This document describes the procedure to configure workgroup bridge (WGB) on a Cisco access point (AP) and to validate the configurations.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Step 1. Configure a WLAN on the WLC to be used for the WGB.
On the WLC navigate to Configuration > Tags & Profiles > WLANs > click + Add as shown in the image.

Give a name to your WLAN and make sure it is enabled.

Navigate to Security tab and select the desired security settings for the created WGB SSID. For the purpose of this document an open SSID was created. Nevertheless, other security options can be created as well.
Warning: Please ensure that the security settings match between the SSID on the WLC and the WGB AP SSID-profile (this profile is configured later in the document on the WGB AP).

Go to the Advanced tab and make sure the CCX Aironet IE is enabled. Then click Apply to Device.

After the WLAN Profile is created, create a Policy Profile for that WLAN. For that, navigate to Configuration > Tags & Profiles > Policy > click + Add.

Enter a name for the policy profile in the General tab and ensure the policy profile is enabled.

Navigate to Access Policies tab and assign a VLAN to your Policy Profile.

Navigate to Advanced tab, scroll down to the WGB Parameters section and select Broadcast Tagging and WGB VLAN options. Then click Apply to Device.

After that, map the policy profile to the WLAN profile. Navigate to Configuration > Tags & Profiles > Tags > click + Add.

Enter a name for the policy tag. Then click + Add.

Scroll down to Map WLAN and Policy section and select the earlier created WLAN policy profiles. Then click ✓.

After ensuring that the mapping was added to the table, click Apply to Device.

Step 2. Configure an AP in WGB mode.
Convert the AP from CAPWAP to WGB type.
WGB_AP#ap-type workgroup-bridge
Configure an IP address for the WGB AP.
For a DHCP IP address:
WGB_AP#configure ap address ipv4 dhcp
For a static IP address:
WGB_AP#configure ap address ipv4 static <ip-address> <netmask> <gateway-ip-address>
Configure an SSID-profile on the WGB AP.
WGB_AP#configure ssid-profile <ssid-profile-name> ssid <radio-SSID> authentication <eap/opem/owe/psk/sae>
Attach the SSID-profile to a radio interface.
WGB_AP#configure dot11Radio <radio-interface-number> mode wgb ssid-profile <configured-ssid-profile-name>
Enable the configured radio on the WGB AP.
WGB_AP#configure dot11Radio 1 enable
After that, the WGB AP connects to the root AP. It is possible to verify from the WLC that the configuration was successful.
On the WLC the WGB AP is seen as a connected wireless client. In the same table the wired clients that are connected through the WGB AP are seen as well.
Example:

Tip: Before proceeding with the configurations on the WGB AP ensure that the AP has a country code configured on it (can be verified with the command "show controllers dot11Radio"), for example:
WGB_AP#show controllers dot11Radio 1
wifi1 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:2699
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Radio Info Summary:
==============================
Radio: 5.0GHz
Carrier Set: (-E) Belgium ( BE)
Tip: If the country code is not configured, convert the AP to CAPWAP mode, join it to a WLC and ensure that the country code is configured. After that, convert the AP to the WGB mode and proceed with the configurations.
You can use these commands to verify the current configurations.
On the WGB AP:
#show wgb ssid
Successful configuration output example:
Configured SSIDs details:
SSID-Profile SSID Authentication DTIM
================================================================================
WGB_ssid_profile "WGB" OPEN 1
#show wgb dot11 associations
Successful configuration output example:
Uplink Radio ID : 1
Uplink Radio MAC : XX:XX:XX:XX:XX:XX
SSID Name : WGB
Connected Duration : 0 hours, 2 minutes, 14 seconds
Parent AP Name : APXXXX.XXXX.XXXX
Parent AP MAC : XX:XX:XX:XX:XX:XX
Uplink State : CONNECTED
Auth Type : OPEN
Dot11 type : 11ax
Channel : 112
Bandwidth : 40 MHz
Current Datarate (Tx/Rx) : 309/195 Mbps
Max Datarate : 1147 Mbps
RSSI : 65
IP : XX.XX.XX.XXX/24
Default Gateway : XX.XX.XX.XXX
IPV6 : ::/128
Assoc timeout : 5000 Msec
Auth timeout : 5000 Msec
Dhcp timeout : 60 Sec
Country-code : BE
#show wgb event all
Collect debugs
On the WGB AP:
After applying the configurations, if the WGB AP is not connecting to the root AP, enable the debug to obtain more details on the reason of the failure:
#debug wgb uplink all
Example of a successful connection output:
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.0356] DOT11_UPLINK_EV: Scan Started ON SLOT 1
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.0357] DOT11_UPLINK_EV: Uplink state changed [DOT11_UPLINK_STOPPED] to [DOT11_UPLINK_SCAN_START]
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.0358] DOT11_UPLINK_EV: Set BH root port(hop 00:00:00:00:00:00) to state PORT_STATE_AUTH
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.0358] DOT11_UPLINK_SCAN: Uplink Scan Started in Dot11Radio1.
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.0362] DOT11_UPLINK_SCAN: Enable passive scan on channel 100
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.0632] Radio configuration has been saved successfully
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.0633]
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.1492] DOT11_UPLINK_SCAN: Enable passive scan on channel 104
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.2895] DOT11_UPLINK_SCAN: Enable passive scan on channel 108
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.4298] DOT11_UPLINK_SCAN: Enable passive scan on channel 112
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.4933] DOT11_UPLINK_SCAN:[*06/19/2026 13:17:00.6489] DOT11_UPLINK_EV: Calling RSSI get for XX:XX:XX:XX:XX:XX
[*06/19/2026 13:17:00.6494] DOT11_UPLINK_EV: parent_rssi: -65, configured low rssi: -70
Rcvd Beacon from XX:XX:XX:XX:XX:XX channel 112 Time 36143
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.4934] DOT11_UPLINK_SCAN: Received Beacon and going to do Active Scan
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.4934] DOT11_UPLINK_SCAN: Sending probe request on channel 112
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.4934] WGB Classifier: Dot11UplinkClassifier: Downstream packet fc 40 Len 39 MAC FF:FF:FF:FF:FF:FF
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.4935] WGB Classifier: Dot11UplinkClassifier: Tx sent to Uplink Access-Point 40 slot 1
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.4952] DOT11_UPLINK_SCAN: Rcvd Probe Response from XX:XX:XX:XX:XX:XX channel 112 Time 38014
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.4952] DOT11_UPLINK_SCAN: WGB_SCAN_STATUS: Received Probe response
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.5266] DOT11_UPLINK_SCAN: Enable passive scan on channel 116
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.6657] DOT11_UPLINK_SCAN: Enable passive scan on channel 120
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.8046] DOT11_UPLINK_SCAN: Enable passive scan on channel 124
Jun 19 12:57:39 WGB_AP kernel: [*06/19/2026 12:57:39.9436] DOT11_UPLINK_SCAN: Enable passive scan on channel 128
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.0827] DOT11_UPLINK_SCAN: Enable passive scan on channel 132
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.2218] DOT11_UPLINK_SCAN: Enable passive scan on channel 136
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.3609] DOT11_UPLINK_SCAN: Enable passive scan on channel 140
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4983] DOT11_UPLINK_SCAN: End of channel list
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4984] DOT11_UPLINK_SCAN: An AP responded, try to assoc to the best one
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4984] DOT11_UPLINK_SCAN: Uplink Scan stopped in Dot11Radio1
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4984] DOT11_UPLINK_SCAN: Choosing best AP
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4985] DOT11_UPLINK_SCAN: Selected best AP : XX:XX:XX:XX:XX:XX
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4985] DOT11_UPLINK_SCAN: Best AP : XX:XX:XX:XX:XX:XX , Channel : 112 , RSSI : 66
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4985] DOT11_UPLINK_SCAN: HD IE not present!
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4986] DOT11_UPLINK_SCAN: WME capable 1
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4986] DOT11_UPLINK_SCAN: Scan done.Starting Authentication power 30
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4987] DOT11_UPLINK_EV: Uplink state changed [DOT11_UPLINK_SCAN_START] to [DOT11_UPLINK_SCAN_DONE]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4988] DOT11_UPLINK_EV: Set BH root port(hop 00:00:00:00:00:00) to state PORT_STATE_AUTH
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.4995] DOT11_UPLINK_EV: existing channel 140, target channel 112
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5001] DOT11_UPLINK_EV: existing channel 140, target channel 112 waiting for 100ms
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5168] DOT11_UPLINK_CONFIG: get tx_pow_lvl 1 by txpower 30
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5433] DOT11_UPLINK_EV: Channel event on slot 1 channel 112 uplink state 5
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5541] DOT11_UPLINK_EV: Channel event on slot 1 channel 112 uplink state 5
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5655] DOT11_UPLINK_EV: Handling auth delay for channel 112. Start connection.
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5718] DOT11_UPLINK_CONFIG: get tx_pow_lvl 1 by txpower 30
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5719] DOT11_UPLINK_EV: Starting Connection (uplink)addr1[XX:XX:XX:XX:XX:XX], (bssid)addr2[XX:XX:XX:XX:XX:XX]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5719] WGB_UPLINK_SEC: New roamed parent : XX:XX:XX:XX:XX:XX
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5719] WGB_UPLINK_SEC: WPAS process does not exist for bssid send uplink XX:XX:XX:XX:XX:XX
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5719] DOT11_UPLINK_EV: Uplink state changed [DOT11_UPLINK_SCAN_DONE] to [DOT11_UPLINK_AUTHENTICATING]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5721] WGB Classifier: Dot11UplinkClassifier: Downstream packet fc b0 Len 30 MAC XX:XX:XX:XX:XX:XX
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5721] WGB Classifier: Dot11UplinkClassifier: Tx sent to Uplink Access-Point b0 slot 1
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5723] DOT11_UPLINK_EV: Auth request sent!
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5753] DOT11_UPLINK_EV: Channel event on slot 1 channel 112 uplink state 5
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5753] DOT11_UPLINK_EV: Channel 112 set response from driver in state DOT11_UPLINK_AUTHENTICATING. Ignore this event
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5764] DOT11_UPLINK_EV: Channel event on slot 1 channel 112 uplink state 5
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.5765] DOT11_UPLINK_EV: Channel 112 set response from driver in state DOT11_UPLINK_AUTHENTICATING. Ignore this event
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6035] WGB Classifier: Dot11UplinkClassifier: Rx sent to WGB Uplink b0
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6036] DOT11_UPLINK_EV: Auth Response (uplink)addr1[XX:XX:XX:XX:XX:XX], (bssid)addr2[XX:XX:XX:XX:XX:XX] status code [0]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6036] DOT11_UPLINK_EV: Uplink state changed [DOT11_UPLINK_AUTHENTICATING] to [DOT11_UPLINK_ASSOCIATING]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6038] DOT11_UPLINK_EV: Assoc. Req. addr1[XX:XX:XX:XX:XX:XX], (bssid)addr2[XX:XX:XX:XX:XX:XX]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6038] DOT11_UPLINK_EV: set_ht_cap_ie_fields: Adding HT Information element to Assoc request slot_id 1
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6038] DOT11_UPLINK_EV: set_vht_cap_ie_fields: Adding VHT Information element to Assoc request slot_id 1
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6038] DOT11_UPLINK_EV: VhtCapInfo=865069494
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6039] DOT11_UPLINK_EV: set_he_cap_ie_fields: Adding HE Information element to Assoc request slot_id 1 channel width 160
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6039] DOT11_UPLINK_EV: set_he_cap_ie_fields: Setting HE MCS NSS map index 1
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6039] DOT11_UPLINK_EV: Added system name : in assoc req.
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6039] DOT11_UPLINK_EV: Added static IP address : XX.XX.XX.XXX in assoc req.
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6040] WGB Classifier: Dot11UplinkClassifier: Downstream packet fc 0 Len 210 MAC XX:XX:XX:XX:XX:XX
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6040] WGB Classifier: Dot11UplinkClassifier: Tx sent to Uplink Access-Point 0 slot 1
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6041] DOT11_UPLINK_EV: Sent Assoc. Req. (uplink)addr1[XX:XX:XX:XX:XX:XX], (bssid)addr2[XX:XX:XX:XX:XX:XX]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6100] WGB Classifier: Dot11UplinkClassifier: Rx sent to WGB Uplink 10
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6101] DOT11_UPLINK_EV: Assoc Response (uplink)addr1[XX:XX:XX:XX:XX:XX], (bssid)addr2[XX:XX:XX:XX:XX:XX] status code [0]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6102] DOT11_UPLINK_EV: Uplink state changed [DOT11_UPLINK_ASSOCIATING] to [DOT11_UPLINK_DHCP]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6108] DOT11_UPLINK_EV: Set BH root port(hop XX:XX:XX:XX:XX:XX) to state PORT_STATE_AUTH
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6118] wlan: [10239:I:ANY] ieee80211_ucfg_setparam_util: adding local peer
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6124] DOT11_UPLINK_EV: Set BH root port(hop XX:XX:XX:XX:XX:XX) to state PORT_STATE_OPEN
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6130] DOT11_UPLINK_EV: Static IP address configured
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6131] DOT11_UPLINK_EV: Uplink state changed [DOT11_UPLINK_DHCP] to [DOT11_UPLINK_CONNECTED]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6241] route: SIOCADDRT: File exists
Jun 19 12:57:40 WGB_AP odhcp6c[186731]: in timer_init.
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6761] odhcp6c[186731]: in timer_init.
Jun 19 12:57:40 WGB_AP odhcp6c[186735]: (re)starting transaction on srcr2
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6782] DOT11_UPLINK_EV: Odhcp6c process started
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6784] DOT11-UPLINK_ESTABLISHED: Interface Dot11Radio1, Associated To AP AP84F1.47D9.BBEC XX:XX:XX:XX:XX:XX [None]
Jun 19 12:57:40 WGB_AP kernel: [*06/19/2026 12:57:40.6786] DOT11_UPLINK_EV: Peer assoc event received from driver
Jun 19 12:57:41 WGB_AP odhcp6c[186735]: Starting SOLICIT transaction (timeout 4294967295s, max rc 0)
Jun 19 12:57:41 WGB_AP odhcp6c[186735]: odhcp6c_update_entry state = 16, valid = 1800, preferred = 1800
Jun 19 12:57:41 WGB_AP odhcp6c[186735]: odhcp6c_update_entry state = 16, valid = 2592000, preferred = 604800
Jun 19 12:57:41 WGB_AP odhcp6c[186735]: odhcp6c_update_entry state = 17, valid = 2592000, preferred = 604800
Jun 19 12:57:43 WGB_AP kernel: [*06/19/2026 12:57:43.6386] ip6_port srcr2, ip6local XXXX::XXXX:XXXX:XXXX:XXXX, ip6 ::, plen 0, gw6 XXXX::XXXX:XXXX:XXXX:XXXX, gw6_mac XX:XX:XX:XX:XX:XX, mtu 1500, vid 0, mode6 2(slaac)
Jun 19 12:58:00 WGB_AP kernel: [*06/19/2026 12:58:00.6134] DOT11_UPLINK_EV: Calling RSSI get for XX:XX:XX:XX:XX:XX
Jun 19 12:58:00 WGB_AP kernel: [*06/19/2026 12:58:00.6138] DOT11_UPLINK_EV: parent_rssi: -63, configured low rssi: -70
Jun 19 12:58:20 WGB_AP kernel: [*06/19/2026 12:58:20.6140] DOT11_UPLINK_EV: Calling RSSI get for XX:XX:XX:XX:XX:XX
Jun 19 12:58:20 WGB_AP kernel: [*06/19/2026 12:58:20.6145] DOT11_UPLINK_EV: parent_rssi: -63, configured low rssi: -70
Jun 19 12:58:40 WGB_AP kernel: [*06/19/2026 12:58:40.6147] DOT11_UPLINK_EV: Calling RSSI get for XX:XX:XX:XX:XX:XX
Jun 19 12:58:40 WGB_AP kernel: [*06/19/2026 12:58:40.6152] DOT11_UPLINK_EV: parent_rssi: -64, configured low rssi: -70
Jun 19 12:59:00 WGB_AP kernel: [*06/19/2026 12:59:00.6154] DOT11_UPLINK_EV: Calling RSSI get for XX:XX:XX:XX:XX:XX
Jun 19 12:59:00 WGB_AP kernel: [*06/19/2026 12:59:00.6158] DOT11_UPLINK_EV: parent_rssi: -64, configured low rssi: -70
Jun 19 12:59:20 WGB_AP kernel: [*06/19/2026 12:59:20.6161] DOT11_UPLINK_EV: Calling RSSI get for XX:XX:XX:XX:XX:XX
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
01-Jul-2026
|
Initial Release |