Which statement about link aggregation when implemented on a cisco wireless lan controller is true?

Home » Cisco » 200-301 » How will Link Aggregation be implemented on a Cisco Wireless LAN Controller?

How will Link Aggregation be implemented on a Cisco Wireless LAN Controller?
A. The EtherChannel must be configured in “mode active”.
B. When enabled, the WLC bandwidth drops to 500 Mbps.
C. To pass client traffic, two or more ports must be configured.
D. One functional physical port is needed to pass client traffic.

Correct Answer: D Explanation/Reference:

Reference: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-2/config-guide/b_cg82/b_cg82_chapter_010101011.html

FULL Printable PDF and Software. VALID exam to help you pass.

• You can bundle all eight ports on a Cisco 5508 Controller into a single link.

• Terminating on two different modules within a single Catalyst 6500 series switch provides redundancy and ensures that connectivity between the switch and the controller is maintained when one module fails. The controller’s port 1 is connected to Gigabit interface 3/1, and the controller’s port 2 is connected to Gigabit interface 2/1 on the Catalyst 6500 series switch. Both switch ports are assigned to the same channel group.

• The controller relies on the switch for the load balancing decisions on traffic that come from the network, with “source-destination IP” as the typically recommended option. It is important to select a correct balancing configuration on the switch side, as some variations might have an impact on controller performance or cause packet drops on some scenarios, where traffic from different ports is split across different data planes internally.

• When using Link aggregation (LAG) make sure all ports of the controller have the same Layer 2 configuration on the switch side. For example, avoid filtering some VLANs in one port, and not the others.

• LAG requires the EtherChannel to be configured for 'mode on' on both the controller and the Catalyst switch.

• Once the EtherChannel is configured as on at both ends of the link, the Catalyst switch should not be configured for either Link Aggregation Control Protocol (LACP) or Cisco proprietary Port Aggregation Protocol (PAgP) but be set unconditionally to LAG. Because no channel negotiation is done between the controller and the switch, the controller does not answer to negotiation frames and the LAG is not formed if a dynamic form of LAG is set on the switch. Additionally, LACP and PAgP are not supported on the controller.

• If the recommended load-balancing method cannot be configured on the Catalyst switch, then configure the LAG connection as a single member link or disable LAG on the controller.

  Figure 1. Link Aggregation with the Catalyst 6500 Series Neighbor Switch
  

• You cannot configure the controller’s ports into separate LAG groups. Only one LAG group is supported per controller.

• When you enable LAG or make any changes to the LAG configuration, you must immediately reboot the controller.

• When you enable LAG, you can configure only one AP-manager interface because only one logical port is needed.

• When you enable LAG, all dynamic AP-manager interfaces and untagged interfaces are deleted, and all WLANs are disabled and mapped to the management interface. Also, the management, static AP-manager, and VLAN-tagged dynamic interfaces are moved to the LAG port.

• Multiple untagged interfaces to the same port are not allowed.

• When you enable LAG, all ports participate in LAG by default. You must configure LAG for all of the connected ports in the neighbor switch.

• When you enable LAG, if any single link goes down, traffic migrates to the other links.

• When you enable LAG, only one functional physical port is needed for the controller to pass client traffic.

• When you enable LAG, access points remain connected to the controller until you reboot the controller, which is needed to activate the LAG mode change, and data service for users continues uninterrupted.

• When you enable LAG, you eliminate the need to configure primary and secondary ports for each interface.

• When you enable LAG, the controller sends packets out on the same port on which it received them. If a CAPWAP packet from an access point enters the controller on physical port 1, the controller removes the CAPWAP wrapper, processes the packet, and forwards it to the network on physical port 1. This may not be the case if you disable LAG.

• When you disable LAG, the management, static AP-manager, and dynamic interfaces are moved to port 1.

• When you disable LAG, you must configure primary and secondary ports for all interfaces.

• When you enable LAG on Cisco 2504 WLC to which the direct-connect access point is associated, the direct connect access point is disconnected since LAG enabling is still in the transition state. You must reboot the controller immediately after enabling LAG.

• In Cisco 8510 WLCs, when more than 1000 APs join the controller, flapping occurs. To avoid this, we recommend that you do not add more than 1000 APs on a single Cisco Catalyst switch for CAPWAP IPv6.

• If you have configured a port-channel on the switch and you have not configured the AP for LAG, the AP moves to standalone mode.

• We recommend that you configure LAG with HA-SSO in disabled state. Therefore, you must enable LAG before placing the controllers in HA-SSO pair or schedule a maintenance window to break the HA-SSO (requires controller reboot) and then enable LG and re enable HA-SSO thereafter (incurs multiple controller reboots in the process).

Page 2

1 - 7 - 8 - A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W

Index

1

1250 series access points

operating modes when using PoE 1

transmit power settings when using PoE 1

7

7920 Client CAC parameter 1

8

802.11a (or 802.11b) > Client Roaming page 1

802.11a (or 802.11b) > Voice Parameters page 1 2 3

802.11a (or 802.11b/g) > EDCA Parameters page 1

802.11a (or 802.11b/g) Global Parameters page 1 2

802.11a (or 802.11b/g) Network Status parameter 1 2

802.11a/n (or 802.11b/g/n) Radios page 1 2

802.11a/n Radios page (from Monitor Menu) 1 2

802.11g Support parameter 1

802.11h Global Parameters page 1

802.1X authentication for access points

802.1x Authentication parameter 1

configuring using the CLI 1

configuring using the GUI 1 2

802.3 Bridging parameter 1

802.3X flow control, enabling 1

A

Access Control List Name parameter 1

access control lists (ACLs)

applying to the controller CPU

configuring using the CLI 1

configuring using the GUI 1

using with the debug facility 1

Access Control Lists > Edit page 1 2

Access Control Lists > New page 1

Access Control Lists page 1

Access Mode parameter 1 2

access point core dumps, uploading

access point count, approved tiers for 5500 series controllers 1

access point event logs, viewing 1

assigning access points to

access point monitor service, debugging 1

access point radios, searching for 1 2

supporting oversized images 1 2

verifying that they join the controller 1

Accounting Server parameters 1

ACL. See <Default Para Font>access control lists (ACLs) 1 2

Admission Control (ACM) parameter 1

Aggregated MAC Service Data Unit (A-MSDU) 1

aggregation method, specifying 1

AirMagnet Enterprise Analyzer 1

All APs > Access Point Name > VLAN Mappings page 1

All APs > Details for (Advanced) page 1 2

configuring link latency 1

All APs > Details for (Credentials) page 1 2

All APs > Details for (FlexConnect) page 1

All APs > Details for (General) page 1

All APs > Details for (High Availability) page 1 2

Anonymous Provision parameter 1

AP > Clients > Traffic Stream Metrics page 1

AP Authentication Policy page 1

AP Ethernet MAC Addresses parameter 1

AP Failover Priority parameter 1

AP Group Name parameter 1

AP Groups > Edit (APs) page 1

AP Local Authentication on a WLAN

AP Mode parameter 1 2 3 4

AP Primary Discovery Timeout parameter 1

ap-count evaluation licenses, activating

using with a controller 1

Applying ACLs to a WLAN 1

Applying ACLs to the controller CPU 1

Assignment Method parameter 1

authenticated local authentication bind method 1 2

Authority ID Information parameter 1 2 3

Authority ID parameter 1 2

Authorize LSC APs against auth-list parameter 1

Authorize MIC APs against auth-list or AAA parameter 1

DHCP addresses for interfaces 1

TFTP server information 1

selecting configuration file 1

Average Data Rate parameter 1 2 3

Average Real-Time Rate parameter 1 2 3

Avoid Cisco AP Load parameter 1

Avoid Foreign AP Interference parameter 1 2 3

Avoid Non-802.11a (802.11b) Noise parameter 1

B

Back-up Primary Controller Name field 1

Back-up Secondary Controller Name parameter 1

Beacon Period parameter 1

Bind Username parameter 1

Burst Data Rate parameter 1 2 3

Burst Real-Time Rate parameter 1 2 3

C

CA Server URL parameter 1

configuring for 7920 phones 1

capacity adder license. See <Default Para Font>licenses 1

viewing a client’s version

CCX Layer 2 client roaming

debugging using the CLI 1

obtaining information using the CLI 1

flexconnect considerations 1

CDP > AP Neighbors > Detail page 1

CDP > Interface Neighbors > Detail page 1

CDP > Traffic Metrics page 1

CDP Advertisement Version parameter 1

CDP Protocol Status parameter 1

Certificate Authority (CA) certificates

Certificate File Name parameter 1

Certificate File Path parameter 1

Certificate Issuer parameter 1

Certificate Password parameter 1 2

Certificate Type parameter 1

Change Rules Priority parameter 1

Channel Announcement parameter 1

Channel Assignment Leader parameter 1

Channel Assignment Method parameter 1

Channel Quiet Mode parameter 1

Channel Scan Duration parameter 1

Channel Width Parameter 1

Check Against CA Certificates parameter 1

Check Certificate Date Validity parameter 1

chokepoints for RFID tag tracking 1

Cisco 5508 Wireless Controller

multiple AP-manager interfaces 1

multiple AP-manager interfaces 1

Cisco 7921 Wireless IP Phones 1

Cisco Centralized Key Management (CCKM). See<Default Para Font> CCKM 1

Cisco Clean Access (CCA) 1

Cisco Discovery Protocol (CDP)

viewing traffic information

Cisco Discovery Protocol parameter 1

Cisco License Manager (CLM)

and the controller license agent 1

Cisco Licensing website 1

Cisco Unified Wireless Network (UWN) Solution

Clear Stats on All APs button 1

enabling wireless connections 1

troubleshooting commands 1

Client Certificate Required parameter 1

client location, using Prime Infrastructure 1 2

Client Protection parameter 1

client roaming, configuring 1

Clients > AP > Traffic Stream Metrics page 1

viewing the status of workgroup bridges 1

Commands > Reset to Factory Defaults page 1

Community Name parameter 1

conditional web redirect 1

Conditional Web Redirect parameter 1

Configuration File Encryption parameter 1

Configuration Wizard - 802.11 Configuration page 1

Configuration Wizard - Miscellaneous Configuration page 1

Configuration Wizard - Set Time page 1

Configuration Wizard - SNMP Summary page 1

Configuration Wizard - System Information page 1

Configuration Wizard - Virtual Interface Configuration page 1

Configuration Wizard Completed page 1

Configuration Wizard-Management Interface Configuration 1

Configuration Wizard-System Information 1

Configure Dynamic Anchoring of Static IP Clients

Configure option for RRM override 1

Configuring a Spectrum Expert 1

Configuring Cisco Cleanair

Configuring Cisco CleanAir

Configuring Client Exclusion Policies (CLI) 1

Configuring Client Exclusion Policies (GUI) 1

Configuring Controller (GUI) 1

Configuring Country Codes (CLI) 1

Configuring Country Codes (GUI) 1

Configuring Coverage Hole Detection on a WLAN (GUI) 1

Configuring Dynamic Anchoring of Static IP Clients

Configuring FlexConnect APs using the CLI. 1

configuring for the debug facility 1

Configuring Sniffing on an Access Point

Configuring Web Redirect (GUI) 1

Control and Provisioning of Wireless Access Points protocol (CAPWAP)

viewing MTU information 1

Controller Time Source Valid parameter 1

multiple-controller deployment 1

single-controller deployment 1

uploading from a 5500 series controller to a TFTP or FTP server 1

Coverage Exception Level per AP parameter 1

configuring per controller

coverage hole detection and correction 1

Coverage Hole Detection Enabled parameter 1

Creating Multiple AP Manager Interfaces - CLI 1

Creating Multiple AP-Manager Interfaces (GUI) 1

D

and OfficeExtend access points 1

Data Encryption parameter 1 2

configuring through NTP server 1 2

DCA Channel Sensitivity parameter 1

default enable password 1

Default Mobility Group parameter 1

Default Routers parameter 1

Destination parameter 1 2

Destination Port parameter 1 2

Detect and Report Ad-Hoc Networks parameter 1

DHCP Addr. Assignment Required parameter 1

DHCP option 43, in controller discovery process 1

DHCP option 52, in controller discovery process 1

DHCP Option 82 format parameter 1

DHCP Option 82 Remote ID Field Format parameter 1

DHCP Server IP Addr parameter 1

Diagnostic Channel parameter 1

disabled clients, configuring a timeout 1

discovery request timer, configuring 1

distribution system ports 1 2

DNS Domain Name parameter 1

DNS IP Address parameter 1

domain name server (DNS) discovery 1

downloading a CA certificate 1

downloading a customized web authentication login page 1

downloading a device certificate 1

Download File to Controller page

downloading a customized web authentication login page 1

downloading CA certificates 1

downloading configuration files 1

downloading login banner file 1

Download SSL Certificate parameter 1

Download Third-Party Certificate

DTLS data encryption. See <Default Para Font>data encryption 1

Dynamic Anchoring for Clients with Static IP Addresses

for the management interface 1

Dynamic AP Management parameter

for management interface 1

dynamic channel assignment (DCA)

dynamic interface example 1

dynamic transmit power control, configuring 1

Dynamic WEP Key Index parameter 1

E

EAP Profile Name parameter 1

EAP-Broadcast Key Interval 1

EAPOL-Key Max Retries parameter 1

EAPOL-Key Timeout parameter 1

Edit QoS Role Data Rates page 1

Egress Interface parameter 1

Enable AP Local Authentication parameter 1

Enable Authentication for Listener parameter 1

Enable Check for All Standard and Custom Signatures parameter 1

Enable Counters parameter 1

Enable Coverage Hole Detection parameter 1

Enable CPU ACL parameter 1

Enable Default Authentication parameter 1

Enable DHCP Proxy parameter 1

Enable Dynamic AP Management parameter 1

Enable EAP-FAST Authentication parameter 1

Enable LEAP Authentication parameter 1

Enable Least Latency Controller Join parameter 1

Enable Link Latency parameter 1 2

Enable Listener parameter 1

Enable Low Latency MAC parameter 1

Enable LSC on Controller parameter 1

Enable NAT Address parameter 1

Enable Notification parameter 1

Enable OfficeExtend AP parameter 1

Enable Password parameter 1

Enable Server Status parameter 1

Enable Tracking Optimization parameter 1

Encryption Key parameter 1

end-user license agreement (EULA) 1 2

enhanced distributed channel access (EDCA) parameters

configuring using the CLI 1

Enter Saved Permission Ticket File Name parameter 1

error codes, for failed VoIP calls 1

Ethernet connection, using remotely 1

Expedited Bandwidth parameter 1

Expiration Timeout for Rogue AP and Rogue Client Entries parameter 1

Extensible Authentication Protocol (EAP)

timeout and failure counters

F

resetting using the GUI 1

failover priority for access points

Fallback Mode parameter 1

File Compression parameter 1

File Name to Save Credentials parameter 1

downloading a CA certificate 1

downloading a configuration file 1

downloading a customized web authentication login page 1

downloading a device certificate 1

upgrading controller software 1

uploading a CA certificate 1

uploading a configuration file 1

uploading a device certificate 1

uploading packet capture files 1

filter, using to view clients 1

FlexConnect Mode AP Fast Heartbeat Timeout parameter 1

Fragmentation Threshold parameter 1

G

General (controller) page

configuring an RF group 1

enabling link aggregation 1

General (security) page 1

Generate Rehost Ticket button 1

Global AP Failover Priority parameter 1

Global Configuration page

configuring backup controllers 1

configuring failover priority for access points 1

global credentials for access points

Group Mode parameter 1 2 3

Guest User Role parameter 1

Guidelines and Limitations for Predownloading 1

H

I

Identity Request Max Retries parameter 1

Identity Request Timeout parameter 1

IKE Diffie Hellman Group parameter 1

Index parameter for IDS 1

Ingress Interface parameter 1

Injector Switch MAC Address parameter 1

Interface Name parameter 1 2

creating multiple AP-manager interfaces 1

Interference threshold parameter 1

Internet Group Management Protocol (IGMP)

Invoke Channel Update Now button 1

Invoke Power Update Now button 1

IP address-to-MAC address binding

J

K

Keep Alive Count parameter 1

Keep Alive Interval parameter 1

Key Encryption Key (KEK) parameter 1

Key Wrap Format parameter 1

L

LAG Mode on Next Reboot parameter 1

Last Auto Channel Assignment parameter 1

Layer 2 Security parameter 1 2 3

Layer 3 Security parameter

choosing server priority order 1

transferring to a replacement controller after an RMA 1

lightweight mode, reverting to autonomous mode 1

and OfficeExtend access points 1

Listener Message Processing URL parameter 1

Lobby Ambassador Guest Management > Guest Users List page 1

Local Auth Active Timeout parameter 1

Local Authentication on a WLAN

local authentication, local switching 1

viewing information using the CLI 1

Local EAP Authentication parameter 1

Local Management Users > New page 1

Local Management Users page 1

Local Mode AP Fast Heartbeat Timer parameter 1

Local Net Users > New page 1

local significant certificate (LSC)

Local Significant Certificates (LSC) - AP Provisioning page 1

Local Significant Certificates (LSC) - General page 1

local user database, capacity 1

LWAPP-enabled access points

disabling the reset button 1

retrieving radio core dumps 1

reverting to autonomous mode 1 2

sending crash information to controller 1

access point core dumps 1

M

MAC address of access point

displayed on controller GUI 1

Management Frame Protection parameter 1

Management IP Address parameter 1

Master Controller Configuration page 1

Master Controller Mode parameter 1

Max HTTP Message Size parameter 1

Max RF Bandwidth parameter 1 2

Max-Login Ignore Identity Response parameter 1

maximum local database entries

configuring using the GUI 1

Maximum Local Database Entries parameter 1

Maximum Number of Sessions parameter 1

Member MAC Address parameter 1

memory leaks, monitoring 1 2

Message Authentication Code Key (MACK) parameter 1

Message parameter for web authentication 1

Metrics Collection parameter 1

MFP Client Protection parameter 1

Min Failed Client Count per AP parameter 1

Mobility Anchor Create button 1

Mobility Anchors option 1

mobility anchors. See <Default Para Font>auto-anchor mobility 1

difference from RF groups 1

mobility ping tests, running 1

MODE access point button 1

monitor intervals, configuring using the GUI 1

multicast client table, viewing 1

N

NAC out-of-band integration

configuring for a specific access point group

for dynamic interface 1 2

for management interface 1 2

Native VLAN ID parameter 1

Neighbor Discovery Packet 1 2

Neighbor Packet Frequency parameter 1

Netbios Name Servers parameter 1

Network Mobility Services Protocol (NMSP) 1

configuring to obtain time and date 1

Number of Attempts to LSC parameter 1

Number of Hits parameter 1

O

OfficeExtend Access Point Home page 1

OfficeExtend access points

firewall requirements 1 2

supported access point models 1 2

OfficeExtend Access Points

OfficeExtend AP parameter 1

Order Used for Authentication parameter 1 2

Over-ride Global Credentials parameter 1 2 3

Override Global Config parameter 1 2

Override Interface ACL parameter 1

P

sample output in Wireshark 1

for access point authentication 1

Physical Mode parameter 1

Physical Status parameter 1

PMK cache lifetime timer 1

Pool End Address parameter 1

Pool Start Address parameter 1

Power Injector Selection parameter 1

Power Injector State parameter 1

Power Neighbor Count parameter 1

Power over Ethernet (PoE)

Power Over Ethernet (PoE) parameter 1

Power Threshold parameter 1

preauthentication access control list (ACL)

for external web server 1 2

Preauthentication ACL parameter 1 2

Predownloading an image 1

Primary Controller parameters 1

Primary RADIUS Server parameter 1

Priority Order > Local-Auth page 1

Priority Order > Management User page 1 2

Privacy Protocol parameter 1

proactive key caching (PKC), with mobility 1

probe requests, described 1

product authorization key (PAK)

obtaining for license upgrade 1

Profile Name parameter 1 2 3 4

protected access credentials (PACs)

Protection Type parameter 1 2

Protocol Type parameter 1

Q

Quality of Service (QoS) parameter 1

NAC out-of-band integration 1

with NAC out-of-band integration 1

Query Interval parameter 1

R

radio measurement requests

viewing status using the CLI 1

radio resource management (RRM)

CCX features. See <Default Para Font>CCX radio management 1

monitor intervals using the GUI 1

configuring per controller using the GUI 1

disabling dynamic channel and power assignment

statically assigning channel and transmit power settings

Wireless > 802.11a/n (or 802.11b/g/n) > RRM > TPC parameter 1

radio resource management (RRM) settings

radio resource monitoring 1

server fallback behavior 1

RADIUS authentication attributes 1

RADIUS authentication attributes, Airespace 1

Redirect URL After Login parameter 1

Refresh-time Interval parameter 1

Regenerate Certificate button 1

Rehost Ticket File Name parameter 1

rehosting a license. See <Default Para Font>licenses 1

Remote Authentication Dial-In User Service. See<Default Para Font> RADIUS 1

Request Max Retries parameter 1

Request Timeout parameter 1

Reserved Roaming Bandwidth parameter 1

Reset Link Latency button 1

Reset Personal SSID parameter 1

resetting the controller 1

RF Channel Assignment parameter 1

RF-Network Name parameter 1

debugging using the CLI 1

RFID tracking on access points, optimizing

RLDP. See <Default Para Font>Rogue Location Discovery Protocol (RLDP) 1

roaming and real-time diagnostics

and OfficeExtend access points 1

Rogue Detection parameter 1 2

Rogue Location Discovery Protocol parameter 1

RRM. See <Default Para Font>radio resource management (RRM) 1

S

Save and Reboot button 1 2

saving configuration settings 1

Scan Threshold parameter 1

Secondary Controller parameters 1

Secondary RADIUS Server parameter 1

Select APs from Current Controller parameter 1

self-signed certificate (SSC)

used to authorize access points 1

serial number for controller, finding 1

serial number of controller, finding 1

Server Address parameter 1

Server Index (Priority) parameter 1 2 3

Server IP Address parameter

Server Status parameter 1 2

Server Timeout parameter 1 2 3

Set to Factory Default button 1

Severity Level Filtering parameter 1

Shared Secret Format parameter 1 2

Shared Secret parameter 1 2

Short Preamble Enabled parameter 1

Signature Events Summary page 1

sniffing. See <Default Para Font>wireless sniffing 1

SNMP NAC State parameter 1

SNMP v1 / v2c Community page 1

changing default values using the GUI 1 2

Source parameter for ACLs 1 2

SpectraLink NetLink phones

Splash Page Web Redirect parameter 1 2

and OfficeExtend access points 1 2

troubleshooting access points

SSLv2 for web authentication, disabling 1

stateful DHCPv6 IP addressing 1

Switch IP Address (Anchor) parameter 1

symmetric mobility tunneling

Symmetric Mobility Tunneling Mode parameter 1

Syslog Configuration page 1

Syslog Facility parameter 1

removing from controller 1

severity level filtering 1

Syslog Server IP Address parameter 1

system logs, viewing using the CLI 1

System Resource Information page 1

T

TACACS+ (Authentication, Authorization, or Accounting) Servers > New page 1

TACACS+ (Authentication, Authorization, or Accounting) Servers page 1

TACACS+ Administration .csv page (on CiscoSecure ACS) 1

troubleshooting access points

Telnet-SSH Configuration page 1

Tertiary Controller parameters 1

text2pcap sample output 1

Time to Live for the PAC parameter 1 2

configuring using the CLI 1

configuring using the GUI 1

time-length-values (TLVs), supported for CDP 1 2

timestamps, enabling or disabling in log and debug messages 1

traffic specifications (TSPEC) request

traffic stream metrics (TSM)

downloading a CA certificate 1

downloading a configuration file 1

downloading a customized web authentication login page 1

downloading a device certificate 1

upgrading controller software 1

uploading a CA certificate 1

uploading a configuration file 1

uploading a device certificate 1

uploading packet capture files 1

Transition Time parameter 1

statically assigning using the CLI 1

statically assigning using the GUI 1

transmit power threshold, decreasing 1

access point join process 1 2

tunnel attributes and identity networking 1

Tx Power Level Assignment parameter 1

U

unique device identifier (UDI)

uploading a CA certificate 1

uploading a device certificate 1

Upload CSV File parameter 1

Upload File from Controller page 1 2 3 4

uploading CA certificates 1

uploading Device certificates 1

URL to Send the Notifications parameter 1

Use AES Key Wrap parameter 1

User Access Mode parameter 1

User Attribute parameter 1

User Credentials parameter 1

User Object Type parameter 1

User Profile Name parameter 1

Using CLI to monitor the Air quality 1

Using GUI to monitor air quality 1

V

Validate Rogue Clients Against AAA parameter 1

Verify Certificate CN Identity parameter 1

VLAN Identifier parameter

for AP-manager interface 1

voice-over-IP (VoIP) telephone roaming 1

VoIP calls, error codes 1

VoIP Snooping and Reporting parameter 1

configuring using the GUI 1

W

Web Auth Type parameter 1 2

obtaining using the GUI 1 2

web authentication login page

customizing from an external web server

modified default example 1

Web Authentication Type parameter 1 2 3

web-browser security alert 1

wireless intrusion prevention system (wIPS)

WLAN mobility security values 1

configuring for guest user 1

mapping an access point group to a WLAN 1 2

checking security settings 1

WLANs > Edit (Advanced) page 1

configuring the diagnostic channel 1

WLANs > Edit (Security > AAA Servers) page

choosing RADIUS or LDAP servers for external authentication 1

disabling accounting servers on a WLAN 1

WLANs > Edit (Security > Layer 3) page

configuring web redirect 1

WLANs > Edit page 1 2 3 4

wplus license. licenses 1

wplus license. See <Default Para Font>licenses 1

Page 3

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Page 4

• Do not configure PSK and CCKM in a WLAN, as this configuration is not supported and impacts client join flow.

• Ensure that TKIP or AES ciphers are enabled with WPA1 configuration, else ISSU may break during upgrade process.

• When you change the WLAN profile name, then FlexConnect APs (using AP-specific VLAN mapping) will become WLAN-specific. If FlexConnect Groups are configured, the VLAN mapping will become Group-specific.

• Do not enable IEEE 802.1X Fast Transition on Flex Local Authentication enabled WLAN, as client association is not supported with Fast Transition 802.1X key management.

• Peer-to-peer blocking does not apply to multicast traffic.

• In FlexConnect, peer-to-peer blocking configuration cannot be applied only to a particular FlexConnect AP or a subset of APs. It is applied to all the FlexConnect APs that broadcast the SSID.

• The WLAN name and SSID can have up to 32 characters.

• WLAN and SSID names support only the following ASCII characters:

  • Numerals: 48 through 57 hex (0 to 9)

  • Alphabets (uppercase): 65 through 90 hex (A to Z)

  • Alphabets (lowercase): 97 through 122 hex (a to z)

  • ASCII space: 20 hex

  • Printable special characters: 21 through 2F, 3A through 40, and 5B through 60 hex, that is: ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~

• WLAN name cannot be a keyword; for example, if you try to create a WLAN with the name as 's' by entering the wlan s command, it results in shutting down all WLANs because 's' is used as a keyword for shutdown.

• You cannot map a WLAN to VLAN 0. Similarly, you cannot map a WLAN to VLANs 1002 to 1006.

• Dual stack clients with a static-IPv4 address is not supported.

• In a dual-stack with IPv4 and IPv6 configured in the Cisco 9800 controller, if an AP tries to join controller with IPv6 tunnel before its IPv4 tunnel gets cleaned, you would see a traceback and AP join will fail.

• When creating a WLAN with the same SSID, you must create a unique profile name for each WLAN.

• All OfficeExtend access points should be in the same access point group, and that group should contain no more than 15 WLANs. A controller with OfficeExtend access points in an access point group publishes only up to 15 WLANs to each connected OfficeExtend access point because it reserves one WLAN for the personal SSID.

• The Cisco Flex 7500 Series Controller does not support the 802.1X security variants on a centrally switched WLAN. For example, the following configurations are not allowed on a centrally switched WLAN:

  • WPA1/WPA2 with 802.1X AKM

  • WPA1/WPA2 with CCKM

  • Conditional webauth

  • Splash WEB page redirect

  • If you want to configure your WLAN in any of the above combinations, the WLAN must be configured to use local switching.

• If you configured your WLAN with EAP Passthrough and if you downgrade to an earlier controller version, you might encounter XML validation errors during the downgrade process. This problem is because EAP Passthrough is not supported in earlier releases. The configuration will default to the default security settings (WPA2/802.1X).

  Note

  The OEAP 600 Series access point supports a maximum of two WLANs and one remote LAN. If you have configured more than two WLANs and one remote LAN, you can assign the 600 Series access point to an AP group. The support for two WLANs and one remote LAN still applies to the AP Group If the 600 Series OEAP is in the default group, the WLAN or remote LAN IDs must be lower than 8.

• Profile name of WLAN can be of max 31 characters for a locally switched WLAN. For central switched WLAN, the profile name can be of 32 characters.

• When multiple WLANs with the same SSID get assigned to the same AP radio, you must have a unique Layer 2 security policy so that clients can safely select between them.

• When WLAN is local switching, associate the client to local-switching WLAN where AVC is enabled. Send some traffic from client, when you check the AVC stats after 90 sec. Cisco WLC shows stats under top-apps but does not show under client. There is timer issue so for the first slot Cisco WLC might not show stats for the clients. Earlier, only 1 sec stats for a client is seen if the timers at AP and at WLC are off by 89 seconds. Now, clearing of the stats is after 180 seconds so stats from 91 seconds to 179 seconds for a client is seen. This is done because two copies of the stats per client cannot be kept due to memory constraint in Cisco 5508 WLC.

• RADIUS server overwrite is not configured on a per WLAN basis, but rather on a per AAA server group basis.

• Downloadable ACL (DACL) is not supported in the FlexConnect mode or the local mode.

Page 5

In some deployments, it is desirable to statically assign channel and transmit power settings to the access points instead of relying on the RRM algorithms provided by Cisco. Typically, this is true in challenging RF environments and non standard deployments but not the more typical carpeted offices.

Note	If you choose to statically assign channels and power levels to your access points and/or to disable dynamic channel and power assignment, you should still use automatic RF grouping to avoid spurious rogue device events.

You can disable dynamic channel and power assignment globally for a Cisco WLC, or you can leave dynamic channel and power assignment enabled and statically configure specific access point radios with a channel and power setting. While you can specify a global default transmit power parameter for each network type that applies to all the access point radios on a Cisco WLC, you must set the channel for each access point radio when you disable dynamic channel assignment. You may also want to set the transmit power for each access point instead of leaving the global transmit power in effect.

This section contains the following subsections:

Page 6

Two adjacent access points on the same channel can cause either signal contention or signal collision. In a collision, data is not received by the access point. This functionality can become a problem, for example, when someone reading an e-mail in a café affects the performance of the access point in a neighboring business. Even though these are separate networks, someone sending traffic to the café on channel 1 can disrupt communication in an enterprise using the same channel. Controllers can dynamically allocate access point channel assignments to avoid conflict and increase capacity and performance. Channels are reused to avoid wasting scarce RF resources. In other words, channel 1 is allocated to a different access point far from the café, which is more effective than not using channel 1 altogether.

The controller’s Dynamic Channel Assignment (DCA) capabilities are also useful in minimizing adjacent channel interference between access points. For example, two overlapping channels in the 802.11b/g band, such as 1 and 2, cannot simultaneously use 11 or 54 Mbps. By effectively reassigning channels, the controller keeps adjacent channels that are separated.

Note	We recommend that you use only nonoverlapping channels (1, 6, 11, and so on).

Note	Channel change does not require you to shut down the radio.

The controller examines a variety of real-time RF characteristics to efficiently handle channel assignments as follows:

• Access point received energy: The received signal strength measured between each access point and its nearby neighboring access points. Channels are optimized for the highest network capacity.

• Noise: Noise can limit signal quality at the client and access point. An increase in noise reduces the effective cell size and degrades user experience. By optimizing channels to avoid noise sources, the controller can optimize coverage while maintaining system capacity. If a channel is unusable due to excessive noise, that channel can be avoided.

• 802.11 interference: Interference is any 802.11 traffic that is not a part of your wireless LAN, including rogue access points and neighboring wireless networks. Lightweight access points constantly scan all the channels looking for sources of interference. If the amount of 802.11 interference exceeds a predefined configurable threshold (the default is 10 percent), the access point sends an alert to the controller. Using the RRM algorithms, the controller may then dynamically rearrange channel assignments to increase system performance in the presence of the interference. Such an adjustment could result in adjacent lightweight access points being on the same channel, but this setup is preferable to having the access points remain on a channel that is unusable due to an interfering foreign access point.

  In addition, if other wireless networks are present, the controller shifts the usage of channels to complement the other networks. For example, if one network is on channel 6, an adjacent wireless LAN is assigned to channel 1 or 11. This arrangement increases the capacity of the network by limiting the sharing of frequencies. If a channel has virtually no capacity remaining, the controller may choose to avoid this channel. In huge deployments in which all nonoverlapping channels are occupied, the controller does its best, but you must consider RF density when setting expectations.

• Load and utilization: When utilization monitoring is enabled, capacity calculations can consider that some access points are deployed in ways that carry more traffic than other access points, for example, a lobby versus an engineering area. The controller can then assign channels to improve the access point that has performed the worst. The load is taken into account when changing the channel structure to minimize the impact on the clients that are currently in the wireless LAN. This metric keeps track of every access point’s transmitted and received packet counts to determine how busy the access points are. New clients avoid an overloaded access point and associate to a new access point. This Load and utilization parameter is disabled by default.

The controller combines this RF characteristic information with RRM algorithms to make system-wide decisions. Conflicting demands are resolved using soft-decision metrics that guarantee the best choice for minimizing network interference. The end result is optimal channel configuration in a three-dimensional space, where access points on the floor above and below play a major factor in an overall wireless LAN configuration.

Note	Radios using 40-MHz channels in the 2.4-GHz band or 80MHz channels are not supported by DCA.

Note	In a Dynamic Frequency Selection (DFS) enabled AP environment, ensure that you enable the UNII2 channels option under the DCA channel to allow 100-MHz separation for the dual 5-GHz radios.

The RRM startup mode is invoked in the following conditions:

• In a single-controller environment, the RRM startup mode is invoked after the controller is upgraded and rebooted.

• In a multiple-controller environment, the RRM startup mode is invoked after an RF Group leader is elected.

• You can trigger the RRM startup mode from the CLI.

The RRM startup mode runs for 100 minutes (10 iterations at 10-minute intervals). The duration of the RRM startup mode is independent of the DCA interval, sensitivity, and network size. The startup mode consists of 10 DCA runs with high sensitivity (making channel changes easy and sensitive to the environment) to converge to a steady-state channel plan. After the startup mode is finished, DCA continues to run at the specified interval and sensitivity.

Note

DCA algorithm interval is set to 1 hour, but DCA algorithm always runs in default interval of 10 min, channel allocation occurs at 10-min intervals for the first 10 cycles, and channel changes occur as per the DCA algorithm every 10 min. After that the DCA algorithm goes back to the configured time interval. This is common for both DCA interval and anchor time because it follows the steady state.

Note	If Dynamic Channel Assignment (DCA)/Transmit Power Control (TPC) is turned off on the RF group member, and auto is set on RF group leader, the channel or TX power on a member gets changed as per the algorithm that is run on the RF group leader.

Page 7

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Page 8

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Page 9

The controllers contain an internal DHCP server. This server is typically used in branch offices that do not already have a DHCP server.

The wireless network generally contains a maximum of 10 APs or less, with the APs on the same IP subnet as the controller.

The internal server provides DHCP addresses to wireless clients, direct-connect APs, and DHCP requests that are relayed from APs. Only lightweight access points are supported. When you want to use the internal DHCP server, ensure that you configure SVI for client VLAN and set the IP address as DHCP server IP address.

DHCP option 43 is not supported on the internal server. Therefore, the access point must use an alternative method to locate the management interface IP address of the controller, such as local subnet broadcast, Domain Name System (DNS), or priming.

Also, an internal DHCP server can serve only wireless clients, not wired clients.

When clients use the internal DHCP server of the controller, IP addresses are not preserved across reboots. As a result, multiple clients can be assigned to the same IP address. To resolve any IP address conflicts, clients must release their existing IP address and request a new one.

Wired guest clients are always on a Layer 2 network connected to a local or foreign controller.

Note	VRF is not supported in the internal DHCP servers. DHCPv6 is not supported in the internal DHCP servers.

Page 10

Cisco Key Integrity Protocol (CKIP) is a Cisco-proprietary security protocol for encrypting 802.11 media. CKIP improves 802.11 security in infrastructure mode using key permutation, a message integrity check (MIC), and a message sequence number. For this feature to operate correctly, you must enable Aironet information elements (IEs) for the WLAN.

A lightweight access point advertises support for CKIP in beacon and probe response packets by adding an Aironet IE and setting one or both of the CKIP negotiation bits (key permutation and multi-modular hash message integrity check [MMH MIC]). Key permutation is a data encryption technique that uses the basic encryption key and the current initialization vector (IV) to create a new key. MMH MIC prevents bit-flip attacks on encrypted packets by using a hash function to compute message integrity code.

The CKIP settings specified in a WLAN are mandatory for any client attempting to associate. If the WLAN is configured for both CKIP key permutation and MMH MIC, the client must support both. If the WLAN is configured for only one of these features, the client must support only the CKIP feature.

CKIP requires that 5-byte and 13-byte encryption keys be expanded to 16-byte keys. The algorithm to perform key expansion occurs at the access point. The key is appended to itself repeatedly until the length reaches 16 bytes. All lightweight access points support CKIP.

Note

CKIP is supported for use only with static WEP. It is not supported for use with dynamic WEP. Therefore, a wireless client that is configured to use CKIP with dynamic WEP is unable to associate to a WLAN that is configured for CKIP. We recommend that you use either dynamic WEP without CKIP (which is less secure) or WPA/WPA2 with TKIP or AES (which are more secure).

Page 11

The Cisco Adaptive Wireless Intrusion Prevention System (wIPS) uses an advanced approach to wireless threat detection and performance management. It combines network traffic analysis, network device and topology information, signature-based techniques, and anomaly detection to deliver highly accurate and complete wireless threat prevention. With a fully infrastructure-integrated solution, you can continually monitor wireless traffic on both the wired and wireless networks and use that network intelligence to analyze attacks from many sources to accurately pinpoint and proactively prevent attacks, rather than wait until damage or exposure has occurred.

Cisco Adaptive wIPS is not configured on the controller. Instead, the Cisco Prime Infrastructure forwards the profile configuration to the wIPS service, which forwards the profile to the controller. The profile is stored in flash memory on the controller and sent to APs when they join the controller. When an access point disassociates and joins another controller, it receives the wIPS profile from the new controller.

Local-mode or FlexConnect mode APs with a subset of wIPS capabilities are referred to as Enhanced Local Mode access point or ELM AP. You can configure an access point to work in the wIPS mode if the AP is in any of the following modes:

• Monitor

• Local

• FlexConnect

The regular local mode or FlexConnect mode AP is extended with a subset of wIPS capabilities. This feature enables you to deploy your APs to provide protection without needing a separate overlay network.

wIPS ELM has the limited capability of detecting off-channel alarms. AN AP periodically goes off-channel, and monitors the nonserving channels for a short duration, and triggers alarms if any attack is detected on the channel. But off-channel alarm detection is best effort, and it takes a longer time to detect attacks and trigger alarms, which might cause the ELM AP to intermittently detect an alarm and clear it because it is not visible. APs in any of the above modes can periodically send alarms based on the policy profile to the wIPS service through the controller. The wIPS service stores and processes the alarms and generates SNMP traps. Cisco Prime Infrastructure configures its IP address as a trap destination to receive SNMP traps from the Cisco MSE.

This table lists all the SNMP trap controls and their respective traps. When a trap control is enabled, all the traps of that trap control are also enabled.

Note	The controller uses only SNMPv2 for SNMP trap transmission.

Table 1. Trap Controls and Descriptions

Type	Trap Control	Description
General	Config Save	Notification that is sent when the controller configuration is modified.
AP	Auth Failure	Trap sent when an AP authorization fails
AP Interface Up/Down	Trap sent when an AP interface (A or B) comes up
Mode Change	Trap sent when an AP mode is changed
AP Register	Trap sent when an AP registers with a switch
Neighbor AP Signal	Trap sent when an AP detects a neighbor AP signal
Client	802.11 Association	Associate notification that is sent when a client sends an association frame
Enhanced 802.11 Association	Associate notification that is sent when a client sends an enhanced association frame
802.11 Disassociation	Disassociate notification that is sent when a client sends a disassociation frame
802.11 Deauthentication	Deauthenticate notification that is sent when a client sends a deauthentication frame
Enhanced 802.11 Deauthentication	Deauthenticate notification that is sent when a client sends an enhanced deauthentication frame
802.11 Failed Authentication	Authenticate failure notification that is sent when a client sends an authentication frame with a status code other than successful
802.11 Failed Association	Associate failure notification that is sent when the client sends an association frame with a status code other than successful
Exclusion	Associate failure notification that is sent when a client is exclusion listed (in a blocked list). Note  The maximum number of static blocked list entries that the APs can have is 340.
Authentication	Authentication notification that is sent when a client is successfully authenticated
Enhanced Authentication	Notification that is sent when a client has successfully gone through enhanced authentication
MaxClients Limit Reached Threshold	Notification that is sent when the maximum number of clients, defined in the Threshold field, is associated with the controller
NAC Alert	Alert that is sent when a client joins an SNMP NAC-enabled WLAN This notification is generated when a client on NAC-enabled SSIDs completes Layer2 authentication to inform the NAC appliance about the client's presence. cldcClientWlanProfileName represents the profile name of the WLAN that the 802.11 wireless client is connected to, cldcClientIPAddress represents the unique IP address of the client. cldcApMacAddress represents the MAC address of the AP to which the client is associated. cldcClientQuarantineVLAN represents the quarantine VLAN for the client. cldcClientAccessVLAN represents the access VLAN for the client.
802.11 Assoc Stats	Associate notification that is sent with data statistics when a client is associated with the controller, or roams. Data statistics include transmitted and received bytes and packets.
Disassociation with Stats	Disassociate notification that is sent with data statistics when a client disassociates from the controller. Data statistics include transmitted and received bytes and packets, SSID, and session ID
WebAuth User Login	Trap sent for web authentiction user login
WebAuth User Logout	Trap sent for web authentiction user logout
Neighbor Client Detection	Trap sent for neighbor client detection
AAA	User Authentication	This trap informs that a client RADIUS authentication failure has occurred
RADIUS Servers Not Responding	This trap is to indicate that RADIUS servers are not responding to authentication requests sent by the RADIUS client
802.11 Security Traps	WEP/WPA Decrypt Error	Notification sent when the controller detects a WEP decrypting error
IDS Signature Attack	Trap sent for IDS signature attacks
MFP	Trap sent for management frame protection (protected management frames)
Rogues	Rogue AP	Whenever a rogue AP is detected, this trap is sent with its MAC address; when a rogue AP that was detected earlier no longer exists, this trap is sent.
Management	SNMP Authentication	The SNMPv2 entity has received a protocol message that is not properly authenticated. Note  When a user who is configured in SNMP V3 mode tries to access the controller with an incorrect password, the authentication fails and a failure message is displayed. However, no trap logs are generated for the authentication failure.
Multiple Users	Multiple users have logged in using the same ID
Strong Password	Trap sent for strong password check
SNMP Authentication	Load Profile	Notification sent when the Load Profile state changes between PASS and FAIL
Noise Profile	Notification sent when the Noise Profile state changes between PASS and FAIL
Interference Profile	Notification sent when the Interference Profile state changes between PASS and FAIL
Coverage Profile	Notification sent when the Coverage Profile state changes between PASS and FAIL
Auto RF Profile Traps	Load Profile	Notification sent when the Load Profile state changes between PASS and FAIL
Noise Profile	Notification sent when the Noise Profile state changes between PASS and FAIL
Interference Profile	Notification sent when the Interference Profile state changes between PASS and FAIL
Coverage Profile	Notification sent when the Coverage Profile state changes between PASS and FAIL
Auto RF Update Traps	Channel Update	Notification sent when the access point dynamic channel algorithm is updated
Tx Power Update	Notification sent when the access point dynamic transmit power algorithm is updated
Mesh	Child Excluded Parent	Notification that is sent when a defined number of failed association to the controller occurs through a parent mesh node
Parent Change	Notification is sent by the agent when a child mesh node changes its parent. The child mesh node remembers previous parent and informs the controller about the change of parent when it rejoins the network
Authfailure Mesh	Notification sent when a child mesh node exceeds the threshold limit of the number of discovery response timeouts. The child mesh node does not try to associate an excluded parent mesh node for the interval defined. The child mesh node remembers the excluded parent MAC address when it joins the network, and informs the controller
Child Moved	Notification sent when a parent mesh node loses connection with its child mesh node
Excessive Parent Change	Notification sent when the child mesh node changes its parent frequently. Each mesh node keeps a count of the number of parent changes in a fixed time. If it exceeds the defined threshold, the child mesh node informs the controller
Excessive Children	Notification sent when the child count exceeds for a RAP and a MAP
Poor SNR	Notification sent when the child mesh node detects a lower SNR on a backhaul link. For the other trap, a notification is sent to clear a notification when the child mesh node detects an SNR on a backhaul link that is higher then the object defined by 'clMeshSNRThresholdAbate'
Console Login	Notification is sent by the agent when a login on a MAP console is either successful or fail after three attempts
Excessive Association	Notification sent when cumulative association counter at parent mesh node exceeds the value configured
Default Bridge Group Name	Notification sent when the MAP mesh node joins its parent using the default bridge group name

For more information about trap logs, see Cisco Wireless Controller Trap Logs at https://www.cisco.com/c/en/us/support/wireless/wireless-lan-controller-software/products-system-message-guides-list.html.

Page 12

• Do not configure PSK and CCKM in a WLAN, as this configuration is not supported and impacts client join flow.

• Ensure that TKIP or AES ciphers are enabled with WPA1 configuration, else ISSU may break during upgrade process.

• When you change the WLAN profile name, then FlexConnect APs (using AP-specific VLAN mapping) will become WLAN-specific. If FlexConnect Groups are configured, the VLAN mapping will become Group-specific.

• Do not enable IEEE 802.1X Fast Transition on Flex Local Authentication enabled WLAN, as client association is not supported with Fast Transition 802.1X key management.

• Peer-to-peer blocking does not apply to multicast traffic.

• In FlexConnect, peer-to-peer blocking configuration cannot be applied only to a particular FlexConnect AP or a subset of APs. It is applied to all the FlexConnect APs that broadcast the SSID.

• The WLAN name and SSID can have up to 32 characters.

• WLAN and SSID names support only the following ASCII characters:

  • Numerals: 48 through 57 hex (0 to 9)

  • Alphabets (uppercase): 65 through 90 hex (A to Z)

  • Alphabets (lowercase): 97 through 122 hex (a to z)

  • ASCII space: 20 hex

  • Printable special characters: 21 through 2F, 3A through 40, and 5B through 60 hex, that is: ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~

• WLAN name cannot be a keyword; for example, if you try to create a WLAN with the name as 's' by entering the wlan s command, it results in shutting down all WLANs because 's' is used as a keyword for shutdown.

• You cannot map a WLAN to VLAN 0. Similarly, you cannot map a WLAN to VLANs 1002 to 1006.

• Dual stack clients with a static-IPv4 address is not supported.

• In a dual-stack with IPv4 and IPv6 configured in the Cisco 9800 controller, if an AP tries to join controller with IPv6 tunnel before its IPv4 tunnel gets cleaned, you would see a traceback and AP join will fail.

• When creating a WLAN with the same SSID, you must create a unique profile name for each WLAN.

• All OfficeExtend access points should be in the same access point group, and that group should contain no more than 15 WLANs. A controller with OfficeExtend access points in an access point group publishes only up to 15 WLANs to each connected OfficeExtend access point because it reserves one WLAN for the personal SSID.

• The Cisco Flex 7500 Series Controller does not support the 802.1X security variants on a centrally switched WLAN. For example, the following configurations are not allowed on a centrally switched WLAN:

  • WPA1/WPA2 with 802.1X AKM

  • WPA1/WPA2 with CCKM

  • Conditional webauth

  • Splash WEB page redirect

  • If you want to configure your WLAN in any of the above combinations, the WLAN must be configured to use local switching.

• If you configured your WLAN with EAP Passthrough and if you downgrade to an earlier controller version, you might encounter XML validation errors during the downgrade process. This problem is because EAP Passthrough is not supported in earlier releases. The configuration will default to the default security settings (WPA2/802.1X).

  Note

  The OEAP 600 Series access point supports a maximum of two WLANs and one remote LAN. If you have configured more than two WLANs and one remote LAN, you can assign the 600 Series access point to an AP group. The support for two WLANs and one remote LAN still applies to the AP Group If the 600 Series OEAP is in the default group, the WLAN or remote LAN IDs must be lower than 8.

• Profile name of WLAN can be of max 31 characters for a locally switched WLAN. For central switched WLAN, the profile name can be of 32 characters.

• When multiple WLANs with the same SSID get assigned to the same AP radio, you must have a unique Layer 2 security policy so that clients can safely select between them.

• When WLAN is local switching, associate the client to local-switching WLAN where AVC is enabled. Send some traffic from client, when you check the AVC stats after 90 sec. Cisco WLC shows stats under top-apps but does not show under client. There is timer issue so for the first slot Cisco WLC might not show stats for the clients. Earlier, only 1 sec stats for a client is seen if the timers at AP and at WLC are off by 89 seconds. Now, clearing of the stats is after 180 seconds so stats from 91 seconds to 179 seconds for a client is seen. This is done because two copies of the stats per client cannot be kept due to memory constraint in Cisco 5508 WLC.

• RADIUS server overwrite is not configured on a per WLAN basis, but rather on a per AAA server group basis.

• Downloadable ACL (DACL) is not supported in the FlexConnect mode or the local mode.

Page 13

This section lists the RADIUS authentication Airespace attributes currently supported on the controller.

This attribute indicates the WLAN ID of the WLAN to which the client should belong. When the WLAN-ID attribute is present in the RADIUS Access Accept, the system applies the WLAN-ID (SSID) to the client station after it authenticates. The WLAN ID is sent by the controller in all instances of authentication except IPsec. In case of web authentication, if the controller receives a WLAN-ID attribute in the authentication response from the AAA server, and it does not match the ID of the WLAN, authentication is rejected. The 802.1X/MAC filtering is also rejected. The rejection, based on the response from the AAA server, is because of the SSID Cisco AVPair support. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          | Vendor type   | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |                           WLAN ID (VALUE)                     | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

• Type – 26 for Vendor-Specific

• Length – 10

• Vendor-Id – 14179

• Vendor type – 1

• Vendor length – 4

• Value – ID of the WLAN to which the client should belong.

This attribute indicates the QoS level to be applied to the mobile client's traffic within the switching fabric, as well as over the air. This example shows a summary of the QoS-Level Attribute format. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          | Vendor type   | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |                           QoS Level                           | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

• Type – 26 for Vendor-Specific

• Length – 10

• Vendor-Id – 14179

• Vendor type – 2

• Vendor length – 4

• Value – Three octets:

  • 3 – Bronze (Background)

  • 0 – Silver (Best Effort)

  • 1 – Gold (Video)

  • 2 – Platinum (Voice)

DSCP is a packet header code that can be used to provide differentiated services based on the QoS levels. This attribute defines the DSCP value to be applied to a client. When present in a RADIUS Access Accept, the DSCP value overrides the DSCP value specified in the WLAN profile. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          |  Vendor type  | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     DSCP (VALUE) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

• Type – 26 for Vendor-Specific

• Length – 10

• Vendor-Id – 14179

• Vendor type – 3

• Vendor length – 4

• Value – DSCP value to be applied for the client.

802.1p VLAN tag received from the client, defining the access priority. This tag maps to the QoS Level for client-to-network packets. This attribute defines the 802.1p priority to be applied to the client. When present in a RADIUS Access Accept, the 802.1p value overrides the default specified in the WLAN profile. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          |  Vendor type  | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | 802.1p (VALUE) | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

• Type – 26 for Vendor-Specific

• Length – 10

• Vendor-Id – 14179

• Vendor type – 4

• Vendor length – 3

• Value – 802.1p priority to be applied to a client.

This attribute indicates the VLAN interface a client is to be associated to. A summary of the Interface-Name Attribute format is shown below. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          |  Vendor type  | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |    Interface Name... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

• Type – 26 for Vendor-Specific

• Length – >7

• Vendor-Id – 14179

• Vendor type – 5

• Vendor length – >0

• Value – A string that includes the name of the interface the client is to be assigned to.

  Note	This attribute only works when MAC filtering is enabled or if 802.1X or WPA is used as the security policy.

This attribute indicates the ACL name to be applied to the client. A summary of the ACL-Name Attribute format is shown below. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          | Vendor type   | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |        ACL Name... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

• Type – 26 for Vendor-Specific

• Length – >7

• Vendor-Id – 14179

• Vendor type – 6

• Vendor length – >0

• Value – A string that includes the name of the ACL to use for the client

In order to support centralized access control through a centralized AAA server such as the Cisco Identity Services Engine (ISE) or ACS, the IPv6 ACL can be provisioned on a per-client basis using AAA Override attributes. In order to use this feature, the IPv6 ACL must be configured on the controller and the WLAN must be configured with the AAA Override feature enabled. The actual named AAA attribute for an IPv6 ACL is Airespace-IPv6-ACL-Name, which is similar to the Airespace-ACL-Name attribute that is used for provisioning an IPv4-based ACL. The AAA attribute returned contents should be a string equal to the name of the IPv6 ACL as configured on the controller.

This attribute is a rate limiting value. It indicates the Data Bandwidth Average Contract that will be applied for a client for non-realtime traffic such as TCP. This value is specific for downstream direction from wired to wireless. When present in a RADIUS Access Accept, the Data Bandwidth Average Contract value overrides the Average Data Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          | Vendor type   | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |        Data Bandwidth Average Contract... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

• Type – 26 for Vendor-Specific

• Length – 10

• Vendor-Id – 14179

• Vendor type – 7

• Vendor length – 4

• Value – A value in kbps

This attribute is a rate limiting value. It indicates the Data Bandwidth Average Contract that will be applied to a client for realtime traffic such as UDP. This value is specific for downstream direction from wired to wireless. When present in a RADIUS Access Accept, the Real Time Bandwidth Average Contract value overrides the Average Real-Time Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          | Vendor type   | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |        Real Time Bandwidth Average Contract... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

• Type – 26 for Vendor-Specific

• Length – 10

• Vendor-Id – 14179

• Vendor type – 8

• Vendor length – 4

• Value – A value in kbps

This attribute is a rate limiting value. It indicates the Data Bandwidth Burst Contract that will be applied to a client for non-realtime traffic such as TCP. This value is specific to downstream direction from wired to wireless. When present in a RADIUS Access Accept, the Data Bandwidth Burst Contract value overrides the Burst Data Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          | Vendor type   | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |        Data Bandwidth Burst Contract... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

• Type – 26 for Vendor-Specific

• Length – 10

• Vendor-Id – 14179

• Vendor type – 9

• Vendor length – 4

• Value – A value in kbps

This attribute is a rate limiting value. It indicates the Data Bandwidth Burst Contract that will be applied to a client for realtime traffic such as UDP. This value is specific to downstream direction from wired to wireless. When present in a RADIUS Access Accept, the Real Time Bandwidth Burst Contract value overrides the Burst Real-Time Rate value present in the WLAN or QoS Profile. The fields are transmitted from left to right.

Note	If you try to implement Average Data Rate and Burst Data Rate as AAA override parameters to be pushed from a AAA server, both Average Data Rate and Burst Data Rate have to be sent from ISE.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          | Vendor type   | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |        Real Time Bandwidth Burst Contract... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

• Type – 26 for Vendor-Specific

• Length – 10

• Vendor-Id – 14179

• Vendor type – 10

• Vendor length – 4

• Value – A value in kbps

This attribute provides the bandwidth contract values to be applied for an authenticating user. When present in a RADIUS Access Accept, the bandwidth contract values defined for the Guest Role overrides the bandwidth contract values (based on QOS value) specified for the WLAN. The fields are transmitted from left to right.

 0                   1                   2                   3  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |     Type      |  Length       |            Vendor-Id +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+      Vendor-Id (cont.)          | Vendor type   | Vendor length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |        GuestRoleName ... +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

• Type – 26 for Vendor-Specific

• Length – 10

• Vendor-Id – 14179

• Vendor type – 11

• Vendor length – Variable based on the Guest Role Name length

• Value – A string of alphanumeric characters

Page 14

Page 15

If your network supports packet multicasting, you can configure the multicast method that the controller uses. The controller can perform multicasting in one of two modes:

• Unicast mode: In this mode, the controller unicasts every multicast packet to every access point associated to the controller. This mode is inefficient but might be required on networks that do not support multicasting.

• Multicast mode: In this mode, the controller sends multicast packets to a CAPWAP multicast group. This method reduces overhead on the controller processor and shifts the work of packet replication to your network, which is much more efficient than the unicast method.

  Note	We recommend that you use the unicast method only in networks where 50 or fewer APs are joined with the controller.

When you enable multicast mode and the controller receives a multicast packet from the wired LAN, the controller encapsulates the packet using CAPWAP and forwards the packet to the CAPWAP multicast group address. The controller always uses the management interface for sending multicast packets. Access points in the multicast group receive the packet and forward it to all the BSSIDs mapped to the interface on which clients receive multicast traffic. From the access point perspective, the multicast appears to be a broadcast to all SSIDs.

The controller supports Multicast Listener Discovery (MLD) v1 snooping for IPv6 multicast. This feature keeps track of and delivers IPv6 multicast flows to the clients that request them. To support IPv6 multicast, you must enable Global Multicast Mode.

Note

When you disable the Global Multicast Mode, the controller still forwards the IPv6 ICMP multicast messages, such as router announcements and DHCPv6 solicits, as these are required for IPv6 to work. As a result, enabling the Global Multicast Mode on the controller does not impact the ICMPv6 and the DHCPv6 messages. These messages will always be forwarded irrespective of whether or not the Global Multicast Mode is enabled.

Internet Group Management Protocol (IGMP) snooping is available to better direct multicast packets. When this feature is enabled, the controller gathers IGMP reports from the clients, processes them, creates unique multicast group IDs (MGIDs) from the IGMP reports after selecting the Layer 3 multicast address and the VLAN number, and sends the IGMP reports to the infrastructure switch. The controller sends these reports with the source address as the interface address on which it received the reports from the clients. The controller then updates the access point MGID table on the access point with the client MAC address. When the controller receives multicast traffic for a particular multicast group, it forwards it to all the access points, but only those access points that have active clients listening or subscribed to that multicast group send multicast traffic on that particular WLAN. IP packets are forwarded with an MGID that is unique for an ingress VLAN and the destination multicast group. Layer 2 multicast packets are forwarded with an MGID that is unique for the ingress interface.

When IGMP snooping is disabled, the following is true:

• The controller always uses Layer 2 MGID when it sends multicast data to the access point. Every interface created is assigned one Layer 2 MGID. For example, the management interface has an MGID of 0, and the first dynamic interface created is assigned an MGID of 8, which increments as each dynamic interface is created.

• The IGMP packets from clients are forwarded to the router. As a result, the router IGMP table is updated with the IP address of the clients as the last reporter.

When IGMP snooping is enabled, the following are true:

• The controller always uses Layer 3 MGID for all Layer 3 multicast traffic sent to the access point. For all Layer 2 multicast traffic, it continues to use Layer 2 MGID.

• IGMP report packets from wireless clients are consumed or absorbed by the controller, which generates a query for the clients. After the router sends the IGMP query, the controller sends the IGMP reports with its interface IP address as the listener IP address for the multicast group. As a result, the router IGMP table is updated with the controller IP address as the multicast listener.

• When the client that is listening to the multicast groups roams from one controller to another, the first controller transmits all the multicast group information for the listening client to the second controller. As a result, the second controller can immediately create the multicast group information for the client. The second controller sends the IGMP reports to the network for all multicast groups to which the client was listening. This process aids in the seamless transfer of multicast data to the client.

• If the listening client roams to a controller in a different subnet, the multicast packets are tunneled to the anchor controller of the client to avoid the reverse path filtering (RPF) check. The anchor then forwards the multicast packets to the infrastructure switch.

  Note	The MGIDs are controller specific. The same multicast group packets coming from the same VLAN in two different controllers may be mapped to two different MGIDs.

  Note	If Layer 2 multicast is enabled, a single MGID is assigned to all the multicast addresses coming from an interface.

  Note	The maximum number of multicast groups supported per VLAN for a controller is 100.

This section contains the following subsections:

Page 16

Page 17

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Page 18

Page 19

RF Group Leader can be configured in two ways as follows:

Note	RF Group Leader is chosen on the basis of the controller with the greatest AP capacity (platform limit.) If multiple controllers have the same capacity, the leader is the one with the highest management IP address.

• Auto Mode: In this mode, the members of an RF group elect an RF group leader to maintain a primary power and channel scheme for the group. The RF grouping algorithm dynamically chooses the RF group leader and ensures that an RF group leader is always present. Group leader assignments can and do change (for instance, if the current RF group leader becomes inoperable or RF group members experience major changes).

• Static Mode: In this mode, a user selects a controller as an RF group leader manually. In this mode, the leader and the members are manually configured and fixed. If the members are unable to join the RF group, the reason is indicated. The leader tries to establish a connection with a member every minute if the member has not joined in the previous attempt.

The RF group leader analyzes real-time radio data collected by the system, calculates the power and channel assignments, and sends them to each of the controllers in the RF group. The RRM algorithms ensure system-wide stability, and restrain channel and power scheme changes to the appropriate local RF neighborhoods.

Note

When a controller becomes both leader and member for a specific radio, you get to view the IPv4 and IPv6 address as part of the group leader. When a Controller A becomes a member and Controller B becomes a leader, the Controller A displays either IPv4 or IPv6 address of Controller B using the address it is connected. So, if both leader and member are not the same, you get to view only one IPv4 or IPv6 address as a group leader in the member.

The RRM algorithms run at a specified updated interval, which is 600 seconds by default. Between update intervals, the RF group leader sends keepalive messages to each of the RF group members and collects real-time RF data.

Note	Several monitoring intervals are also available. See the Configuring RRM section for details.

RF Grouping failure reason codes and their explanations are listed below:

Table 1. RF Grouping Failure Reason Codes

Reason Code	Description
1	Maximum number (20) of controllers are already present in the group.
2	If the following conditions are met: The request is from a similar powered controller and, Controller is the leader for the other band, OR Requestor group is larger.
3	Group ID do not match.
4	Request does not include source type.
5	Group spilt message to all member while group is being reformed.
6	Auto leader is joining a static leader, during the process deletes all the members.
9	Grouping mode is turned off.
11	Country code does not match.
12	Controller is up in hierarchy compared to sender of join command (static mode). Requestor is up in hierarchy (auto mode).
13	Controller is configured as static leader and receives join request from another static leader.
14	Controller is already a member of static group and receives a join request from another static leader.
15	Controller is a static leader and receives join request from non-static member.
16	Join request is not intended to the controller. Controller name and IP do not match.
18	RF domain do not match.
19	Controller received a Hello packet at incorrect state.
20	Controller has already joined Auto leader, now gets a join request from static leader.
21	Group mode change. Domain name change from CLI. Static member is removed from CLI.
22	Max switch size (350) is reached

Radio Resource Management White Paper: https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-3/b_RRM_White_Paper/b_RRM_White_Paper_chapter_011.html

Page 20

RF Profiles allows you to tune groups of APs that share a common coverage zone together and selectively change how RRM will operates the APs within that coverage zone.

For example, a university might deploy a high density of APs in an area where a high number of users will congregate or meet. This situation requires that you manipulate both data rates and power to address the cell density while managing the co-channel interference. In adjacent areas, normal coverage is provided and such manipulation would result in a loss of coverage.

Using RF profiles and AP groups allows you to optimize the RF settings for AP groups that operate in different environments or coverage zones. RF profiles are created for the 802.11 radios. RF profiles are applied to all APs that belong to an AP group, where all APs in that group will have the same profile settings.

The RF profile gives you the control over the data rates and power (TPC) values.

Note	The application of an RF profile does not change the AP’s status in RRM. It is still in global configuration mode controlled by RRM.

To address high-density complex RF topologies, the following configurations are available:

• High Density Configurations—The following configurations are available to fine tune RF environments in a dense wireless network:

  • Client limit per WLAN or radio—Maximum number of clients that can communicate with the AP in a high-density environment.

  • Client trap threshold—Threshold value of the number of clients that associate with an access point, after which an SNMP trap is sent to the controller and Cisco Prime Infrastructure.

• Stadium Vision Configurations—You can configure the following parameter:

  • Multicast data rates—Configurable data rate for multicast traffic based on the RF condition of an AP.

• Out-of-Box AP Configurations—To create an Out-of-Box AP group that consists of newly installed access points that belong to the default AP group. When you enable this feature:

• • Newly installed access points (assigned to the 'default-group' AP group by default) are automatically assigned to the Out-of-Box AP group upon associating with the controller, and their radios are administratively disabled. This eliminates any RF instability caused by the new access points.

  • When Out-of-Box is enabled, default-group APs currently associated with the controller remain in the default group until they reassociate with the controller.

  • All default-group APs that subsequently associate with the controller (existing APs on the same controller that have dropped and reassociated, or APs from another controller) are placed in the Out-of-Box AP group.

    Note	When removing APs from the Out-of-Box AP group for production use, we recommend that you assign the APs to a custom AP group to prevent inadvertently having them revert to the Out-of-Box AP group.

  • Special RF profiles are created per 802.11 band. These RF profiles have default settings for all the existing RF parameters and additional new configurations.

  Note

  When you disable this feature after you enable it, only subscription of new APs to the Out of Box AP group stops. All APs that are subscribed to the Out of Box AP Group remain in this AP group. The network administrators can move such APs to the default group or a custom AP group upon network convergence.

• Band Select Configurations— Band Select addresses client distribution between the 2.4-GHz and 5-GHz bands by first understanding the client capabilities to verify whether a client can associate on both 2.4-GHz and 5-GHz spectrum. Enabling band select on a WLAN forces the AP to do probe suppression on the 2.4-GHz band that ultimately moves dual band clients to 5-GHz spectrum. You can configure the following band select parameters per AP Group:

  • Probe response—Probe responses to clients that you can enable or disable.

  • Probe Cycle Count—Probe cycle count for the RF profile. The cycle count sets the number of suppression cycles for a new client.

  • Cycle Threshold—Time threshold for a new scanning RF Profile band select cycle period. This setting determines the time threshold during which new probe requests from a client come in a new scanning cycle.

  • Suppression Expire—Expiration time for pruning previously known 802.11b/g clients. After this time elapses, clients become new and are subject to probe response suppression.

  • Dual Band Expire—Expiration time for pruning previously known dual-band clients. After this time elapses, clients become new and are subject to probe response suppression.

  • Client RSSI—Minimum RSSI for a client to respond to a probe.

• Load Balancing Configurations—Load balancing maintains fair distribution of clients across APs. You can configure the following parameters:

  • Window—Load balancing sets client association limits by enforcing a client window size. For example, if the window size is defined as 3, assuming fair client distribution across the floor area, then an AP should have no more than 3 clients associated with it than the group average.

  • Denial—The denial count sets the maximum number of association denials during load balancing.

• Coverage Hole Mitigation Configurations—You can configure the following parameters:

  • Data RSSI—Minimum receive signal strength indication (RSSI) value for data packets received by the access point. The value that you enter is used to identify coverage holes (or areas of poor coverage) within your network.

  • Voice RSSI—Minimum receive signal strength indication (RSSI) value for voice packets received by the access point.

  • Coverage Exception—Percentage of clients on an access point that are experiencing a low signal level but cannot roam to another access point. If an access point has more number of such clients than the configured coverage level it triggers a coverage hole event.

  • Coverage Level—Minimum number of clients on an access point with an RSSI value at or below the data or voice RSSI threshold to trigger a coverage hole exception.

Page 21

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Page 22

Page 23

Page 24

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Page 25

The band select algorithm affects clients that use 2.4-GHz band. Initially, when a client sends a probe request to an access point, the corresponding client probe’s Active and Count values (as seen from the band select table) become 1. The algorithm functions based on the following scenarios:

• Scenario1: Client RSSI (as seen from the show cont d0/d1 | begin RSSI command output) is greater than both Mid RSSI and Acceptable Client RSSI.

  • Dual-band clients: No 2.4-GHz probe responses are seen at any time; 5-GHz probe responses are seen for all 5-GHz probe requests.

  • Single-band (2.4-GHz) clients: 2.4-GHz probe responses are seen only after the probe suppression cycle.

  • After the client’s probe count reaches the configured probe cycle count, the algorithm waits for the Age Out Suppression time and then marks the client probe’s Active value as 0. Then, the algorithm is restarted.

• Scenario2: Client RSSI (as seen from show cont d0/d1 | begin RSSI ) lies between Mid-RSSI and Acceptable Client RSSI.

  • All 2.4-GHz and 5-GHz probe requests are responded to without any restrictions.

  • This scenario is similar to the band select disabled.

Note

The client RSSI value (as seen in the sh cont d0 | begin RSSI command output) is the average of the client packets received, and the Mid RSSI feature is the instantaneous RSSI value of the probe packets. As a result, the client RSSI is seen as weaker than the configured Mid RSSI value (7-dB delta). The 802.11b probes from the client are suppressed to push the client to associate with the 802.11a band.

Page 26

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.