Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Device Credentials tab.

Step 3

From the left hierarchy tree, choose a site.

Step 4

Do one of these tasks:

Step 5

In the Manage Credentials slide-in pane, from the Add drop-down list, choose CLI.

Step 6

Complete the listed fields using this table:

Step 7

(Optional) Check the Assign credential to site check box to assign the CLI credential to the selected site.

Step 8

Click Save.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Device Credentials tab.

Step 3

From the left hierarchy tree, choose a site.

Step 4

Do one of these tasks:

Step 5

In the Manage Credentials slide-in pane, from the Add drop-down list, choose SNMPv2c Read or SNMPv2c Write.

Step 6

Complete the listed fields using this table:

Step 7

(Optional) Check the Assign credential to site check box to assign the SNMPv2c credential to the selected site.

Step 8

Click Save.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Device Credentials tab.

Step 3

From the left hierarchy tree, choose a site.

Step 4

Do one of these tasks:

Step 5

In the Manage Credentials slide-in pane, from the Add drop-down list, choose SNMPv3.

Step 6

Complete the listed fields using this table:

Step 7

(Optional) Check the Assign credential to site check box to assign the SNMPv3 credential to the selected site.

Step 8

Click Save.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Device Credentials tab.

Step 3

From the left hierarchy tree, choose a site.

Step 4

Do one of these tasks:

Step 5

In the Manage Credentials slide-in pane, from the Add drop-down list, choose HTTP(S) Read or HTTP(S) Write.

Step 6

Complete the listed fields using this table:

Step 7

(Optional) Check the Assign credential to site check box to assign the HTTPS credential to the selected site.

Step 8

Click Save.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Device Credentials tab.

Step 3

From the left hierarchy tree, select the required site.

Step 4

Locate the type of global device credential that you want to assign.

Step 5

Check the corresponding Assign check box for the credential.

Step 6

From the Credential drop-down list, choose the credential that you want to assign to the selected site.

Step 7

Click Save.

Step 8

To unassign a device credential from a site:

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click Edit Dashboard.

Step 5

In the Customize Wireless Settings Dashboard slide-in pane, drag and drop the required network settings to the new positions to change their priority in the dashboard.

Step 6

Click Save.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click SSIDs.

Step 5

In the SSID table, hover your cursor over Add, and choose Enterprise.

Step 6

In the Wireless SSID workflow, complete the Basic Settings setup:

1. If the Sensor toggle button is available, ensure that it’s disabled.

2. In the Wireless Network Name (SSID) field, enter a unique name for the wireless network.

3. In the WLAN Profile Name field, enter a name for the WLAN profile.

   Based on the WLAN profile name, Catalyst Center autopopulates the policy profile name for Cisco Catalyst 9800 Series Wireless Controller.

4. In the Radio Policy area, do these tasks:

   • Check the 2.4GHz check box to create the WLAN for 2.4-GHz.

   • Check the 5GHz check box to create the WLAN for 5-GHz.

   • Check the 6GHz check box to create the WLAN for 6-GHz. This band is supported for devices running Cisco IOS XE Release 17.7 or later.

   • From the 802.11b/g Policy drop-down list, choose a policy.

     Note	This drop-down list is available only when you check the 2.4GHz check box.

   • Check the Band Select check box to choose the required band.

     Note	This check box is available only when you check both the 2.4GHz and 5GHz check boxes.

   • Check the 6 GHz Client Steering check box to enable client steering.

     Note	This check box is available only when you check the 6GHz check box.

5. To enable or disable the fastlane capabilities on the network, use the Fast Lane toggle button.

   By enabling fastlane, you can set the iOS devices to receive an optimized level of wireless connectivity and enhanced QoS.

   When fastlane capabilities are enabled, QoS selection isn't applicable. For Cisco IOS XE wireless controllers, QoS (both egress and ingress) is set to empty. For Cisco AireOS Wireless Controllers, the egress QoS is set to VoIP (Platinum).

6. In the Quality of Service(QoS) area, do these tasks:

   • From the Egress drop-down list, choose an egress QoS: VoIP (Platinum), Video (Gold), Best Effort (Silver), or Non-real Time (Bronze)

   • From the Ingress drop-down list, choose an ingress QoS: VoIP (Platinum), Video (Gold), Best Effort (Silver), or Non-real Time (Bronze)

     Note	Ingress QoS is applicable only for Cisco IOS XE wireless controllers.

   The QoS selection isn't applicable when Fast Lane is enabled. For Cisco IOS XE wireless controllers, QoS (both egress and ingress) is set to empty. For Cisco AireOS Wireless Controllers, the egress QoS is set to VoIP (Platinum).

7. Under SSID STATE, use the toggle buttons to enable or disable these settings:

   • Admin Status: Use this toggle button to turn on or turn off the radios on the APs. When the Admin Status is disabled, the APs remain associated with the wireless controller and are accessible, and the APs still require licenses.

   • Broadcast SSID: Use this toggle button to enable or disable the visibility of the SSID to all the wireless clients within range.

Step 7

Complete the Security Settings setup:

1. For L2 Security, choose the encryption and authentication type for the network. The sites, buildings, and floors inherit settings from the Global hierarchy. You can override the level of security at the site, building, or floor level.

   • Enterprise: You can configure both WPA2 and WPA3 security authentication by checking the respective check boxes. By default, the WPA3 check box is checked.

     To enable AP beacon protection, check the AP Beacon Protection check box.

     Note

     Wi-Fi Protected Access (WPA2) uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). WPA3 is the latest version of WPA, which is a suite of protocols and technologies that provide authentication and encryption for Wi-Fi networks. WPA3-Enterprise provides higher-grade security protocols for sensitive data networks. WPA3 is supported on Cisco AireOS Wireless Controllers running Release 8.10 and later, and Cisco Catalyst 9800 Series Wireless Controllers running Cisco IOS XE Release 16.12 and later. For multiband operation using only 2.4-GHz and 5-GHz bands, you must enable WPA2 (WPA3 is optional). WPA2 isn’t supported for the 6-GHz band. For multiband operation using 2.4-GHz, 5-GHz, and 6-GHz bands, you must enable WPA3 and disable WPA2 for the 6-GHz band to be operational on the devices running versions between Cisco IOS XE Release 17.7 and Cisco IOS XE Release 17.11. For devices running Cisco IOS XE 17.12 or later, you can enable all the radio bands on the same SSID with WPA3 enabled.

   • Personal: You can configure both WPA2 and WPA3 security authentication by checking the respective check boxes. By default, the WPA3 check box is checked. If you choose Personal, in the Pass Phrase field, enter the passphrase key. This key is used as the pairwise master key (PMK) between the clients and authentication server.

     To enable AP beacon protection, check the AP Beacon Protection check box.

     Note

     WPA3-Personal brings better protection to individual users by providing a more robust password-based authentication. This authentication makes the brute-force dictionary attack more difficult and time-consuming. For WPA2-Personal, you can override a preshared key (PSK) at the site, building, or floor level. If you override a PSK at the building level, the subsequent floors inherit the new settings. For more information, see Configure site-level overrides for an SSID for enterprise networks. For multiband operation using only 2.4-GHz and 5-GHz bands, you must enable WPA2 (WPA3 is optional). For multiband operation using 2.4-GHz, 5-GHz, and 6-GHz bands, you must enable WPA3 and disable WPA2 for the 6-GHz band to be operational on the devices running Cisco IOS XE Release 17.7 and later. WPA2 isn’t supported for the 6-GHz band.

     (Optional) For WPA2-Personal, to configure multi-preshared key (MPSK) support:

     1. Click Configure MPSK.

     2. In the Configure MPSK dialog box, click Add to add an MPSK.

        You can add up to five MPSKs.

     3. From the Priority drop-down list, choose a priority.

        Note	If the priority 0 key isn’t configured in the central web authentication (CWA) Flex mode, client connection to the WLAN may fail.

     4. From the Passphrase Type drop-down list, choose a passphrase type.

     5. In the Passphrase field, enter a passphrase.

     6. Click Save.

     MPSK isn’t supported on Cisco AireOS Wireless Controllers. MPSK applies to Layer 2 security configuration for WPA2-Personal.

   • Open Secured: From the Select existing Open SSID drop-down list, choose an open SSID to redirect the clients to an open-secured SSID. The open-secured policy provides the least security.

     Note	Fast Transition isn’t applicable for open-secured SSID. Because an open-secured SSID depends on an open SSID, you must have enabled anchor on an open SSID before enabling it on an open-secured SSID.

   • Open: The open policy provides no security. It allows any device to connect to the wireless network without authentication.

     Note	If you chose only the 6GHz radio policy in the Basic Settings window, the Open option is dimmed.

2. For Fast Transition (802.11r):

   • Choose a mode: Adaptive, Enable, or Disable.

     Note

     802.11r allows wireless clients to quickly roam from one AP to another AP. Fast transition ensures less disrupted connectivity when a wireless client roams from one AP to another AP. We recommend that you disable fast transition for WLANs using open authentication. Cisco AireOS Wireless Controllers don't support the Adaptive fast transition mode.

   • Check the Over the DS check box to enable fast transitions over a distributed system. By default, fast transition over a distributed system is disabled.

3. Under WPA2 Encryption, WPA3 Encryption or WPA2/WPA3 Encryption, from the available options, choose the required options.

   The options available under this section vary based on the settings that you choose under L2 Security. These options may be available: AES(CCMP128), GCMP128, CCMP256, and GCMP256

   Note	This section isn’t available for the Open security under L2 Security.

4. Under Auth Key Management, check the check box next to the required options.

   Note	This section isn’t available for the Open security under L2 Security.

   The options available under this section vary based on the fast transition settings. These options may be available:

   • For AES(CCMP128): OWE, 802.1x (802.1X-SHA1), FT + 802.1x, CCKM, 802.1x-SHA256 (802.1X-SHA2), PSK, FT + PSK, Easy-PSK, PSK-SHA256 (PSK-SHA2), SAE, SAE-EXT-KEY, FT + SAE, FT + SAE-EXT-KEY

   • For GCMP128: SUITEB-1X

   • For CCMP256: SUITEB192-1X

   • For GCMP256: SUITEB192-1X

   • Timestamp Tolerance (in milliseconds) (for CCKM): Enter the CCKM tolerance level in milliseconds. The valid range is from 1000 through 5000. The default value is 1000. Authenticated client devices can roam from one AP to another AP without any perceptible delay during reassociation. CCKM tolerance level isn’t applicable for Cisco AireOS Wireless Controllers.

5. For Authentication, Authorization, and Accounting Configuration, click Configure AAA to add and configure the AAA servers for the enterprise wireless network SSID.

   For more information, see Configure AAA server for an enterprise wireless network.

   Check one or more of the available check boxes:

   • To enable the AAA override functionality, check the AAA Override check box.

     By default, this check box is dimmed. You must configure an AAA server using the Configure AAA option to use this check box.

   • Identity PSK (for Personal Layer 2 security): Check this check box to enable the creation of unique preshared keys for individuals or groups of users in the SSID. If you check this check box, the Enable Posture check box is displayed.

   • MAC Filtering (for Enterprise Layer 2 security): Check this check box to enable MAC-based access control or security on the wireless network.

     Note	When MAC filtering is enabled, only the MAC addresses that you add to the wireless LAN are allowed to join the network.

   • Deny RCM Clients: Check this check box to deny clients with randomized MAC addresses. This option is supported for Cisco AireOS Wireless Controllers running Release 8.10 MR5 and later, and Cisco Catalyst 9800 Series Wireless Controllers running Cisco IOS XE Release 17.5 and later.

   • Enable Posture: Check this check box to enable posture assessment. If you enable MAC filtering, this check box is dimmed.

     The Pre-Auth ACL List Name drop-down list is displayed when you enable posture. Posture is a service in Cisco Identity Services Engine (Cisco ISE) that allows you to check the state, also known as posture, of all the endpoints that are connecting to a network for compliance with corporate security policies. This allows you to control clients' access to protected areas of a network.

     Pre-Auth ACL List Name: From the drop-down list, choose the ACL list name that you already created to map with the SSID.

     Note	AAA configuration is mandatory for posturing. Click Configure AAA to add AAA servers for the enterprise wireless network SSID.

6. Click Next.

Step 8

Complete the Advance Settings setup:

1. For MFP Client Protection, choose Optional, Required, or Disabled.

   Note

   Management Frame Protection (MFP) increases the security of management frames. It provides security for the otherwise unprotected and unencrypted 802.11 management messages that are passed between APs and clients. MFP provides both infrastructure and client support. By default, Optional is selected. If you choose Required, the clients are allowed to associate only if the MFP is negotiated (that is, if WPA2 is configured on the wireless controller, and the client is also configured for WPA2 and supports CCXv5 MFP). MFP client protection is supported only on Cisco AireOS Wireless Controllers. MFP client protection isn’t supported for the 6-GHz band.

2. For Protected Management Frame (802.11w), choose the required option.

   Note	The options available under Protected Management Frame (802.11w) vary based on the settings that you choose under L2 Security. These options may be available: Optional, Required, or Disabled

3. To configure all the 11k-capable clients to request a neighbor report about the known neighboring APs that are candidates for roaming, use the 11k - Neighbor List toggle button.

   To facilitate roaming, a 11k-capable client that is associated with an AP sends a request to a list of neighboring APs. The request is sent in the form of an 802.11 management frame, which is known as an action frame. The AP responds with a list of neighbor APs on the same WLAN with the Wi-Fi channel numbers. The response is also an action frame. The client identifies the AP candidates for the next roam from the response frame.

4. To enable or disable RADIUS profiling on a WLAN, use the Radius Client Profiling toggle button.

   Note	At least one AAA or PSN server is required to enable this feature.

5. To enable or disable the coverage hole detection functionality, use the Coverage Hole Detection toggle button.

6. Under WLAN Timeouts, do these tasks:

   • Session Timeout: Check this check box to set the maximum time for a client session to remain active before reauthorization. In the corresponding field, enter the session timeout in seconds. The valid range is from 1 through 86400.

     Note	By default, Session Timeout is enabled with a timeout of 1800 seconds.

   • Client Exclusion: Check this check box to set the client exclusion timer. In the corresponding field, enter the client exclusion time in seconds. The valid range is from 0 through 2147483647.

     Note	When a user fails to authenticate, the wireless controller denies the client connection. The client isn’t allowed to connect to the network until the exclusion timer expires. By default, Client Exclusion is enabled with a timeout of 180 seconds.

   • Client User Idle Timeout: Check this check box to set the user idle timeout for a WLAN. In the corresponding field, enter the user idle timeout in seconds. The valid range is from 15 through 100000.

     If the data sent by the client is more than the threshold specified by the user idle timeout, the client is considered to be active, and the wireless controller begins another timeout period.

     Note	By default, Client User Idle Timeout is enabled with a user idle timeout of 300 seconds.

7. Under 11v BSS Transition Support, do these tasks:

   • BSS Max Idle Service: Check this check box to set the idle period timer value. The idle period timer value is transmitted using the association and reassociation response frame from APs to the client.

     Note	The BSS Max idle period is the time frame during which an AP doesn’t disassociate a client because of nonreceipt of frames from the connected client.

   • Directed Multicast Service: Check this check box to enable directed multicast service.

     Note	By default, Directed Multicast Service is enabled. Using the Directed Multicast Service (DMS), the client requests APs to transmit the required multicast packets as unicast frames. This allows clients to sleep for a longer period and saves the battery power.

8. (Optional) For NAS-ID:

   1. From the NAS-ID Opt drop-down list, choose the required type of network access server identifier (NAS ID).

      To specify a custom script for the NAS ID, from the NAS-ID Opt drop-down list, choose Custom Option and enter the custom script in the corresponding Custom Script for Opt field. You can enter up to 31 alphanumeric characters, special characters, and spaces for the custom script. Catalyst Center doesn't support the special characters ? " < and trailing spaces for the custom script.

      Note	Catalyst Center supports NAS ID with custom script only for Cisco Catalyst 9800 Series Wireless Controllers that run Cisco IOS XE Release 17.7 or later.

   2. (Optional) Click + to add another NAS ID. You can add up to three NAS IDs.

      Note	Catalyst Center applies only one NAS ID for Cisco AireOS Wireless Controllers. You can overwrite the NAS ID at the site-level from the Design > Network Settings > Wireless window.

9. (Optional) Under Configure Client Rate Limit, enter a value for the client rate limit in bits per second. The valid range is from 8000 through 100000000000. The value must be a multiple of 500.

   Note

   This configuration is applicable for Cisco AireOS Wireless Controllers. To configure the client rate limit for Cisco AireOS Wireless Controllers, click the menu icon and choose Design > Feature Templates > Wireless > Advanced SSID Configuration. For more information, see Create a feature template for advanced SSID.

   The valid ranges for client rate limit on Cisco IOS XE devices include:

   • The valid range for Cisco Catalyst 9800-L Wireless Controller, Cisco Catalyst 9800-40 Wireless Controller, and Cisco Catalyst 9800-80 Wireless Controller is from 8000 through 67000000000 bits per second.

   • The valid range for Cisco Catalyst 9800-CL Wireless Controllers is from 8000 through 10000000000 bits per second.

   • The valid range for Cisco Embedded Wireless Controller on Catalyst Access Points is from 8000 through 2000000000 bits per second.

   • The valid range for Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9000 Series Switches is from 8000 through 100000000000 bits per second.

10. Click Next.

Step 9

(Optional) Complete the Associate Feature Templates to SSID setup:

1. Check the check box next to the required feature template.

   If you want to create a feature template, click Add and configure the required settings. For more information, see Create a feature template for advanced SSID.

2. Click Next.

Step 10

Complete the Associate SSID to Profile setup:

1. From the left pane, choose a profile and click Associate Profile.

   If you don’t have a profile, click Add Profile and configure the profile settings. For more information, see Create network profiles for wireless.

2. Click Next.

Step 11

In the Summary window, review the configuration settings. (To make any changes, click Edit.)

Step 12

Click Save.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click SSIDs.

Step 5

From the SSID table, in the AAA Servers column, click Configure AAA for the SSID for which you want to configure the AAA server.

Step 6

From the Configure Authentication and Authorization Server drop-down list of the Configure AAA Server slide-in pane, you can either search for a server IP address by entering its name in the Search field or choose the AAA IP address.

Step 7

Click + to add an Additional Server.

Step 8

From the Additional Server drop-down list, choose the server IP address.

Step 9

To use the AAA server for accounting, check the Copy Same Servers for Accounting check box.

Step 10

To configure a different accounting server for an SSID:

1. From the Configure Accounting Server drop-down list, you can either search for a server IP address by entering its name in the Search field or choose the accounting server IP address.

2. Click + to add an Additional Server.

   Note	You can configure a maximum of six accounting servers for an SSID of enterprise wireless network.

3. From the Additional Server drop-down list, choose the server IP address.

Step 11

Click Configure.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click SSIDs.

Step 5

In the SSID table, hover your cursor over Add, and choose Guest.

Step 6

In the Wireless SSID workflow, complete the Basic Settings setup:

1. In the Wireless Network Name (SSID) field, enter a unique name for the wireless network.

2. In the WLAN Profile Name field, enter a name for the WLAN profile.

   Based on the WLAN profile name, Catalyst Center autopopulates the policy profile name for Cisco Catalyst 9800 Series Wireless Controller.

3. In the Radio Policy area, do these tasks:

   • Check the 2.4GHz check box to create the WLAN for 2.4-GHz.

   • Check the 5GHz check box to create the WLAN for 5-GHz.

   • Check the 6GHz check box to create the WLAN for 6-GHz. This band is supported for devices running Cisco IOS XE Release 17.7 or later.

   • From the 802.11b/g Policy drop-down list, choose a policy.

     Note	This drop-down list is available only when you check the 2.4GHz check box.

   • Check the Band Select check box to choose the required band.

     Note	This check box is available only when you check both the 2.4GHz and 5GHz check boxes.

   • Check the 6 GHz Client Steering check box to enable client steering.

     Note	This check box is available only when you check the 6GHz check box.

4. To enable or disable the fastlane capabilities on the network, use the . When fastlane capabilities are enabled, QoS selection isn't applicable. For Cisco IOS XE wireless controllers, QoS (both egress and ingress) is set to empty. For Cisco AireOS Wireless Controllers, the egress QoS is set to VoIP (Platinum).

   Note	By enabling fastlane, you can configure the iOS devices to receive an optimized level of wireless connectivity and enhanced QoS.

5. In the Quality of Service(QoS) area, do these tasks:

   • From the Egress drop-down list, choose an egress QoS: VoIP (Platinum), Video (Gold), Best Effort (Silver), or Non-real Time (Bronze)

   • From the Ingress drop-down list, choose an ingress QoS: VoIP (Platinum), Video (Gold), Best Effort (Silver), or Non-real Time (Bronze)

     Note	Ingress QoS is applicable only for Cisco IOS XE wireless controllers.

   The QoS selection isn't applicable when Fast Lane is enabled. For Cisco IOS XE wireless controllers, QoS (both egress and ingress) is set to empty. For Cisco AireOS Wireless Controllers, the egress QoS is set to VoIP (Platinum).

6. Under SSID STATE, use the toggle buttons to enable or disable these settings:

   • Admin Status: Use this toggle button to turn on or turn off the radios on the APs. When the Admin Status is disabled, the APs remain associated with the wireless controller and are accessible, and the APs still require licenses.

   • Broadcast SSID: Use this toggle button to enable or disable the visibility of the SSID to all the wireless clients within range.

Step 7

Complete the Security Settings setup:

1. For the L2 SECURITY area, choose the L2 encryption and authentication type:

   • Enterprise: You can configure either the WPA2 or the WPA3 security authentication type by checking the respective check boxes. By default, the WPA2 check box is enabled.

     To enable AP beacon protection, check the AP Beacon Protection check box.

     Note

     Wi-Fi Protected Access (WPA2) uses the stronger Advanced Encryption Standard encryption algorithm using Counter Mode with Cipher Block Chaining Message Authentication Code Protocol (AES-CCMP). Fast transition is applicable for enterprise WPA2 SSID. WPA3 security authentication is the latest version of WPA, which is a suite of protocols and technologies that provide authentication and encryption for Wi-Fi networks. WPA3-Enterprise provides higher grade security protocols for sensitive data networks. For multiband operation using only 2.4-GHz and 5-GHz bands, you must enable WPA2 (WPA3 is optional). WPA2 isn’t supported for the 6-GHz band. For multiband operation using 2.4-GHz, 5-GHz, and 6-GHz bands, you must enable WPA3 and disable WPA2 for the 6-GHz band to be operational on the devices running versions between Cisco IOS XE Release 17.7 and Cisco IOS XE Release 17.11. For devices running Cisco IOS XE 17.12 or later, you can enable all the radio bands on the same SSID with WPA3 enabled.

   • Personal: You can configure both WPA2 and WPA3 or configure WPA2 and WPA3 individually by checking the respective check boxes.

     To enable AP beacon protection, check the AP Beacon Protection check box.

     Note

     WPA3-Personal security authentication brings better protection to individual users by providing more robust password-based authentication. This makes the brute-force dictionary attack more difficult and time-consuming. Enter the passphrase key in the Pass Phrase field. This key is used as the pairwise master key (PMK) between the clients and the authentication server. For multiband operation using only 2.4-GHz and 5-GHz bands, you must enable WPA2 (WPA3 is optional). For multiband operation using 2.4-GHz, 5-GHz, and 6-GHz bands, you must enable WPA3 and disable WPA2 for the 6-GHz band to be operational on the devices running Cisco IOS XE Release 17.7 and later. WPA2 isn’t supported for the 6-GHz band.

     (Optional) For WPA2-Personal, to configure multi-preshared key (MPSK) support:

     1. Click Configure MPSK.

     2. In the Configure MPSK dialog box, click Add to add an MPSK.

        You can add up to five MPSKs.

     3. From the Priority drop-down list, choose a priority.

        Note	If the priority 0 key isn’t configured in central web authentication (CWA) Flex mode, client connection to the WLAN may fail.

     4. From the Passphrase Type drop-down list, choose a passphrase type.

     5. In the Passphrase field, enter a passphrase.

     6. Click Save.

     MPSK isn’t supported on Cisco AireOS Wireless Controllers. MPSK applies to the Layer 2 security configuration for WPA2-Personal.

   • Open Secured: From the Select existing Open SSID drop-down list, choose an open SSID to associate with the open SSID. Associating secures the open SSID. You must have an open SSID created before associating it with the open secured SSID.

     Note	Fast Transition isn’t applicable for open-secured SSID. Because open-secured SSID depends on open SSID, you must have enabled the anchor on open SSID before enabling it on open-secured SSID.

   • Open: The open policy provides no security. It allows any device to connect to the wireless network without authentication.

     Note	If you chose only the 6GHz radio policy in the Basic Settings window, the Open option is dimmed.

2. For Fast Transition (802.11r):

   • Choose a mode: Adaptive, Enable, or Disable.

     Note

     802.11r allows wireless clients to quickly roam from one AP to another AP. Fast transition ensures less disrupted connectivity when a wireless client roams from one AP to another AP. We recommend that you disable fast transition for WLANs using open authentication. Cisco AireOS Wireless Controllers don't support the Adaptive fast transition mode.

   • Check the Over the DS check box to enable fast transitions over a distributed system. By default, fast transition over a distributed system is disabled.

3. Under WPA2 Encryption, WPA3 Encryption, or WPA2/WPA3 Encryption, from the available options, choose the required options.

   The options available under this section vary based on the settings that you chose under L2 Security. These options may be available: AES(CCMP128), GCMP128, CCMP256, GCMP256

   Note	This section isn’t available for the Open security under L2 Security.

4. Under Auth Key Management, check the check box next to the required options.

   Note

   This section isn’t available for the Open security under Level of Security. These options may be available: For AES(CCMP128): OWE, 802.1x (802.1X-SHA1), FT + 802.1x, CCKM, 802.1x-SHA256 (802.1X-SHA2), PSK, FT + PSK, Easy-PSK, PSK-SHA256 (PSK-SHA2), SAE, SAE-EXT-KEY, FT + SAE, FT + SAE-EXT-KEY For GCMP128: SUITEB-1X For CCMP256: SUITEB192-1X For GCMP256: SUITEB192-1X

   The options available under this section vary based on the fast transition settings.

   • Timestamp Tolerance (in milliseconds) (for CCKM): Enter the CCKM tolerance level in milliseconds. The valid range is from 1000 through 5000. The default value is 1000. Authenticated client devices can roam from one AP to another AP without any perceptible delay during reassociation. CCKM tolerance level isn’t applicable for Cisco AireOS Wireless Controllers.

5. For the L3 Security setting, choose the L3 encryption and authentication type:

   • Web Policy: Provides a higher level of L3 security.

     For Authentication Server, configure these authentication server settings:

     Authentication server type	Description
     Central Web Authentication	Use AAA server for central web authentication (CWA). (Optional) If you choose Cisco ISE for CWA, from the What kind of portal are you creating today? drop-down list, choose the type of portal you want to create: Self Registered: The guests are redirected to the self-registered guest portal to register by providing information to automatically create an account. HotSpot: The guests can access the network without providing any credentials. (Optional) If you choose Cisco ISE for CWA, from the Where will your guests redirect after successful authentication? drop-down list, choose where you want to redirect the guests after successful authentication: Success Page: The guests are redirected to the Authentication Success window. Original URL: The guests are redirected to the URL that they had originally requested. Custom URL: The guests are redirected to the custom URL that is specified here. Enter a redirect URL in the Redirect URL field.
     Web Authentication Internal Web Authentication External	Web authentication or Web Auth is a Layer 3 security method that allows a client to pass Dynamic Host Configuration Protocol (DHCP) and Domain Name System (DNS) traffic only until they have passed some form of authentication. For web authentication internal, the client is redirected to a window that is constructed by the Cisco Wireless Controller. For web authentication external, the client is redirected to the specified URL. Enter a redirect URL in the Web Auth Url field.
     Web Passthrough Internal Web Passthrough External	Web passthrough is used for guest access and doesn't requires authentication credentials. In web passthrough authentication, wireless users are redirected to the Usage Policy window when they use the internet for the first time. After accepting the policy, users are allowed to use the internet.

   • Open: There is no security at the Layer 3 level and any device can connect to the SSID.

6. If you choose Web Authentication Internal, Web Authentication External, Web Passthrough Internal, or Web Passthrough External, in the Timeout Settings for sleeping clients area, choose an authentication setting for sleeping clients:

   • Always authenticate: Enables authentication for sleeping clients.

   • Authenticate after: Enter how many minutes you want sleeping clients to be remembered for before reauthentication becomes necessary. The valid range is from 10 minutes through 43200 minutes, and the default duration is 720 minutes.

   Note

   Clients with guest access and web authentication are allowed to sleep and wake up without having to reauthenticate through the login window. You can configure how long a client is remembered on a WLAN and a user group policy that is mapped to the WLAN. The sleeping timer becomes effective after the idle timeout. If the client timeout is less than the time configured on the sleeping timer of the WLAN, the lifetime of the client is used as the sleeping time.

7. For Authentication, Authorization, and Accounting Configuration, click Configure AAA to add and configure the AAA servers for the guest wireless network SSID.

   For more information, see Configure AAA server for a guest wireless network.

   Check one or more of these available check boxes:

   • To enable the AAA override functionality, check the AAA Override check box.

     By default, this check box is dimmed. You must configure an AAA server using the Configure AAA option to use this check box.

   • Identity PSK (for Personal Layer 2 security): Check this check box to enable the creation of unique preshared keys for individuals or groups of users in the SSID.

   • MAC Filtering (for Enterprise Layer 2 security): Check this check box to enable MAC-based access control or security in the wireless network.

     Note	When MAC filtering is enabled, only the MAC addresses that you add to the wireless LAN are allowed to join the network.

   • Deny RCM Clients: Check this check box to deny clients with randomized MAC addresses. This option is supported for Cisco AireOS Wireless Controllers running Release 8.10 MR5 and later, and Cisco Catalyst 9800 Series Wireless Controllers running Cisco IOS XE Release 17.5 and later.

   • Pre-Auth ACL List Name: From the drop-down list, choose the ACL list name that you already created to map with the SSID.

8. Click Next.

Step 8

Complete the Advance Settings setup:

1. For MFP Client Protection, choose Optional, Required, or Disabled.

   Note

   Management Frame Protection (MFP) increases the security of management frames. It provides security for the otherwise unprotected and unencrypted 802.11 management messages that are passed between APs and clients. MFP provides both infrastructure and client support. By default, Optional is selected. If you choose Required, the clients are allowed to associate only if MFP is negotiated (that is, if WPA2 is configured on the wireless controller, and the client is also configured for WPA2 and supports CCXv5 MFP). MFP client protection is supported only on Cisco AireOS Wireless Controllers. MFP client protection isn’t supported for the 6-GHz band.

2. For Protected Management Frame (802.11w), choose the required option.

   Note	The options available under Protected Management Frame (802.11w) vary based on the settings that you chose under Level of Security. These options may be available: Optional, Required, or Disabled

3. To configure all the 11k-capable clients to request a neighbor report about the known neighboring APs that are candidates for roaming, use the 11k - Neighbor List toggle button.

   Note

   To facilitate roaming, a 11k-capable client that is associated with an AP sends a request to a list of neighboring APs. The request is sent in the form of an 802.11 management frame, which is known as an action frame. The AP responds with a list of neighbor APs on the same WLAN with the Wi-Fi channel numbers. The response is also an action frame. The client identifies the AP candidates for the next roam from the response frame.

4. To enable or disable RADIUS profiling on a WLAN, use the Radius Client Profiling toggle button.

   Note	At least one AAA or PSN server is required to enable this feature.

5. To enable or disable the coverage hole detection functionality, use the Coverage Hole Detection toggle button.

6. Under WLAN Timeouts, do these tasks:

   • Session Timeout: Check this check box to set the maximum time for a client session to remain active before reauthorization. In the corresponding field, enter the session timeout in seconds. The valid range is from 1 through 86400.

     Note	By default, Session Timeout is enabled with a timeout of 1800 seconds.

   • Client Exclusion: Check this check box to set the client exclusion timer. In the corresponding field, enter the client exclusion time in seconds. The valid range is from 0 through 2147483647.

     Note	When a user fails to authenticate, the wireless controller denies the client connection. The client isn’t allowed to connect to the network until the exclusion timer expires. By default, Client Exclusion is enabled with a timeout of 180 seconds.

   • Client User Idle Timeout: Check this check box to set the user idle timeout period for a WLAN. In the corresponding field, enter the user idle timeout in seconds. The valid range is from 15 through 100000.

     Note	If the data sent by the client is more than the threshold quota specified as the user idle timeout period, the client is considered to be active and the wireless controller refreshes for another timeout period. By default, Client User Idle Timeout is enabled with a user idle timeout of 300 seconds.

7. For 11v BSS Transition Support:

   • BSS Max Idle Service: Check this check box to set the idle period timer value. The idle period timer value isn’t transmitted using the association and reassociation response frame from the APs to the client.

     Note	The BSS Max idle period is the time frame during which an AP doesn’t disassociate a client because of nonreceipt of frames from the connected client.

   • Directed Multicast Service: Check this check box to enable directed multicast service.

     Note	By default, Directed Multicast Service is enabled. Using the Directed Multicast Service (DMS), the client requests APs to transmit the required multicast packets as unicast frames. This allows clients to sleep for a longer period and saves the battery power.

8. (Optional) For NAS-ID:

   1. From the NAS-ID Opt drop-down list, choose the required type of network access server identifier (NAS ID).

      (Optional) To specify a custom script for the NAS ID, choose Custom Option from the NAS-ID Opt drop-down list and enter the custom script in the corresponding Custom Script for Opt field. You can enter up to 31 alphanumeric characters, special characters, and spaces for the custom script. Catalyst Center doesn't support the special characters ? " < and trailing spaces for the custom script.

      Note	Catalyst Center supports NAS ID with custom script only for Cisco Catalyst 9800 Series Wireless Controllers that run Cisco IOS XE Release 17.7 or later.

   2. (Optional) Click + to add another network access server identifier. You can add up to three NAS IDs.

      Note	Catalyst Center applies only one NAS ID for Cisco AireOS Wireless Controllers. You can overwrite the NAS ID at the site-level from the Design > Network Settings > Wireless window.

9. (Optional) Under Configure Client Rate Limit, enter a value for the client rate limit in bits per second. The valid range is from 8000 through 100000000000. The value must be a multiple of 500.

   Note

   This configuration is applicable for Cisco AireOS Wireless Controllers. To configure the client rate limit for Cisco AireOS Wireless Controllers, click the menu icon and choose Design > Feature Templates > Wireless > Advanced SSID Configuration. For more information, see Create a feature template for advanced SSID.

   The valid ranges for client rate limit on Cisco IOS XE devices include:

   • The valid range for Cisco Catalyst 9800-L Wireless Controller, Cisco Catalyst 9800-40 Wireless Controller, and Cisco Catalyst 9800-80 Wireless Controller is from 8000 through 67000000000 bits per second.

   • The valid range for Cisco Catalyst 9800-CL Wireless Controller is from 8000 through 10000000000 bits per second.

   • The valid range for Cisco Embedded Wireless Controller on Catalyst Access Points is from 8000 through 2000000000 bits per second.

   • The valid range for Cisco Catalyst 9800 Embedded Wireless Controller for Catalyst 9000 Series Switches is from 8000 through 100000000000 bits per second.

10. Click Next.

Step 9

(Optional) Complete the Associate Feature Templates to SSID setup:

1. Check the check box next to the required feature template.

   If you want to create a feature template, click Add and configure the required settings. For more information, see Create a feature template for advanced SSID.

2. Click Next.

Step 10

Complete the Associate SSID to Profile setup:

1. From the left pane, choose a profile and click Associate Profile.

   If you don’t have a profile, click Add Profile and configure the profile settings. For more information, see Create network profiles for wireless.

2. Click Next.

Step 11

In the Summary window, review the configuration settings. (To make any changes, click Edit.)

Step 12

Click Save to save the SSID settings.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click SSIDs.

Step 5

From the SSID table, in the AAA Servers column, click Configure AAA for the SSID for which you want to configure the AAA server.

Step 6

From the Server drop-down list of the Configure AAA Server slide-in pane, you can either search for a AAA IP address by entering its name in the Search field or choose AAA IP address.

Step 7

Click + to add an Additional Server.

Step 8

From the Additional Server drop-down list, choose the server IP address.

Step 9

(Optional) To delete a server or an additional server, click the delete icon next to each server.

Step 10

To use the AAA server for accounting, check the Copy Same Servers for Accounting check box.

Step 11

To configure a different accounting server for an SSID:

1. From the Configure Accounting Server drop-down list, you can either search for a server IP address by entering its name in the Search field or choose the accounting server IP address.

2. Click + to add an Additional Server.

   Note	You can configure a maximum of six accounting servers for an SSID of enterprise wireless network.

3. From the Additional Server drop-down list, choose the server IP address.

Step 12

Click Configure.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click SSIDs.

Step 5

In the SSID table, click SSID Scheduler.

Step 6

In the SSID Scheduler window, click Add.

Step 7

In the Create Scheduler slide-in pane, do these steps:

1. Enter a unique name for the SSID scheduler that you want to create.

2. Click the Client Deny radio button for denying clients from joining SSID.

3. Click the Enable SSID radio button to schedule SSID broadcasting.

4. Choose the Scheduler Type Daily, Weekly, or Monthly and complete the required settings.

5. From the Time Zone drop-down list, choose the time zone.

6. Click Save.

   The created SSID scheduler appears in the SSID Scheduler table.

Step 8

To edit the SSID scheduler:

1. From the SSID Scheduler table, choose the SSID scheduler and click Edit.

2. In the Edit SSID Scheduler slide-in pane, make the required changes and click Save.

Step 9

To delete the SSID scheduler, choose the SSID scheduler and click Delete.

Step 10

To view the details of the SSID scheduler, choose the SSID scheduler and click Scheduler History.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click Interfaces & VLAN Groups.

Step 5

Click the Interfaces tab.

Step 6

From the Wireless Interfaces table, click Add.

Step 7

Configure the wireless interface settings in the Create a Wireless Interface slide-in pane:

1. In the Interface Name field, enter the dynamic interface name.

2. In the VLAN ID field, enter the VLAN ID for the interface.

   For Cisco AireOS Wireless Controllers, the valid range is from 1 through 4094. For Cisco Catalyst 9800 Series Wireless Controllers, the valid range is from 2 through 4094.

Step 8

Click Save.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click Interfaces & VLAN Groups.

Step 5

Click the VLAN Groups tab.

Step 6

From the VLAN Group table, click Add.

Step 7

In the Add VLAN Group slide-in pane, do these steps:

1. Enter a valid VLAN Group Name

2. Select single or multiple interfaces from the list.

3. Click Save.

Step 8

In the Edit Network Profile window, the VLAN group is associated with the SSID.

Step 9

To add more SSIDs to the VLAN group, click Add SSID.

Step 10

Choose Interface or VLAN group.

Step 11

Click the add icon to create a new interface or VLAN group.

Step 12

Click Save.

Step 13

In Configure Interface and VLAN, you can view the list of interface names, interface group names, and other parameters required to configure the interface and VLAN.

Step 14

From the main menu, choose Provision > Network Devices > Inventory.

Step 15

Select the device.

Step 16

From the Actions drop-down menu, choose Provision > Provision Device.

Step 17

Review the details on the Assign Site, Configuration, Feature Templates, Advanced Configuration, and Summary windows. On each window, click Next to proceed to the next window.

Step 18

Click Deploy.

Step 19

Choose Now and click Apply.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click RF Profiles.

Step 5

In the Wireless Radio Frequency Profile area, hover your cursor over Add and choose Basic RF Profile.

Step 6

In the Profile Name field of the Create Wireless Radio Frequency Profile window, enter the RF profile name.

Step 7

Do this configuration in the 2.4 GHz tab:

1. Ensure that the 2.4 GHz toggle button is enabled.

   Note

   For Cisco Catalyst 9800 Series Wireless Controller, if you disable the 2.4 GHz toggle button, Catalyst Center disables the Admin status of the 2.4 GHz RF profile. For Cisco AireOS Wireless Controller, if you disable the 2.4 GHz toggle button and reprovision the wireless controller or AP, Catalyst Center creates the RF profile for the corresponding band and maps it to the AP group (instead of configuring it as None) and disables the Admin status of the corresponding radios on the APs. For Cisco AireOS Wireless Controller, when you disable the Admin status for the 2.4-GHz band on the RF profile, Catalyst Center changes the XOR radio on the APs using that RF profile to manual 5-GHz mode. If you enable the Admin status later and reprovision the AP, Catalyst Center changes the radio to automatic mode enabling the usage of 2.4-GHz and 5-GHz bands, and monitor mode. So, if you want to disable the Admin status for the 2.4-GHz band on XOR-capable APs, we recommend that you disable the Admin status of the XOR radio using the Configure Access Points workflow. The Admin status configured using the Configure Access Points workflow isn't overwritten when the wireless controller or APs are reprovisioned. For more information, see Configure APs.

2. Under Parent Profile, click High, Medium (Typical), Low, or Custom. (The available data rates and power configuration values change depending on the parent profile chosen. For example, if you choose High, it populates the profile configurations available in the device for 2.4-GHz. If you change any settings in the populated data rates and power configurations, the Parent Profile automatically changes to Custom.) A new RF profile is created only for the selected custom profiles.

   Note	Low, Medium (Typical), and High are the default RF profiles. If you choose a default RF profile, the respective RF profile on the device is used, and the new RF profile isn’t created on wireless controller.

3. DCA Channel dynamically manages the channel assignment for an RF group and evaluates the assignments on a per-AP radio basis.

   • Check the Select All check box to select DCA channels 1, 6, and 11. Alternatively, check the individual check boxes next to the channel numbers.

   • If the individual channel numbers aren't already displayed, click Show Advanced to select the channel numbers under the Advanced Options.

   • Check the Select All check box to select DCA channels that are under Advanced Options, or check the check box next to the individual channel numbers. The available channel numbers are 2, 3, 4, 5, 7, 8, 9, 10, 12, 13, and 14.

     Note

     For Cisco AireOS Wireless Controller, Catalyst Center automatically configures the selected DCA channels in the global RRM DCA channel list. Select the DCA channels based on the country code of the device. During provisioning, only the allowed channels for the country configured on the wireless controller are considered and the unsupported channels are ignored. Provisioning may fail if all the channels that you've selected are unsupported as per the country codes configured on the controller.

4. Under Supported Data Rate, do this configuration:

   • Check the Enable 802.11b data rates check box to enable the 802.11b data rates.

   • Use the slider to set the rates at which data can be transmitted between an access point and a client. The available data rates are 1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, and 54.

5. Under Mandatory Data Rates, check the check boxes next to the individual data rates. You can choose up to two data rates. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

   The available data rates change depending on the data rates set under Supported Data Rate.

6. Under Tx Power Configuration, set the power level and power threshold for an AP.

   • Power Level: Determines whether the power of an AP needs to be reduced. Reducing the power of an AP helps mitigate co-channel interference with another AP on the same channel or in close proximity. Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm to 30 dBm.

   • RX SOP Threshold (dBm): Receiver Start of Packet Detection Threshold (RX SOP) determines the Wi-Fi signal level, in dBm, at which an AP's radio demodulates and decodes a packet. From the RX SOP Threshold (dBm) drop-down list, choose High, Medium, Low, Auto, or Custom threshold value.

     If you choose the Custom RX SOP threshold, the RX-SOP Threshold (dBm) Custom Value field is displayed. In this field, enter a custom value for the RX SOP threshold in dBm. The value range is from -85 dBm through -60 dBm. For the 2.4-GHz band, the high threshold value is -79 dBm, the medium threshold value is -82 dBm, and the low threshold value is -85 dBm.

   • TPC Power Threshold: Is the cutoff signal level used by Radio Resource Management (RRM) to determine whether to reduce the power of an AP. Use the Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmission power rates. The range is from -80 dBm to -50 dBm.

7. Under Coverage Hole Detection, do this configuration:

   Note

   You must enable global coverage hole detection in Design > Feature Templates > Wireless > RRM General Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for the RRM general parameters, see Create a feature template for RRM general parameters. For information about provisioning, see Provision Wireless Devices.

   • In the Minimum Client Level (clients) field, enter a value for the minimum number of clients. The valid range is from 1 through 200. The default value is 3.

   • In the Data RSSI Threshold (dBm) field, enter the data Received Signal Strength Indication (RSSI) threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

   • In the Voice RSSI Threshold (dBm) field, enter the voice RSSI threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

   • In the Exception Level (%) field, enter an exception level. The valid range is from 0 through 100 percent. The default value is 25 percent.

8. Under Client Limit, in the Max Clients field, enter the maximum client limit value. The valid range is from 0 through 500.

   Note

   A maximum client limit isn’t supported on Cisco AireOS Wireless Controllers. If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7 or later and earlier than Cisco IOS XE Release 17.9, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9 or later, the maximum client limit is 500.

9. Under 802.11ax, configure this spatial reuse parameters for 802.11ax:

   Note	802.11ax is supported only on wireless controllers that run Cisco IOS XE Release 17.6.1 and later.

   • Check the OBSS PD check box to enable the Overlapping BSS Packet Detect (OBSS-PD) functionality.

   • In the Non-SRG OBSS PD Max Threshold (dBm) field, enter a value for the non-Spatial Reuse Group (SRG) OBSS-PD maximum threshold in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

   • Check the SRG OBSS PD check box to enable the SRG OBSS-PD functionality.

     SRG OBSS-PD is supported only on wireless controllers that run Cisco IOS XE Release 17.7.1 and later.

   • In the SRG OBSS PD Min Threshold (dBm) field, enter a value for the SRG OBSS-PD minimum threshold in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -82 dBm.

   • In the SRG OBSS PD Max Threshold (dBm) field, enter a value for the SRG OBSS-PD maximum threshold in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

Step 8

Do this configuration in the 5 GHz tab:

1. Ensure that the 5 GHz toggle button is enabled.

   Note

   For Cisco Catalyst 9800 Series Wireless Controller, if you disable the 5 GHz toggle button, Catalyst Center disables the Admin status of the 5 GHz RF profile. For Cisco AireOS Wireless Controller, if you disable the 2.4 GHz toggle button and reprovision the wireless controller or AP, Catalyst Center creates the RF profile for the corresponding band and maps it to the AP group (instead of configuring it as None) and disables the Admin status of the corresponding radios on the APs. For Cisco AireOS Wireless Controller, when you disable the Admin status for the 5-GHz band on the RF profile, Catalyst Center changes the XOR radio on the APs using that RF profile to manual 2.4-GHz mode. If you enable the Admin status later and reprovision the AP, Catalyst Center changes the radio to automatic mode enabling the usage of 2.4-GHz and 5-GHz bands, and monitor mode. So, if you want to disable the Admin status for the 5-GHz band on XOR-capable APs, we recommend that you disable the Admin status of the XOR radio using the Configure Access Points workflow. The Admin status configured using the Configure Access Points workflow isn't overwritten when the wireless controller or APs are reprovisioned. For more information, see Configure APs.

2. Under Parent Profile, click High, Medium (Typical), Low, or Custom. (The available data rates and power configuration values change depending on the parent profile chosen. For example, if you choose High, it populates the configurations available in the device for 5 GHz. If you change any settings in the populated data rates and power configurations, the Parent Profile automatically changes to Custom.) A new RF profile is created only for select custom profiles.

   Note	Low, Medium (Typical), and High are the default RF profiles. If you choose a default RF profile, the respective RF profile that is already present in the device is used and the new RF profile isn’t created on wireless controller.

3. From the Channel Width drop-down list, choose a channel bandwidth option: 20 MHz, 40 MHz, 80 MHz, 160 MHz, or Best.

4. To enable preamble puncturing for this band, click the Preamble Puncturing toggle button.

   Note	Preamble puncturing is applicable only for Cisco Wireless Controllers running Cisco IOS XE 17.15.2 or later.

5. Check the Zero Wait DFS check box to allow APs with 5-GHz radio band to switch to a new channel without any waiting time.

   Note	Catalyst Center supports Zero Wait DFS for Cisco Wireless Controllers running Cisco IOS XE Release 17.9.1 and later.

6. Under DCA Channel, do this configuration to manage the channel assignments:

   Note

   For Cisco AireOS Wireless Controller, Catalyst Center automatically configures the selected DCA channels in the global RRM DCA channel list. Select the DCA channels based on the country code of the device. During provisioning, only the allowed channels for the country configured on the wireless controller are considered and the unsupported channels are ignored. Provisioning may fail if all the channels that you've selected are unsupported as per the country codes configured on the controller.

   • Check the Select All check box to select DCA channels UNII-1 36-48, UNII-2 52-144, and UNII-3 149-173. Alternatively, check the individual check boxes next to the channel numbers.

   • If the individual channel numbers aren't already displayed, click Show Advanced to choose the channel numbers for each band.

   • UNII-1 36-48: The channels available for UNII-1 band are 36, 40, 44, and 48. Check the UNII-1 36-48 check box to include all channels, or check an individual check box.

   • UNII-2 52-144: The channels available for UNII-2 band are 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, and 144. Check the UNII-2 52-144 check box to include all channels, or check an individual check box.

   • UNII-3 149-173: The channels available for UNII-3 band are 149, 153, 157, 161, 165, 169, and 173. Check the UNII-3 149-173 check box to include all channels, or check an individual check box.

7. Use the Supported Data Rate slider to set the rates at which data can be transmitted between an access point and a client. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

8. Under Mandatory Data Rates, check the check boxes next to the individual data rates. You can choose up to two data rates. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

   The available data rates change depending on the data rates set under Supported Data Rate.

9. Under Tx Power Configuration, set the power level and power threshold for an AP.

   • Power Level: Determines whether the power of an AP needs to be reduced. Reducing the power of an AP helps mitigate co-channel interference with another AP on the same channel or in close proximity. Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm to 30 dBm, and the default is -10 dBm.

   • RX SOP Threshold (dBm): RX SOP determines the Wi-Fi signal level, in dBm, at which an AP's radio demodulates and decodes a packet. From the RX SOP Threshold (dBm) drop-down list, choose High, Medium, Low, Auto, or Custom threshold value.

     If you choose the Custom RX SOP threshold, the RX-SOP Threshold (dBm) Custom Value field is displayed. In this field, enter a custom value for the RX SOP threshold in dBm. The value range is from -85 dBm through -60 dBm. For the 5-GHz band, the high threshold value is -76 dBm, the medium threshold value is -78 dBm, and the low threshold value is -80 dBm.

   • TPC Power Threshold: Is the cutoff signal level used by Radio Resource Management (RRM) to determine whether to reduce the power of an AP. Use the Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmission power rates. The range is from -50 dBm to 80 dBm, and the default threshold is -70 dBm.

10. Under Coverage Hole Detection, do this configuration:

    Note

    You must enable global coverage hole detection in Design > Feature Templates > Wireless > RRM General Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for the RRM general parameters, see Create a feature template for RRM general parameters. For information about provisioning, see Provision Wireless Devices.

    • In the Minimum Client Level (clients) field, enter a value for the minimum number of clients. The valid range is from 1 through 200. The default value is 3.

    • In the Data RSSI Threshold (dBm) field, enter the data Received Signal Strength Indication (RSSI) threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

    • In the Voice RSSI Threshold (dBm) field, enter the voice RSSI threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

    • In the Exception Level (%) field, enter an exception level. The valid range is from 0 through 100 percent. The default value is 25 percent.

11. Under Client Limit, in the Max Clients field, enter the maximum client limit value. The valid range is from 0 through 500.

    Note

    A maximum client limit isn’t supported on Cisco AireOS Wireless Controllers. If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7 or later and earlier than Cisco IOS XE Release 17.9, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9 or later, the maximum client limit is 500.

12. Under Flexible Radio Assignment (FRA), check the Client Aware check box to enable the Client Aware feature.

    This feature monitors the dedicated 5-GHz radio. When the client load passes the threshold, it automatically changes the FRA from a monitor role into a 5-GHz role, effectively doubling the capacity of the cell on demand. Once the capacity crisis is over and Wi-Fi load returns to normal, the radios resume their previous roles.

    Note

    You must enable FRA in Design > Feature Templates > Wireless > RRM FRA Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for the RRM FRA parameters, see Create a feature template for RRM FRA parameters. For information about provisioning, see Provision Wireless Devices.

    If you enable the Client Aware feature, do this configuration:

    • In the Client Select (%) field, enter a value for client selection. The valid range is from 0 through 100 percent. The default value is 50 percent.

    • In the Client Reset (%) field, enter a reset value for the client. The valid range is from 0 through 100 percent. The default value is 5 percent.

13. Under 802.11ax, configure this spatial reuse parameters for 802.11ax:

    Note	802.11ax is supported only on wireless controllers that run Cisco IOS XE Release 17.6.1 and later.

    • Check the OBSS PD check box to enable the Overlapping BSS Packet Detect (OBSS-PD) functionality.

    • In the Non-SRG OBSS PD Max Threshold (dBm) field, enter a value for the non-Spatial Reuse Group (SRG) OBSS-PD maximum threshold in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

    • Check the SRG OBSS PD check box to enable the SRG OBSS-PD functionality.

      SRG OBSS-PD is supported only on wireless controllers that run Cisco IOS XE Release 17.7.1 and later.

    • In the SRG OBSS PD Min Threshold (dBm) field, enter a value for the SRG OBSS-PD minimum threshold in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -82 dBm.

    • In the SRG OBSS PD Max Threshold (dBm) field, enter a value for the SRG OBSS-PD maximum threshold in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

Step 9

Configure these in the 6 GHz tab:

1. Ensure that the 6 GHz toggle button is enabled.

   Note	The 6-GHz radio is supported only on wireless controllers that run Cisco IOS XE Release 17.7.1 and later. For Cisco Catalyst 9800 Series Wireless Controller, if you disable the 6 GHz toggle button, Catalyst Center disables the Admin status of the 6 GHz RF profile.

2. Use the DBS Channel Width slider to set the minimum and maximum channel width of the RF profile.

   The available channel width options are 20 MHz, 40 MHz, 80 MHz, 160 MHz, or 320 MHz.

   Note	The 320 MHz channel width is applicable only for Cisco Wireless Controllers running Cisco IOS XE 17.15.2 or later.

3. To enable preamble puncturing for this band, click the Preamble Puncturing toggle button.

   Note	Preamble puncturing is applicable only for Cisco Wireless Controllers running Cisco IOS XE 17.15.2 or later.

4. Enable the Enable PSC Enforcing toggle button to allow Preferred Scanning Channel (PSC) enforcement.

   PSC enforcement improves the connectivity of 6-GHz devices by prioritizing PSC-enabled channels.

   Note	If you enable PSC enforcement, the check boxes next to the non-PSC channels are dimmed.

5. Under DCA Channel, do this configurration to manage channel assignments.

   • Check the Select All check box to include all DCA channels, or check an individual check box to select an individual DCA channel.

     • UNII-5 1-93

     • UNII-6 97-113

     • UNII-7 117-185

     • UNII-8 189-233

   • If the channel numbers aren't already displayed, click Show Advanced to select the channel numbers for each band.

   Note

   Select the DCA channels based on the country code of the device. During provisioning, only the allowed channels for the country configured on the wireless controller are considered and the unsupported channels are ignored. Provisioning may fail if all the channels that you've selected are unsupported as per the country codes configured on the controller.

6. Use the Supported Data Rate slider to set the rates at which data can be transmitted between an access point and a client. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

7. Under Mandatory Data Rates, check the check boxes next to the individual data rates. You can choose up to two data rates. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

   The available data rates change depending on the data rates set under Supported Data Rate.

8. Under Tx Power Configuration, set the power level and power threshold for an AP.

   • Standard Power Service: For APs with the standard power capability, compliance with FCC regulations requires the activation of Automatic Frequency Coordination (AFC). AFC uses the AP location and height data to determine the optimal channel and transmission power, ensuring noninterference with the licensed incumbent users on the 6-GHz band. You can use the Standard Power Service feature on Catalyst Center to activate AFC. By default, this feature is disabled. To enable this feature, click the Standard Power Service toggle button.

     This feature is applicable only for Cisco Catalyst 9800 Series Wireless Controllers running Cisco IOS XE Release 17.12.3 or later. When this feature is disabled, the 6-GHz dual-power mode APs are restricted to operate only in the low-power indoor mode, and the standard-power mode only APs have the radios disabled completely.

     Note

     To ensure proper functioning of this feature, you must configure the AP height, AP height uncertainty, and external antenna cable length on the corresponding wireless controller. For the standard power-capable APs to operate on standard power, you must ensure that you select at least one supported DCA channel based on your country-specific regulations.

   • Power Level: Determines whether the power of an AP needs to be reduced. Reducing the power of an AP helps mitigate co-channel interference with another AP on the same channel or in close proximity. Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm to 30 dBm.

   • RX SOP Threshold (dBm): RX SOP determines the Wi-Fi signal level, in dBm, at which an AP's radio demodulates and decodes a packet. From the RX SOP Threshold (dBm) drop-down list, choose High, Medium, Low, Auto, or Custom threshold value.

     If you choose the Custom RX SOP threshold, the RX-SOP Threshold (dBm) Custom Value field is displayed. In this field, enter a custom value for the RX SOP threshold in dBm. The value range is from -85 dBm through -60 dBm. For the 6-GHz band, the high threshold value is -76 dBm, the medium threshold value is -78 dBm, and the low threshold value is -80 dBm.

   • TPC Power Threshold: Is the cutoff signal level used by Radio Resource Management (RRM) to determine whether to reduce the power of an AP. Use the Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmission power rates. The range is from -80 dBm to -50 dBm.

9. Under Coverage Hole Detection, do this configuration:

   Note

   You must enable global coverage hole detection in Design > Feature Templates > Wireless > RRM General Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for the RRM general parameters, see Create a feature template for RRM general parameters. For information about provisioning, see Provision Wireless Devices.

   • In the Minimum Client Level (clients) field, enter a value for the minimum number of clients. The valid range is from 1 through 200. The default value is 3.

   • In the Data RSSI Threshold (dBm) field, enter the data Received Signal Strength Indication (RSSI) threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

   • In the Voice RSSI Threshold (dBm) field, enter the voice RSSI threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

   • In the Exception Level (%) field, enter an exception level. The valid range is from 0 through 100 percent. The default value is 25 percent.

10. Under Client Limit, in the Max Clients field, enter the maximum client limit value. The valid range is from 0 through 500.

    Note

    If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7 or later and earlier than Cisco IOS XE Release 17.9, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9 or later, the maximum client limit is 500.

11. Under Flexible Radio Assignment (FRA), complete this task:

    Note

    You must enable FRA in Design > Feature Templates > Wireless > RRM FRA Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for the RRM FRA parameters, see Create a feature template for RRM FRA parameters. For information about provisioning, see Provision Wireless Devices. FRA is supported only on wireless controllers that run Cisco IOS XE Release 17.9.1 or later.

    • In the Client Reset Count field, enter a reset count value for the client. The valid range is from 0 through 10. The default value is 1.

    • In the Client Utilization Threshold (%) field, enter a utilization threshold value for the client. The valid range is from 0 through 100 percent. The default value is 5 percent.

12. Under 802.11ax, do this configuration:

    • From the 6 GHz Discovery Frames drop-down list, choose the required option from None, Broadcast Probe Response, and FILS Discovery.

      6-GHz discovery frames are needed if the 6-GHz band is the only operational band. For more information about the 6-GHz discovery frames, click Learn More.

    • In the Broadcast Probe Response Interval (msec) field, enter the broadcast probe response interval, in msec. The valid range is from 5 msec through 25 msec. The default value is 20 msec.

13. Under MULTI BSSID, check the check box to enable these multiple basic service set identifier (BSSID) parameters:

    • Target Wake time

    • TWT Broadcast Support

    Note

    You must enable multiple BSSID in Design > Feature Templates > Wireless > Dot11ax Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for Dot11ax, see Create a feature template for Dot11ax configuration. For information about provisioning, see Provision Wireless Devices.

14. Under 802.11AX PARAMETERS, check the corresponding check box to enable these parameters:

    • Downlink OFDMA

    • Uplink OFDMA

    • Downlink MU-MIMO

    • Uplink MU-MIMO

15. Under 802.11BE PARAMETERS, check the corresponding check box to enable these parameters:

    • Downlink OFDMA

    • Uplink OFDMA

    • Downlink MU-MIMO

    • Uplink MU-MIMO

    • OFDMA Multi-RU

    Note	The 802.11be parameters are applicable only for Cisco Wireless Controllers running Cisco IOS XE 17.15.2 or later.

    You must enable the 802.11be status in Design > Feature Templates > Wireless > Dot11be Status Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for 802.11be, see Create a feature template for Dot 11be status configuration. For information about provisioning, see Provision Wireless Devices.

16. Under SPATIAL REUSE, do this configuration:

    • Check the OBSS PD check box to enable the Overlapping BSS Packet Detect (OBSS-PD) functionality.

    • In the Non-SRG OBSS PD Max Threshold (dBm) field, enter a value for the non-Spatial Reuse Group (SRG) OBSS-PD maximum threshold in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

    • Check the SRG OBSS PD check box to enable the SRG OBSS-PD functionality.

      SRG OBSS-PD is supported only on wireless controllers that run Cisco IOS XE Release 17.7.1 and later.

    • In the SRG OBSS PD Min Threshold (dBm) field, enter a value for the SRG OBSS-PD minimum threshold in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -82 dBm.

    • In the SRG OBSS PD Max Threshold (dBm) field, enter a value for the SRG OBSS-PD maximum threshold in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

Step 10

Click Save.

Step 11

(Optional) To mark a profile as the default RF profile, check the Profile Name check box and click Mark Default. In the Warning window, click OK.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click RF Profiles.

Step 5

In the Wireless Radio Frequency Profile area, click the Basic RF Profile tab.

Step 6

Check the check box next to the basic profile name that you want to edit.

Step 7

From the Action drop-down list, choose Edit/View.

Step 8

In the Edit Wireless Radio Frequency Profile window, configure the basic RF profile settings. For more information, see Create a wireless radio frequency profile.

Step 9

Click Save.

Step 10

To delete a basic RF profile, check the check box next to the basic RF profile name.

Step 11

From the Action drop-down list, choose Delete and then click Yes.

Step 12

To mark a basic RF profile as the default, check the check box next to a basic RF profile name.

Step 13

From the Action drop-down list, choose Mark Default and then click Yes.

Step 1

From the main menu, choose Design > Network Settings

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click RF Profiles.

Step 5

In the Basic RF Profile tab, check the check box next to the profile name that you want to clone.

Step 6

From the Actions drop-down list, choose Create a Clone.

Step 7

In the Profile Name field of the Create Wireless Radio Frequency Profile window, enter a unique name for the profile.

Step 8

Edit the RF profile configurations as necessary. For more information, see Create a wireless radio frequency profile.

Step 9

Click Save.

Step 1

From the main menu, choose Design > Network Settings.

Step 2

Click the Wireless tab.

Step 3

From the left hierarchy tree, select Global.

Step 4

Click RF Profiles.

Step 5

In the Wireless Radio Frequency Profile area, hover your cursor over Add and choose AI RF Profile.

Step 6

In the Profile Name field of the Create AI Radio Frequency Profile window, enter the RF profile name.

Step 7

In the Radio Frequency Settings area of Basic Settings, check the 2.4 GHz, 5 GHz, or 6 GHz check box.

Step 8

In the Busy Hours area, define the start and end time of the site time zone.

Step 9

In the Busy Hour Sensitivity area, click the Low, Medium, or High radio button to define the threshold of the Radio Resource Management (RRM) sensitivity for the busy hours interval.

Step 10

In the Enable RF Settings area, click the toggle buttons under the 2.4 GHz, 5 GHz, or 6 GHz columns to enable or disable RF settings for the corresponding bands.

Step 11

In the Advanced area, click the 2.4 GHz toggle button.

1. In the DCA Channel area, check the Select All check box to select DCA channels 1, 6, and 11. Alternatively, check the individual check boxes next to the channel numbers.

2. In the Advanced Options area, check the Select All check box to select all the DCA channels.

3. If the individual channel numbers aren’t already displayed, click Show Advanced to select the remaining channel numbers.

4. Check the check box next to the individual channel numbers. The channel numbers that are available for the profile are 2, 3, 4, 5, 7, 8, 9, 10, 12, 13, and 14.

   Note

   Select the DCA channels based on the country code of the device. During provisioning, only the allowed channels for the country configured on the wireless controller are considered and the unsupported channels are ignored. Provisioning may fail if all the channels that you've selected are unsupported as per the country codes configured on the controller.

5. In the Supported Data Rate area, do this configuration:

   • Check the Enable 802.11b data rates check box to enable the 802.11b data rates. This action also enables the 802.11b supported data rate check boxes in the Mandatory Data Rates area.

   • Use the slider to set the rates at which data can be transmitted between an AP and a client. The available data rates are 1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, and 54.

6. In the Mandatory Data Rates area, check the check box next to the individual data rates. You can choose up to two data rates. The available data rates are 1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, and 54.

7. In the Tx Power Configuration area, do this configuration :

   • Power Level: Determines whether the power of an AP needs to be reduced. Reducing the power of an AP helps mitigate co-channel interference. Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm through 30 dBm. The minimum default is -10 dBm and the maximum default is 30 dBm.

   • RX SOP Threshold (dBm): Receiver Start of Packet Detection Threshold (RX SOP) determines the Wi-Fi signal level, in dBm, at which an AP's radio demodulates and decodes a packet. From the RX SOP Threshold (dBm) drop-down list, choose High, Medium, Low, Auto, or Custom threshold value.

     If you choose the Custom RX SOP threshold, the RX-SOP Threshold (dBm) Custom Value field is displayed. In this field, enter a custom value for the RX SOP threshold in dBm. The value range is from -85 dBm through -60 dBm. For the 2.4-GHz band, the high threshold value is -79 dBm, the medium threshold value is -82 dBm, and the low threshold value is -85 dBm.

   • TPC Power Threshold: Is the cutoff signal level used by RRM to determine whether to reduce the power of an AP. Use the TPC Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmission power rates. The range is from -80 dBm through -50 dBm.

8. Under Coverage Hole Detection, do this configuration:

   Note

   You must enable global coverage hole detection in Design > Feature Templates > Wireless > RRM General Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for RRM general parameters, see Create a feature template for RRM general parameters. For information about provisioning, see Provision Wireless Devices.

   • In the Minimum Client Level (clients) field, enter a value for the minimum number of clients. The valid range is from 1 through 200. The default value is 3.

   • In the Data RSSI Threshold (dBm) field, enter the data Received Signal Strength Indication (RSSI) threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

   • In the Voice RSSI Threshold (dBm) field, enter the voice RSSI threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

   • In the Exception Level (%) field, enter an exception level. The valid range is from 0 through 100 percent. The default value is 25 percent.

9. Under CLIENT LIMIT, in the Max Clients field, enter the maximum client limit value. The valid range is from 0 through 500.

   Note

   If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7.1, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7.1 or later and earlier than Cisco IOS XE Release 17.9.1, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9.1 or later, the maximum client limit is 500.

10. Under 802.11ax, configure these spatial reuse parameters:

    Note	802.11ax is supported only on wireless controllers that run Cisco IOS XE Release 17.6.1 and later.

    • Check the OBSS PD check box to enable the Overlapping BSS Packet Detect (OBSS-PD) functionality.

    • In the Non-SRG OBSS PD Max Threshold (dBm) field, enter a value for the non-Spatial Reuse Group (SRG) OBSS-PD maximum threshold, in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

    • Check the SRG OBSS PD check box to enable the SRG OBSS-PD functionality.

      SRG OBSS-PD is supported only on wireless controllers that run Cisco IOS XE Release 17.7.1 and later.

    • In the SRG OBSS PD Min Threshold (dBm) field, enter a value for the SRG OBSS-PD minimum threshold, in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -82 dBm.

    • In the SRG OBSS PD Max Threshold (dBm) field, enter a value for the SRG OBSS-PD maximum threshold, in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

Step 12

In the Advanced area, click the 5 GHz toggle button.

1. To enable preamble puncturing on the band, click the Preamble Puncturing toggle button.

   Note	Preamble puncturing is applicable only for Cisco Wireless Controllers running Cisco IOS XE 17.15.2 or later.

2. Check the Zero Wait DFS check box to allow APs with 5-GHz radio to switch to a new channel without any waiting time.

   Note	Catalyst Center supports Zero wait DFS for Cisco Wireless Controllers running Cisco IOS XE Release 17.9.1 and later.

3. Use the DBS Max Width slider to set the channel width of the AI RF profile.

   The available channel width options are 20 MHz, 40 MHz, 80 MHz, or 160 MHz.

   The Auto Channels Logic area displays a color-coded representation of channels that are available in the Unlicensed National Information Infrastructure (UNII) radio bands for the available channel widths.

   You can select DBS Max Width only when DBS is enabled.

   When you disable the DBS, Catalyst Center allows you to select the static channel width.

4. Set the DCA Channel to manage these channel assignments:

   • UNII-1 36-48: The channels available for UNII-1band are 36, 40, 44, and 48.

   • UNII-2 52-144: The channels available for UNII-2band are 52, 56, 60, 64, 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140, and 144.

   • UNII-3 149-165: The channels available for UNII-3 band are 149, 153, 157, 161, and 165.

5. Check the Select All check box to include all DCA channels, or check an individual check box to select an individual DCA channel.

6. Click Show Advanced to view and select the individual DCA channel numbers.

   • Check the UNII-1 36-48 check box to include all channels, or check an individual check box.

   • Check the UNII-2 52-144 check box to include all channels, or check an individual check box.

   • Check the UNII-3 149-165 check box to include all channels, or check an individual check box.

   Note

   Select the DCA channels based on the country code of the device. During provisioning, only the allowed channels for the country configured on the wireless controller are considered and the unsupported channels are ignored. Provisioning may fail if all the channels that you've selected are unsupported as per the country codes configured on the controller.

7. Use the Supported Data Rate slider to set the rates at which data can be transmitted between an AP and a client. The available data rates are 6, 9, 11, 12, 18, 24, 36, 48, and 54.

8. In the Mandatory Data Rates area, check the check box next to the individual data rates. You can choose up to two data rates. The available data rates are 6, 9, 11, 12, 18, 24, 36, 48, and 54.

9. In the Tx Power Configuration area, do this configuration:

   • Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm through 30 dBm. The minimum default is -10 dBm and the maximum default is 30 dBm.

   • RX SOP Threshold (dBm): RX SOP determines the Wi-Fi signal level, in dBm, at which an AP's radio demodulates and decodes a packet. From the RX SOP Threshold (dBm) drop-down list, choose High, Medium, Low, Auto, or Custom threshold value.

     If you choose the Custom RX SOP threshold, the RX-SOP Threshold (dBm) Custom Value field is displayed. In this field, enter a custom value for the RX SOP threshold in dBm. The value range is from -85 dBm through -60 dBm. For the 5-GHz band, the high threshold value is -76 dBm, the medium threshold value is -78 dBm, and the low threshold value is -80 dBm.

   • Use the TPC Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmit power rates. The range is from -80 dBm through -50 dBm.

10. Under Coverage Hole Detection, do this configuration:

    Note

    You must enable global coverage hole detection in Design > Feature Templates > Wireless > RRM General Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for RRM general parameters, see Create a feature template for RRM general parameters. For information about provisioning, see Provision Wireless Devices.

    • In the Minimum Client Level (clients) field, enter a value for the minimum number of clients. The valid range is from 1 through 200. The default value is 3.

    • In the Data RSSI Threshold (dBm) field, enter the data Received Signal Strength Indication (RSSI) threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

    • In the Voice RSSI Threshold (dBm) field, enter the voice RSSI threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

    • In the Exception Level (%) field, enter an exception level. The valid range is from 0 through 100 percent. The default value is 25 percent.

11. Under CLIENT LIMIT, in the Max Clients field, enter the maximum client limit value. The valid range is from 0 through 500.

    Note

    If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7.1, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7.1 or later and earlier than Cisco IOS XE Release 17.9.1, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9.1 or later, the maximum client limit is 500.

12. Under 802.11ax, configure these spatial reuse parameters:

    Note	802.11ax is supported only on wireless controllers that run Cisco IOS XE Release 17.6.1 and later.

    • Check the OBSS PD check box to enable the Overlapping BSS Packet Detect (OBSS-PD) functionality.

    • In the Non-SRG OBSS PD Max Threshold (dBm) field, enter a value for the non-Spatial Reuse Group (SRG) OBSS-PD maximum threshold, in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

    • Check the SRG OBSS PD check box to enable the SRG OBSS-PD functionality.

      SRG OBSS-PD is supported only on wireless controllers that run Cisco IOS XE Release 17.7.1 and later.

    • In the SRG OBSS PD Min Threshold (dBm) field, enter a value for the SRG OBSS-PD minimum threshold, in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -82 dBm.

    • In the SRG OBSS PD Max Threshold (dBm) field, enter a value for the SRG OBSS-PD maximum threshold, in dBm. The valid range is from -82 dBm through -62 dBm. The default value is -62 dBm.

Step 13

In the Advanced area, click the 6 GHz toggle button.

1. Use the DBS Width slider to set the minimum and maximum channel width of the AI RF profile.

   The available channel width options are 20 MHz, 40 MHz, 80 MHz, or 160 MHz.

   The Auto Channels Logic area displays a color-coded representation of channels that are available in the UNII radio bands for the available channel widths.

   You can select DBS Width only when DBS is enabled.

2. To enable preamble puncturing on the band, click the Preamble Puncturing toggle button.

   Note	Preamble puncturing is applicable only for Cisco Wireless Controllers running Cisco IOS XE 17.15.2 or later.

3. Enable the Enable PSC Enforcing toggle button to allow Preferred Scanning Channel (PSC) enforcement.

   PSC enforcement improves the connectivity of the 6-GHz devices by prioritizing the PSC-enabled channels.

   Note	If you enable PSC enforcement, the check boxes next to the non-PSC channels are dimmed and the check boxes next to the PSC channels are checked by default. If necessary, you can uncheck the check box next to the required PSC channel.

4. Set the DCA Channel to manage these channel assignments:

   • UNII-5 1-93: The channels available for the UNII-5 band are 1, 5, 9, 13, 17, 21, 25, 29, 33, 37, 41, 45, 49, 53, 57, 61, 65, 69, 73, 77, 81, 85, 89, and 93.

   • UNII-6 97-113: The channels available for the UNII-6 band are 97, 101, 105, 109, and 113.

   • UNII-7 117-185: The channels available for the UNII-7 band are 117, 121, 125, 129, 133, 137, 141, 145, 149, 153, 157, 161, 165, 169, 173, 177, 181, and 185.

   • UNII-8 189-233: The channels available for the UNII-8 band are 189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, and 233.

5. Check the Select All check box to include all DCA channels, or check an individual check box to select an individual DCA channel.

6. Click Show Advanced to select the remaining DCA channel numbers.

   • Check the UNII-5 1-93 check box to include all channels, or check an individual check box.

   • Check the UNII-7 117-185 check box to include all channels, or check an individual check box.

   • Check the UNII-8 189-233 check box to include all channels, or check an individual check box.

   Note

   Select the DCA channels based on the country code of the device. During provisioning, only the allowed channels for the country configured on the wireless controller are considered and the unsupported channels are ignored. Provisioning may fail if all the channels that you've selected are unsupported as per the country codes configured on the controller.

7. Use the Supported Data Rates slider to set the rates at which data can be transmitted between an AP and a client. The available data rates are 6, 9, 12, 18, 24, 36, 48, and 54.

8. In the Tx Power Configuration area, do this configuration.

   • Standard Power Service: For APs with the standard power capability, compliance with FCC regulations requires the activation of Automatic Frequency Coordination (AFC). AFC uses the AP location and height data to determine the optimal channel and transmission power, ensuring noninterference with the licensed incumbent users on the 6-GHz band. You can use the Standard Power Service feature on Catalyst Center to activate AFC. By default, this feature is disabled. To enable this feature, click the Standard Power Service toggle button.

     This feature is applicable only for Cisco Catalyst 9800 Series Wireless Controllers running Cisco IOS XE Release 17.12.3 or later. When this feature is disabled, the 6-GHz dual-power mode APs are restricted to operate only in the low-power indoor mode, and the standard-power mode only APs have the radios disabled completely.

     Note

     To ensure proper functioning of this feature, you must configure the AP height, AP height uncertainty, and external antenna cable length on the corresponding wireless controller. For the standard power-capable APs to operate on standard power, you must ensure that you select at least one supported DCA channel based on your country-specific regulations.

   • Use the Power Level slider to set the minimum and maximum power level. The range is from -10 dBm through 30 dBm.

   • RX SOP Threshold (dBm): RX SOP determines the Wi-Fi signal level, in dBm, at which an AP's radio demodulates and decodes a packet. From the RX SOP Threshold (dBm) drop-down list, choose High, Medium, Low, Auto, or Custom threshold value.

     If you choose the Custom RX SOP threshold, the RX-SOP Threshold (dBm) Custom Value field is displayed. In this field, enter a custom value for the RX SOP threshold in dBm. The value range is from -85 dBm through -60 dBm. For the 6-GHz band, the high threshold value is -76 dBm, the medium threshold value is -78 dBm, and the low threshold value is -80 dBm.

   • Use the TPC Power Threshold slider to increase and decrease the power value, which causes the AP to operate at higher or lower transmit power rates. The range is from -80 dBm through -50 dBm.

9. Under Coverage Hole Detection, do this configuration:

   Note

   You must enable global coverage hole detection in Design > Feature Templates > Wireless > RRM General Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for RRM general parameters, see Create a feature template for RRM general parameters. For information about provisioning, see Provision Wireless Devices.

   • In the Minimum Client Level (clients) field, enter a value for the minimum number of clients. The valid range is from 1 through 200. The default value is 3.

   • In the Data RSSI Threshold (dBm) field, enter the data Received Signal Strength Indication (RSSI) threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

   • In the Voice RSSI Threshold (dBm) field, enter the voice RSSI threshold in dBm. The valid range is from -90 dBm through -60 dBm. The default value is -80 dBm.

   • In the Exception Level (%) field, enter an exception level. The valid range is from 0 through 100 percent. The default value is 25 percent.

10. Under CLIENT LIMIT, in the Max Clients field, enter the maximum client limit value. The valid range is from 0 through 500.

    Note

    If the wireless controller is running a version earlier than Cisco IOS XE Release 17.7.1, the maximum client limit is 200. If the wireless controller is running Cisco IOS XE Release 17.7.1 or later and earlier than Cisco IOS XE Release 17.9.1, the maximum client limit is 400. If the wireless controller is running Cisco IOS XE Release 17.9.1 or later, the maximum client limit is 500.

11. Under 802.11ax, do this configuration:

    • From the 6 GHz Discovery Frames drop-down list, choose the required option from None, Broadcast Probe Response, and FILS Discovery.

      6-GHz discovery frames are needed if the 6-GHz band is the only operational band. For more information about the 6-GHz discovery frames, click Learn More.

    • In the Broadcast Probe Response Interval (msec) field, enter the broadcast probe response interval, in msec. The valid range is from 5 msec through 25 msec. The default value is 20 msec.

12. Under MULTI BSSID, check the check box to enable the multiple basic service set identifier (BSSID) parameters, including:

    • Target Wake time

    • TWT Broadcast Support

    Note

    You must enable multiple BSSID in Design > Feature Templates > Wireless > Dot11ax Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for Dot11ax, see Create a feature template for Dot11ax configuration. For information about provisioning, see Provision Wireless Devices.

13. Under 802.11AX PARAMETERS, check the corresponding check box to enable these parameters:

    • Downlink OFDMA

    • Uplink OFDMA

    • Downlink MU-MIMO

    • Uplink MU-MIMO

14. Under 802.11BE PARAMETERS, check the corresponding check box to enable these parameters:

    • Downlink OFDMA

    • Uplink OFDMA

    • Downlink MU-MIMO

    • Uplink MU-MIMO

    • OFDMA Multi-RU

    Note	The 802.11be parameters are applicable only for Cisco Wireless Controllers running Cisco IOS XE 17.15.2 or later.

    You must enable the 802.11be status in Design > Feature Templates > Wireless > Dot11be Status Configuration for the corresponding radio band and provision it on the managing wireless controller. For information about the feature template for 802.11be, see Create a feature template for Dot 11be status configuration. For information about provisioning, see Provision Wireless Devices.