-
Cisco Wireless LAN Controller Configuration Guide, Release 7.2
-
Preface
-
Chapter 1 - Overview
-
Chapter 2 - Using the Web-Browser and CLI Interfaces
-
Chapter 3 - Configuring Ports and Interfaces
-
Chapter 4 - Configuring Controller Settings
-
Chapter 5 - Configuring Video Streams
-
Chapter 6 - Configuring Security Solutions
-
Chapter 7 - Working with WLANs
-
Chapter 8 - Controlling Lightweight Access Points
-
Chapter 9 - Controlling Mesh Access Points
-
Chapter 10 - Managing Controller Software and Configurations
-
Chapter 11- Managing User Accounts
-
Chapter 12 - Configuring Radio Resource Management
-
Chapter 13 - Configuring Cisco CleanAir
-
Chapter 14 - Configuring Mobility Groups
-
Chapter 15 - Configuring FlexConnect
-
Chapter 16 - Configuring Mobile Concierge
-
Appendix A - Troubleshooting
-
Index
-
Feedback
Table Of Contents
Cisco Unified Wireless Network Solution Overview
Multiple-Controller Deployments
Cisco WLAN Solution Wired Security
Cisco Wireless LAN Controllers
Cisco Flex 7500 Series Controller
Cisco Wireless Services Module 2
Cisco Wireless Controller on Cisco Services-Ready Engine (SRE)
Cisco UWN Solution Wired Connections
Cisco Wireless LAN Controller Memory
Cisco Wireless LAN Controller Failover Protection
Overview
This chapter describes the controller components and features. It contains these sections:
•
Cisco Unified Wireless Network Solution Overview
•
•
•
•
•
Cisco Unified Wireless Network Solution Overview
The Cisco Unified Wireless Network (Cisco UWN) solution is designed to provide 802.11 wireless networking solutions for enterprises and service providers. The Cisco UWN solution simplifies deploying and managing large-scale wireless LANs and enables a unique best-in-class security infrastructure. The operating system manages all data client, communications, and system administration functions, performs radio resource management (RRM) functions, manages system-wide mobility policies using the operating system security solution, and coordinates all security functions using the operating system security framework.
The Cisco UWN solution consists of Cisco wireless LAN controllers and their associated lightweight access points controlled by the operating system, all concurrently managed by any or all of the operating system user interfaces:
•
•
•
Note
•
The Cisco UWN solution supports client data services, client monitoring and control, and all rogue access point detection, monitoring, and containment functions. It uses lightweight access points, Cisco wireless LAN controllers, and the optional Cisco WCS to provide wireless services to enterprises and service providers.
Note
Figure 1-1 shows the Cisco wireless LAN controller components, which can be simultaneously deployed across multiple floors and buildings.
Figure 1-1 Cisco UWN Solution Components
Single-Controller Deployments
A standalone controller can support lightweight access points across multiple floors and buildings simultaneously and support the following features:
•
•
•
Some controllers use redundant Gigabit Ethernet connections to bypass single network failures.
Note
Figure 1-2 shows a typical single-controller deployment.
Figure 1-2 Single-Controller Deployment
Multiple-Controller Deployments
Each controller can support lightweight access points across multiple floors and buildings simultaneously. However, full functionality of the Cisco wireless LAN solution occurs when it includes multiple controllers. A multiple-controller system has the following additional features:
•
•
•
Figure 1-3 shows a typical multiple-controller deployment. The figure also shows an optional dedicated management network and the three physical connection types between the network and the controllers.
Figure 1-3 Typical Multiple-Controller Deployment
Operating System Software
The operating system software controls controllers and lightweight access points. It includes full operating system security and radio resource management (RRM) features.
Operating System Security
Operating system security bundles Layer 1, Layer 2, and Layer 3 security components into a simple, Cisco WLAN solution-wide policy manager that creates independent security policies for each of up to 16 wireless LANs. See "Cisco UWN Solution WLANs" section.
The 802.11 Static WEP weaknesses can be overcome using the following robust industry-standard security solutions:
•
•
–
–
•
•
The WEP problem can be further solved using the following industry-standard Layer 3 security solutions:
•
•
•
•
These and other security features use industry-standard authorization and authentication methods to ensure the highest possible security for your business-critical wireless LAN traffic.
Cisco WLAN Solution Wired Security
Each controller and lightweight access point is manufactured with a unique, signed X.509 certificate. These signed certificates are used to verify downloaded code before it is loaded, ensuring that hackers do not download malicious code into any controller or lightweight access point.
The controllers and lightweight access points also use the signed certificates to verify the downloaded code before it is loaded, ensuring that hackers do not download malicious code into any Cisco wireless controller or lightweight access point.
Layer 2 and Layer 3 Operation
Lightweight Access Point Protocol (LWAPP) communications between the controller and lightweight access points can be conducted at Layer 2 or Layer 3. Control and Provisioning of Wireless Access Points protocol (CAPWAP) communications between the controller and lightweight access points are conducted at Layer 3. Layer 2 mode does not support CAPWAP.
Note
Note
Operational Requirements
The requirement for Layer 3 LWAPP communications is that the controller and lightweight access points can be connected through Layer 2 devices on the same subnet or connected through Layer 3 devices across subnets. Another requirement is that the IP addresses of access points should be either statically assigned or dynamically assigned through an external DHCP server.
The requirement for Layer 3 CAPWAP communications across subnets is that the controller and lightweight access points are connected through Layer 3 devices. Another requirement is that the IP addresses of access points should be either statically assigned or dynamically assigned through an external DHCP server.
Configuration Requirements
When you are operating the Cisco wireless LAN solution in Layer 2 mode, you must configure a management interface to control your Layer 2 communications.
When you are operating the Cisco wireless LAN solution in Layer 3 mode, you must configure an AP-manager interface to control lightweight access points and a management interface as configured for Layer 2 mode.
Cisco Wireless LAN Controllers
When you are adding lightweight access points to a multiple-controller deployment network, it is convenient to have all lightweight access points associate with one master controller on the same subnet. That way, the you do not have to log into multiple controllers to find out which controller newly-added lightweight access points associated with.
One controller in each subnet can be assigned as the master controller while adding lightweight access points. As long as a master controller is active on the same subnet, all new access points without a primary, secondary, and tertiary controller assigned automatically attempt to associate with the master controller. This process is described in the "Cisco Wireless LAN Controller Failover Protection" section.
You can monitor the master controller using the WCS Web User Interface and watch as access points associate with the master controller. You can then verify the access point configuration and assign a primary, secondary, and tertiary controller to the access point, and reboot the access point so it reassociates with its primary, secondary, or tertiary controller.
Note
Client Location
When you use Cisco WCS in your Cisco wireless LAN solution, controllers periodically determine the client, rogue access point, rogue access point client, radio frequency ID (RFID) tag location and store the locations in the Cisco WCS database. For more information on location solutions, see these documents:
Cisco Wireless Control System Configuration Guide:
http://www.cisco.com/en/US/products/ps6305/products_installation_and_configuration_guides_list.html
Cisco Location Appliance Configuration Guide:
http://www.cisco.com/en/US/products/ps6386/products_installation_and_configuration_guides_list.html
Cisco 3300 Series Mobility Services Engine Configuration Guide:
http://www.cisco.com/en/US/products/ps9742/products_installation_and_configuration_guides_list.html
Controller Platforms
Controllers are enterprise-class high-performance wireless switching platforms that support 802.11a/n and 802.11b/g/n protocols. They operate under control of the operating system, which includes the radio resource management (RRM), creating a Cisco UWN solution that can automatically adjust to real-time changes in the 802.11 RF environment. Controllers are built around high-performance network and security hardware, resulting in highly reliable 802.11 enterprise networks with unparalleled security.
The following controllers are supported in software release 7.2:
•
•
•
•
Cisco 2500 Series Controller
The Cisco 2500 Series Wireless Controller works in conjunction with Cisco lightweight access points and the Cisco Wireless Control System (WCS) to provide system-wide wireless LAN functions. As a component of the Cisco Unified Wireless Network (CUWN), the Cisco 2500 Series controller provides real-time communication between a wireless access points and other devices to deliver centralized security policies, guest access, wireless intrusion prevention system (wIPS), context-aware (location), RF management, quality of services for mobility services such as voice and video, and OEAP support for the teleworker solution.
Cisco 2500 Series Wireless Controllers support up to 50 lightweight access points in increments of 5 and 25 access points with a minimum of 5 access points.
The Cisco 2500 Series Controller offers robust coverage with 802.11 a/b/g or delivers reliability using 802.11n and Cisco Next-Generation Wireless Solutions and Cisco Enterprise Wireless Mesh.
Features Not Supported
•
•
•
•
•
•
•
Cisco 5500 Series Controllers
The Cisco 5500 Series Wireless LAN Controller is currently available in one model: 5508. The 5508 controller supports up to 500 lightweight access points and 7000 wireless clients (or 5000 wireless clients and 2500 RFID tags when using the client location feature), making it ideal for large enterprises and high-density applications.
The Cisco 5500 Series Controller can be equipped with one or two power supplies. When the controller is equipped with two power supplies, the power supplies are redundant, and either power supply can continue to power the controller if the other power supply fails.
Features Not Supported
•
Note
•
•
•
•
•
•
Note
•
Note
Cisco Flex 7500 Series Controller
The Cisco Flex 7500 Series Controller enables you to deploy full featured, scalable, and secure FlexConnect network services across geographic locations. Cisco Flex 7500 Series Controller virtualizes the complex security, management, configuration and troubleshooting operations within the data center and then transparently extends those services to each store. Deployments using Cisco Flex 7500 Series Controller are easier for IT to set up, manage and scale.
The Cisco Flex 7500 Series Controller is designed to meet the scaling requirements to deploy the FlexConnect solution in branch networks. Cisco Unified Wireless Solution supports two major deployment models: FlexConnect and monitor mode. FlexConnect is designed to support wireless branch networks by allowing the data to be switched locally while the access points are being controlled and managed by a centralized controller. It aims at delivering a cost effective FlexConnect solution on a large scale.
The Cisco Flex 7500 Series Controller supports the following access points: 1140, 3500, 3600, 1250, 1260, 1040, 1130, 1240, 800 and the Cisco Aironet 600 Series OfficeExtend Access Point.
The Cisco Flex 7500 Series Controller provides the following features:
•
•
•
•
•
Note
Features Not Supported
These software features are not supported on Cisco Flex 7500 Series Controllers:
•
•
•
•
•
•
•
Cisco Wireless Services Module 2
The Cisco Wireless Services Module 2 (WiSM2) provides medium-sized to large single-site WLAN deployments with exceptional performance, security, and scalability to support mission-critical wireless business communications. It helps to lower hardware costs and offers flexible configuration options that can reduce the total cost of operations and ownership for wireless networks. Features include:
•
•
•
•
•
Features Not Supported
•
•
•
•
•
•
•
•
•
Cisco Wireless Controller on Cisco Services-Ready Engine (SRE)
The Cisco Wireless Controller application on the Cisco Services-Ready Engine (SRE) enables systemwide wireless functions in small to medium-sized enterprises and branch offices. Delivering 802.11n performance and scalability, the Cisco Wireless Controller on the SRE is an entry-level controller that provides low total cost of ownership and investment protection by integrating seamlessly with the existing network. The Cisco SRE Modules are router blades for the Cisco Integrated Services Routers Generation 2 (ISR G2), which allows you to provision the Cisco Wireless Controller applications on the module remotely at any time. This can help your organization to quickly deploy wireless on-demand, reduce operating costs, and consolidate the branch office infrastructure.
As a component of the Cisco Unified Wireless Network, this controller provides real-time communication between Cisco Aironet access points, the Cisco Wireless Control System (WCS), and the Cisco Mobility Services Engine (MSE) to deliver centralized security policies, wireless intrusion prevention system (wIPS) capabilities, award-winning RF management, context-aware capabilities for location tracking, and quality of service (QoS) for voice and video.
The Cisco Wireless LAN Controller on the Cisco SRE supports from five to 50 access points, and additional access point support may be added in increments of five or 25. The licensing structure supports a variety of business mobility needs as part of the basic feature set, including Enterprise Wireless Mesh, which allows access points to dynamically establish wireless connections in locations where it may be difficult or impossible to physically connect to the wired network.
The Cisco Wireless Controller application is available for Cisco SRE Internal Services Module (ISM) 300 and the Cisco SRE Service Module (SM) 700 and SM 900, with flexible licensing and deployment options.
Features Not Supported
•
•
•
•
•
•
•
Cisco UWN Solution Wired Connections
The Cisco UWN solution components communicate with each other using industry-standard Ethernet cables and connectors. Details of the wired connections are as follows:
•
•
•
•
Cisco UWN Solution WLANs
The Cisco UWN solution can control up to 512 WLANs for lightweight access points. Each WLAN has a separate WLAN ID (1 through 512), a separate profile name, and a WLAN SSID and can be assigned with unique security policies. The lightweight access points broadcast all active Cisco UWN solution WLAN SSIDs and enforce the policies defined for each WLAN.
Note
If management over wireless is enabled across the Cisco UWN solution, you can manage the system across the enabled WLAN using CLI and Telnet, http/https, and SNMP.
To configure WLANs, see Chapter 7 "Working with WLANs."
File Transfers
You can upload and download operating system code, configuration, and certificate files to and from the controller using the GUI, CLI, or Cisco WCS as follows:
•
•
http://www.cisco.com/en/US/products/ps6305/products_installation_and_configuration_guides_list.html
Power Over Ethernet
Lightweight access points can receive power through their Ethernet cables from 802.3af-compatible Power over Ethernet (PoE) devices, which can reduce the cost of discrete power supplies, additional wiring, conduits, outlets, and installation time. PoE frees you from having to mount lightweight access points or other powered equipment near AC outlets, which provides greater flexibility in positioning the access points for maximum coverage.
When you are using PoE, you run a single CAT-5 cable from each lightweight access point to PoE-equipped network elements, such as a PoE power hub or a Cisco WLAN Solution single-line PoE injector. When the PoE equipment determines that the lightweight access point is PoE-enabled, it sends 48 VDC over the unused pairs in the Ethernet cable to power the access point.
The PoE cable length is limited by the 100BASE-T or 10BASE-T specification to 100 m or 200 m, respectively.
Lightweight access points can receive power from an 802.3af-compliant device or from the external power supply.
Cisco Wireless LAN Controller Memory
The controller contains two kinds of memory: volatile RAM, which holds the current, active controller configuration, and NVRAM (nonvolatile RAM), which holds the reboot configuration. When you are configuring the operating system in controller, you are modifying volatile RAM; you must save the configuration from the volatile RAM to the NVRAM to ensure that the controller reboots in the current configuration.
Knowing which memory you are modifying is important when you are doing the following tasks:
•
•
•
•
•
Cisco Wireless LAN Controller Failover Protection
During installation, we recommend that you connect all lightweight access points to a dedicated controller, and configure each lightweight access point for final operation. This step configures each lightweight access point for a primary, secondary, and tertiary controller and allows it to store the configured mobility group information.
During failover recovery, the following tasks are performed:
•
•
•
In multiple-controller deployments, if one controller fails, the access points perform the following tasks:
•
•
•
•
When sufficient controllers are deployed, if one controller fails, active access point client sessions are momentarily dropped while the dropped access point associates with another controller, allowing the client device to immediately reassociate and reauthenticate.
To know more about high availability, see http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a00809a3f5d.shtml
