WLC ports and WLAN planning

WLC ports and WLAN planning

Management of Cisco APs is usually done by connecting to the WLC in a web browser (HTTP/HTTPS). For initial boot monitoring or quick, basic changes, you can also use a direct serial console connection. Once an AP is online and has a management IP address, you can use Telnet or (preferably) SSH to access the Command Line Interface (CLI) over the wired network.

There are two software platforms that Cisco WLCs are typically deployed on. Modern WLCs such as the Catalyst 9800 run on IOS-XE. Older WLCs run on Cisco’s AireOS platform.

WLC physical and logical ports WLCs include several port types that support network connectivity and management.

• Physical Ports:
  • Serial (Console) Port: Used for initial setup and troubleshooting.
  • Ethernet Service Port: Provides out-of-band management access via SSH or the GUI (web browser).
  • Redundancy Port: A dedicated physical interface used for High Availability (HA) setups (like SSO). It synchronizes bulk/incremental data, negotiates roles, and carries keep-alive messages between Active and Standby controllers.
  • Ethernet (Data) Ports: The primary ports for most traffic, including control and data CAPWAP tunnels to APs, plus in-band management traffic. On AireOS controllers, these are called distribution system ports (referring to the wired network).
  • Trunking and LAG: WLC Ethernet ports must carry traffic for many VLANs, so they should be configured for 802.1Q trunking. For resiliency and load balancing (and additional bandwidth), you can bundle multiple Ethernet ports into a Link Aggregation Group (LAG), similar to an EtherChannel on a switch. The connected switchports must also be configured as an EtherChannel. Image 256 Image Title - Image of WLC and its physical ports
• Logical Ports (Interfaces):
  • Dynamic Interfaces: Used to map wired VLANs to wireless LANs. AireOS controllers require an IP address, subnet mask, default gateway, and DHCP server configuration for each dynamic interface (per VLAN). IOS-XE controllers, on the other hand, treat these as Layer 2, meaning the controller doesn’t need an IP address for each VLAN.
  • Wireless Management Interface (WMI): Handles in-band management traffic, including RADIUS authentication, SSH, GUI administration (via the web browser: HTTP), SNMP monitoring, syslog messages, NTP synchronization, and inter-controller communication. It also terminates CAPWAP tunnels from APs. It requires an IP address, subnet mask, and default gateway. On IOS-XE controllers, the WMI is often a Switched Virtual Interface (SVI).
  • Virtual Interface: Used for specific client-facing operations, such as relaying DHCP requests to a DHCP server or supporting client mobility. Clients perceive the controller’s virtual interface address as the DHCP server. This address is never used for controller-to-network device communication and should be configured with a non-routable, unpingable IP address (e.g., 1.1.1.1), or a non-routable private IP address used strictly for the Virtual Interface. For seamless client roaming, all controllers in the same mobility group should use an identical virtual interface address.

Accessing the WLC GUI

To configure a WLC, you typically use its web-based Graphical User Interface (GUI). Open a browser and navigate to the WLC’s management IP address using HTTP or HTTPS.

This assumes the controller has already been given an initial configuration (including a management IP address). For HTTPS access, the controller must also have a valid SSL certificate available for the connection.

Both the GUI and CLI require user authentication. Authentication can be handled by:

• A local user database on the controller
• External Authentication, Authorization and Accounting (AAA) servers such as TACACS+ or RADIUS

We will discuss AAA, TACACS+ and RADIUS in more detail in the Security chapters.

After you log in to an IOS-XE controller, you’ll land on a dashboard. To make configuration changes, select Configuration from the left-side menu. On AireOS controllers, click the Advanced link in the upper-right corner to access configuration options.

Image 257

Image Title - Image of WLC logon screen

The GUI layout differs between platforms:

• IOS-XE controllers show a vertical list of configuration categories on the left.
• AireOS controllers use tabs across the top, with function lists on the left.

Even though the navigation looks different, both platforms provide access to the same core wireless configuration settings.

Planning your WLAN deployment

Before you create WLANs, plan the design. WLANs (like VLANs) can separate users and traffic, but there are practical limits.

• WLAN Limits: Cisco controllers support a maximum of 512 WLANs, but only 16 can be actively used on a single AP. For best practice purposes however, it is recommended to configure 5 or fewer WLANs is ideal for efficiency.
• Airtime Consumption: Each WLAN requires APs to broadcast beacon management frames at regular intervals (typically 10 times per second) to advertise its existence. More WLANs mean more beacons, consuming valuable airtime, especially at lower mandatory data rates. Excessive beacons can starve the channel, impacting client data transmission. A general rule of thumb is to limit WLANs to five or fewer, with three being ideal.

Key parameters to plan for each WLAN include:

• The Service Set Identifier (SSID) string.
• The controller interface and corresponding VLAN number.
• The type of wireless security required.