Stackvora.tech

Create an SSID on Cisco WLC

Detailed guide on creating a new SSID on Cisco WLCs (2500, 3500, 5500, 9800 Series) with WPA2-Enterprise, RADIUS integration, FlexConnect, and common configurations.

Creating a new Wireless Local Area Network (WLAN), commonly known as an SSID, on a Cisco Wireless LAN Controller (WLC) involves configuring various parameters across security, networking, and advanced settings. This guide focuses on the typical steps for setting up a secure enterprise SSID using WPA2-Enterprise with 802.1X authentication, applicable to AireOS WLCs (e.g., 2500, 3500, 5500 Series) and Catalyst 9800 Series WLCs.

WLAN Creation Fundamentals

The initial step is to define the basic properties of your SSID, including its name, ID, and type. These settings determine how the SSID is broadcast and its fundamental operational mode.

AireOS WLC (CLI/GUI)

On AireOS WLCs, you navigate to WLANs in the GUI. Click Create New to start the wizard.

  • Type: Select WLAN.
  • Profile Name: A descriptive name for the WLAN on the WLC (e.g., Corp_Employees). This is for WLC internal identification.
  • SSID: The actual name broadcast to clients (e.g., Corporate-WiFi). Can be different from the Profile Name.
  • WLAN ID: A unique identifier (1-512 for most AireOS, 1-16 for older models). Choose an available ID.
(Cisco Controller) > config wlan create <wlan-id> <profile-name> <ssid>
(Cisco Controller) > config wlan enable <wlan-id>

Catalyst 9800 Series WLC (CLI/GUI)

For Catalyst 9800s, navigate to Configuration > WLANs. Click + Add.

  • Profile Name: Internal WLC name (e.g., Corp_Employees_WLAN).
  • SSID: Broadcast name (e.g., Corporate-WiFi).
  • WLAN ID: Automatically assigned or manually selected.
9800-WLC# conf t
9800-WLC(config)# wireless profile wlan <profile-name>
9800-WLC(config-wireless-wlan-profile)# ssid <ssid>
9800-WLC(config-wireless-wlan-profile)# enable
9800-WLC(config-wireless-wlan-profile)# end

Security Configuration: WPA2-Enterprise (802.1X)

For robust security, WPA2-Enterprise with 802.1X (using a RADIUS server) is the standard. This mandates individual user authentication.

AireOS WLC

In the WLAN configuration, navigate to the Security tab, then Layer 2.

  • Layer 2 Security: Select WPA + WPA2 or specifically WPA2.
  • WPA2 Policy: Select 802.1X. Ensure AES (CCMP) is enabled for encryption.
  • Auth Key Management: Select 802.1X.

Under the AAA Servers tab:

  • Select your primary RADIUS server from the dropdown.
  • (Optional) Add secondary and tertiary RADIUS servers for redundancy.
  • Ensure Authentication CallPoint is enabled (default).
  • For specific use cases (e.g., guest portals), you might enable NAC State or RADIUS NAC, but for a standard enterprise WLAN, this is typically left disabled.
(Cisco Controller) > config wlan security wpa wpa2 enable <wlan-id>
(Cisco Controller) > config wlan security wpa wpa2 ciphers aes enable <wlan-id>
(Cisco Controller) > config wlan security wpa akm 8021x enable <wlan-id>
(Cisco Controller) > config wlan aaa auth-list <wlan-id> <radius-auth-list-name>

The radius-auth-list-name refers to a pre-configured RADIUS server group under Security > AAA > Radius > Authentication.

Catalyst 9800 Series WLC

After creating the WLAN profile, associate a security policy. Navigate to Configuration > Security > AAA > AAA Method List. Create an authentication method list if one doesn't exist, e.g., WLAN-Auth-List.

9800-WLC(config)# aaa new-model
9800-WLC(config)# aaa authentication dot1x WLAN-Auth-List group <radius-server-group-name> local
9800-WLC(config)# aaa authorization network WLAN-Auth-List group <radius-server-group-name>

Then, apply this to the WLAN profile:

9800-WLC# conf t
9800-WLC(config)# wireless profile policy <policy-profile-name>
9800-WLC(config-wireless-policy-profile)# security auth-list <WLAN-Auth-List>
9800-WLC(config-wireless-policy-profile)# security dot1x
9800-WLC(config-wireless-policy-profile)# security wpa2-akm dot1x
9800-WLC(config-wireless-policy-profile)# security wpa2-ciphers aes
9800-WLC(config-wireless-policy-profile)# vlan <vlan-id>

And link the WLAN profile to the policy profile:

9800-WLC(config)# wireless tag policy <policy-tag-name>
9800-WLC(config-wireless-policy-tag)# wlan <profile-name> policy <policy-profile-name>
9800-WLC(config-wireless-policy-tag)# exit
9800-WLC(config)# wireless tag site <site-tag-name>
9800-WLC(config-wireless-site-tag)# policy-tag <policy-tag-name>
9800-WLC(config-wireless-site-tag)# ap-profile <default-ap-profile>
9800-WLC(config-wireless-site-tag)# exit
9800-WLC(config)# ap <ap-name> policy-tag <policy-tag-name> site-tag <site-tag-name>

This tag-based architecture for 9800 WLCs allows for flexible assignment of WLANs to APs and policy profiles.

Interface and VLAN Mapping

Each WLAN needs to be mapped to a Layer 3 interface on the WLC, which in turn maps to a VLAN on your wired network. This defines the subnet and routing for clients connecting to the SSID.

AireOS WLC

In the WLAN configuration, under the General tab, select the appropriate Interface/Interface Group from the dropdown. This interface must be pre-configured under Controller > Interfaces with the correct VLAN ID and IP addressing.

(Cisco Controller) > config wlan interface <wlan-id> <interface-name>

Catalyst 9800 Series WLC

On 9800 Series WLCs, VLAN mapping is done within the Policy Profile. As shown above, use vlan <vlan-id> in the policy profile configuration. If using a VLAN interface on the WLC, ensure it's configured under Configuration > Interface.

Advanced Settings and FlexConnect

Advanced settings cover various operational aspects, including client load balancing, bandwidth management, and specific deployment modes like FlexConnect.

AireOS WLC

Under the WLAN configuration's Advanced tab:

  • Allow AAA Override: Enable this if your RADIUS server will return VLAN IDs, QoS profiles, or ACLs to override WLC settings. Essential for dynamic VLAN assignment.
  • DHCP Address Assignment: If using a DHCP server other than the WLC, ensure DHCP Server is set to Default or specify an external DHCP server.
  • Client Exclusion: Can be used to temporarily block misbehaving clients.
  • FlexConnect Local Switching: If your APs are deployed in FlexConnect mode (formerly H-REAP) and you want client traffic to be switched locally at the AP site (rather than tunneled back to the WLC), enable this. This is critical for branch office deployments to minimize WAN utilization and provide local access even if the WLC connection is down. When enabled, ensure the APs are configured for FlexConnect, and local VLANs are mapped correctly on the AP.
  • FlexConnect Local Authentication: (Optional) For FlexConnect deployments, enables local authentication against a local RADIUS server or local EAP if the WAN link to the central WLC's RADIUS server is down.
(Cisco Controller) > config wlan aaa-override enable <wlan-id>
(Cisco Controller) > config wlan flexconnect local-switching enable <wlan-id>
(Cisco Controller) > config wlan flexconnect local-auth enable <wlan-id>

Catalyst 9800 Series WLC

Advanced settings are largely configured within the Policy Profile and AP Profile.

  • AAA Override: Enabled via aaa override command within the policy profile or security aaa override.
  • FlexConnect Local Switching (Central/Local Switching): This is defined at the WLAN-to-policy-profile mapping. If you want local switching, the policy profile should not have no client vlan <vlan-id> and the AP profile should have flexconnect vlan <vlan-id> configured for the relevant VLANs.
  • FlexConnect Local Authentication: Configured in the AP profile, allowing APs to perform local authentication.
9800-WLC(config-wireless-policy-profile)# aaa override
9800-WLC(config-wireless-policy-profile)# central switching  ! For centralized switching
9800-WLC(config-wireless-policy-profile)# no central switching ! For local switching (FlexConnect)

9800-WLC(config)# wireless profile ap <ap-profile-name>
9800-WLC(config-wireless-ap-profile)# flexconnect local-authentication
9800-WLC(config-wireless-ap-profile)# flexconnect vlan <vlan-id> native <native-vlan-id>

Applying and Verifying the WLAN

After configuring, ensure the WLAN is enabled and mapped to the appropriate AP groups/tags for broadcast.

AireOS WLC

On the General tab of the WLAN configuration, ensure Status is set to Enabled. Then, navigate to WLANs > Advanced > AP Groups and map the WLAN to the desired AP groups. Each AP group can have different WLANs enabled and different radio policy.

(Cisco Controller) > config wlan enable <wlan-id>
(Cisco Controller) > config wlan apgroup add <wlan-id> <apgroup-name>

Catalyst 9800 Series WLC

The WLAN is enabled when linked to a Policy Profile and subsequently to an AP Tag. Ensure the APs themselves have the correct Site Tag and Policy Tag applied. Use show wireless summary and show wireless wlan summary to verify.

9800-WLC# show wireless wlan summary
9800-WLC# show wireless tag policy summary
9800-WLC# show wireless tag site summary
9800-WLC# show wireless client summary

Common Pitfalls

  • WLAN ID Conflict: Ensure the chosen WLAN ID is unique and not in use.
  • RADIUS Server Mismatch: Incorrect shared secret, IP address, or port (default 1812/UDP for Auth, 1813/UDP for Acct).
  • VLAN Mismatches: The VLAN ID configured on the WLC interface (or policy profile) must match the trunk configuration on the upstream switch ports connected to the WLC and the APs (if local switching).
  • FlexConnect Misconfiguration: If FlexConnect Local Switching is enabled, but the AP is not in FlexConnect mode, or VLAN mappings are incorrect, clients will fail to obtain IP addresses.
  • AAA Override Issues: If AAA override is enabled but the RADIUS server is not sending a Tunnel-Private-Group-ID (VLAN ID) or similar attributes, clients might get stuck in the default VLAN.
  • AP Group/Tag Assignment: If a WLAN is enabled but not associated with an AP group (AireOS) or policy tag (9800 Series) that is applied to the APs, the SSID will not be broadcast.

Back to the knowledge base · Ask the AI assistant