The Cisco Catalyst 9800 Series Wireless Controllers comprise next-generation wireless controllers (referred to as controller in this document) built for intent-based networking. The Catalyst 9800 Series Wireless Controllers are Cisco IOS XE based and integrate the radio frequency (RF) capabilities from Cisco Aironet with the intent-based networking capabilities of Cisco IOS XE to create a best-in-class wireless experience for your organization.

The Catalyst 9800 controllers are enterprise ready to power your business-critical operations and transform end-customer experiences:

• The controllers come with high availability and seamless software updates that are enabled by hot and cold patching. This keeps your clients and services up and running always, both during planned and unplanned events.

• The controllers come with built-in security, including secure boot, run-time defenses, image signing, integrity verification, and hardware authenticity.

• The controllers can be deployed anywhere to enable wireless connectivity, for example, on an on-premise device, on cloud (public or private), or embedded on a Cisco Catalyst switch (for SDA deployments) or a Cisco Catalyst access point (AP).

• The controllers can be managed using Cisco Cisco Catalyst Center, programmability interfaces, for example, NETCONF and YANG, or web-based GUI or CLI.

• The controllers are built on a modular operating system. Open and programmable APIs enable the automation of your day zero to day n network operations. Model-driven streaming telemetry provides deep insights into your network and client health.

The Catalyst 9800 Series controllers are available in multiple form factors to cater to your deployment options:

• Catalyst 9800 Series Wireless Controller Appliance

• Catalyst 9800 Series Wireless Controller for Cloud

• Catalyst 9800 Embedded Wireless Controller for a Cisco switch

Note	All the Cisco IOS-XE programmability-related topics on the Cisco Catalyst 9800 controllers are supported by DevNet, either through community-based support or through DevNet developer support. For more information, go to https://developer.cisco.com.

Table 1. New and Modified Software Features

Feature Name	Description and Documentation Link
CAPWAP Message Aggregation	This feature aggregates the CAPWAP control messages of the same type waiting in the queue to be transmitted to the AP. The following command is introduced: capwap aggregation For more information, see AP Configuration.
Cisco Catalyst 9800 Controller Automated Frequency Coordination (AFC) Support for Cisco Catalyst IW9167E Heavy Duty Access Point and Cisco Catalyst IW9167I Heavy Duty Access Point	Cisco Catalyst 9800 Series Wireless Controller serves as an AFC proxy to send the AP information to the AFC system.
Enhancing AP using BLE support on Cisco Catalyst IW9167E and IW9167I Heavy Duty Series Access Points	You can configure an AP as Bluetooth Low Energy (BLE) gateway. Based on the type of AP, there are two types of BLE gateways: Base BLE Gateway: This AP type allows you to choose between Transmit mode and Scan mode. Advanced BLE Gateway: This AP type comes with an installed IOx application. You use this application to set up floor beacons on the Cisco-partnered Device Manager website. For Catalyst IW9167E AP, antenna 4 of 2.4 GHz and antenna 1 of 5 GHz shares the antenna with BLE radio. BLE antenna sharing restrictions: When you enable BLE, the 2.4 GHz radio does not support the 4x4 antenna. When you enable a 5 GHz single-band antenna in slot 4, the BLE radio is disabled. Note   For Cisco Catalyst IW9167I AP, the BLE gateway enabling alignment is the same as that of Cisco Catalyst 9166 Series AP.
FlexConnect Central Web Authentication Central Switching L3 VLAN Override Support	From this release, L3 VLAN override in FlexConnect central web authentication (CWA) is supported for both local and guest clients.
gNMI: SubscribeResponse with sync_response	The sync_response is a boolean field that is part of the SubscribeResponse response message. The sync_response message is sent after the first update message. For more information, see Programmability Configuration Guide.
gNMI Telemetry Support: Stream Subscriptions with On-Change Mode	This feature introduces gNMI telemetry support on-change subscriptions on the same set of models as other telemetry protocols For more information, see Programmability Configuration Guide.
IOx Application support on Cisco Catalyst IW9167E and IW9167I Heavy Duty Series Access Points	The Cisco Internet of Experience (IOx) application enables and allows access points to run third-party applications in the CAPWAP mode. To enable IOx, you need an extra memory space up to 50 MB for DRAM and another 100 MB for each IOx application. You can install up to two applications on the AP. The memory size requirement is based on the following components: Actual size of the application Run-time data storage Bundled IOx infrastructure into access point software (once IOx is bundled into the build, the file size increases by 9 MB) IOx application ensures a secure connection with IoT devices at the edge and integrates reliably with IoT sensors.
Israel Domain Changes	From this release, for indoor Wi-Fi 6E APs, Israel and Turkey are moved to the -E regulatory domain and support 6-GHz radio bands. For outdoor APs, Israel is moved from -ROW to the new -I regulatory domain.
Kernel Minidump and Trustzone Upgrade	From this release, the Kernel Minidump and Trustzone Upgrade feature offers a more effective method for diagnosing kernel issues. The following command is introduced: core-dump kernel type For more information, see Kernel Minidump and Trustzone Upgrade.
New Countries for 6-GHz Radio Support	From this release, Argentina, Chile, Colombia, Dominican Republic, Israel, Mexico, Singapore, South Africa, Thailand, and Turkey are added to the list of countries that support 6-GHz radio band.
Optimizing Dual 5G Mode in AP for Serial Backhaul Support on Cisco Catalyst IW9167E Heavy Duty Series Access Point	This feature enhances the performance and efficiency of a wireless network by optimizing the use of dual 5G radios in an AP for backhaul. In this feature, AP operates in the dual 5G mode using two 5G radios. You can enable backhaul on two 5G radios. The two backhaul radios provide uplink and downlink access to maximize throughput over multiple mesh hops. Note   For the dual 5G serial backhaul, ensure that slot 2 operates in 5G mode when enabling mesh dual 5G serial backhaul. When slot 2 operates in 6 GHz, AP is unable to be configured in mesh mode. The backhaul root AP (RAP) does not support multiple downlink channels. When you configure mesh mode in AP, block the 6G band for slot 2 as it does not support both backhaul and access. By default, the following actions are performed without any configuration change except enabling dual-5G: Mesh access point (MAP) seeks for a primary device on all enabled radios. MAP performs uplink and downlink on the same slot while other slots are in access mode.
Power Profile Support with 30-watts Power over Ethernet (PoE) on Cisco Catalyst IW9167I Heavy Duty Access Point	The AP power policy allows you to define the power budget utilization available for an AP, wherein, you can define a set of policies for different interfaces on an AP. From this release, Cisco Catalyst IW9167I Heavy Duty AP supports Power policy AP feature especially when AP works with 802.3at power. PoE+ is a new interface introduced in Cisco Catalyst IW9167I Heavy Duty AP, in addition to the Ethernet and LAN interfaces. AP is now powered by 30W through either 802.3at or 802.3bt standards, offering versatility in deployment and ensuring high-performance wireless connectivity. To enable flexible power policy, a power profile must be configured on the controller, extending the AP Join profile. The power profile supports local and FlexConnect modes but is unsupported in mesh mode.
Proto Encoding: Enhancements for Emulated On-Change Subscription	For more information, see Programmability Configuration Guide.
Quality of Service (QoS) Classification and Marking Support on WGB	WGB allows you to classify different packets from two wired ports and mark them to a different access control driver queue based on your configuration. In addition to TCP or UDP, WGB also supports configuring the ACL rules and QoS policies based on Ethernet type, transport layer port numbers or port range, and DSCP. During classification, the device performs a lookup and assigns a QoS label to the packet. The QoS label indicates all QoS actions to perform on the packet and identifies the queue from which the packet is sent. The feature is supported on the following APs: Cisco Catalyst IW9167E Heavy Duty Access Point Cisco Catalyst IW9165E Rugged Access Point For more information, see the Support for QoS ACL Classification and Marking sections of the Cisco Catalyst IW9165E Rugged Access Point and Wireless Client Configuration Guide and Cisco Catalyst IW9167E Heavy Duty Access Point Configuration Guide.
Radio Resource Management (RRM) Dynamic Channel Assignment (DCA) Support on Mesh Backhaul	Until the Cisco IOS XE 17.13.1 release, the RRM DCA optimized the root AP (RAP) backhaul radio channel of a mesh subtree by considering the noise, interference, load, and the RF parameter measurements only from the RAP. From this release, the RRM DCA on Mesh Backhaul feature enables DCA to make better channel assignments for a mesh subtree, by having continuous measurements and inputs from the whole mesh tree required to run DCA. The following command is introduced: show wireless mesh rrm dca changed For more information, see Mesh Access Points.
SDA IPv6 Underlay Support	From this release, this feature provides a wireless SDA IPv6 underlay support to enable IPv6-based communications in a fabric domain.
Show Technical Diagnostics for Appliances	From this release, the show tech-support diagnostic command is supported. This command is introduced to display the diagnostic technical support information of a system. For more information about the command, see Cisco Catalyst 9800 Sesries Wireless Controllers Command Reference.
SNMP Support for WGB on Cisco Catalyst IW9165E Rugged Access Point and Wireless Client and Cisco Catalyst IW9167E Heavy Duty Access Point	The Work Group Bridge (WGB) now supports Simple Network Management Protocol (SNMP) configuration. This provides network administrators with direct access to a comprehensive range of states and counters from the WGB. With the SNMP interface, customers gain the ability to effortlessly monitor the health and performance of their WGBs deployed in the field. This enhancement ensures greater visibility and control over network infrastructure, facilitating proactive maintenance and optimizing operational efficiency. The supported SNMP configuration versions and levels supported are as follows: Community-based SNMP Version 2 (SNMPv2c) SNMP Version 3 allows you to combine users into groups of different authorization and access privileges. You can associate a group to the following security levels: AuthNoPriv: With a username and password for authentication AuthPriv: With a username and password for authentication and encryption For more information, see the Configuring and Validating SNMP with WGB section of the Cisco Catalyst IW9165E Rugged Access Point and Wireless Client Configuration Guide and Cisco Catalyst IW9167E Heavy Duty Access Point Configuration Guide
Support for Built-In GPS as Proxy GPS for other 6E APs on Cisco Catalyst IW9167E Heavy Duty Access Point and Cisco Catalyst IW9167I Heavy Duty Access Point	These APs function as anchor APs with GPS functionality and help in providing geolocation data for other APs that do not have direct GPS signals, in geo-location derivation within the network. Additionally, in the absence of GPS coverage, these APs can utilize other 6E APs with GPS to derive their location. APs report the geolocation data to the controller via Global Navigation Satellite System (GNSS), ensuring that the network management system has accurate location details for each AP. Cisco Catalyst IW9165E Rugged Access Point and Cisco Catalyst IW9165D Heavy Duty Access Point also support this feature.
Support for CAPWAP Mode on Cisco Catalyst IW9165E Rugged Access Point and Cisco Catalyst IW9165D Heavy Duty Access Point	This feature enables APs to use CAPWAP to communicate with the controller and other APs on the network. APs are now upgraded to support CAPWAP images, enabling mode conversion to CAPWAP. Supported Platforms and Modes: Cisco Catalyst IW9165E Rugged Access Point: Supports CAPWAP, URWB, and WGB. Cisco Catalyst IW9165D Heavy Duty Access Point: Supports CAPWAP and URWB. The following command is introduced: configure boot mode capwap For more information, see Cisco Catalyst IW9165E Rugged Access Point and Wireless Client Configuration Guide and Cisco Catalyst IW9165D Heavy Duty Access Point Configuration Guide.
Support for Cisco CleanAir Pro Technology on Cisco Catalyst IW9167E Heavy Duty Access Point	The Cisco CleanAir Pro technology is designed to perform spectral scanning and interferer identification over Wi-Fi frequencies using the dedicated 2X2 scanning radio to get better outcomes for Radio Resource Management (RRM) features. The following CleanAir Pro functions are supported: Provide reports on the different categories of non-Wi-Fi interference, for the 2.4-GHz, 5-GHz, and 6-GHz bands. Reports the type of interferer, the severity of the interference, and the impacted channels to the controller, through Interference Device Reports (IDRs). Establishes Air Quality for all interfaces on the AP.
Support for CW-ANT-D1-NS-00 Antenna on Cisco Catalyst 9163E Access Point	From this release CW-ANT-D1-NS-00 Antenna is supported on Cisco Catalyst 9163E Access Point. For more information, see Cisco Catalyst 9163E Series Access Points Data sheet.
Enable Secure Data Wipe Capabilities for Legacy Products	From this release, the factory- reset all secure command erases all user data and metadata from bootflash. For more information, see the Performing Secure Erase section of your respective controller installation guides. Cisco Catalyst 9800-80 Wireless Controller Hardware Installation Guide Cisco Catalyst 9800-40 Wireless Controller Hardware Installation Guide
Support for Scanning Radio on Cisco Catalyst IW9167E Heavy Duty Access Point	From this release, you can set up a dedicated scanning radio in your enterprise wireless network to scan multiple variables, such as RF interference, user density, AP failure, noise, rogue APs, and coverage. The following features are supported by the scanning radio: Cisco Advanced Wireless Intrusion Prevention System (aWIPS) Rogue Radio Resource Management (RRM) Fast Locate Cisco Intelligent Capture (iCAP) Spectrum Analysis CleanAir Pro
Tier B/C/D Country Support for Cisco Catalyst 9166D1 Access Points	From this release, Australia, Austria, Belgium, Bulgaria, Canada, China, Croatia, Czech Republic, Cyprus, Denmark, Estonia, Finland, France, Germany, Gibraltar, Greece, Hungary, Iceland, Ireland, Italy, Japan, Korea, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Mexico, Monaco, Netherlands, New Zealand, Norway, Poland, Portugal, Romania, Slovak Republic, Slovenia, Spain, Sweden, Switzerland, United Kingdom, United States of America are added to the list of countries that support 2.4-GHz, 5-GHz, and 6-GHz radio bands.
Wi-Fi AP Automated Frequency Coordination (AFC) support for 6G Standard Power Mode on Cisco Catalyst IW9165E Rugged Access Point and Wireless Client, Cisco Catalyst IW9165D Heavy Duty Access Point, Cisco Catalyst IW9167E Heavy Duty Access Point, and Cisco Catalyst IW9167E Heavy Duty Access Point	APs support the AFC 6G in Standard Power mode. AFC system helps to allocate the channels and power levels to APs to operate in standard power mode in the 6-GHz frequency spectrum. The response is then sent back to the controller and assigns a standard power channel to the AP based on the allowed channel list returned by the AFC system. The APs support standard power mode only in the -B domain and are allowed to operate in the UNII-5 (5.925-6.425 GHz) and UNII-7 (6.525-7.125 GHz). With AFC 6G, APs can switch between 5G and 6G bands. The 6G band is only available in standard power mode with Self Identifiable Antenna. The following command is introduced to display the AFC request and response data: show rrm afc
YANG RPC Support for clear aaa counters and clear radius statistics Commands.	From this release, YANG RPC is supported for the clear aaa counters and clear radius statistics commands so that they can clear all counters, or specified RADIUS server ID counters to the device.
YANG Support for Mutiple Next-Hops	From this release, a new container is added under the next-hop-options choice node to retrieve all next-hops for a given route or prefix. Also, an uptime leaf node is added to provide the timestamp for each next hop.

MIBs

The following MIBs are newly added or modified:

• CISCO-LWAPP-RF-MIB.my

• CISCO-LWAPP-REAP-MIB.my

• CISCO-LWAPP-TAGS-MIB.my

• CISCO-LWAPP-DOT11-MIB.my

• CISCO-LWAPP-WLAN-SECURITY-MIB.my

• CISCO-LWAPP-TC-MIB.my

• CISCO-LWAPP-AP-MIB.my

• CISCO-LWAPP-AP-MIB.my

• AIRESPACE-WIRELESS-MIB.my

• CISCO-LWAPP-QOS-MIB.my

This feature allows for the collection of non-personal usage device systems information for Cisco products, which helps in continuous product improvements. This feature is supported on the Cisco Catalyst 9800 Series Wireless Controllers (9800-80, 9800-40, 9800-L, and 9800-CL). You can use the the pae command to enable or disable this feature.

The following commands are introduced as part of this feature:

• pae

• show product-analytics kpi

• show product-analytics report

• show product-analytics stats

Note	Turning off Smart Licensing Device Systems Information does not impact other Systems Information collection including from Cisco Catalyst Center or vManage.

Important: Cisco is constantly striving to advance our products and services. Knowing how you use our products is key to accomplishing this goal. To that end, Cisco will collect device and licensing Systems Information through Cisco Smart Software Manager (CSSM) for product and customer experience improvement, analytics, and adoption. Cisco processes your data in accordance with the General Terms and Conditions, the Cisco Privacy Statement and any other applicable agreement with Cisco. To modify your organization’s preferences for device and licensing systems information, use the pae command. For more information, see Cisco Catalyst 9800 Series Wireless Controller Command Reference.

For additional information on this feature, see Wireless Product Analytics FAQ.

• The Zero Wait Dynamic Frequency Selection feature is disabled on Cisco Catalyst 9136 Series APs when dual 5-GHz is enabled.

• The value for the Disruptive Ranging Timer in the Auto Location feature has been changed from 10 minutes to 15 minutes.

• The ap tri-radio command is applicable for Cisco Catalyst 9130, 9136, and 9124 APs.

• From this release, if the power requirement is similar or more than the maximum power in Low Power Mode (LPM), ensure that the power mode switches to Standard Power Mode.

The Cisco Catalyst 9800 Series Wireless Controller GUI features an interactive help that walks you through the GUI and guides you through complex configurations.

You can start the interactive help in the following ways:

• By hovering your cursor over the blue flap at the right-hand corner of a window in the GUI and clicking Interactive Help.

• By clicking Walk-me Thru in the left pane of a window in the GUI.

• By clicking Show me How displayed in the GUI. Clicking Show me How triggers a specific interactive help that is relevant to the context you are in.

  For instance, Show me How in Configure > AAA walks you through the various steps for configuring a RADIUS server. Choose Configuration> Wireless Setup > Advanced and click Show me How to trigger the interactive help that walks you through the steps relating to various kinds of authentication.

The following features have an associated interactive help:

• Configuring AAA

• Configuring FlexConnect Authentication

• Configuring 802.1x Authentication

• Configuring Local Web Authentication

• Configuring OpenRoaming

• Configuring Mesh APs

Note

If the WalkMe launcher is unavailable on Safari, modify the settings as follows: Choose Preferences > Privacy. In the Website tracking section, uncheck the Prevent cross-site tracking check box to disable this action. In the Cookies and website data section, uncheck the Block all cookies check box to disable this action.

The following table lists the supported virtual and hardware platforms. (See Supported PIDs and Ports for the list of supported modules.)

Table 2. Supported Virtual and Hardware Platforms

Platform	Description
Cisco Catalyst 9800-80 Wireless Controller	A modular wireless controller with up to 100-GE modular uplinks and seamless software updates. The controller occupies a 2-rack unit space and supports multiple module uplinks.
Cisco Catalyst 9800-40 Wireless Controller	A fixed wireless controller with seamless software updates for mid-size to large enterprises. The controller occupies a 1-rack unit space and provides four 1-GE or 10-GE uplink ports.
Cisco Catalyst 9800-L Wireless Controller	The Cisco Catalyst 9800-L Wireless Controller is the first low-end controller that provides a significant boost in performance and features.
Cisco Catalyst 9800 Wireless Controller for Cloud	A virtual form factor of the Catalyst 9800 Wireless Controller that can be deployed in a private cloud (supports VMware ESXi, Kernel-based Virtual Machine [KVM], Microsoft Hyper-V, and Cisco Enterprise NFV Infrastructure Software [NFVIS] on Enterprise Network Compute System [ENCS] hypervisors), or in the public cloud as Infrastructure as a Service (IaaS) in Amazon Web Services (AWS), Google Cloud Platform (GCP) marketplace, and Microsoft Azure.
Cisco Catalyst 9800 Embedded Wireless Controller for Switch	The Catalyst 9800 Wireless Controller software for the Cisco Catalyst 9000 switches brings the wired and wireless infrastructure together with consistent policy and management. This deployment model supports only Software Defined-Access (SDA), which is a highly secure solution for small campuses and distributed branches.

The following table lists the host environments supported for private and public cloud.

Table 3. Supported Host Environments for Public and Private Cloud

Host Environment	Software Version
VMware ESXi	VMware ESXi vSphere 6.0, 6.5, 6.7, and 7.0 VMware ESXi vCenter 6.0, 6.5, 6.7, and 7.0
KVM	Linux KVM-based on Red Hat Enterprise Linux 7.6, 7.8, and 8.2 Ubuntu 16.04.5 LTS, Ubuntu 18.04.5 LTS, Ubuntu 20.04.5 LTS
AWS	AWS EC2 platform
NFVIS	ENCS 3.8.1 and 3.9.1
GCP	GCP marketplace
Microsoft Hyper-V	Windows 2019 Server and Windows Server 2016 (Version 1607) with Hyper-V Manager (Version 10.0.14393)
Microsoft Azure	Microsoft Azure

The following table lists the supported Cisco Catalyst 9800 Series Wireless Controller hardware models.

The base PIDs are the model numbers of the controller.

The bundled PIDs indicate the orderable part numbers for the base PIDs that are bundled with a particular network module. Running the show version , show module , or show inventory command on such a controller (bundled PID) displays its base PID.

Note that unsupported SFPs will bring down a port. Only Cisco-supported SFPs (GLC-LH-SMD and GLC-SX-MMD) should be used on the route processor (RP) ports of C9800-80-K9 and C9800-40-K9.

Table 4. Supported PIDs and Ports

Controller Model	Description
C9800-CL-K9	Cisco Catalyst Wireless Controller as an infrastructure for cloud.
C9800-80-K9	Eight 1/10-Gigabit Ethernet SFP or SFP+ ports and two power supply slots.
C9800-40-K9	Four 1/10-Gigabit Ethernet SFP or SFP+ ports and two power supply slots.
C9800-L-C-K9	4x2.5/1-Gigabit ports 2x10/5/2.5/1-Gigabit ports
C9800-L-F-K9	4x2.5/1-Gigabit ports 2x10/1-Gigabit ports

The following table lists the supported SFP models.

Table 5. Supported SFPs

SFP Name	C9800-80-K9	C9800-40-K9	C9800-L-F-K9
COLORCHIP-C040- Q020-CWDM4-03B	Supported	—	—
DWDM-SFP10G-30.33	Supported	Supported	—
DWDM-SFP10G-61.41	Supported	Supported	—
FINISAR-LR – FTLX1471D3BCL 1	Supported	Supported	Supported
FINISAR-SR – FTLX8574D3BCL	Supported	Supported	Supported
FINISAR- FTL4C1QL2L	Supported	—	—
FINISAR- FTL4C1QE1C	Supported	—	—
GLC-BX-D	Supported	Supported	Supported
GLC-BX-U	Supported	Supported	Supported
GLC-EX-SMD	Supported	Supported	—
GLC-LH-SMD	Supported	Supported	—
GLC-SX-MMD	Supported	Supported	Supported
GLC-T	Supported	—	—
GLC-TE	Supported	Supported	Supported
GLC-ZX-SMD	Supported	Supported	Supported
QSFP-100G-LR4-S	Supported	—	—
QSFP-100G-SR4-S	Supported	—	—
QSFP-40G-BD-RX	Supported	—	—
QSFP-40G-CSR-S	Supported	—	—
QSFP-40G-ER4	Supported	—	—
QSFP-40G-LR4	Supported	—	—
QSFP-40G-LR4-S	Supported	—	—
QSFP-40G-SR-BD	Supported	—	—
QSFP-40G-SR4	Supported	—	—
QSFP-40G-SR4-S	Supported	—	—
QSFP-40GE-LR4	Supported	—	—
QSFP-H40G-ACU7M	Supported	—	—
SFP-10G-AOC10M	Supported	Supported	—
SFP-10G-AOC1M	Supported	Supported	—
SFP-10G-AOC2M	Supported	Supported	—
SFP-10G-AOC3M	Supported	Supported	—
SFP-10G-AOC5M	Supported	Supported	—
SFP-10G-AOC7M	Supported	Supported	—
SFP-10G-ER	Supported	Supported	—
SFP-10G-LR	Supported	Supported	Supported
SFP-10G-LR-S	Supported	Supported	Supported
SFP-10G-LR-X	Supported	Supported	Supported
SFP-10G-LRM	Supported	Supported	Supported
SFP-10G-SR	Supported	Supported	Supported
SFP-10G-SR-S	Supported	Supported	Supported
SFP-10G-SR-X	Supported	Supported	Supported
SFP-10G-ZR	Supported	Supported	—
SFP-H10GB- ACU10M	Supported	Supported	Supported
SFP-H10GB- ACU7M	Supported	Supported	Supported
SFP-H10GB- CU1.5M	Supported	Supported	Supported
SFP-H10GB-CU1M	Supported	Supported	Supported
SFP-H10GB-CU2.5M	Supported	Supported	Supported
SFP-H10GB-CU2M	Supported	Supported	Supported
SFP-H10GB-CU3M	Supported	Supported	Supported
SFP-H10GB-CU5M	Supported	Supported	Supported

¹ The FINISAR SFPs are not Cisco specific and some of the features, such as DOM, may not work properly.

Optics Modules

The Cisco Catalyst 9800 Series Wireless Controller supports a wide range of optics. The list of supported optics is updated on a regular basis. See the tables at the following location for the latest transceiver module compatibility information:

https://www.cisco.com/en/US/products/hw/modules/ps5455/products_device_support_tables_list.html

The following Cisco APs are supported in this release.

Indoor Access Points

• Cisco Catalyst 9105AX (I/W) Access Points

• Cisco Catalyst 9115AX (I/E) Access Points

• Cisco Catalyst 9117AX (I) Access Points

• Cisco Catalyst 9120AX (I/E/P) Access Points

• Cisco Catalyst 9130AX (I/E) Access Points

• Cisco Catalyst 9136 (I) Access Points

• Cisco Catalyst 9162 (I) Series Access Points

• Cisco Catalyst 9164 (I) Series Access Points

• Cisco Catalyst 9166 (I/D1) Series Access Points

• Cisco Aironet 1815 (I/W/M/T), 1830 (I), 1840 (I), and 1852 (I/E) Access Points

• Cisco Aironet 1800i Access Point

• Cisco Aironet 2800 (I/E) Series Access Points

• Cisco Aironet 3800 (I/E/P) Series Access Points

• Cisco Aironet 4800 (I) Series Access Points

Outdoor Access Points

• Cisco Aironet 1540 (I/D) Series Access Points

• Cisco Aironet 1560 (I/D/E) Series Access Points

• Cisco Aironet 1570 (IC/EC/EAC) Series Access Points

• Cisco Industrial Wireless 3700 Series Access Points

• Cisco Catalyst Industrial Wireless 6300 Heavy Duty Series Access Point

• Cisco 6300 Series Embedded Services Access Point

• Cisco Catalyst 9124AX (I/D/E) Access Points

• Cisco Catalyst 9163 (E) Series Access Points

• Cisco Catalyst Industrial Wireless 9167 (I/E) Heavy Duty Access Points

• Cisco Catalyst Industrial Wireless 9165 (E/I) Heavy Duty Access Points

Integrated Access Points

• Integrated Access Point on Cisco 1100 ISR (ISR-AP1100AC-x, ISR-AP1101AC-x, and ISR-AP1101AX-x)

Network Sensor

• Cisco Aironet 1800s Active Sensor

Pluggable Modules

• Wi-Fi 6 Pluggable Module for Industrial Routers

Supported Access Point Channels and Maximum Power Settings

Supported access point channels and maximum power settings on Cisco APs are compliant with the regulatory specifications of channels, maximum power levels, and antenna gains of every country in which the access points are sold. For more information about the supported access point transmission values in Cisco IOS XE software releases, see the Detailed Channels and Maximum Power Settings document at https://www.cisco.com/c/en/us/support/ios-nx-os-software/ios-xe-17/products-technical-reference-list.html.

For information about Cisco Wireless software releases that support specific Cisco AP modules, see the "Software Release Support for Specific Access Point Modules" section in the Cisco Wireless Solutions Software Compatibility Matrix document.

The following table provides software compatibility information.

Table 7. Compatibility Information

Cisco Catalyst 9800 Series Wireless Controller Software	Cisco Identity Services Engine	Cisco Prime Infrastructure	Cisco AireOS-IRCM Interoperability	Cisco Catalyst Center	Cisco Spaces: Connector	Cisco CMX
IOS XE 17.14.1	3.2 3.1 3.0 2.7 * all with latest patches	3.10.4 Update 03	8.10.190.0 8.10.185.0 8.10.183.0 8.10.182.0 8.10.181.0 8.10.171.0 8.10.162.0 8.10.151.0 8.10.142.0 8.10.130.0 8.5.176.2 8.5.182.104	See Cisco Catalyst Center Compatibility Information	3, May 2023 2.3.4 2.3.3 2.3.2 2.3.1 See Cisco Spaces Compatibility Matrix	11.0 10.6.3

The following subsections list the hardware and software required to access the Cisco Catalyst 9800 Controller GUI.

Table 8. Hardware Requirements

Processor Speed	DRAM	Number of Colors	Resolution	Font Size
233 MHz minimum2	512 MB3	256	1280 x 800 or higher	Small

Software Requirements

Operating Systems:

• Windows 7 or later

• Mac OS X 10.11 or later

Browsers:

• Google Chrome: Version 59 or later (on Windows and Mac)

• Microsoft Edge: Version 40 or later (on Windows)

• Safari: Version 10 or later (on Mac)

• Mozilla Firefox: Version 60 or later (on Windows and Mac)

Note	Firefox Version 63.x is not supported.

The controller GUI uses Virtual Terminal (VTY) lines for processing HTTP requests. At times, when multiple connections are open, the default number of VTY lines of 15 set by the device might get exhausted. Therefore, we recommend that you increase the number of VTY lines to 50.

To increase the VTY lines in a device, run the following commands in the following order:

1. device# configure terminal

2. device(config)# line vty 50

   A best practice is to configure the service tcp-keepalives to monitor the TCP connection to the device.

3. device(config)# service tcp-keepalives-in

4. device(config)# service tcp-keepalives-out

Ensure that you familiarize yourself with the following points before proceeding with the upgrade:

Caution

During controller upgrade or reboot, if route processor ports are connected to any Cisco switch, ensure that the route processor ports are not flapped (shut/no shut process). Otherwise, it may lead to a kernel crash.

Cisco Wave 2 APs may get into a boot loop when upgrading software over a WAN link. For more information, see: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/220443-how-to-avoid-boot-loop-due-to-corrupted.html.

The following Wave 1 APs are not supported from 17.4 to 17.9.2, 17.10.x, 17.11.x, 17.13.x, and 17.14.x:

• Cisco Aironet 1570 Series Access Point

• Cisco Aironet 1700 Series Access Point

• Cisco Aironet 2700 Series Access Point

• Cisco Aironet 3700 Series Access Point

Note

Support for the above APs was reintroduced from Cisco IOS XE Cupertino 17.9.3. Support for these APs does not extend beyond the normal product lifecycle support. Refer to the individual End-of-Support bulletins on Cisco.com. Feature support is on parity with the 17.3.x release. Features introduced in 17.4.1 or later are not supported on these APs in the 17.9.3 release. You can migrate directly to 17.9.3 from 17.3.x, where x=4c or later.

• From Cisco IOS XE Dublin 17.10.x, Key Exchange and MAC algorithms like diffie-hellman-group14-sha1, hmac-sha1, hmac-sha2-256, and hmac-sha2-512 are not supported by default and it may impact some SSH clients that only support these algorithms. If required, you can add them manually. For information on manually adding these algorithms, see the SSH Algorithms for Common Criteria Certification document available at: https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/sec-vpn/b-security-vpn/m_sec-secure-shell-algorithm-ccc.html

• If APs fail to detect the backup image after running the archive download-sw command, perform the following steps:

  1. Upload the image using the no-reload option of the archive download-sw command:

     Device# archive download-sw /no-reload tftp://<tftp_server_ip>/<image_name>

  2. Restart the CAPWAP process using capwap ap restart command. This allows the AP to use the correct backup image after the restart (reload is not required.)

     Device# capwap ap restart 

     Caution

     The AP will lose connection to the controller during the join process. When the AP joins the new controller, it will see a new image in the backup partition. So, the AP will not download a new image from the controller.

• Fragmentation lower than 1500 is not supported for the RADIUS packets generated by wireless clients in the Gi0 (OOB) interface.

• Cisco IOS XE allows you to encrypt all the passwords used on the device. This includes user passwords and SSID passwords (PSK). For more information, see the "Password Encryption" section of the Cisco Catalyst 9800 Series Configuration Best Practices document.

• While upgrading to Cisco IOS XE 17.3.x and later releases, if the ip http active-session-modules none command is enabled, you will not be able to access the controller GUI using HTTPS. To access the GUI using HTTPS, run the following commands in the order specified below:

  1. ip http session-module-list pkilist OPENRESTY_PKI

  2. ip http active-session-modules pkilist

• Cisco Aironet 1815T OfficeExtend Access Point will be in local mode when connected to the controller. However, when it functions as a standalone AP, it gets converted to FlexConnect mode.

• The Cisco Catalyst 9800-L Wireless Controller may fail to respond to the BREAK signals received on its console port during boot time, preventing users from getting to the ROMMON. This problem is observed on the controllers manufactured until November 2019, with the default config-register setting of 0x2102. This problem can be avoided if you set config-register to 0x2002. This problem is fixed in the 16.12(3r) ROMMON for Cisco Catalyst 9800-L Wireless Controller. For information about how to upgrade the ROMMON, see the Upgrading ROMMON for Cisco Catalyst 9800-L Wireless Controllers section of the Upgrading Field Programmable Hardware Devices for Cisco Catalyst 9800 Series Wireless Controllers document.

• By default, the controller uses a TFTP block size value of 512, which is the lowest possible value. This default setting is used to ensure interoperability with legacy TFTP servers. If required, you can change the block size value to 8192 to speed up the transfer process, using the ip tftp blocksize command in global configuration mode.

• We recommend that you configure the password encryption aes and the key config-key password-encrypt key commands to encrypt your password.

• If the following error message is displayed after a reboot or system crash, we recommend that you regenerate the trustpoint certificate:

   ERR_SSL_VERSION_OR_CIPHER_MISMATCH

  Use the following commands in the order specified below to generate a new self-signed trustpoint certificate:

  1. device# configure terminal

  2. device(config)# no crypto pki trustpoint trustpoint_name

  3. device(config)# no ip http server

  4. device(config)# no ip http secure-server

  5. device(config)# ip http server

  6. device(config)# ip http secure-server

  7. device(config)# ip http authentication local/aaa

• Do not deploy OVA files directly to VMware ESXi 6.5. We recommend that you use an OVF tool to deploy the OVA files.

• Ensure that you remove the controller from Cisco Prime Infrastructure before disabling or enabling Netconf-YANG. Otherwise, the system may reload unexpectedly.

• Unidirectional Link Detection (UDLD) protocol is not supported.

• SIP media session snooping is not supported on FlexConnect local switching deployments.

• The Cisco Catalyst 9800 Series Wireless Controllers (C9800-CL, C9800-L, C9800-40, and C9800-80) support a maximum of 14,000 leases with internal DHCP scope.

• Configuring the mobility MAC address using the wireless mobility mac-address command is mandatory for both HA and 802.11r.

• If you have Cisco Catalyst 9120 (E/I/P) and Cisco Catalyst 9130 (E) APs in your network and you want to downgrade, use only Cisco IOS XE Gibraltar 16.12.1t. Do not downgrade to Cisco IOS XE Gibraltar 16.12.1s.

• The following SNMP variables are not supported:

  • CISCO-LWAPP-WLAN-MIB: cLWlanMdnsMode

  • CISCO-LWAPP-AP-MIB.my: cLApDot11IfRptncPresent, cLApDot11IfDartPresent

• If you are upgrading from Cisco IOS XE Gibraltar 16.11.x or an earlier release, ensure that you unconfigure the advipservices boot-level licenses on both the active and standby controllers using the no license boot level advipservices command before the upgrade. Note that the license boot level advipservices command is not available in Cisco IOS XE Gibraltar 16.12.1s and 16.12.2s.

• The Cisco Catalyst 9800 Series Wireless Controller has a service port that is referred to as GigabitEthernet 0 port.

  The following protocols and features are supported through this port:

  • Cisco Catalyst Center

  • Cisco Smart Software Manager

  • Cisco Prime Infrastructure

  • Telnet

  • Controller GUI

  • HTTP

  • HTTPS

  • Licensing for Smart Licensing feature to communicate with CSSM

  • SSH

• During device upgrade using GUI, if a switchover occurs, the session expires and the upgrade process gets terminated. As a result, the GUI cannot display the upgrade state or status.

• From Cisco IOS XE Bengaluru 17.4.1 onwards, the telemetry solution provides a name for the receiver address instead of the IP address for telemetry data. This is an additional option. During the controller downgrade and subsequent upgrade, there is likely to be an issue—the upgrade version uses the newly named receivers, and these are not recognized in the downgrade. The new configuration gets rejected and fails in the subsequent upgrade. Configuration loss can be avoided when the upgrade or downgrade is performed from Cisco Catalyst Center.

• Communication between Cisco Catalyst 9800 Series Wireless Controller and Cisco Prime Infrastructure uses different ports:

  • All the configurations and templates available in Cisco Prime Infrastructure are pushed through SNMP and CLI, using UDP port 161.

  • Operational data for controller is obtained over SNMP, using UDP port 162.

  • AP and client operational data leverage streaming telemetry:

    • Cisco Prime Infrastructure to controller: TCP port 830 is used by Cisco Prime Infrastructure to push the telemetry configuration to the controller (using NETCONF).

    • Controller to Cisco Prime Infrastructure: TCP port 20828 is used for Cisco IOS-XE 16.10.x and 16.11.x, and TCP port 20830 is used for Cisco IOS-XE 16.12.x, 17.1.x and later releases.

• To migrate public IP address from 16.12.x to 17.x. ensure that you configure the service internal command. If you do not configure the service internal command, the IP address does not get carried forward.

• RLAN support with Virtual Routing and Forwarding (VRF) is not available.

• When you encounter the SNMP error SNMP_ERRORSTATUS_NOACCESS 6, it means that the specified SNMP variable is not accessible.

• We recommend that you perform a controller reload whenever there is a change in the controller's clock time to reflect an earlier time.

Note

The DTLS version (DTLSv1.0) is deprecated for Cisco Aironet 1800 based on latest security policies. Therefore, any new out-of-box deployments of Cisco Aironet 1800 APs will fail to join the controller and you will get the following error message: %APMGR_TRACE_MESSAGE-3-WLC_GEN_ERR: Chassis 1 R0/2: wncd: Error in AP Join, AP <AP-name>, mac:<MAC-address>Model AIR-AP1815W-D-K9, AP negotiated unexpected DTLS version v1.0 To onboard new Cisco Aironet 1800 APs and to establish a CAPWAP connection, explicitly set the DTLS version to 1.0 in the controller using the following configuration: config terminal ap dtls-version dtls_1_0 end Note that setting the DTLS version to 1.0 affects all the existing AP CAPWAP connections. We recommend that you apply the configuration only during a maintenance window. After the APs download the new image and join the controller, ensure that you remove the configuration.

To upgrade the field programmable hardware devices for Cisco Catalyst 9800 Series Wireless Controllers, see Upgrading Field Programmable Hardware Devices for Cisco Catalyst 9800 Series Wireless Controllers.

Important

Before you begin a downgrade process, you must manually remove the configurations which are applicable in the current version but not in older version. Otherwise, you might encounter an unexpected behavior.

Table 9. Upgrade Path to Cisco IOS XE Dublin 17.14.x

Current Software	Upgrade Path for Deployments with 9130 or 9124	Upgrade Path for Deployments Without 9130 or 9124
16.10.x	—	Upgrade first to 16.12.5 or 17.3.x and then to 17.14.x.
16.11.x	—	Upgrade first to 16.12.5 or 17.3.x and then to 17.14.x.
16.12.x	Upgrade first to 17.3.5 or later or 17.6.x or later, and then to 17.14.x.	Upgrade first to 17.3.5 or later or 17.6.x or later, and then to 17.14.x.
17.1.x	Upgrade first to 17.3.5 or later and then to 17.14.x.	Upgrade first to 17.3.5 or later and then to 17.14.x.
17.2.x	Upgrade first to 17.3.5 or later and then to 17.14.x.	Upgrade first to 17.3.5 or later and then to 17.14.x.
17.3.1 to 17.3.4	Upgrade first to 17.3.5 or later or 17.6.x or later, and then to 17.14.x.	Upgrade directly to 17.14.x.
17.3.4c or later	Upgrade directly to 17.14.x.	Upgrade directly to 17.14.x.
17.4.x	Upgrade first to 17.6.x and then to 17.14.x.	Upgrade directly to 17.14.x.
17.5.x	Upgrade first to 17.6.x and then to 17.14.x.	Upgrade directly to 17.14.x.
17.6.x	Upgrade directly to 17.14.x.	Upgrade directly to 17.14.x.
17.7.x	Upgrade directly to 17.14.x.	Upgrade directly to 17.14.x.
17.8.x	Upgrade directly to 17.14.x.	Upgrade directly to 17.14.x.
17.9.x	Upgrade directly to 17.14.x	Upgrade directly to 17.14.x
17.10.x	Upgrade directly to 17.14.x	Upgrade directly to 17.14.x
17.11.x	Upgrade directly to 17.14.x	Upgrade directly to 17.14.x
17.12.x	Upgrade directly to 17.14.x	Upgrade directly to 17.14.x
17.13.x	Upgrade directly to 17.14.x	Upgrade directly to 17.14.x
8.9.x or any version prior to 8.10.171.0	Upgrade first to 17.3.5 or later or 17.6.x or later, and then to 17.14.x	Upgrade directly to 17.14.x.

This section describes the various aspects of upgrading the controller software.

The Smart Licensing Using Policy feature is automatically enabled on the controller. This is also the case when you upgrade to this release. By default, your Smart Account and Virtual Account in Cisco Smart Software Manager (CSSM) are enabled for Smart Licensing Using Policy. For more information, see the "Smart Licensing Using Policy" chapter in the Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide.

For a more detailed overview on Cisco Licensing, see cisco.com/go/licensingguide.

This section describes the interoperability of the controller software with client devices.

The following table lists the configurations used for testing client devices.

Table 10. Test Configuration for Interoperability

Hardware or Software Parameter	Hardware or Software Type
Release	Cisco IOS XE 17.14.x
Cisco Wireless Controller	See Supported Hardware.
Access Points	See Supported APs.
Radio	802.11ac 802.11a 802.11g 802.11n
Security	Open, PSK (WPA2-AES), 802.1X (WPA2-AES) (EAP-FAST, EAP-TLS)
RADIUS	See Compatibility Matrix.
Types of tests	Connectivity, traffic (ICMP), and roaming between two APs

The following table lists the client types on which the tests were conducted. Client types included laptops, hand-held devices, phones, and printers.

Issues describe unexpected behavior in Cisco IOS releases in a product. Issues that are listed as Open in a prior release are carried forward to the next release as either Open or Resolved.

Note	All incremental releases contain fixes from the current release.

For the most up-to-date, detailed troubleshooting information, see Troubleshooting TechNotes.

• Information about Cisco IOS XE

• Cisco Validated Design documents

• MIB Locator to locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets

Cisco Wireless Controller

For more information about the Cisco wireless controller, lightweight APs, and mesh APs, see these documents:

• Cisco Wireless Solutions Software Compatibility Matrix

• Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide

• Cisco Catalyst 9800 Series Wireless Controller Command Reference

• Cisco Catalyst 9800 Series Configuration Best Practices

• In-Service Software Upgrade Matrix

• Upgrading Field Programmable Hardware Devices for Cisco Catalyst 9800 Series Wireless Controllers

The installation guide for your controller is available at:

• Hardware Installation Guides

All Cisco Wireless Controller software-related documentation

Cisco Catalyst 9800 Wireless Controller Data Sheets

• Cisco Catalyst 9800-CL Wireless Controller for Cloud Data Sheet

• Cisco Catalyst 9800-80 Wireless Controller Data Sheet

• Cisco Catalyst 9800-40 Wireless Controller Data Sheet

• Cisco Catalyst 9800-L Wireless Controller Data Sheet

Cisco Embedded Wireless Controller on Catalyst Access Points

For more information about the Cisco Embedded Wireless Controller on Catalyst Access Points, see:

https://www.cisco.com/c/en/us/support/wireless/embedded-wireless-controller-catalyst-access-points/tsd-products-support-series-home.html

Wireless Product Comparison

• Compare specifications of Cisco wireless APs and controllers

• Wireless LAN Compliance Lookup

• Cisco AireOS to Cisco Catalyst 9800 Wireless Controller Feature Comparison Matrix

Cisco Access Points–Statement of Volatility

The STATEMENT OF VOLATILITY is an engineering document that provides information about the device, the location of its memory components, and the methods for clearing device memory. Refer to the data security policies and practices of your organization and take the necessary steps required to protect your devices or network environment.

The Cisco Aironet and Catalyst AP Statement of Volatility (SoV) documents are available on the Cisco Trust Portal.

You can search by the AP model to view the SoV document.

Cisco Prime Infrastructure

Cisco Prime Infrastructure Documentation

Cisco Connected Mobile Experiences

Cisco Connected Mobile Experiences Documentation

Cisco Catalyst Center

Cisco Catalyst Center Documentation

• To receive timely, relevant information from Cisco, sign up at Cisco Profile Manager.

• To get the business impact you’re looking for with the technologies that matter, visit Cisco Services.

• To submit a service request, visit Cisco Support.

• To discover and browse secure, validated enterprise-class apps, products, solutions and services, visit Cisco Marketplace.

• To obtain general networking, training, and certification titles, visit Cisco Press.

• To find warranty information for a specific product or product family, access Cisco Warranty Finder.