible to configure the AP multicast mode for Cisco Flex 7500 series controllers because only unicast is supported.

Also, it is not possible to configure Global multicast mode for Cisco Flex 7500 series controllers.

Configurations from WLC

Complete the following steps:

1. On the WLANs > New page, enter Store1 in the Profile Name field, enter store in the SSID field, and choose 17 from the ID drop-down list.

Note: WLAN IDs 1-16 are part of the default group and cannot be deleted. In order to satisfy our requirement of using same SSID store per store with a different WPA2-PSK, you need to use WLAN ID 17 and beyond because these are not part of the default group and can be limited to each store.

2. Under WLANs > Security, choose PSK from the Auth Key Mgmt drop-down list, choose ASCII from the PSK Format drop-down list, and then click Apply.

3. Click WLANs > General, verify the Security Policies change, and check the Status box to enable the WLAN.

4. Repeat steps 1, 2 and 3 for new WLAN profile Store2, with SSID as store and ID as 18.

5. Create and enable the WLAN profile with Profile Name DataCenter, SSID DataCenter and ID 1.

Note: On creation, WLAN IDs from 1-16 are automatically part of the default-ap-group.

6. Under WLANs, verify the status of WLAN IDs 1, 17 and 18.

7. Click WLANs > Advanced > AP group > Add Group.

8. Add AP Group Name as Store1, same as WLAN profile Store1, and Description as the Location of the Store. In this example, California is used as the location of the store.

9. Click Add when done.

10. Click Add Group and create the AP Group Name as Store2 and the description as New York.

11. Click Add.

12. Verify the group creation by navigating to WLANs > Advanced > AP Groups.

13. Click AP Group Name Store1 to add or edit the WLAN.

14. Click Add New to select the WLAN.

15. Under WLANs, from the WLAN SSID drop-down, choose WLAN ID 17 store(17).

16. Click Add after WLAN ID 17 is selected.

17. Repeat steps (14 -16) for WLAN ID 1 DataCenter(1). This step is optional and needed only if you want to allow Remote Resource access.

18. Go back to the WLANs > Advanced > AP Groups.

19. Click AP Group Name Store2 to add or edit WLAN.

20. Click Add New to select the WLAN.

21. Under WLANs, from WLAN SSID drop-down, choose WLAN ID 18 store(18).

22. Click Add after WLAN ID 18 is selected.

23. Repeat steps 14 -16 for WLAN ID 1 DataCenter(1).

Note: Adding multiple WLAN profiles with the same SSID under a single AP group is not permitted.

Note: Adding APs to the AP group is not captured in this document, but it is needed for clients to access network services.

Summary

■AP groups simplify network administration.

■Troubleshooting ease with per branch granularity

■Increased flexibility

Primary Objectives of FlexConnect Groups

Backup RADIUS Server Failover

You can configure the controller to allow a FlexConnect access point in standalone mode to perform full 802.1X authentication to a backup RADIUS server. In order to increase the resiliency of the branch, administrators can configure a primary backup RADIUS server or both a primary and secondary backup RADIUS server. These servers are used only when the FlexConnect access point is not connected to the controller.

Note: Backup RADIUS accounting is not supported.

Local Authentication

Before the 7.0.98.0 code release, local authentication was supported only when FlexConnect is in Standalone Mode to ensure client connectivity is not affected during WAN link failure. With the 7.0.116.0 release, this feature is now supported even when FlexConnect access points are in Connected Mode.

Figure 9 Central Dot1X Authentication (FlexConnect APs Acting as Authenticator)

As shown in Figure 9, branch clients can continue to perform 802.1X authentication when the FlexConnect Branch APs lose connectivity with Flex 7500. As long as the RADIUS/ACS server is reachable from the Branch site, wireless clients will continue to authenticate and access wireless services. In other words, if the RADIUS/ACS is located inside the Branch, then clients will authenticate and access wireless services even during a WAN outage.

Note: This feature can be used in conjunction with the FlexConnect backup RADIUS server feature. If a FlexConnect Group is configured with both backup RADIUS server and local authentication, the FlexConnect access point always attempts to authenticate clients using the primary backup RADIUS server first, followed by the secondary backup RADIUS server (if the primary is not reachable), and finally the Local EAP Server on FlexConnect access point itself (if the primary and secondary are not reachable).

Local EAP (Local Authentication Continuation)

Figure 10 Dot1X Authentication (FlexConnect APs Acting as Local-EAP Server)

■You can configure the controller to allow a FlexConnect AP in standalone or connected mode to perform LEAP or EAP-FAST authentication for up to 100 statically configured users. The controller sends the static list of user names and passwords to each FlexConnect access point of that particular FlexConnect Group when it joins the controller. Each access point in the group authenticates only its own associated clients.

■This feature is ideal for customers who are migrating from an autonomous access point network to a lightweight FlexConnect access point network and are not interested in maintaining a large user database, or adding another hardware device to replace the RADIUS server functionality available in the autonomous access point.

■As shown in Figure 10, if the RADIUS/ACS server inside the Data Center is not reachable, then FlexConnect APs automatically acts as a Local-EAP Server to perform Dot1X authentication for wireless branch clients.

CCKM/OKC Fast Roaming

■FlexConnect Groups are required for CCKM/OKC fast roaming to work with FlexConnect access points. Fast roaming is achieved by caching a derivative of the master key from a full EAP authentication so that a simple and secure key exchange can occur when a wireless client roams to a different access point. This feature prevents the need to perform a full RADIUS EAP authentication as the client roams from one access point to another. The FlexConnect access points need to obtain the CCKM/OKC cache information for all the clients that might associate so they can process it quickly instead of sending it back to the controller. If, for example, you have a controller with 300 access points and 100 clients that might associate, sending the CCKM/OKC cache for all 100 clients is not practical. If you create a FlexConnect Group comprising a limited number of access points (for example, you create a group for four access points in a remote office), the clients roam only among those four access points, and the CCKM/OKC cache is distributed among those four access points only when the clients associate to one of them.

■This feature along with Backup Radius and Local Authentication (Local-EAP) ensures no operational downtime for your branch sites.

Note: CCKM/OKC fast roaming among FlexConnect and non-FlexConnect access points is not supported.

Figure 11 Wireless Network Design Reference Using FlexConnect Groups

FlexConnect Group Configuration from WLC

Complete the steps in this section in order to configure FlexConnect Groups to support Local Authentication using LEAP, when FlexConnect is either in Connected or Standalone mode. The configuration sample in Figure 11 illustrates the objective differences and 1:1 mapping between the AP Group and FlexConnect Group.

1. Click New under Wireless > FlexConnect Groups.

2. Assign Group Name Store 1, similar to the sample configuration as shown in Figure 11.

3. Click Apply when the Group Name is set.

4. Click the Group Name Store 1 that you just created for further configuration.

5. Click Add AP.

6. Check the Enable AP Local Authentication check box to enable Local Authentication when the AP is in Standalone Mode.

Note: Step 20 shows how to enable Local Authentication for Connected Mode AP.

7. Check the Select APs from current controller check box to enable the AP Name drop-down menu.

8. Choose the AP from the drop-down that needs to be part of this FlexConnect Group.

9. Click Add after the AP is chosen from the drop-down.

10. Repeat steps 7 and 8 to add all the APs to this FlexConnect Group that are also part of AP-Group Store 1. See Figure 11 to understand the 1:1 mapping between the AP-Group and FlexConnect Group.

If you have created an AP-Group per Store (Figure 7), then ideally all the APs of that AP-Group should be part of this FlexConnect Group (Figure 11. Maintaining 1:1 ratio between the AP-Group and FlexConnect Group simplifies network management.

11. Click Local Authentication > Protocols and check the Enable LEAP Authentication check box.

12. Click Apply.

Note: If you have a backup controller, make sure the FlexConnect Groups are identical and AP MAC address entries are included per FlexConnect Group.

13. Under Local Authentication, click Local Users.

14. Set the UserName, Password and Confirm Password fields, then click Add to create user entry in the Local EAP server residing on the AP.

15. Repeat step 13 until your local user name list is exhausted. You cannot configure or add more than 100 users.

16. Click Apply after step 14 is completed and the Number of users count is verified.

17. From the top pane, click WLANs.

18. Click WLAN ID 17. This was created during the AP Group creation. See Figure 7.

19. Under WLANs > Edit for WLAN ID 17, click Advanced.

20. Check the FlexConnect Local Auth check box to enable Local Authentication in Connected Mode.

Note: Local Authentication is supported only for FlexConnect with Local Switching.

Note: Always make sure to create the FlexConnect Group before enabling Local Authentication under WLAN.

NCS and Cisco Prime also provides the FlexConnect Local Auth check box in order to enable Local Authentication in Connected Mode as shown here:

NCS and Cisco Prime also provides facility to filter and monitor FlexConnect Locally Authenticated clients as shown here:

Verification Using CLI

Client authentication state and switching mode can quickly be verified using this CLI on the WLC:

(Cisco Controller) >show client detail 00:24:d7:2b:7c:0c

Client MAC Address............................... 00:24:d7:2b:7c:0c

Client Username................................. N/A

AP MAC Address................................... d0:57:4c:08:e6:70

Client State..................................... Associated

H-REAP Data Switching............................ Local

H-REAP Authentication............................ Local

Summary

■AAA VLAN override is supported from release 7.2 for WLANs configured for local switching in central and local authentication mode.

■AAA override should be enabled on WLAN configured for local switching.

■The FlexConnect AP should have VLAN pre-created from WLC for dynamic VLAN assignment.

■If VLANs returned by AAA override are not present on AP client, they will get an IP from the default VLAN interface of the AP.

Procedure

Complete these steps:

1. Create a WLAN for 802.1x authentication.

2. Enable AAA override support for local switching WLAN on the WLC. Navigate to WLAN GUI > WLAN > WLAN ID > Advanced tab.

3. Add the AAA server details on the controller for 802.1x authentication. To add the AAA server, navigate to WLC GUI > Security > AAA > Radius > Authentication > New.

4. The AP is in local mode by default, so covert the mode to FlexConnect mode. Local mode APs can be converted to FlexConnect mode by going to Wireless > All APs, and click the Individual AP.

5. Add the FlexConnect APs to the FlexConnect Group.

6. Navigate under WLC GUI > Wireless > FlexConnect Groups > Select FlexConnect Group > General tab > Add AP.

7. The FlexConnect AP should be connected on a trunk port and WLAN mapped VLAN and AAA overridden VLAN should be allowed on the trunk port.

Note: In this configuration, VLAN 109 is used for WLAN VLAN mapping and VLAN 3 is used for AAA override.

8. Configure WLAN to VLAN Mapping for the FlexConnect AP. Based on this configuration, the AP would have the interfaces for the VLAN. When the AP receives the VLAN configuration, corresponding dot11 and Ethernet sub-interfaces are created and added to a bridge-group. Associate a client on this WLAN and when the client associates, its VLAN (default, based on the WLAN-VLAN mapping) is assigned.

9. Navigate to WLAN GUI > Wireless > All APs, click the specific AP > FlexConnect tab, and click VLAN Mapping.

10. Create a user in the AAA server and configure the user to return VLAN ID in IETF Radius attribute.

11. To have dynamic VLAN assignment, the AP would have the interfaces for the dynamic VLAN pre-created based on the configuration using existing WLAN-VLAN Mapping for the individual FlexConnect AP or using ACL-VLAN mapping on FlexConnect Group.

12. To configure AAA VLAN on the FlexConnect AP, navigate to WLC GUI > Wireless > FlexConnect Group, click the specific FlexConnect group > VLAN-ACL mapping, and enter VLAN in the Vlan ID field.

13. Associate a client on this WLAN and authenticate using the user name configured in the AAA server in order to return the AAA VLAN.

14. The client should receive an IP address from the dynamic VLAN returned via the AAA server.

15. To verify, click WLC GUI > Monitor > Client, click the specific client MAC address in order to check the client details.

Limitations

■Cisco Airespace-specific attributes will not be supported and IETF attribute VLAN ID will only be supported.

■A maximum of 16 VLANs can be configured in per-AP configuration either via WLAN-VLAN Mapping for individual FlexConnect AP or using ACL-VLAN mapping on the FlexConnect Group.

Summary

Traffic flow on WLANs configured for Local Switching when Flex APs are in Connected Mode:

■If the VLAN is returned as one of the AAA attributes and that VLAN is not present in the Flex AP database, traffic will switch centrally and the client will be assigned this VLAN/Interface returned from the AAA server provided that the VLAN exists on the WLC.

■If the VLAN is returned as one of the AAA attributes and that VLAN is not present in the Flex AP database, traffic will switch centrally. If that VLAN is also not present on the WLC, the client will be assigned a VLAN/Interface mapped to a WLAN on the WLC.

■If the VLAN is returned as one of the AAA attributes and that VLAN is present in the FlexConnect AP database, traffic will switch locally.

■If the VLAN is not returned from the AAA server, the client will be assigned a WLAN mapped VLAN on that FlexConnect AP and traffic will switch locally.

Traffic flow on WLANs configured for Local Switching when Flex APs are in Standalone Mode:

■If the VLAN returned by an AAA server is not present in the Flex AP database, the client will be put to default VLAN (that is, a WLAN mapped VLAN on Flex AP). When the AP connects back, this client will be de-authenticated and will switch traffic centrally.

■If the VLAN returned by an AAA server is present in the Flex AP database, the client will be put into a returned VLAN and traffic will switch locally.

■If the VLAN is not returned from an AAA server, the client will be assigned a WLAN mapped VLAN on that FlexConnect AP and traffic will switch locally.

Procedure

Complete these steps:

1. Configure a WLAN for Local Switching and enable AAA override.

2. Enable Vlan based Central Switching on the newly created WLAN.

3. Set AP Mode to FlexConnect.

4. Make sure that the FlexConnect AP has some sub-interface present in its database, either via WLAN-VLAN Mapping on a particular Flex AP or via configuring VLAN from a Flex group. In this example, VLAN 63 is configured in WLAN-VLAN mapping on Flex AP.

5. In this example, VLAN 62 is configured on WLC as one of the dynamic interfaces and is not mapped to the WLAN on the WLC. The WLAN on the WLC is mapped to Management VLAN (that is, VLAN 61).

6. Associate a client to the WLAN configured in Step 1 on this Flex AP and return VLAN 62 from the AAA server. VLAN 62 is not present on this Flex AP, but it is present on the WLC as a dynamic interface so traffic will switch centrally and the client will be assigned VLAN 62 on the WLC. In the output captured here, the client has been assigned VLAN 62 and Data Switching and Authentication are set to Central.

Note: Observe that although WLAN is configured for Local Switching, the Data Switching field for this client is Central based on the presence of a VLAN (that is, VLAN 62, which is returned from the AAA server, is not present in the AP Database).

7. If another user associates to the same AP on this created WLAN and some VLAN is returned from the AAA server which is not present on the AP as well as the WLC, traffic will switch centrally and the client will be assigned the WLAN mapped interface on the WLC (that is, VLAN 61 in this example setup), because the WLAN is mapped to the Management interface which is configured for VLAN 61.

Note: Observe that although WLAN is configured for Local Switching, the Data Switching field for this client is Central based on the presence of a VLAN. That is, VLAN 61, which is returned from the AAA server, is not present in the AP Database but is also not present in the WLC database. As a result, the client is assigned a default interface VLAN/Interface which is mapped to the WLAN. In this example, the WLAN is mapped to a management interface (that is, VLAN 61) and so the client has received an IP address from VLAN 61.

8. If another user associates to it on this created WLAN and VLAN 63 is returned from the AAA server (which is present on this Flex AP), the client will be assigned VLAN 63 and traffic will switch locally.

Limitations

■VLAN Based Central Switching is only supported on WLANs configured for Central Authentication and Local Switching.

■The AP sub-interface (that is, VLAN Mapping) should be configured on the FlexConnect AP.

■RADIUS NAC is not supported when VLAN based central switching feature is turned on.

Summary

■Create FlexConnect ACL on the controller.

■Apply the same on a VLAN present on FlexConnect AP under AP Level VLAN ACL mapping.

■Can be applied on a VLAN present in FlexConnect Group under VLAN-ACL mapping (generally done for AAA overridden VLANs).

■While applying ACL on VLAN, select the direction to be applied which will be “ingress”, “egress” or “ingress and egress”.

Procedure

Complete these steps:

1. Create a FlexConnect ACL on the WLC. Navigate to WLC GUI > Security > Access Control List > FlexConnect ACLs.

2. Click New.

3. Configure the ACL Name.

4. Click Apply.

5. Create rules for each ACL. In order to create rules, navigate to WLC GUI > Security > Access Control List > FlexConnect ACLs, and click the above created ACL.

6. Click Add New Rule.

Note: Configure the rules as per the requirement. If the permit any rule is not configured at the end, there is an implicit deny which will block all traffic.

7. Once the FlexConnect ACLs are created, it can be mapped for WLAN-VLAN mapping under individual FlexConnect AP or can be applied on VLAN-ACL mapping on the FlexConnect Group.

8. Map FlexConnect ACL configured above at AP level for individual VLANs under VLAN mappings for individual FlexConnect AP. Navigate to WLC GUI > Wireless > All AP, click the specific AP > FlexConnect tab > VLAN Mapping.

9. FlexConnect ACL can also be applied on VLAN-ACL mapping in the FlexConnect Group. VLANs created under VLAN-ACL mapping in FlexConnect Group are mainly used for dynamic VLAN override.

Limitations

■A maximum of 512 FlexConnect ACLs can be configured on WLC.

■Each individual ACL can be configured with 64 rules.

■A maximum of 32 ACLs can be mapped per FlexConnect Group or per FlexConnect AP.

■At any given point in time, there is a maximum of 16 VLANs and 32 ACLs on the FlexConnect AP.

Summary

■The Split Tunneling functionality is supported on WLANs configured for Central Switching advertised by Flex APs only.

■The DHCP required should be enabled on WLANs configured for Split Tunneling.

■The Split Tunneling configuration is applied per WLAN configured for central switching on per Flex AP or for all the Flex APs in a FlexConnect Group.

Procedure

Complete these steps:

1. Configure a WLAN for Central Switching (that is, Flex Local Switching should not be enabled).

2. Set the DHCP Addr. Assignment field to Required.

3. Set AP Mode to FlexConnect.

4. Configure FlexConnect ACL with a permit rule for traffic which should be switched locally on the Central Switch WLAN. In this example, the FlexConnect ACL rule is configured so it will alert ICMP traffic from all the clients which are on the 9.6.61.0 subnet (that is, exist on the Central site) to 9.1.0.150 to be switched locally after the NAT operation is applied on Flex AP. The rest of the traffic will hit an implicit deny rule and be switched centrally over CAPWAP.

5. This created FlexConnect ACL can be pushed as a Split Tunnel ACL to individual Flex AP or can also be pushed to all the Flex APs in a Flex Connect group.

6. Complete these steps in order to push Flex ACL as a Local Split ACL to individual Flex AP:

a. Click Local Split ACLs.

b. Select WLAN Id on which Split Tunnel feature should be enabled, choose Flex-ACL, and click Add.

c. Flex-ACL is pushed as Local-Split ACL to the Flex AP.

7. Complete these steps in order to push Flex ACL as Local Split ACL to a FlexConnect Group:

a. Select the WLAN Id on which the Split Tunneling feature should be enabled. On the WLAN-ACL mapping tab, select FlexConnect ACL from the FlexConnect Group where particular Flex APs are added, and click Add.

b. The Flex-ACL is pushed as LocalSplit ACL to Flex APs in that Flex group.

Limitations

■Flex ACL rules should not be configured with permit/deny statement with same subnet as source and destination.

■Traffic on a Centrally Switched WLAN configured for Split Tunneling can be switched locally only when a wireless client initiates traffic for a host present on the local site. If traffic is initiated by clients/host on a local site for wireless clients on these configured WLANs, it will not be able to reach the destination.

■Split Tunneling is not supported for Multicast/Broadcast traffic. Multicast/Broadcast traffic will switch centrally even if it matches the Flex ACL.

Summary

■FlexConnect will not disconnect clients when the AP is connecting back to the same controller provided there is no change in configuration on the controller.

■FlexConnect will not disconnect clients when connecting to the backup controller provided there is no change in configuration and the backup controller is identical to the primary controller.

■FlexConnect will not reset its radios on connecting back to the primary controller provided there is no change in configuration on the controller.

Limitations

■Supported only for FlexConnect with Central/Local Authentication with Local Switching.

■Centrally authenticated clients require full re-authentication if the client session timer expires before the FlexConnect AP switches from Standalone to Connected mode.

■Flex 7500 primary and backup controllers must be in the same mobility domain.

Primary Objective

■Set limits on maximum clients

■Operational ease

Note: This is not a form of QoS.

By default, the feature is disabled and does not force the limit.

Limitations

This feature does not enforce client limit when the FlexConnect is in Standalone state of operation.

WLC Configuration

Complete these steps:

1. Select the Centrally Switched WLAN ID 1 with SSID DataCenter. This WLAN was created during THE AP Group creation. See Figure 7.

2. Click the Advanced tab for WLAN ID 1.

3. Set the client limit value for the Maximum Allowed Clients text field.

4. Click Apply after the text field for Maximum Allowed Clients is set.

Default for Maximum Allowed Clients is set to 0, which implies there is no restriction and the feature is disabled.

NCS Configuration

In order to enable this feature from the NCS, go to Configure > Controllers > Controller IP > WLANs > WLAN Configuration > WLAN Configuration Details.

Configuration through Cisco Prime

In order to enable this feature from the Cisco Prime, go to Configure > Controllers > Controller IP > WLANs > WLAN Configuration > WLAN Configuration Details.

Summary

■Peer-to-peer Blocking is configured per WLAN

■Per WLAN, peer-to-peer blocking configuration is pushed by WLC to FlexConnect APs.

■Peer-to-peer blocking action configured as drop or upstream-forward on WLAN is treated as peer-to-peer blocking enabled on FlexConnect AP.

Procedure

Complete these steps:

1. Enable peer-to-peer blocking action as Drop on WLAN configured for FlexConnect Local Switching.

2. Once the P2P Blocking action is configured as Drop or Forward-Upstream on WLAN configured for local switching, it is pushed from the WLC to the FlexConnect AP. The FlexConnect APs will store this information in the reap config file in flash. With this, even when FlexConnect AP is in standalone mode, it can apply the P2P configuration on the corresponding sub-interfaces.

Limitations

■In FlexConnect, solution P2P blocking configuration cannot be applied only to a particular FlexConnect AP or sub-set of APs. It is applied to all FlexConnect APs that broadcast the SSID.

■Unified solution for central switching clients supports P2P upstream-forward. However, this will not be supported in the FlexConnect solution. This is treated as P2P drop and client packets are dropped instead of forwarded to the next network node.

■Unified solution for central switching clients supports P2P blocking for clients associated to different APs. However, this solution targets only clients connected to the same AP. FlexConnect ACLs can be used as a workaround for this limitation.

Summary

■Ease of software management

■Schedule per store upgrades: NCS or Cisco Prime is needed to accomplish this.

■Reduces downtime

Procedure

Complete these steps:

1. Upgrade the image on the primary and backup controllers.

Navigate under WLC GUI > Commands > Download File to start the download.

2. Save the configurations on the controllers, but do not reboot the controller.

3. Issue the AP pre-image download command from the primary controller.

a. Navigate to WLC GUI > Wireless > Access Points > All APs and choose the access point to start pre-image download.

b. Once the access point is chosen, click the Advanced tab.

c. Click Download Primary to initiate pre-image download.

4. Reboot the controllers after all the AP images are downloaded.

The APs now fall back to Standalone mode until the controllers are rebooting.

Note: In Standalone mode, Fault Tolerance will keep Clients associated.

Once the controller is back, the APs automatically reboot with the pre-downloaded image. After rebooting, the APs re-join the primary controller and resume client's services.

Limitations

■Works only with CAPWAP APs.

Summary

■Primary and Subordinate APs are selected for each AP Model per FlexConnect Group

■Primary downloads image from WLC

■Subordinate downloads image from Primary AP

■Reduces downtime and saves WAN bandwidth

Procedure

Complete these steps:

1. Upgrade the image on the controller.

2. Navigate to WLC GUI > Commands > Download File to begin the download.

3. Save the configurations on the controllers, but do not reboot the controller.

4. Add the FlexConnect APs to FlexConnect Group.

5. Navigate to WLC GUI > Wireless > FlexConnect Groups, select FlexConnect Group > General tab > Add AP.

6. Check the FlexConnect AP Upgrade check box in order to achieve efficient AP image upgrade.

7. Navigate to WLC GUI > Wireless > FlexConnect Groups, select FlexConnect Group > Image Upgrade tab.

8. The primary AP can be selected manually or automatically:

a. To manually select the primary AP, navigate to WLC GUI > Wireless > FlexConnect Groups, select FlexConnect Group > Image Upgrade tab > FlexConnect Master APs, and select AP from the drop-down list, and click Add Master.

Note: Only one AP per model can be configured as primary AP. If primary AP is configured manually, the Manual field will be updated as yes.

b. To automatically select primary AP, navigate to WLC GUI > Wireless > FlexConnect Groups, select FlexConnect Group > Image Upgrade tab, and click FlexConnect Upgrade.

Note: If primary AP is selected automatically, the Manual field will be updated as no.

9. To start efficient AP image upgrade for all the APs under a specific FlexConnect Group, click FlexConnect Upgrade.

10. Navigate to WLC GUI > Wireless > FlexConnect Groups, select FlexConnect group > Image Upgrade tab and then click FlexConnect Upgrade.

Note: Subordinate Maximum Retry Count is the number of attempts (44 by default) in which the subordinate AP will make in order to download an image from the primary AP, after which it will fall back to download the image from the WLC. It will make 20 attempts against WLC in order to download a new image after which the administrator has to re-initiate the download process.

11. Once FlexConnect Upgrade is initiated, only the primary AP will download the image from the WLC. Under All AP page, Upgrade Role will be updated as Master/Central which means primary AP has downloaded the image from the WLC which is at the central location. The subordinate AP will download the image from the primary AP which is at the local site and is the reason under All AP page Upgrade Role will be updated as Slave/Local.

12. To verify this, navigate to WLC GUI > Wireless.

13. Reboot the controllers after all the AP images are downloaded. The APs now fall back to Standalone mode until the controllers are rebooting.

Note: In Standalone mode, Fault Tolerance will keep Clients associated.

Once the controller is back, the APs automatically reboot with the pre-downloaded image. After rebooting, the APs re-join the primary controller and resume the client's services.

Limitations

■Primary AP selection is per FlexConnect Group and per AP model in each group.

■Only 3 subordinate APs of same model can upgrade simultaneously from their primary AP and rest of the subordinate APs will use the random back-off timer to retry for the primary AP in order to download the AP image.

■In the instance that the subordinate AP fails to download the image from the primary AP for some reason, it will go to the WLC in order to fetch the new image.

■This works only with CAPWAP APs.

■Smart AP image upgrade does not work when the primary AP is connected over CAPWAPv6.

Manual Mode

This mode is available on all the platforms and allows the change to take place only on per AP basis.

1. Navigate to WLC GUI > Wireless > All APs and choose the AP.

2. Select FlexConnect as the AP Mode, then click Apply.

3. Changing the AP mode causes the AP to reboot.

This option is also available on all the current WLC platforms.

Auto Convert Mode

■This feature is supported in Flex 7500, 8510, 8540 and 5520 controller.

(Cisco Controller) >config ap autoconvert ?

disable............Disables auto conversion of unsupported mode APs to supported modes when AP joins

flexconnect........Converts unsupported mode APs to flexconnect mode when AP joins monitor............Converts unsupported mode APs to monitor mode when AP joins

(Cisco Controller) >

1. The Auto-conversion feature is disabled by default, which can be verified by using this show command:

(Cisco Controller) >show ap autoconvert

AP Autoconvert.................................. Disabled

Non-supported AP modes = Local Mode, Sniffer, Rogue Detector and Bridge.

This option is currently available only via CLIs.

These CLIs are available only on the WLC 7500.

2. Performing config ap autoconvert flexconnect CLI converts all the APs in the network with non-supported AP mode to FlexConnect mode. Any APs that are already in FlexConnect or Monitor Mode are not affected.

(Cisco Controller) >config ap autoconvert flexconnect

(Cisco Controller) >show ap autoconvert

AP Autoconvert.................................. FlexConnect

(Cisco Controller) >

3. Performing config ap autoconvert monitor CLI converts all the APs in the network with non-supported AP mode to Monitor mode. Any APs that are already in FlexConnect or Monitor mode are not affected.

(Cisco Controller >config ap autoconvert monitor

(Cisco Controller) >show ap autoconvert

AP Autoconvert................................. Monitor

There is no option to perform both config ap autoconvert flexconnect and config ap autoconvert monitor at the same time.

Summary

■No special configuration is required on WLC in order to support WGB on Flex AP.

■Fault Tolerance is supported for WGB and clients behind WGB.

■WGB is supported on an IOS AP: 1240, 1130, 1140, 1260, 1600, 1250, 2600, and 3600.

Procedure

Complete these steps:

1. No special configuration is needed in order to enable WGB/uWGB support on FlexConnect APs for WLANs configured for local switching as WGB. Also, clients behind WGB are treated as normal clients on local switching configured WLANs by Flex APs. Enable FlexConnect Local Switching on a WLAN.

2. Set AP Mode to FlexConnect.

3. Associate WGB with wired clients behind this configured WLAN.

4. To check the details for WGB, go to Monitor > Clients, and select WGB from the list of clients.

5. To check the details of the wired/wireless clients behind WGB, go to Monitor > Clients, and select the client.

Limitations

■Wired clients behind WGB will always be on the same VLAN as WGN itself. Multiple VLAN support for clients behind WGB is not supported on Flex AP for WLANs configured for Local Switching.

■A maximum of 20 clients (wired/wireless) are supported behind WGB when associated to Flex AP on WLAN configured for local switching. This number is the same as what we have today for WGB support on Local mode AP.

■Web Auth is not supported for clients behind WGB associated on WLANs configured for local switching.

Summary

■Support for configuration of Primary and Backup RADIUS servers per FlexConnect Group, which may or may not be present in the global list of RADIUS authentication servers.

■The maximum number of unique RADIUS servers that can be added on a WLC is the number of FlexConnect Groups that can be configured on a given platform times two. An example is one primary and one secondary RADIUS server per FlexConnect Group.

■Software upgrade from a previous release to release 7.4 will not cause any RADIUS configuration loss.

■The deletion of the primary RADIUS server is allowed without having to deleting the secondary RADIUS server. This is consistent with the present FlexConnect Group configuration for the RADIUS server.

Procedure

1. Mode of configuration prior to release 7.4.

A maximum of 17 RADIUS servers can be configured under the AAA Authentication configuration.

2. Primary and Secondary RADIUS servers can be associated with a FlexConnect Group using a drop-down list comprising of RADIUS servers configured on the AAA Authentication page.

3. Mode of configuration at FlexConnect Group in release 7.4.

Primary and Secondary RADIUS servers can be configured under the FlexConnect Group using an IP address, port number and Shared Secret.

Limitations

■Software downgrade from release 7.4 to a previous release will retain the configuration but with some limitations.

■Configuring a primary/secondary RADIUS server when a previous one is configured will cause the older entry to be replaced by the new one.

EAP-TLS

Certificate Generation for EAP-TLS

The following steps are needed on the WLC and the client in order to authenticate the client to the FlexConnect AP using EAP-TLS authentication.

On WLC:

1. Generate device certificate for the WLC.

2. Get device certificate signed by CA server.

3. Generate CA certificate from the CA server.

4. Import device and CA certificate into the WLC in.pem format.

On Client:

1. Generate client certificate.

2. Get client certificate signed by CA server.

3. Generate CA certificate from the CA server.

4. Install client and CA certificate on the client.

Detailed steps on how to accomplish the above steps are listed in Document-100590 ( http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a008093f1b9.shtml)

Figure 13 Document 100590

Configuration of EAP-TLS on FlexConnect AP

1. Create WLAN for Local Switching and Local Authentication.

In the example below, two WLANs have been created, one for EAP-TLS and the other for PEAP authentication.

Figure 14 WLAN Configuration for PEAP and EAP-TLS

2. Enable FlexConnect Local Switching and FlexConnect Local Auth.

Figure 15 WLANs for Local Switching and Local Authentication

3. Enable AP Local Authentication.

Check the Enable AP Local Authentication check box on the FlexConnect Groups edit page. Radius Servers on the FlexConnect Group must be ‘Unconfigured’. If any RADIUS servers are configured on the FlexConnect Group, the AP tries to authenticate the wireless clients using the RADIUS servers first. AP Local Authentication is attempted only if no RADIUS servers are found, either because the RADIUS servers timed out or no RADIUS servers were configured.

Figure 16 FlexConnect Group Configuration for AP Local Authentication

4. Selecting EAP methods will now have two more options, PEAP and EAP-TLS under the FlexConnect Group with the existing LEAP and EAP-FAST options.

a. Current controller release supports downloading of EAP device and root (CA) certificates to the controller and the same is stored in PEM format on the flash.

Figure 17 Downloading Vendor Device Certificate

Figure 18 Downloading Vendor CA Certificate

b. With release 7.5, these certificates will be used for authenticating clients using EAP-TLS. Both the device and root certificates will be downloaded to all the FlexConnect APs in the FlexConnect Group if the EAP-TLS method is enabled, and the same is used at the AP to authenticate the clients.

c. When a new AP joins the group, certificates will be pushed to the AP along with other configurations. The user has to download the EAP device and Root certificates to controller prior to enabling EAP-TLS on the FlexConnect Group.

d. Upon receiving a certificate message from the controller, the AP will import these certificates, store them in memory and use them for authenticating clients.

e. EAP TLS Certificate Download option is provided to push any updated certificates to the AP.

Figure 19 Enabling PEAP and EAP TLS on AP Local Authentication under FlexConnect Group

Certificate Files on AP

Four files are downloaded to the AP, when EAP-TLS is enabled.

■eapdev.pem.ca – This is the CA (root) certificate.

■eapdev.pem.crt –This is the public certificate of the device.

■eapdev.pem.prv –This is the RSA private key of the device.

■eapdevpwd – This is the password file to protect the private key.

Figure 20 Files Stored in the Flash on AP

Client Configuration

Configure the wireless profile for EAP-TLS by selecting EAP Type EAP-TLS and specifying the Trusted Root certificate Authorities and the client certificate.

Figure 21 Wireless Profile for EAP-TLS

Figure 22 Validate Server Identity

Once the client is connected, Server Based Authentication will reflect EAP-TLS.

Figure 23 Client Authentication using EAP-TLS

Client Certificates

The Trusted Root and Client Certificates can be viewed as follows (These are the certificates as generated earlier)

Figure 24 Certificates on Client

Figure 25 Trusted Root (CA) Certificate on Client

Figure 26 Trusted Client Certificate

Show Commands

The EAP type of the client will be reflected on the WLC and can be seen in the output of show client detail.

Figure 27 EAP Type for Client Authenticated using EAP-TLS

EAP-PEAP

PEAP (EAP-MSCHAPv2 and EAP-GTC) EAP Type is supported with release 7.5 and Users need to be added on the WLC as shown below. A maximum of 100 users can be added per FlexConnect Group.

User Creation

Figure 28 User Addition for Local Authentication

Client Configuration

Selecting EAP Type EAP-MSCHAPv2 or GTC can configure the wireless profile for EAP-PEAP.

Figure 29 Wireless Profile for EAP-PEAP (EAP-MSCHAPv2)

Users created on the controller need to be configured on the client.

Figure 30 User Name and Password for PEAP

Figure 31 Cisco Aironet Desktop Utility Profile Management

Once the client is connected, Server Based Authentication will reflect PEAP(EAP-MSCHAPv2).

Figure 32 Client Authentication using PEAP(EAP-MSCHAPv2)

Once the client is authenticated, the EAP Type can be seen under the Client Detail page.

Figure 33 Web GUI Client Details

Show Commands

The EAP type of the client will be reflected on the WLC and can be seen in the output of show client detail.

Figure 34 EAP Type of Client Authenticated using PEAP

CLI Support for PEAP and EAP-TLS on FlexConnect APs

Two new CLIs have been added to configure PEAP and EAP-TLS from the controller.

config flexconnect group <groupName> radius ap peap <enable | disable>

config flexconnect group <groupName> radius ap eap-tls <enable | disable>

A CLI for certificate download has been added as well.

config flexconnect group <groupName> radius ap eap-cert download

Configurations at the AP can be seen from the console.

Figure 35 CLI Commands on AP Console

The following commands can be used to troubleshoot this feature:

debug eap all

debug aaa authentication

debug dot11 aaa authenticator all

debug aaa api

debug aaa subsys

debug dot11 aaa dispatcher

debug aaa protocol local

debug radius

debug aaa dead-criteria transaction

Guidelines

■FlexConnect AP should be in standalone mode or configured for Local authentication.

■Certificates must be present on the AP for EAP-TLS to work.

WLAN-VLAN Mapping Inheritance

■WLAN level WLAN-VLAN mapping has the lowest precedence.

■Higher precedence mapping will override the mapping of lower precedence

■AP level WLAN-VLAN mapping has the highest precedence

■On deletion of a higher precedence mapping, the next highest precedence mapping will take effect.

The following figure depicts the order of precedence as it refers to WLAN-VLAN mapping at the WLAN, FlexConnect Group and at the AP.

Figure 36 Flow of Inheritance

GUI Configuration

1. Create WLAN for Local Switching

Figure 37 WLAN for Local Switching

Figure 38 FlexConnect Local Switching

The WLAN is mapped to the management VLAN 56.

Figure 39 WLAN Mapped to VLAN 56 Management Interface

Figure 40 WLAN Mapped to VLAN 56 as Per WLAN-Specific Mapping

When a client connects to this WLAN, it will get an IP in VLAN 56.

Figure 41 Client in VLAN 56

2. Create WLAN-VLAN mapping under FlexConnect Groups. This capability is the new feature in release 7.5.

Figure 42 WLAN Mapped to VLAN 57 under FlexConnect Group

WLAN-VLAN mappings can be viewed per AP from the VLAN Mappings page.

Figure 43 VLAN Mappings at AP

In this example, the WLAN is mapped to VLAN 57 on the FlexConnect Group, since the Group-specific mappings take precedence over WLAN-specific mappings.

Figure 44 WLAN 1 Mapped to VLAN 57 as Per Group-Specific Configuration Inheritance

The client is assigned an IP address in VLAN 57.

Figure 45 Client in VLAN 57

3. To create a WLAN-VLAN mapping at the AP, select Make AP Specific under VLAN Mappings.

Once this is done, the WLAN is mapped to VLAN 58 since AP-specific mappings take precedence over Group-specific and WLAN-specific mappings.

Figure 46 WLAN Mapped to VLAN 58 as Per AP-Specific Mapping Inheritance

The client is assigned an IP address in VLAN 58.

Figure 47 Client in VLAN 58

CLI Configuration

The following CLIs have been added as part of this feature:

■ config flexconnect group <group> wlan-vlan wlan <wlan-id> add vlan <vlan-id>

■ config flexconnect group <group> wlan-vlan wlan <wlan-id> delete

■ config ap flexconnect vlan remove wlan <wlan_id> <ap_name>

Figure 48 WLAN-VLAN Configuration at FlexConnect Group from CLI

The command show flexconnect group detail can be used to see the WLAN-VLAN mapping for the FlexConnect Group

Figure 49 show flexconnect group detail Output

The command show ap config general <AP name> can be used to view the WLAN-VLAN mappings per AP.

Figure 50 show ap config general Output

The following commands can be used to troubleshoot this feature:

On WLC:

■ debug flexconnect wlan-vlan <enable | disable>

On AP:

■ debug capwap flexconnect wlan-vlan

Guidelines

■The WLAN should be locally switched.

■The configuration will be pushed to the AP only if the WLAN is broadcasted on that AP.

Dynamic VLAN Assignment with RADIUS Server

In most WLAN systems, each WLAN has a static policy that applies to all clients associated with a Service Set Identifier (SSID), or WLAN in the controller terminology. Although powerful, this method has limitations, because it requires clients to associate with different SSIDs to inherit different QoS and security policies.

However, the Cisco WLAN solution supports identity networking. This allows the network to advertise a single SSID, but allows specific users to inherit different QoS or security policies based on the user credential.

Dynamic VLAN assignment is one such feature that places a wireless user into a specific VLAN based on the credentials supplied by the user. A RADIUS authentication server, such as CiscoSecure ACS or ISE, handles this task of assigning users to a specific VLAN.

Dynamic VLAN Assignment is possible with FlexConnect branch deployments based on VLAN ID or VLAN Name for central switching and based on VLAN ID only, for local switching WLANs prior to this release. This release introduces the feature that allows VLAN Name Override for FlexConnect Local Switching WLANs as well.

VLAN Name Override Overview

The VLAN Name Override feature is useful in deployments that have a single central radius authenticating multiple branches. With hundreds of different branches, it becomes very difficult to standardize VLAN IDs across all sites and requires a configuration that provides a unique VLAN Name mapped locally to a VLAN ID that can be different across different branch locations.

This design involving different VLAN IDs across different sites is also useful from the sizing and scaling perspective to limit the number of clients per Layer 2 broadcast domain.

Use Case Definition

To explain further the use case that this feature addresses, consider the following example.

Remote Site A has three categories of users in the departments such as Engineering, Marketing, and Sales that need to be mapped to different VLAN IDs. Engineering needs to be mapped to VLAN ID 10, marketing to 20, and Sales to 30. Similarly, on Remote Site B, the same category of users needs to be mapped to VLAN ID 11, 21, and 31 respectively. All client authentications happen centrally with the RADIUS server shared across all sites. Using AAA Override of VLAN ID does not satisfy the requirement since a different set of VLAN IDs are present in each branch. For example, the RADIUS server is configured to return VLAN ID 20 for marketing. When a marketing employee authenticates in Remote Site B, VLAN 20 is not present in that branch and the user will be defaulted to the WLAN mapped VLAN ID for the FlexConnect Group at that branch, thus breaking the requirement.

VLAN Mapping Design

VLAN Name to VLAN ID mappings allow the VLAN ID details to be abstracted out in the form of VLAN Name templates that are applied to FlexConnect Groups. Each VLAN Name template contains up to 16 VLAN Name to VLAN ID mappings. VLAN Name to ID mappings are pushed to the FlexConnect APs that are part of the FlexConnect Group, as long as the corresponding VLAN ID is present on the FlexConnect Group, via a WLAN-VLAN or VLAN-ACL Mapping. Multiple VLAN Names mapped to a single VLAN ID is possible, and the VLAN Name can have a maximum of 32 ASCII characters.

In the example considered in this section, VLAN Name to VLAN ID mapping template ‘Remote Site A’ is created and applied to FlexConnect Group A. Similarly, VLAN Name to VLAN ID mapping template ‘Remote Site B’ is created and applied to FlexConnect Group B. The mapping is pushed to the individual APs that are part of the FlexConnect Group.

Solution – AAA Override of VLAN Name

The RADIUS Server is configured with the Airespace Attributes Aire-Interface-Name or IETF Attribute Tunnel-Private-Group-ID to return a VLAN Name, instead of a VLAN ID.

For example, when VLAN Name “marketing” is returned to an AP in Remote Site A, a VLAN Name to VLAN ID mapping lookup is done and the client is assigned to the corresponding VLAN ID. In Remote Site A, the client is assigned VLAN ID 20, and in Remote Site B, the client is assigned VLAN ID 21 as shown in the following figure.

The benefit of using this approach is that the RADIUS Server only needs to be aware of the user function and logical categorization of that user, and can be kept independent of the specifics of VLAN design within the branch itself.

■This feature supports both Central and Local Authentication with local switching WLANs.

■If the AAA server returns multiple VLAN attributes, preference is given to the VLAN Name attribute.

■In the event that Aire-Interface-Name and Tunnel-Private-Group-ID are both returned, the Tunnel-Private-Group-ID attribute is given preference.

■If AAA server returns an unknown VLAN name attribute, the client is defaulted to the WLAN-VLAN ID mapping present on the AP.

■This feature is also supported in the standalone mode.

Feature Configuration

This section provides step-by-step information on how to configure the features described in the following section.

Configuring Features

To configure the features, perform these steps:

1. From the controller GUI, choose WLANs > New to create a new WLAN. The New WLANs window is displayed. Enter the WLAN ID and WLAN SSID information. You can enter any name to be the WLAN SSID. Click Apply to go to the Edit window of the WLAN.

2. Configure the WLAN for WPA2 Layer 2 Security and AAA Server information. It is the job of the RADIUS server to assign a wireless client to a specific VLAN Name upon successful authentication.

3. Configure the WLAN for FlexConnect Local Switching in the Advanced tab.

4. Check the Allow AAA Override check box to override the WLC and FlexConnect Group configurations by the RADIUS server.

5. Click Apply.

6. Connect two access points to the WLC and convert them to FlexConnect mode.

7. Create two FlexConnect Groups under Wireless > FlexConnect Groups > New.

8. Click Apply.

In this example, FlexGroupA and FlexGroupB have been created for the Remote Sites A and B as explained in the use case study.

9. Click the FlexConnect Group name to edit. Assign one AP each to the FlexConnect Groups under FlexConnect Groups > Edit FlexConnect Group Name > General.

10. Click Apply.

11. Assign VLANs specific to each site on the FlexConnect Groups under FlexConnect Groups > Edit FlexConnect Group Name > ACL Mapping > AAA VLAN-ACL mapping.

In this example VLAN 37, 38 are assigned to Remote Site A and VLAN 37, 39 are assigned to Remote Site B.

12. Click Apply.

VLAN Name Mapping

Creating VLAN Name Template

13. Create a VLAN Name template under Wireless > FlexConnect Groups > FlexConnect VLAN Templates > New.

14. Click Apply.

In this example, the template is called Remote Site A. Observe that the status of the template is Modified.

15. Click the template to edit it and then click the New Mapping button to add the VLAN Name to VLAN ID mappings.

16. Add the VLAN Name to VLAN ID Mapping and click Apply. In this example, VLAN Name marketing is mapped to VLAN ID 38.

17. On the VLAN Template > Edit page, click Apply All.

The status of the template changes to Applied.

Note: In order for the mapping to be pushed to the FlexConnect APs, the state of the template should be Applied. If the state is Modified, changes can be made to the template but they will not be pushed to the FlexConnect APs.

18. Similarly, create a VLAN Template for Remote Site B with VLAN Name marketing mapped to VLAN ID 39.

19. Make sure that both the templates are created and the status is Applied.

Copying VLAN Name Template (Optional)

You can copy the VLAN Name templates to create a duplicate template. To copy the template, perform these steps:

20. Click the Copy button under Wireless > FlexConnect Groups > FlexConnect VLAN Templates.

21. In the VLAN Template Name field, enter the destination template name. From the Existing VLAN Template drop-down menu, select the source template name.

22. Click Copy.

In this example, Remote Site B template is copied to Remote Site C since the sites B and C have the same VLAN Name to VLAN ID mapping requirements.

Assigning VLAN Name Template

The VLAN Templates created must be applied to the respective FlexConnect Groups. To do this, perform these steps:

23. Under FlexConnect Groups > Edit FlexConnect Group Name > General, assign VLAN Template Name from the drop-down menu.

In this example, Template Remote Site A is assigned to FlexGroupA and Template Remote Site B is assigned to FlexGroupB.

24. Click Apply.

Verifying VLAN Name Mappings on FlexConnect AP

To verify that the VLAN Mappings are pushed to the FlexConnect APs, perform these steps:

25. Check the VLAN Template Name under Wireless > All APs > Details > FlexConnect.

26. Click the VLAN Name Id Mappings link to verify the individual mappings.

27. Similarly, verify the mappings for the other FlexConnect AP in FlexGroupB.

Thus, VLAN Name marketing is mapped to VLAN ID 38 in Remote Site A and to VLAN ID 39 in Remote Site B.

RADIUS Server Configuration

The following screenshot is from Cisco ACS 5.3. Cisco ACS or Cisco ISE can be used as the AAA RADIUS Server. Configure the user details under Policy Elements > Authorization and Permissions > Network Access > Authorization Profiles and add Tunnel-Private-Group-ID or Aire-Interface-Name attribute to reflect VLAN Name marketing.

Verifying AAA Override

To verify AAA override, perform these steps:

28. Connect a client to AP in Remote Site A and upon successful authentication, verify that it has an IP address in the VLAN mapped to VLAN Name marketing in that site. In this example marketing is mapped to VLAN 38 in Remote Site A.

29. The VLAN Name for the client can also be verified on the client details page under Monitor > Clients > Detail by clicking the MAC address of the client.

30. Associate the client to the other FlexConnect AP and the same WLAN and upon successful authentication, verify that it has an IP address in the VLAN mapped to VLAN name marketing in that site. In this example, marketing is mapped to VLAN 39 in Remote Site B.

31. Make sure that the Flex VLAN Name field in the client details page reflects the correct Flex VLAN name and VLAN ID.

Client ACL Overview

a. This feature allows application of Per-Client ACL for locally switching WLANs.

b. Client ACL is returned from the AAA server on successful Client L2 Authentication/Web Auth as part of Airespace Radius Attributes.

c. The controller will be used to pre-create the ACLs at the AP. When the AP receives the ACL configuration, it will create the corresponding IOS ACL. Once, AAA server provides the ACL, the client structure will be updated with this information.

d. There will be configuration per FlexConnect Group as well as per AP. A maximum of 16 ACLs can be created for a FlexConnect Group and a maximum of 16 ACLs can be configured per-AP.

e. In order to support fast roaming (CCKM/PMK) for the AAA overridden clients, the controller will maintain these ACL in the cache and push them to all APs which are part of the FlexConnect Group.

f. In the case of central authentication, when the controller receives the ACL from the AAA server, it will send the ACL name to the AP for the client. For locally authenticated clients, the ACL will be sent from the AP to the controller as part of CCKM/PMK cache, which will then be distributed to all APs belonging to the FlexConnect-group.

g. Maximum of 16 Client ACLs per FlexConnect Group, maximum of 16 Client ACLs per-AP

h. Total of 96 ACLs can be configured on the AP (32 VLAN-ACL, 16 WLAN-ACL, 16 Split tunnel, 16 FlexConnect Client ACL, 16 AP Client ACL), each ACL with 64 rules.

i. The ACL will be applied on the dot11 side for the client in question. This ACL will be applied in addition to the VLAN ACL, which is applied on the VLAN of the Ethernet interface of the AP.

j. Client ACL applied in addition to VLAN-ACL, both can exist simultaneously and are applied serially.

Configuring Client ACL

1. Create a Local Switching WLAN, which is either centrally switched or locally switched.

Figure 51 Create Local Switching WLAN

2. Turn on AAA override for the WLAN by checking the Allow AAA Override check box.

3. Create a FlexConnect ACL.

FlexConnect ACL can be configured from the Security page as well as from the Wireless page.

Figure 52 Configure FlexConnect ACL

Figure 53 Configure FlexConnect ACL

4. Assign the FlexConnect ACL to the FlexConnect Group or to the AP.

Figure 54 ACL Mapping on FlexConnect Group

Figure 55 ACL Mapping on AP

5. Configure the Airespace attribute on the Radius/Cisco ACS server/ISE.

Figure 56 Aire-Acl-Name on Cisco ACS Server

Figure 57 Airespace ACL Name on ISE

6. Authenticate the client.

CLI Configuration

The Client ACL can be seen on the AP using the commands show access-list and show controllers dot11Radio

Figure 58 show access-lists Output

Figure 59 Client ACL on AP

http://www.cisco.com/c/en/us/support/wireless/flex-7500-series-wireless-controllers/tsd-products-support-series-home.html

Guidelines

■Prior to AAA sending the client ACL, the ACL should be pre-created on the group or AP. The ACL will not be dynamically downloaded to the AP at the time of client join.

■A maximum of 96 ACLs can be configured on the AP.

■Each ACL will have a maximum of 64 rules.

■If client is already authenticated, and ACL name is changed on the radius, then client will have to do a full authentication again to get the correct client ACL.

■Since ACL not saved in cache at the controller, if the AP reboots/crashes, its cache will not be updated and the client will have to do full authentication for correct client ACL to be applied.

■If an ACL is returned from the AAA server but the corresponding ACL is not present on the AP, the client will be de-authenticated. A log message will be generated at the AP and WLC console.

On AP:

*Mar 4 09:20:43.255: %LWAPP-3-CLIENT_ACL_ENTRY_NOT_EXIST: Deleting Mobile for 0040.96b8.d4be: CLIENT ACL not exist on AP

On WLC:

*spamApTask7: Mar 04 14:51:03.989: #HREAP-3-CLIENT_ACL_ENTRY_NOT_EXIST: spam_lrad.c:36670 The client 00:40:96:b8:d4:be could not join AP : 34:a8:4e:e7:5b:c0 for slot 1, Reason: acl returned from RADIUS/local policy not present at AP

The various scenarios are listed in the table below:

VideoStream for FlexConnect Local Switching

Introduction

Cisco Unified Wireless Network (CUWN) release 8.0 introduces a new feature—VideoStream for Local Switching, for branch office deployments. This feature enables the wireless architecture to deploy multicast video streaming across the branches, just like it is currently possible for enterprise deployments. This feature recompenses the drawbacks that degrade the video delivery as the video streams and clients scale in a branch network. VideoStream makes video multicast to wireless clients more reliable and facilitates better usage of wireless bandwidth in the branch.

Components Used

VideoStream feature for Local Switching is available in CUWN software version 8.0. This feature is supported on all wireless LAN controllers (WLANs) and newer generation indoor access points (APs). This feature is unavailable on autonomous access points.

Supported Wireless Hardware and Software

VideoStream is supported on all the following Cisco Wireless LAN controllers:

■Cisco 5500 Controller

■Cisco 7510 Controller

■Cisco 8510 Controller

■Cisco WiSM-2 Controller

■Cisco 2504 Controller

■vWLC

IGMPv2 is the supported version on all of the controllers.

VideoStream is supported on 802.11n models of APs consisting of Cisco Aironet 1140, 1250, 1260, 1520, 1530, 1550, 1600, 2600, 3500, 3600 series APs and 802.11ac models 3700 and 2700 series APs.

Theory of Operation

Before going into details about the VideoStream feature, you should understand some of the shortfalls in Wi-Fi multicast. 802.11n is a prominently discussed wireless technology for indoor wireless deployments. Equally prominent requirement is seen in multimedia service on an enterprise and branch network, in particular, video. Multicast does not provide any MAC layer recovery on multicast and broadcast frames. Multicast and broadcast packets do not have an Acknowledgement (ACK), and all packet delivery is best effort. Multicast over wireless with 802.11a/b/g/n does not provide any mechanism for reliable transmission.

Wireless deployments are prone to interference, high channel utilization, and low SNR at the edge of the cell. There are also many clients sharing the same channel but have different channel conditions, power limitations, and client processing capabilities. Therefore, multicast is not a reliable transmission protocol to all the clients in the same channel because each client has different channel conditions.

Wireless multicast does not prioritize the video traffic even though it is marked as Differentiated Service Code Point (DSCP) by the video server. The application will see a loss of packets with no ACK, and retries to the delivery will be bad. In order to provide reliable transmissions of multicast packet, it is necessary that the network classify queues and provisions using Quality of Service (QoS). This virtually removes the issue of unreliability by eliminating dropped packets and delay of the packets to the host by marking the packets and sorting them to the appropriate queue.

Even though the 802.11n, and now 802.11ac, adaptation has gained momentum both with the network and clients, wireless multicast has not been able to use the 802.11n and 802.11ac data rates. This has also been one of the factors for an alternate mechanism for wireless multicast propagation.

VideoStream

VideoStream provides efficient bandwidth utilization by removing the need to broadcast multicast packets to all WLANs on the AP regardless if there is a client joined to a multicast group. In order to get around this limitation, the AP has to send multicast traffic to the host using Unicast forwarding, only on the WLAN that the client is joined and at the data rate the client is joined at.

VideoStream can be enabled globally on the controller. The feature can also be enabled at the WLAN level, and provides more control to the administrator to identify specific video streams for Multicast Direct functionality.

Stream Admission

As mentioned earlier, while video is an efficient, high-impact means of communication, it is also very bandwidth intensive, and as is seen, not all video content is prioritized the same. From earlier discussion it is clear that organizations investing in video cannot afford to have network bandwidth consumed without any prioritization of business-critical media.

Multicast to Unicast

By enabling 802.11n data rates and providing packet error correction, multicast-to-unicast capabilities of Cisco VideoStream enhances reliability of delivering streaming video over Wi-Fi beyond best-effort features of traditional wireless networks.

A wireless client application subscribes to an IP multicast stream by sending an IGMP join message. With reliable multicast, this request is snooped by the infrastructure, which collects data from the IGMP messages. The AP checks the stream subscription and configuration. A response is sent to the wireless client attached to the AP in order to initiate reliable multicast once the stream arrives. When the multicast packet arrives, the AP replicates the multicast frame and converts it to 802.11 unicast frames. Finally, a reliable multicast service delivers the video stream as unicast directly to the client.

Higher Video Scaling on Clients

With Cisco VideoStream technology, all of the replication is done at the edge (on the AP), thus utilizing the overall network efficiently. At any point in time, there is only the configured media stream traversing the network, because the video stream is converted to unicast at the APs based on the IGMP requests initiated by the clients. Some other vendor implementations do a similar conversion of multicast to unicast, but do it inefficiently as evidenced by the load put on the wired network to support the stream.

Switch Configuration

VideoStream can be deployed on an existing branch wide wired and wireless network. The overall implementation and maintenance costs of a video over wireless network are greatly reduced. The assumption is that the wired network is multicast enabled. In order to verify that the access switch is part of the layer 3 network, connect a client machine to the switchport and verify if the client machine is able to join a multicast feed.

Show run | include multicast displays if multicast is enabled on the layer 3 switch else if not enabled for multicast, you can enable multicast by executing the following command on the switch:

L3_Switch# show run | include multicast

ip multicast-routing distributed

Depending on the type of Protocol Independent Routing (PIM) configuration on the wired network, the layer 3 switch is configured either in PIM Sparse mode or in PIM dense mode. There is also a hybrid mode, PIM sparse-dense mode which is widely used.

interface Vlan56

ip address 9.5.56.1 255.255.255.0

ip helper-address 9.1.0.100

ip pim sparse-dense-mode

end

show ip igmp interfaces display the SVI interfaces that are participating in the IGMP membership. This command displays the version of IGMP configured on the switch or the router. The IGMP activity on the interface can also be verified in the form of IGMP join and leave messages by the clients.

L3_Switch#show ip igmp interface

Vlan56 is up, line protocol is up

Internet address is 9.5.56.1/24

IGMP is enabled on interface

Current IGMP host version is 2

Current IGMP router version is 2

IGMP query interval is 60 seconds

IGMP configured query interval is 60 seconds

IGMP querier timeout is 120 seconds

IGMP configured querier timeout is 120 seconds

IGMP max query response time is 10 seconds

Last member query count is 2

Last member query response interval is 1000 ms

Inbound IGMP access group is not set

IGMP activity: 6 joins, 3 leaves

Multicast routing is enabled on interface

Multicast TTL threshold is 0

Multicast designated router (DR) is 9.5.56.1 (this system)

IGMP querying router is 9.5.56.1 (this system)

Multicast groups joined by this system (number of users):

224.0.1.40(1)

The above configuration can be verified by running the show ip mroute command on the layer 3 switch. The above configuration has certain entries that need to be looked into. The special notation of (Source, Group), pronounced “S, G” where the source “S” is the source IP address of the multicast server and “G” is the Multicast Group Address that a client has requested to join. If the network has many sources, you will see on the routers an (S,G) for each of the source IP address and Multicast Group addresses. This output displayed below also has information of outgoing and incoming interfaces.

L3_Switch# show ip mroute

IP Multicast Routing Table

Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,

L - Local, P - Pruned, R - RP-bit set, F - Register flag,

T - SPT-bit set, J - Join SPT, M - MSDP created entry, E - Extranet,

X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,

U - URD, I - Received Source Specific Host Report,

Z - Multicast Tunnel, z - MDT-data group sender,

Y - Joined MDT-data group, y - Sending to MDT-data group,

V - RD & Vector, v - Vector

Outgoing interface flags: H - Hardware switched, A - Assert winner

Timers: Uptime/Expires

Interface state: Interface, Next-Hop or VCD, State/Mode

(*, 239.255.255.250), 4d20h/00:02:35, RP 0.0.0.0, flags: DC

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list:

Vlan56, Forward/Sparse-Dense, 4d20h/stopped

(*, 229.77.77.28), 4d15h/00:02:36, RP 0.0.0.0, flags: DC

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list:

Vlan56, Forward/Sparse-Dense, 00:24:34/stopped

(*, 224.0.1.40), 5d17h/00:02:41, RP 0.0.0.0, flags: DCL

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list:

Vlan56, Forward/Sparse-Dense, 5d17h/stopped

Controller Configuration

Enabling VideoStream—Global

Enable Global Multicast Mode and IGMP snooping on the controller as shown below:

Figure 60 WLC Configuration

(Cisco Controller) >config network multicast global enable

(Cisco Controller) >config network multicast igmp snooping enable

To enable the VideoStream feature globally on the controller, navigate to Wireless > Media Stream > General and check the Multicast Direct Feature check box. Enabling the feature here populates some of the configuration parameters on the controller for VideoStream.

Figure 61 Enable VideoStream - Global

(Cisco Controller) > config media-stream multicast-direct ?

enable Enable Global Multicast to Unicast Conversion

disable Disable Global Multicast to Unicast Conversion

The multicast direct button under WLAN > QoS appears on if the feature is enabled globally.

This provides the flexibility to enable VideoStream feature per SSID and is described later in this document.

Turn on Local Switching under WLAN > Advanced and ensure that the APs in the setup are in FlexConnect mode.

Figure 62 Enable Local Switching on WLAN

Figure 63 Change AP Mode to FlexConnect

Add Media Stream Configuration

To add a multicast stream to the controller, navigate to Wireless > Media Stream > Streams and click Add New.

Figure 64 Media Stream Configuration

For configuration using CLI use:

configure media-stream add multicast-direct <media-stream-name> <start-IP> <end-IP> [template | detail <bandwidth> <packet-size> <Re-evaluation> video <priority> <drop|fallback>]

As mentioned it is necessary that the administrator is aware of the video characteristic streaming through a controller. A true balance must be drawn when the streams configuration are added. For example, if the stream bit rate varies between 1200 Kbps and 1500 Kbps the stream must be configured for a bandwidth of 1500 Kbps. If the stream is configured for 3000 Kbps then you will have lesser video client serviced by the AP. Similarly, configuring for 1000 Kbps will cause pixelization, bad audio, and bad user experience.

The multicast destination start IP address and end IP address can be the same address as shown in Figure 64. You can also configure a range of multicast address on the controller. There is a limitation of 100 on the number of multicast addresses entries or the number of stream entries that will be pushed to the APs.

Enabling VideoStream – WLAN

One or all WLANs/SSIDs configured can be enabled for streaming video with VideoStream. This is another configuration step that can control the enabling of the VideoStream feature. Enabling or disabling the VideoStream feature is non-disruptive. Click WLAN > <WLAN ID> > QoS.

Figure 65 Enable VideoStream – WLAN

Configure the Quality of Service (QoS) to Gold (video) to stream video to wireless client at a QoS value of gold (4). This will only enable video quality of service to wireless clients joined to a configured stream on the controller. The rest of the clients will be enabled for appropriate QoS. To enable Multicast Direct on the WLAN, check the Multicast Direct check box as shown in Figure 65. This will enable the WLAN to service wireless clients with the VideoStream feature.

(Cisco Controller) > config wlan media-stream multicast-direct 1 ?

enable Enables Multicast-direct on the WLAN

disable Disables Multicast-direct on the WLAN.

All wireless clients requesting to join a stream will be assigned video QoS priority on admission. Wireless client streaming video prior to enabling the feature on the WLAN will be streaming using normal multicast. Enabling the feature switch the clients to multicast-direct automatically on the next IGMP snooping interval. Legacy multicast can be enabled on the WLAN by not checking the Multicast Direct feature. This will show that wireless clients streaming video are in Normal Multicast mode.

Verifying VideoStream Functionality

Make sure the wireless clients are associated to the access point(s), and are configured for a correct interface. As seen in the Figure 66, there are three clients associated to one AP. All three clients have an IP address from VLAN 56 (SSID name—enjoy).The associated clients have an IP address and good uplink connectivity to the AP.

Figure 66 Client Summary

Enable streaming on the wired side by connecting a video server with a configured multicast address 229.77.77.28. Refer the following link to know how to stream from a Video Sever: https://wiki.videolan.org/Documentation:Streaming_HowTo_New/#Streaming_using_the_GUI

Complete the steps:

1. Join wireless clients to the multicast streaming video.

Note: Use VLC player to stream and watch video.

2. Double click on the VLC icon on your desktop. Click Media > Open Network stream. Choose
Protocol = UDP, Address = 229.77.77.28, Port = 1234 in the format udp://@229.77.77.28:1234.

3. Click Play.

L3_Switch# show ip mroute

IP Multicast Routing Table

Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,

L - Local, P - Pruned, R - RP-bit set, F - Register flag,

T - SPT-bit set, J - Join SPT, M - MSDP created entry, E - Extranet,

X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,

U - URD, I - Received Source Specific Host Report,

Z - Multicast Tunnel, z - MDT-data group sender,

Y - Joined MDT-data group, y - Sending to MDT-data group,

V - RD & Vector, v - Vector

Outgoing interface flags: H - Hardware switched, A - Assert winner

Timers: Uptime/Expires

Interface state: Interface, Next-Hop or VCD, State/Mode

(*, 239.255.255.250), 4d20h/00:02:47, RP 0.0.0.0, flags: DC

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list:

Vlan56, Forward/Sparse-Dense, 4d19h/stopped

(*, 229.77.77.28), 4d15h/00:02:44, RP 0.0.0.0, flags: DC

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list:

Vlan56, Forward/Sparse-Dense, 00:17:24/stopped

(*, 224.0.1.40), 5d17h/00:02:53, RP 0.0.0.0, flags: DCL

Incoming interface: Null, RPF nbr 0.0.0.0

Outgoing interface list:

Vlan56, Forward/Sparse-Dense, 5d17h/stopped

It is observed that the MAC address of the wireless clients is in a Multicast-Direct Allowed State.

Figure 67 FlexConnect VideoStream Clients

The Wireshark capture on the client shows the Multicast to Unicast Video Stream. The Ethernet header contains the MAC address of the client as the Destination MAC address, for example, 7c:d1:c3:86:7e:dc.

Figure 68 Wireshark Capture Depicting mc2uc

Limitations

The limitations to this feature scope include:

1. There is no admission control for local switched clients’ multicast video requests, which means always admit the configured video stream subscriptions as mc2uc.

2. Due to the limit of CAPWAP payload length, only the first 100 media-streams will be pushed from the controller to the AP in this release. For example,
config media-stream add multicast-direct stream1 225.0.0.1 225.0.0.10 template coarse, is considered as one entry.

3. Roaming support is limited to adding mobile payload. Whenever the client roams to another AP, the WLC will add the entry for the client in the mc2uc table. This means that roaming in standalone mode of FlexConnect AP will not be supported for this feature.

4. Currently this feature only has IPv4 support.

Show Commands – Controller

Some of the show commands are documented earlier in this document. The following section is only for your reference:

(Cisco Controller) >show ap summary

Number of APs.................................... 5

Global AP User Name.............................. Not Configured

Global AP Dot1x User Name........................ Not Configured

AP Name Slots AP Model Ethernet MAC Location Country IP Address Clients DSE Location

------------------ ----- -------------------- ----------------- ---------------- ---------- ----------- -------- --------------

AP1142 2 AIR-LAP1142N-A-K9 f0:f7:55:f1:75:20 default location IN 9.5.56.109 0 [0,0,0 ]

AP_2600 2 AIR-CAP2602E-N-K9 fc:99:47:d9:86:90 default location IN 9.5.56.110 0 [0,0,0 ]

AP3700 2 AIR-CAP3702E-N-K9 7c:ad:74:ff:6b:46 default location IN 9.5.56.116 0 [0,0,0 ]

AP_3600-2 2 AIR-CAP3602I-N-K9 a4:4c:11:f0:e9:dc default location IN 9.5.56.111 0 [0,0,0 ]

AP_1600 2 AIR-CAP1602I-N-K9 6c:20:56:13:f6:23 default location IN 9.5.56.105 2 [0,0,0 ]

(Cisco Controller) >show client summary

Number of Clients................................ 2

Number of PMIPV6 Clients......................... 0

GLAN/

RLAN/

MAC Address AP Name Slot Status WLAN Auth Protocol Port Wired PMIPV6 Role

----------------- ----------------- ---- ------------- ----- ---- ---------------- ---- ----- ------- ----------------

88:cb:87:bd:0c:ab AP_1600 1 Associated 1 Yes 802.11a 1 No No Local

d8:96:95:02:7e:b4 AP_1600 1 Associated 1 Yes 802.11a 1 No No Local

(Cisco Controller) >show media-stream multicast-direct state

Multicast-direct State........................... enable

Allowed WLANs.................................... 1

(Cisco Controller) >show media-stream group summary

Stream Name Start IP End IP Operation Status

------------- --------------------------------------- --------------------------------------- ----------------

Media1 239.1.1.1 239.2.2.2 Multicast-direct

Media2 229.77.77.28 229.77.77.28 Multicast-direct

(Cisco Controller) >show media-stream group detail Media2

Media Stream Name................................ Media2

Start IP Address................................. 229.77.77.28

End IP Address................................... 229.77.77.28

RRC Parmmeters

Avg Packet Size(Bytes).......................... 1200

Expected Bandwidth(Kbps)........................ 500

Policy.......................................... Admit

RRC re-evaluation............................... periodic

QoS............................................. Video

Status.......................................... Multicast-direct

Usage Priority.................................. 1

Violation....................................... fallback

(Cisco Controller) >show flexconnect media-stream client summary

Client Mac Stream Name Multicast IP AP-Name VLAN Type

----------------- -------------------- --------------- ------------------------- ----- ----------------

7c:d1:c3:86:7e:dc Media2 229.77.77.28 AP_1600 0 Multicast Direct

88:cb:87:bd:0c:ab Media2 229.77.77.28 AP_1600 0 Multicast Direct

d8:96:95:02:7e:b4 Media2 229.77.77.28 AP_1600 0 Multicast Direct

(Cisco Controller) >show flexconnect media-stream client Media2

Media Stream Name................................ Media2

IP Multicast Destination Address (start)......... 229.77.77.28

IP Multicast Destination Address (end)........... 229.77.77.28

Client Mac Multicast IP AP-Name VLAN Type

----------------- --------------- ------------------------- ----- ----------------

7c:d1:c3:86:7e:dc 229.77.77.28 AP_1600 0 Multicast Direct

88:cb:87:bd:0c:ab 229.77.77.28 AP_1600 0 Multicast Direct

d8:96:95:02:7e:b4 229.77.77.28 AP_1600 0 Multicast Direct

Show and Debug Commands – AP

■ Debug ip igmp snooping group

■ Debug capw mcast

■ Show capwap mcast flexconnect clients

■ Show capwap mcast flexconnect groups

AP_1600#show capwap mcast flexconnect clients

======

Bridge Group: 1

=======

Multcast Group Address 229.77.77.28::

MCUC List:

Number of MCUC Client: 3

88cb.87bd.0cab(Bridge Group = 1 Vlan = 0)

7cd1.c386.7edc(Bridge Group = 1 Vlan = 0)

d896.9502.7eb4(Bridge Group = 1 Vlan = 0)

--------

MC Only List:

Number of MC Only Client: 0

--------

AP_1600#show capwap mcast flexconnect groups

WLAN mc2uc configuration:

WLAN ID 1, Enabled State 1

WLAN ID 2, Enabled State 0

WLAN ID 3, Enabled State 0

WLAN ID 4, Enabled State 0

WLAN ID 5, Enabled State 0

WLAN ID 6, Enabled State 0

WLAN ID 7, Enabled State 0

WLAN ID 8, Enabled State 0

WLAN ID 9, Enabled State 0

WLAN ID 10, Enabled State 0

WLAN ID 11, Enabled State 0

WLAN ID 12, Enabled State 0

WLAN ID 13, Enabled State 0

WLAN ID 14, Enabled State 0

WLAN ID 15, Enabled State 0

WLAN ID 16, Enabled State 0

Video Group Configuration:

Group startIp 239.1.1.1 endIp 239.2.2.2

Group startIp 229.77.77.28 endIp 229.77.77.28

FlexConnect Faster Time to Deploy

The existing system requires an AP reboot when converted from Local mode to FlexConnect mode. Once the AP boots up, it joins back the controller and subsequently all the FlexConnect configuration is pushed down to the AP. This process increases the total time to deploy a FlexConnect solution in a branch. Time to deployment is a critical differentiator for any branch deployment.

This feature in release 8.0 eliminates the need to reboot when the AP is converted to FlexConnect mode. When the controller sends the AP a mode change message, the AP will get converted to FlexConnect mode without requiring a reload. The AP sub mode will also be configured if the AP receives the AP sub mode payload information from the controller. With this approach, the AP entry will be maintained at the controller and there will not be any AP disassociation.

Only Local mode to Flexconnect mode conversion is supported, any other mode change will cause an AP reboot. Similarly, changing of the AP sub mode to WIPS does not need reboot, but the rest of the sub mode configuration requires AP reboot.

Figure 69 Conversion to FlexConnect - No Reboot Required

How AVC Works

■NBAR2 engine runs on the FlexConnect AP.

■Classification of applications happens at the access point using the DPI engine (NBAR2) to identify applications using L7 signatures.

■AP collects application information and exports it to controller every 90 seconds.

■Real-time applications are monitored on the controller user interface.

■Ability to take actions, drop, mark or rate-limit, is possible on any classified application on the FlexConnect access point.

AVC Facts and Limitations

■AVC on the FlexConnect AP can classify and take action on 1000+ different applications.

■The protocol pack running on the FlexConnect APs is different from the one running on the WLC.

■AVC stats on the GUI are displayed for the top 10 applications by default. This can be changed to top 20 or 30 applications as well.

■Intra FlexConnect Group roaming support.

■IPv6 traffic cannot be classified.

■AAA override of AVC profiles is not supported.

■Multicast traffic is not supported by AVC application.

■Netflow export for FlexConnect AVC is not supported in 8.1.

Configuring Application Visibility

To configure the application visibility, perform these steps:

1. Open a web browser on the wired laptop, and then enter your WLC IP Address.

2. Create an OPEN WLAN with naming convention, for example, “FlexDemo”.

3. Enable FlexConnect Local Switching on the WLAN and then click Apply.

4. Make sure that the APs connected to this WLAN are among the list of supported access points for this feature.

5. Convert the AP to FlexConnect mode by selecting FlexConnect in the AP Mode drop-down menu, and then click Apply. The mode changes to FlexConnect without a reboot.

6. Create a FlexConnect Group and add the AP to the FlexConnect Group. In the following example, “FlexGroup” is the FlexConnect Group and the access point AP3600 is added to it.

7. Applications that can be identified, classified, and controlled are listed under Wireless > Application Visibility and Control > FlexConnect AVC Applications. The access points support Protocol Pack version 8.0 and NBAR engine version 16.

8. Create an AVC profile under Wireless > Application Visibility and Control > FlexConnect AVC Profiles > New with name “Drop_youtube”.

9. Click Apply.

The AVC profile is created with the new name “Drop_youtube”.

10. Click the Profile name and then click Add New Rule. Select the Application Group, Application Name, and Action, and then click Apply.

11. Verify that the rule is added as shown in the following figure.

The status of the FlexConnect AVC profile at this point is Modified.

12. Select the profile and click Apply for the profile to be applied and to take effect.

The status of the FlexConnect AVC profile is changed to Applied.

13. Enable Application Visibility on the FlexConnect group under Wireless > FlexConnect Group > FlexConnect Group name > WLAN AVC Mapping by selecting the WLAN ID and choosing Enable from the drop-down menu.

14. Apply the FlexConnect AVC profile by selecting the profile created in the previous set from the Flex AVC Profile drop-down menu. Click Add and then click Apply.

15. Once AVC is enabled on the FlexConnect Group, from the associated wireless client, start different types of traffic using the applications (already installed) such as Cisco Jabber/WebEx Connect, Skype, Yahoo Messenger, HTTP, HTTPS/SSL, Microsoft Messenger, Ping, Trace route, and so on.

Once traffic is initiated from the wireless client, visibility of different traffic can be observed on a per FlexConnect Group and per client basis. This provides the administrator a good overview of the network bandwidth utilization and type of traffic in the network per client and per branch site

16. To check the visibility globally for all WLANs on a FlexConnect Group, click Monitor > Applications > FlexConnect > FlexConnect Groups and then select the FlexConnect group created earlier.

The following screen is visible which lists aggregate data for the top 10 applications running on that particular FlexConnect group.

This page provides more granular visibility per FlexConnect Group and lists the top 10 applications in the last 90 seconds, as well as cumulative stats for the top 10 applications. You can view upstream and downstream statistics individually per FlexConnect Group from the same page by clicking the Upstream and Downstream tabs.

Note: The number of applications that are displayed on this page can be increased to 20 or 30 by modifying the Max Number of Records field on this page. The default value is 10.

17. To have more granular visibility of the top 10 applications per client on a particular locally switched WLAN where AVC visibility is enabled, click Monitor > Applications > FlexConnect Group > FlexConnect Group name > Clients. Then, click any individual client MAC entry listed on that page.

After clicking on an individual client MAC entry, the client details page appears.

This page provides further granular stats per client associated on locally switched WLANs, where AVC visibility is enabled on the WLAN itself or on the FlexConnect Group as in this example. The page lists the top 10 applications in last the 90 seconds as well as cumulative stats for top 10 applications.

18. You can view upstream and downstream stats individually per client from the same page by clicking the Upstream and Downstream tabs.

Note: The number of applications that are displayed on this page can be increased to 20 or 30 by modifying the Max Number of Records Field on this page. The default value is 10.

19. You can clear the AVC stats for the particular client by clicking the Clear AVC Stats button.

Now, if you open YouTube, from wireless clients, you will observe that client cannot play any YouTube videos. Also, if applicable, open your Facebook account and try to open any YouTube video. You will observe YouTube videos cannot be played. Because YouTube is blocked in the FlexConnect AVC profile, and AVC profile is mapped to WLAN on the FlexConnect Group. You cannot access YouTube videos via browser, or even via YouTube application or from any other website.

Note: If your browser was already open with YouTube, refresh the browser for the AVC profile to take effect.

Feature Introduction

Prior to release 8.1, VLAN support and Native VLAN ID configuration is available on a per FlexConnect AP basis.

To consolidate the configurations for all the FlexConnect APs at each branch, ease the process of configuration and management, as well as to bring about consistency of configuration within a given branch, this configuration is provided at the FlexConnect Group starting release 8.1.

This feature is supported on all WLCs and APs supporting FlexConnect mode in release 8.1.

VLAN Support/ Native VLAN on FlexConnect Group

■This feature provides the ability to configure VLAN Support and Native VLAN ID on a FlexConnect group.

■Additionally, an override option is also provided at the group.

■The override option overrides the VLAN Support and Native VLAN ID parameters previously configured on the access points, changes the inheritance level at the AP to “Group-specific”, removes AP specific WLAN-VLAN mappings, and pushes the group-specific configuration including WLAN-VLAN mapping configured on the group to all the APs in that group.

■When the override flag is set at the FlexConnect group, modification of VLAN Support, Native VLAN ID, WLAN-VLAN Mappings, and Inheritance-Level at the AP is not allowed.

■In addition to the above-mentioned configurations, an additional Inheritance-Level configuration is provided at the FlexConnect AP. This needs to be set to “Make VLAN AP specific” to configure any AP-Specific VLAN Support, Native VLAN ID, and VLAN-WLAN mappings on the AP. Note that the user can modify this knob only when the override flag at the group is disabled.

In the following example, two FlexConnect groups have been configured. FlexConnect group 1 has the override flag enabled. As a result, all the APs in this group inherit the VLAN configuration from the group including the VLAN Support, Native VLAN, and WLAN-VLAN mappings. FlexConnect group 2 has the override flag disabled. Thus, the APs in this group will follow the inheritance based on the AP and group specific configuration and inheritance order. An AP that has inheritance set to AP-Specific will have the AP-specific parameters in action. An AP that has inheritance set to Group-specific will inherit the configuration from the group.

AP Fallback Behavior

With Override Flag Enabled on Secondary Controller

When the override flag is enabled on the secondary controller, the APs inherit the configuration from the secondary controller irrespective of the configuration on the primary controller and the APs.

With Override Flag Disabled on Secondary Controller

With the override flag disabled on the secondary controller, the APs that were configured with AP-specific parameters retain their AP specific configuration unless specifically changed on the secondary controller on a per AP basis. The APs, which inherit their configuration from the FlexConnect group on the primary, will inherit their configuration from the FlexConnect group on the secondary controller based on the configuration of the secondary FlexConnect group. Note that the FlexConnect group override flag configuration is not stored on the AP.

Upgrade and Downgrade Considerations

When upgrading to release 8.1, the existing FlexConnect group configuration follows the following rules:

■Native VLAN ID on the FlexConnect group is set to 1

■VLAN support on the FlexConnect group is disabled

■Override flag on the FlexConnect group is disabled

When downgrading from release 8.1:

■VLAN Support and Native VLAN ID is on a per AP basis

■WLAN-VLAN mappings follow the previous inheritance model

Configuring VLAN Support / Native VLAN Using Web UI

To configure VLAN Support/ Native VLAN from the GUI, perform these steps:

1. Go to Wireless > FlexConnect Groups > ‘FlexConnect Group Name’ > WLAN VLAN Mapping.

2. Check the VLAN Support check box, enter a Native VLAN ID in the box provided, and check the Enable Override Native VLAN on AP check box as shown in the following figure.

The knob for Override Native VLAN on AP does the following:

■Overrides the VLAN Support and Native VLAN ID parameters previously configured on the access points.

■Changes the Inheritance Level at the AP to “Group-specific”.

■Removes AP Specific WLAN-VLAN Mappings.

■Pushes the group-specific configuration including WLAN-VLAN Mapping configured on the group to all the APs in that group.

Note: When the override flag is set at the FlexConnect Group, modification of VLAN Support, Native VLAN ID, WLAN-VLAN Mappings, and Inheritance-Level at the AP is not allowed.

3. In addition to the above-mentioned configurations, an additional Inheritance-Level configuration is provided at the FlexConnect AP. Set this to Make VLAN AP specific to configure any AP-Specific VLAN Support, Native VLAN ID, and VLAN-WLAN mappings on the AP. Note that the user can modify this knob only when the override flag at the group is disabled.

Configuring VLAN Support / Native VLAN Using CLI

To configure FlexConnect Group-Specific VLAN Support, Native VLAN ID, and Override flag, the following CLIs can be used:

■Enable or disable VLAN Support at the FlexConnect Group

■Configure Native VLAN ID at the FlexConnect Group

■Configure Override flag at the FlexConnect Group

To configure the AP-specific configuration, the following CLIs can be used:

■Existing CLI to Configure VLAN Support at FlexConnect AP

■Existing CLI to Configure Native VLAN ID at FlexConnect AP

■New CLI to Remove Native VLAN ID configuration at FlexConnect AP

The following show commands can be used to view the VLAN Support, Native VLAN ID and Override flag configuration at the FlexConnect Group:

(Cisco Controller) > show flexconnect group detail NewFlexGroup

The following show commands can be used to view the Inheritance level, VLAN Support, and Native VLAN ID configuration at the FlexConnect AP:

(Cisco Controller) > show ap config general AP3600

Key Enhancements

■Ability to track a given client in a branch

■Central and local authentication support

■Provide AP and group level client troubleshooting

■Complete client life cycle support

■Maximum four clients per FlexConnect AP or FlexConnect group

■Support for debugging in roaming scenarios within FlexConnect group

Debug per AP

From the WLC CLI, run the following command to enable the debug per AP:

debug flexconnect client ap <AP-Name>add <MAC addr1>

Debug per FlexConnect Group (FCG)

From the WLC CLI, run the following command to enable the debug per FCG:

debug flexconnect client group <group-name> add/delete <addr1> { <addr2> | <addr3> | <addr4>}

Enabling Syslog on FlexConnect AP and FlexConnect Group

1. Open the tftp32 application installed on your PC.

2. Click Settings.

3. Check the Syslog Server check box to enable the application as a syslog server and then click OK.

4. Go to the WLC CLI and set the syslog server for the debugs by running the following commands:

Syslog Per FlexAP

Syslog Per FlexConnect Group

The show debug command on WLC CLI verifies that the syslog is configured.

The debug logs can be viewed on the syslog server file and on the AP console.