Converged Access Workflow Overview
The Converged Access workflow simplifies, automates and optimizes deployment of various enterprise-class next generation wireless deployment models for campus and branch networks. Cisco Prime Infrastructure can automate the converged access deployment of wireless networks using converged access components such as Catalyst 3650, 3850, 4500 SUP 8-E switches, and Cisco 5760 Wireless LAN controller (WLC). The catalyst switches can be deployed as Mobility Agent (MA), Mobility Controller (MC), and Guest Anchor controller (GA).
Figure 36-1 illustrates the wireless converged access deployment models.
Figure 36-1 Converged Access Workflow Overview
Single-switch Small Network Deployment Model
This deployment model assumes single Catalyst 3650, 3850 or 4500 SUP 8-E switch deployed in Access layer in combined MA and MC roles. The Catalyst switches can be deployed in individual standalone system mode or in stackwise redundant supervisor mode.
Controller-less Large Wireless Deployment Model
This deployment model consists of multiple sub-domains and allows inter-domain MC peering for end-to-end seamless roaming across sub-domains. The MA switches are deployed in Access layer while the MC switches can be placed in Distribution layer.
Controller-based Large Wireless Deployment Model
A large scale converged access campus building is deployed with external 5760 WLC as MC. The Access layer switches are deployed as MA across multiple buildings with centralized 5760 MC. In such large network, multiple 5760 WLCs may co-exist for better load balancing and redundancy. Depending on the roaming requirement across different buildings, the inter-domain mobility peering between 5760 WLCs can be established.
Centralized Wireless Campus Deployment Model
In this deployment model, the switches in Access layer remain in traditional switching mode and wireless communication between Access Point (AP) and WLC is built as overlay network. In large scale campus deployments, multiple 5760 WLCs can be deployed for better load balancing and redundancy. To provide seamless large mobility domains, the inter-domain mobility peering 5760 WLCs can be established.
Key Benefits
-
Simple Automated Deployment—Simplifies the converged access deployment by automating the device configuration process. Requires only a few deployment specific inputs from the network administrator and pushes the complete converged access configurations to the network devices.
-
Error Free Deployment—The template based configuration used by Cisco Prime Infrastructure avoids manual misconfigurations, making it easier to build/maintain enterprise-wide standardized configurations that are well understood by the network administrator.
-
Optimized Deployment—The configuration templates used by Cisco Prime Infrastructure incorporates a large number of Cisco best practice guidelines, improving the deployment quality. Some of the best practice wireless technologies/features that are automatically included in the template are Band-Select, Radio Resource Management (RRM), Fast SSID-Change, CleanAir, and Wireless QoS.
-
High Scalability—Supports large enterprises with thousands of branches. It not only reduces efforts to deploy greenfield branches, but also simplifies large scale conversion of traditional Ethernet based branch networks to converged access branches in an error-free way.
Related Topics
Prerequisites for Converged Access Deployment
To successfully deploy the Converged Access solution using the Converged Access Workflow, the wired infrastructure of the network should be set for further configuration required for converged access. This section describes the prerequisite configurations for Converged Access Workflow based deployment.
You can view the prerequisites using the click here link in the
Before you Begin
page in the Converged Access Workflow (Services > Network Services > Converged Access).
Related Topics
Prerequisites for Layer 2 and Layer 3
Table 36-4
describes the Layer 2 and Layer 3 prerequisites, and sample configuration for the Converged Access Workflow. In the sample configuration, the following nomenclature is used to represent the various wireless management VLANs in the MA and MC.
-
WM_VLAN - Name of the Wireless Management VLAN
-
WM_VLAN_id - ID of the Wireless Management VLAN
-
WLAN1_Client_VLAN_Name - VLAN name of WLAN 1
-
WLAN2_Client_VLAN_Name - VLAN name of WLAN 2
-
WLAN3_Client_VLAN_Name - VLAN name of WLAN 3
-
WLAN1_Client_VLAN_id - VLAN ID of WLAN 1
-
WLAN2_Client_VLAN_id - VLAN ID of WLAN 2
-
WLAN3_Client_VLAN_id - VLAN ID of WLAN 3
Note WLANx_Client_VLAN_id represents all the three client VLAN Ids.
Table 36-4 Layer 2 and Layer 3 Prerequisites for Converged Access Switches for Device Roles MA and MC
Task on Converged Access Switch
|
|
Wireless Management VLAN
-
Create wireless management VLAN with a network wide unique name.
-
Configure access ports connected to APs under this VLAN.
|
! Mgmt VLAN on Access Switch
! Apply VLAN to access ports connected to Access Points
interface GigabitEthernet 1/0/x
description Connected to Access-Points
switchport access vlan <WM_VLAN_id>
|
Create Wireless Client VLANs
-
Create wireless client VLANs in VLAN database. The VLAN names are common across campus and branches.
|
! Create the wireless Client VLANs on Access Switch
vlan <WLAN1_Client_VLAN_id>
name <WLAN1_Client_VLAN_Name>
vlan <WLAN2_Client_VLAN_id>
name <WLAN2_Client_VLAN_Name>
vlan <WLAN3_Client_VLAN_id>
name <WLAN3_Client_VLAN_Name>
|
DHCP Snooping /ARP Inspection
-
Enable DHCP snooping and ARP inspection on each WLAN client VLANs in the access switch (for static or dynamic VLAN).
-
Configure upstream Layer 2 trunk as trusted for ARP inspection and DHCP snooping.
|
! Enable DHCP Snooping & ARP Inspection on all WLAN
! Client VLANs (Static or Dynamic)
ip dhcp snooping vlan name
no ip dhcp snooping information option
ip arp inspection vlan <WLANx_Client_VLAN_id>
ip arp inspection validate source destination allow-zeros
interface Port-Channel <id>
description L2 Trunk to Upstream Router/Switch
|
Switch Trunk Ports
-
Configure trunk ports to the WAN router(s). The trunk must allow WM_VLAN and the Client VLANs, and must be a trusted port for DHCP snooping or ARP inspection.
-
Ensure that the other ends of the trunk ports are properly configured (not shown).
|
! Configure trunk port to other connected switches/router
description Connected to Upstream System
switchport trunk allowed vlan add <WM_VLAN_id>, <WLAN1_Client_VLAN_id>,<WLAN2_Client_VLAN_id>, <WLAN3_Client_VLAN_id>,
|
Default Gateway
-
Ensure that default gateway is configured.
|
! Configure default-gateway
|
Wireless Mobility Controller
-
If you want Catalyst 3650, 3850, and 4500 SUP 8-E switches to be deployed as MC then configure the switches as MC, and reload them to make the configuration effective.
|
wireless mobility controller
|
AP Licenses
-
MC must have sufficient AP licenses to support all APs in its sub-domain, and activate the licenses on the APs. The activation does not require a reboot.
-
The GA does not require AP license.
|
! Activate AP license on branch converged access switch
license right-to-use activate ap-count <count> slot <ID> acceptEULA
|
Security
-
Convert relevant authentication commands on the access switches to their Class-Based Policy Language (CPL) equivalents.
|
authentication convert-to new-style
This command permanently converts the legacy configuration on the switch to identity-based networking services. On entering this command, a message is displayed for your permission to continue. Permit the conversion.
|
Update AP Interface Template
-
Add wireless management VLAN to the AP interface template LAP_INTERFACE_TEMPLATE.
-
Apply the updated template to each switch port connected to an AP.
-
Verify that the VLANs are applied using the following command:
show derived-config interface <
interface id
>
This step is not necessary if
autoconf enable
command is globally configured. In this case, the switch automatically detects the device types of the connected devices, and applies appropriate interface templates.
|
template LAP_INTERFACE_TEMPLATE
switchport access vlan <Wireless_Mgmt_VLAN_id>
! Associate the LAP_INTERFACE_TEMPLATE to switch
! ports connected to APs. This puts the interface
! in shutdown state; so issue a “no shut” command
source template LAP_INTERFACE_TEMPLATE
|
Table 36-5
describes the Layer 2 and Layer 3 prerequisites, and sample configuration for GA. In the sample configuration, the following nomenclature is used to represent the wireless management VLAN and Guest VLAN details for GA:
-
WM_VLAN - Name of the Wireless Management VLAN
-
WM_VLAN_id - ID of the Wireless Management VLAN
-
GUEST_VLAN_Name - VLAN name of Guest Anchor Controller
-
GUEST_VLAN_id - VLAN ID of Guest Anchor Controller
Table 36-5 Layer 2 and Layer 3 Prerequisites for Guest Anchor Controller
Task on Guest Anchor Controller
|
Sample Configuration for Guest Access Controller
|
Wireless Management VLAN
-
Create wireless management VLAN with a network wide unique name.
|
! Mgmt VLAN on Access Switch
|
Create Wireless Guest VLAN
-
Create wireless Guest VLANs in VLAN database. The VLAN name must be common across all GAs.
|
! Create the wireless guest VLANS on Access Switch
|
DHCP Snooping / ARP Inspection
-
Enable DHCP snooping and ARP inspection on the Guest VLAN.
-
Configure Layer 2 trunk connected to the network as trusted for ARP inspection and DHCP snooping.
|
! Enable DHCP Snooping & ARP Inspection on Guest
ip dhcp snooping vlan name <GUEST_VLAN_Name>
no ip dhcp snooping information option
ip arp inspection vlan <GUEST_VLAN_id>
ip arp inspection validate source destination allow-zeros
interface Port-Channel <id>
description L2 Trunk to network
|
Default Gateway
-
Ensure that default gateway is configured.
|
ip default-gateway <ip address>
|
Security
-
Convert relevant authentication commands on the access switches to their Class-Based Policy Language (CPL) equivalents.
|
authentication convert-to new-style
This command permanently converts the legacy configuration on the switch to identity-based networking services. On entering this command, a message is displayed for your permission to continue. Permit the conversion.
|
Related Topics
Prerequisites for Server Configuration
-
Cisco Prime Infrastructure
– All network-wide catalyst switches and 5760 WLCs must be configured with SNMP.
– The Converged Access switches must be added to the inventory of Cisco Prime Infrastructure. You need to provide SNMP and Telnet credentials to add the devices to the inventory.
– Link Cisco Prime Infrastructure with Cisco ISE engine as external server to centrally monitor end-to-end client connectivity and policy enforcement details.
– All network devices including catalyst switches and Guest Anchor WLC must be configured in Cisco ISE/ACS to enable centralized policy engine function.
– AAA configuration is not required for converged access on individual network devices as it is automatically generated by Converged Access Workflow.
-
DHCP Server—Internal or external DHCP server must be preconfigured with appropriate pool settings for wireless clients.
-
DNS Server—Must be preconfigured with appropriate name-lookup process to successfully connect to the network.
Related Topics
Converged Access Template Based Deployment
Cisco Prime Infrastructure uses different templates for different deployment models. You need to select the appropriate template based on your network topology as explained in
Table 36-6
:
Table 36-6 Network Topology and Configuration Template Mapping
|
|
Single-switch small network
|
IOS-XE Controller - Small Network
|
Controller-less large wireless branch
|
IOS-XE Controller - Large Network
|
Controller-based large wireless branch
|
IOS-XE Controller - Large Network
|
Centralized wireless campus
|
IOS-XE Centralized Wireless Network
|
To deploy a converged access template:
Step 1 Choose Services > Converged Access.
Step 2 Click Next to choose the configuration.
Step 3 From the Select Deployment Model drop-down list, choose any one of the following options:
-
IOS-XE Controller - Small Network
-
IOS-XE Controller - Large Network
-
IOS-XE Centralized Wireless Network
Step 4 Click Next to choose the devices to be deployed.
Step 5 Choose all the devices and click Next to apply the selected network configuration.
The selected device will be listed out in the left pane, and in the right pane you can configure the templates by entering the values for the WLANs, Guest WLAN, Security, and Wireless Management.
Step 6 Check the
All Selected Devices
check box and enter the WLANs, Security and Application Services configuration values that are common to all the selected devices.
Step 7 Click
Apply
.
Step 8 Select the individual devices and enter the device specific configuration values such as Guest Controller, Mobility and Witless Management IP.
For more details, see Guidelines for Entering Configuration Values in Related Topics.
Step 9 Click Apply and then Next to view the confirmation screen.
The confirmation screen allows you to view the device configuration information before deployment.
Step 10 Click
Deploy
.
Related Topics
Guidelines for Entering Configuration Values
This section provides the field descriptions for converged access template and guidelines for entering the global and local configuration values for the following deployment models with specific examples.
-
Controller-less single-switch deployment model
-
Controller-less large wireless deployment model
-
Controller-based large wireless deployment model
-
Centralized wireless campus deployment model
Related Topics
Converged Access Template Field Descriptions
This section contains the field descriptions for converged access template.
Table 36-7 WLAN Field Descriptions
|
|
SSID
|
Name of the wireless LAN.
|
ID
|
Wireless LAN ID (1 - 16).
|
Pre-Shared Key
|
Wi-Fi Protected Access Pre-Shared Key (WPA2-PSK) is a security mechanism used to authenticate and validate users on a wireless LAN (WLAN) or Wi-Fi connection. This is a mandatory field. The value must be alphanumeric and at least eight characters long.
|
Client VLAN Name
|
Name of the client VLAN. Can be alphanumeric.
|
Table 36-8 Guest Controller Field Descriptions
|
|
Anchor Controller IP
|
Wireless management IP of Guest Anchor device.
|
Anchor Group Name
|
Group name of Anchor device.
|
Foreign Controller
|
Wireless management IP of MC to which the Guest Anchor device is associated.
|
Table 36-9 Security Field Descriptions
|
|
Server Protocol
|
Remote Authentication Dial In User Service (RADIUS) protocol.
|
Server IP
|
IP address of the RADIUS server.
|
Server Key
|
Password of Radius server.
|
Table 36-10 Application Services Field Descriptions
|
|
Netflow Collectors (IP:Port)
|
IP—The IP address of the Prime Infrastructure server.
Port—The port on which the NetFlow monitor will receive the exported data. For Cisco Prime Infrastructure the default port is 9991.
Example: 172.20.114.251:9991
|
WLAN-1 SSID Bandwidth(%)
|
Specify the maximum bandwidth percentage allowed for first WLAN.
|
WLAN-2 SSID Bandwidth(%)
|
Specify the maximum bandwidth percentage allowed for second WLAN.
|
WLAN-3 SSID Bandwidth(%)
|
Specify the maximum bandwidth percentage allowed for third WLAN.
|
Guest SSID Bandwidth(%)
|
Specify the maximum bandwidth percentage allowed for Guest WLAN.
|
Table 36-11 Wireless Mobility Field Descriptions
|
|
Role
|
Mobility Controller or Mobility Agent.
|
Controller IP
|
Wireless Management IP of Controller device.
|
Switch Peer Group Name
|
Peer group name in which the Agent is added.
|
Mobility Agent IP(s)
|
Wireless management IP of Mobility Agent devices. If you are entering more than one IP addresses, use semicolon to separate the IP addresses.
|
Peer Controller IP(s)
|
Wireless Management IP of peer controller device. If you are entering more than one IP addresses, use semicolon to separate the IP addresses.
|
RF Group Name
|
The RG group name used in the deployment.
|
Table 36-12 Wireless Management Field Descriptions
|
|
VLAN ID
|
VLAN ID of the selected device.
|
IP
|
Wireless management IP of the selected device.
|
Subnet mask
|
Subnet mask allocated to the selected device.
|
Related Topics
Entering Configuration Values for Controller-less Single-Switch Deployment Model
A small-sized remote branch office or retail store may consists of a single converged access switch (standalone or stack) to provide network connectivity to the wired and wireless users.
For such network designs, the switch integrates both MC and MA functions. These networks may need guest wireless services, as well as common security and network access policy enforcement across all deployed sites.
The network administrator can use Cisco Prime Infrastructure IOS-XE Controller Small Network template to deploy converged access. Figure 36-2 illustrates the reference network for single-switch small network that shows three branch offices. Each site can be independently deployed using the workflow. Alternatively, one deployment workflow can deploy multiple sites.
Figure 36-2 Controller-less Single-switch Small Network Model
In Figure 36-2, the wireless client VLAN name is same for all the devices associated to a particular SSID. You can configure the globally significant values (common to all sites) at the same time. The globally significant values include WLANs, Radius parameters, and Application Viability Control (AVC) configuration.
To enter globally significant values for all the devices, see
Converged Access Template Based Deployment
in Related Topics.
Figure 36-3 shows the common configuration values for all the devices in the single-switch small network topology shown in Figure 36-2.
Figure 36-3 Sample Configuration values for WLAN, Guest WLAN, Security, AVC, and RF
After applying the globally significant configuration values, you need to select the devices individually and apply the device specific configuration values such as Anchor Controller and Wireless Management IP addresses.
Table 36-13
describes the sample Guest Controller configuration values for MA/MC 10.100.1.109 and GA based on Figure 36-2.
Table 36-13 Sample Guest Controller Configuration Values for MA/MC (10.100.1.109) and GA
|
|
|
Anchor Controller IP
|
10.99.2.242; 10.99.2.243
|
10.99.2.242; 10.99.2.243
|
Anchor Group Name
|
CA-Mobility-SubDomain-3
|
CA-Mobility-SubDomain-3
|
Foreign Controllers
|
10.101.4.109
|
10.101.1. 109; 10.101.4.109; 10.101.7.109
|
Table 36-14
describes the sample Wireless Management configuration values for MA/MC 10.100.1.109 and GA (10.99.2.242) based on Figure 36-2.
Table 36-14 Sample Wireless Management Configuration Values for MA/MC (10.100.1.109) and GA
|
|
|
VLAN ID
|
155
|
33
|
IP
|
10.101.1.109
|
10.99.2.242
|
Subnet Mask
|
255.255.255.240
|
255.255.255.240
|
Country Code
|
US
|
US
|
Apply the Guest Controller and Wireless Management configuration values for all the MA/MC and GA as described in
Table 36-13
and
Table 36-14
.
Related Topics
Entering Configuration Values for Controller-Less Large Wireless Deployment Model
Figure 36-4 illustrates the Controller-less deployment model that leverages Catalyst switches for MA and MC roles without depending on an external WLC. This converged access deployment models can be implemented using Cisco Prime Infrastructure IOS-XE Controller Large Network template.
Figure 36-4 Controller-less Large Branch Network Model
Enter the globally significant configuration values such as WLANs, Guest WLAN, Radius Parameters, and AVC for all the selected device at the same time as explained in single-switch small network deployment model. After applying the globally significant values, enter the Wireless Management IP for each device as explained in single-switch small network deployment model.
After applying Wireless Management IP, enter the Guest Controller values for MA, MC and GA.
Table 36-15
describes the Guest controller configuration values for MA, MC in SPG-1 and GA shown in Figure 36-4.
Table 36-15 Sample Guest Controller Configuration Values for MA, MC, and GA
|
|
|
|
Anchor Controller IP
|
10.99.2.242
|
10.99.2.242
|
10.99.2.242
|
Anchor Group Name
|
CA-Mobility-SubDomain-3
|
CA-Mobility-SubDomain-3
|
CA-Mobility-SubDomain-3
|
Foreign Controller
|
10.101.4.109
|
10.101.3.109
|
10.101.3.109
|
Table 36-16
describes the mobility configuration values for MA, MC in SPG-1, and GA as shown in Figure 36-4.
Table 36-16 Sample Mobility Configuration Values for MA, MC, and GA
|
|
|
|
Role
|
Agent
|
Controller
|
Controller
|
Controller IP
|
10.101.3.109
|
10.101.3.109
|
—
|
Switch Peer Group Name
|
SPG-1
|
SPG-1
|
—
|
Mobility Agent IP(s)
|
—
|
10.101.1.109
|
—
|
Peer Controller IP(s)
|
—
|
10.101.4.109
|
—
|
RF Group Name
|
CA-RF
|
CA-RF
|
CA-RF
|
Repeat the same procedure for MA and MC in SPG-2 as shown in Figure 36-4.
Related Topics
Entering Configuration Values for Controller-Based Large Wireless Deployment Model
Figure 36-5 illustrates the controller-based large deployment model that leverages the same IOS-XE Controller Large Network template for deploying converged access with an external 5760 WLC as the MC.
Figure 36-5 Controller-Based Large Campus Model
Enter the globally significant configuration values such as WLANs, Guest WLAN, Radius Parameters, and AVC for all the selected devices at the same time as described in single-switch small network deployment model. After applying the globally significant values, enter the Wireless Management IP for each device as explained in single-switch small network deployment model.
After applying Wireless Management IP, enter the Guest Controller values for MA, MC, and GA.
Table 36-17
describes the Guest controller configuration values for MA, MC in SPG-1 and GA shown in Figure 36-5.
Table 36-17 Sample Guest Controller Configuration values for MA, MC, and GA
|
|
|
|
Anchor Controller IP
|
10.99.2.242
|
10.99.2.242
|
10.99.2.242
|
Anchor Group Name
|
CA-Mobility-SubDomain-3
|
CA-Mobility-SubDomain-3
|
CA-Mobility-SubDomain-3
|
Foreign Controller
|
10.99.2.242; 10.100.222.1
|
10.99.2.242; 10.100.222.1
|
10.100.221.1; 10.100.222.1
|
Table 36-18
describes the mobility configuration values for MA, MC in SPG-1 and GA shown in Figure 36-5.
Table 36-18 Sample Mobility Configuration Values for MA, MC and GA
Repeat the same procedure for MA and MC in SPG-2 shown in Figure 36-5.
|
|
|
|
Role
|
Agent
|
Controller
|
Controller
|
Controller IP
|
10.100.221.1
|
10.100.221.1
|
—
|
Switch Peer Group Name
|
SPG-1
|
SPG-1
|
—
|
Mobility Agent IP(s)
|
—
|
10.101.1.109;
10.101.2.109
|
—
|
Peer Controller IP(s)
|
—
|
10.100.222.1
|
—
|
RF Group Name
|
CA-RF
|
CA-RF
|
CA-RF
|
Related Topics
Entering Configuration Values for Centralized Wireless Campus Deployment Model
Cisco Prime Infrastructure IOS-XE Centralized Wireless template supports traditional wireless deployment model using next-generation 5760-WLC. In this model, any generation Access layer switches are deployed in traditional Ethernet switch mode over which WLC and the APs build an overlay network using CAPWAP Tunneling mechanism.
Figure 36-6 illustrates 5760-WLC based Centralized Wireless deployment using IOS-XE Centralized template.
Figure 36-6 Centralized Campus Network Model
You can configure the globally significant values such as WLANs, Radius Parameters, and AVC for all the devices at the same time as explained in small network deployment model.
After applying Wireless Management IP, enter the Guest Controller values for 5760 WLC and GA.
Table 36-19
describes the Guest controller configuration values for 5760 WLC in SPG-1 and GA for the topology shown in Figure 36-6.
Table 36-19 Sample Guest Controller Configuration Values for 5760 WLC and GA
|
|
|
Anchor Controller IP
|
10.99.2.242
|
10.99.2.242
|
Anchor Group Name
|
CA-Mobility-SubDomain-3
|
CA-Mobility-SubDomain-3
|
Foreign Controllers
|
10.100.222.1
|
10.100.221.1; 10.100.222.1
|
Table 36-20 Sample Mobility Configuration Values for 5760 WLC and GA
|
|
|
Peer Controller IP(s)
|
10.100.222.1
|
—
|
RF Group Name
|
CA-RF
|
CA-RF
|
Repeat the same procedure for 5760 WLC in SPG-2 shown in Figure 36-6.
Related Topics