The Cisco Catalyst 9800 Series Wireless Controllers comprise next-generation wireless controllers (referred to as controller in this document) built for intent-based networking. The controllers use Cisco IOS XE software and integrate the radio frequency (RF) capabilities from Cisco Aironet with the intent-based networking capabilities of Cisco IOS XE to create a best-in-class wireless experience for your organization.

The controllers are enterprise ready to power your business-critical operations and transform end-customer experiences:

• The controllers come with high availability and seamless software updates that are enabled by hot and cold patching. This keeps your clients and services up and running always, both during planned and unplanned events.

• The controllers come with built-in security, including secure boot, run-time defenses, image signing, integrity verification, and hardware authenticity.

• The controllers can be deployed anywhere to enable wireless connectivity, for example, on an on-premise device, on cloud (public or private), or embedded on a Cisco Catalyst switch (for SDA deployments) or a Cisco Catalyst access point (AP).

• The controllers can be managed using Cisco Catalyst Center, programmability interfaces, for example, NETCONF and YANG,or web-based GUI or CLI.

• The controllers are built on a modular operating system. Open and programmable APIs enable the automation of your day zero to day n network operations. Model-driven streaming telemetry provides deep insights into your network and client health.

The controllers are available in multiple form factors to cater to your deployment options:

• Catalyst 9800 Series Wireless Controller Appliance

  • Cisco Catalyst 9800-80, Catalyst 9800-40, and Catalyst 9800-L Wireless Controllers

  • Cisco Catalyst CW9800H1 and CW9800H2 Wireless Controllers

  • Cisco Catalyst CW9800M Wireless Controller

• Catalyst 9800 Series Wireless Controller for Cloud

• Catalyst 9800 Embedded Wireless Controller for a Cisco Switch

Note	All the Cisco IOS XE programmability-related topics on the controllers are supported by DevNet, either through community-based support or through DevNet developer support. For more information, go to https://developer.cisco.com.

Note	For information about the recommended Cisco IOS XE releases for Cisco Catalyst 9800 Series Wireless Controllers, see the documentation at: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214749-tac-recommended-ios-xe-builds-for-wirele.html

MIBs

The following MIBs are newly added or modified:

• CISCO-LWAPP-DOT11-MIB.my

• CISCO-LWAPP-DOT11-MIB.my

MIBs

The following MIBs are newly added or modified:

• AIRESPACE-WIRELESS-MIB.my

• CISCO-LWAPP-AP-MIB.my

• CISCO-LWAPP-DOT11-MIB.my

• CISCO-LWAPP-DOT11-CLIENT-MIB.my

• CISCO-LWAPP-REAP-MIB.my

• CISCO-LWAPP-RF-MIB.my

• CISCO-LWAPP-TAGS-MIB.my

• CISCO-LWAPP-TC-MIB.my

• CISCO-LWAPP-WLAN-SECURITY-MIB.my

Behavior Change for Cisco IOS XE 17.15.4

• The Cisco Catalyst 9124 mesh APs (MAP) powered with 30W, when joined to a Cisco Catalyst 9124 EWC root AP, tri-radio was not supported with 30W. It was only possible to enable it if MAP was powered with 60W. With the change in behavior, you can enable tri-radio with 30W.

• Controller displayed out-of-order packet issue with fragmented packets when Auto QoS was enabled. When a client tries to connect to an EAP-TLS-based SSID, during the certificate exchange, the client sends its device certificate. If the certificate is fragmented because it exceeds the MTU (1500), the fragments are observed to be sent out-of-order from the controller when Auto QoS is enabled.

  With the change in behavior, the fragments are classified and applied with default action. For workarounds, refer to CSCwo97886.

• The Cisco Catalyst 9130AXI-C APs in Bangladesh (BD) regulatory domain do not announce High Efficiency capabilities (802.11ax) on 5-GHz radio (Slot 1) but the same AP advertises on 2.4-GHz radio (Slot 0). Therefore, clients to connect to 2.4-GHz or on 5-GHz by using 802.11a data rates.

  With the change in behavior, the APs advertise High Efficiency on 5-GHz radio and clients connect to 802.11ax(5-GHz). For workarounds, refer to CSCwp17376

• The ip proxy-arp configuration is disabled by default under VLAN interfaces for the controller.

• Remove redundant counters from show wireless stats ap name ap-name dot11 5GHz output.

  The output of show wireless stats ap name ap-name dot11 5GHz , displays two counters: FailedCount and AckFailureCount. Confirm if both counters are identical and remove one of them (preferably AckFailureCount, since it is not incremental).

• For Cisco Aironet 1815T Series AP, from Cisco IOS XE 17.12.x, .../storage/config.oeap was created beforehand as long as the AP is in OEAP mode.

  With the change in behavior, once the AP boots in FlexConnect OEAP mode, it switches on the default OEAP DHCP server (dhcp0) as day 1 configuration.

• In the Mobility Data DTLS tunnel, DTLS encryption was enabled on Peer1 and disabled on Peer2, causing the mobility tunnel to be up. However, with the change in behavior, DTLS encryption is enabled on Peer1 and disabled on Peer2, causing the mobility tunnel to go down.

• The maximum supported RFIDs per WNCD for any platform has been increased to greater than 9601 RFIDs. The new value of the maximum RFID is platform dependent.

• When source-interface was configured under mDNS globally, this source-interface was chosen to send out mDNS packets. When the source-interface was not configured, then, the controller used wireless management interface WMI) to send out the mDNS packets.

  With the change in behavior, when source-interface is configured, the controller uses this configured source-interface to send out mDNS packets. When the source-interface is not configured,

  • Option 1: Use SVI as the source-interface (if SVI of the intended VLAN is configured).

  • Option 2: If option 1 fails, use the default Wireless Management Interface (WMI).

• Authentication for AP with EAP fails if the password is more than 31 characters. With the change in behavior, password with more than 31 characters works successfully.

• Thermal throttle configuration between 40C and 50C for CW9172I AP:

  Split-phy: 2/5/6 GHz 1SS, Scan Radio, BLE, USB, and 2.5 Gbps Ethernet

  Single-phy: 2ghz 1SS, 5 GHz 2SS, Scan Radio, BLE, USB, and 2.5Gbps Ethernet

  Thermal throttle configuration between 40C and 50C for CW9172H AP: 2/5/6 GHz 1SS, Scan Radio, BLE, PoE-out and 2.5Gbps Ethernet

• Thermal degradation for CW9172I and CW9172H APs start before reaching 40C. With the change in behavior, the thermal degradation for CW9172I and CW9172H APs start at 40C.

• In the early development phase, radio profiles were not mapped by default. Later, the behavior changed to automatically link the default radio profile under an RF tag whenever a new RF tag was created.

  However, due to code limitations, a default radio profile cannot be created under the RF tag when the RF tag is created using NETCONF or WebUI. The radio profile has to be linked manually while creating an RF tag using NETCONF or WebUI interfaces.

Behavior Change for Cisco IOS XE 17.15.3

• RADIUS packets were getting fragmented with the default value of 1396. With the change in behavior, RADIUS packets are fragmented based on the source interface IP MTU.

  This behaviour change is applicable only when the RADIUS source interface is attached under the RADIUS group. If there is no source interface attached under the RADIUS group, this change is not applicable.

• The default platform punt-policer commands have been modified. We recommend that you check if you have modified the default platform punt-policer commands for any of the releases. In such a case, delete the commands before upgrading, and reapply them after upgrading to 17.15 or later, using the corresponding keywords.

  Note	The following command has changed in-between releases: platform punt-policer wls_sisf_pkt 5000 high (17.9) > platform punt-policer wls_sisf_arp_v6nd_pkt 5000 high (17.12) > platform punt-policer wls-sisf-arp-v6nd-pkt 5000 high (17.15)

  The following are the default commands in Cisco IOS XE 17.12 and Cisco IOS XE 17.15:

  17.12

  Device# show run all | i platform punt-policer wls
  platform punt-policer wls_dot11_pkt 14000
  platform punt-policer wls_dot11_pkt 2700 high
  platform punt-policer wls_capwap_pkt 437
  platform punt-policer wls_capwap_pkt 90000 high
  platform punt-policer wls_mobility_pkt 437
  platform punt-policer wls_mobility_pkt 45000 high
  platform punt-policer wls_sisf_pkt 437
  platform punt-policer wls_sisf_pkt 8000 high
  platform punt-policer wls_sisf_arp_v6nd_pkt 437
  platform punt-policer wls_sisf_arp_v6nd_pkt 8000 high
  platform punt-policer wls_ap_https 40000
  platform punt-policer wls_ap_https 437 high
  

  17.15

  Device# show run all | i platform punt-policer wls
  platform punt-policer wls-mgmt-pkt 14000
  platform punt-policer wls-mgmt-pkt 2700 high
  platform punt-policer wls-tunnel-pkt 437
  platform punt-policer wls-tunnel-pkt 90000 high
  platform punt-policer wls-mobility-pkt 437
  platform punt-policer wls-mobility-pkt 45000 high
  platform punt-policer wls-sisf-pkt 437
  platform punt-policer wls-sisf-pkt 8000 high
  platform punt-policer wls-sisf-arp-v6nd-pkt 437
  platform punt-policer wls-sisf-arp-v6nd-pkt 8000 high
  platform punt-policer wls-https-dnld 40000
  platform punt-policer wls-https-dnld 437 high
  platform punt-policer wls-cfg-pkt 4000
  platform punt-policer wls-cfg-pkt 437 high
  

• When the controller receives an ARP request with the source IP matching another client IP address that is present in the device tracking database, whose preference level is higher than ARP [DHCP], the baseline behavior is to exclude the incoming client.

  With the behavior change, the controller drops the ARP packet and does not exclude the client.

• If you have enabled 802.11be and Wi-Fi clients connect to an SSID, the SSID must be compatible with Wi-Fi 7 requirements (WPA3; if using SAE, it must be SAE-EXT or SAE/SAE-EXT). This functionality was optional in Cisco IOS XE 17.15.2, but in Cisco IOS XE 17.15.3, it is enforced.

Behavior Change for Cisco IOS XE 17.15.2

• When Wi-Fi 7 APs are converted from Meraki to Cisco Catalyst with a valid country code stored in the shared environment, the Country Code Resolution Method is displayed as Installed via Meraki Dashboard.

• XOR 5-GHz or 6-GHz slot 2 will be put in the 5-GHz band if the country code set on Cisco Catalyst Wireless 9166I Series AP does not support the 6-GHz band.

• Fast Transition Adaptive is not supported for WPA3 SAE.

• In Cisco IOS XE 17.15.2, the lack of support for link re-configuration in Multi-Link Operation (MLO) may lead to client disruptions. This issue arises when clients are connected to 802.11be radios, especially if 802.11be is enabled across all radio bands. To notify of potential disruptions, users will be notified through pop-up notifcations. These messages appear across all radio bands of the AP whenever configuration changes to radio parameters result in a radio reset, or enable or disable the workflow.

• The output for show ap config slots and show ap config general commands are duplicate. To reduce the duplicate output, perform the following:

  • Leave the detailed information for each radio slot remains unchanged.

  • Retain only the key AP general information.

• When a country using channels 1, 5, 9, and 13 is added to the controller, the 2.4-GHz RF profiles automatically update to include these channels, leading to inconsistencies. The behaviour is observed in Cisco IOS XE Amsterdam 17.3.x, Cisco IOS XE Bengaluru 17.6.x, and Cisco IOS XE Cupertino 17.9.x, and it should be avoided. RF profiles should remain unchanged initially, with manual adjustments made only if necessary for countries supporting additional channels.

• When a country from the European Telecommunications Standards Institute (ETSI) or Rest of World (ROW) domain is set up in the controller and AP join profile, Dual 5G is enabled. If the country code is then changed to another within the same domain, it causes the AP to continuously reboot.

• Global Use APs: APs are not able to migrate to Meraki in Catalyst mode via Option 17 in external DHCPv6 server. Set the Fast Offline migration bit to 01 in external DHCP server, for the APs to migrate to Meraki mode.

• Global Use APs: The output of the show ap regulatory activation all command displays the regulatory activation file metadata.

• You can allow the 5-GHz or 6-GHz XOR radio to move to 6GHz:

  • When the 6-GHz network is enabled.

  • When the Regulatory Domain Allowed by Country is 6GHz.

  Note	This does not apply when the Flexible Radio Assignment (FRA) configuration is enabled.

• The IP overlap feature supports FlexConnect VLAN-based central switching.

• The Security Group Access Control List (SGACL) logging records are generated and managed through an internal High-Speed Logging (HSL) server. These records are then sent to a Syslog server under the following conditions:

  • A packet hits a logging access control entry (ACE).

  • The Cisco TrustSec role-based policy is enabled.

• The Unscheduled Automatic Power Save Delivery (U-APSD) can now be configured to be enabled or disabled in the probe, beacon, and association response.

Behavior Change for Cisco IOS XE 17.15.1

• From this release, the Mobility Tunnel UP/DOWN messages will be marked for severity level ALERT.

• From this release, it is not possible to disable the 802.11h channel switch. The channel switch announcements (CSA) remain enabled at all times because they help clients when the APs announce the change from the current channel to a new channel, thereby reducing the number of reconnections.

• The minimum memory requirement of the Cisco Catalyst 9800 Wireless Controller for Cloud - Ultra-Low Profile variant is increased from 4 GB to 6 GB.

• From this release, the SuiteB and SuiteB-192 authentication and key management (AKMs) are decoupled from the GCMP128, GCMP256/CCMP256 and must be configured separately. When the controller is upgraded from a lower version to 17.15, WLANs configured with suiteb AKMs will be affected. If the controller downgrades from version 17.15 to a lower one, the WLANs enabled with only suiteb AKMs will remain operational, while the WLANs with multiple AKMs enabled will be operational without the suiteb-related AKMs.

• From this release, the default air pressure sample interval is changed from 30 seconds to 60 seconds. For example, if the duration is set to 10 minutes, the APs send 10 samples that are spaced at 60 seconds each.

The following table lists the host environments supported for private and public cloud.

The following table lists the supported Cisco Catalyst 9800 Series Wireless Controller hardware models.

The base PIDs are the model numbers of the controller.

The bundled PIDs indicate the orderable part numbers for the base PIDs that are bundled with a particular network module. Running the show version , show module , or show inventory command on such a controller (bundled PID) displays its base PID.

Note that unsupported SFPs will bring down a port. Only Cisco-supported SFPs (GLC-LH-SMD and GLC-SX-MMD) should be used on the route processor (RP) ports of C9800-80-K9 and C9800-40-K9.

The following table lists the supported SFP models.

Optics Modules

The Cisco Catalyst 9800 Series Wireless Controller supports a wide range of optics. The list of supported optics is updated on a regular basis. See the tables at the following location for the latest transceiver module compatibility information:

https://www.cisco.com/c/en/us/support/interfaces-modules/transceiver-modules/products-device-support-tables-list.html

Indoor Access Points

• Cisco Catalyst 9105AX (I/W) Access Points

• Cisco Catalyst 9115AX (I/E) Access Points

• Cisco Catalyst 9117AX (I) Access Points

• Cisco Catalyst 9120AX (I/E/P) Access Points

• Cisco Catalyst 9130AX (I/E) Access Points

• Cisco Catalyst 9136AX Access Points

• Cisco Catalyst 9162 (I) Series Access Points

• Cisco Catalyst 9164 (I) Series Access Points

• Cisco Catalyst 9166 (I/D1) Series Access Points

• Cisco Wireless 9172 (I) Series Wi-Fi 7 Access Points

• Cisco Wireless 9176 (I/D1) Series Wi-Fi 7 Access Points

• Cisco Wireless 9178 (I) Series Wi-Fi 7 Access Points

• Cisco Aironet 1815 (I/W/M/T), 1830 (I), 1840 (I), and 1852 (I/E) Access Points

• Cisco Aironet 1800i Access Point

• Cisco Aironet 2800 (I/E) Series Access Points

• Cisco Aironet 3800 (I/E/P) Series Access Points

• Cisco Aironet 4800 (I) Series Access Points

Outdoor Access Points

• Cisco Aironet 1540 (I/D) Series Access Points

• Cisco Aironet 1560 (I/D/E) Series Access Points

• Cisco Aironet 1570 (I/D/E) Series Access Points

• Cisco Aironet 1570 (IC/EC/EAC) Series Access Points

• Cisco Catalyst Industrial Wireless 6300 Heavy Duty Series Access Point

• Cisco 6300 Series Embedded Services Access Point

• Cisco Catalyst 9124AX (I/D/E) Access Points

• Cisco Catalyst 9163 (E) Series Access Points

• Cisco Catalyst Industrial Wireless 9167 (I/E) Heavy Duty Access Points

• Cisco Catalyst Industrial Wireless 9165E Rugged Access Point

• Cisco Catalyst Industrial Wireless 9165D Heavy Duty Access Point

Integrated Access Points

• Integrated Access Point on Cisco 1100 ISR (ISR-AP1100AC-x, ISR-AP1101AC-x, and ISR-AP1101AX-x)

Network Sensor

• Cisco Aironet 1800s Active Sensor

Pluggable Modules

• Cisco Wi-Fi Interface Module (WIM)

Supported Access Point Channels and Maximum Power Settings

Supported access point channels and maximum power settings on Cisco APs are compliant with the regulatory specifications of channels, maximum power levels, and antenna gains of every country in which the access points are sold. For more information about the supported access point transmission values in Cisco IOS XE software releases, see the Detailed Channels and Maximum Power Settings document at https://www.cisco.com/c/en/us/support/ios-nx-os-software/ios-xe-17/products-technical-reference-list.html.

For information about Cisco Wireless software releases that support specific Cisco AP modules, see the "Software Release Support for Specific Access Point Modules" section in the Cisco Wireless Solutions Software Compatibility Matrix document.

The following table provides software compatibility information. For more information, see Cisco Wireless Solutions Software Compatibility Matrix

Software Requirements

Operating Systems:

• Windows 7 or later

• Mac OS X 10.11 or later

Browsers:

• Google Chrome: Version 59 or later (on Windows and Mac)

• Microsoft Edge: Version 40 or later (on Windows)

• Safari: Version 10 or later (on Mac)

• Mozilla Firefox: Version 60 or later (on Windows and Mac)

Note	Firefox Version 63.x is not supported.

The controller GUI uses Virtual Terminal (VTY) lines for processing HTTP requests. At times, when multiple connections are open, the default number of VTY lines of 15 set by the device might get exhausted. Therefore, we recommend that you increase the number of VTY lines to 50.

To increase the VTY lines in a device, run the following commands in the following order:

1. device# configure terminal

2. device(config)# line vty 50

   A best practice is to configure the service tcp-keepalives to monitor the TCP connection to the device.

3. device(config)# service tcp-keepalives-in

4. device(config)# service tcp-keepalives-out

Cisco Wireless Licences

Cisco Wireless licenses, a part of the Cisco Networking Subscription licensing model, is a software license that helps you to deploy your Wi-Fi 7 Access Points in an on-premise, hybrid, or a cloud managed network. From Cisco IOS XE 17.15.2, Cisco Wireless licenses are supported on Wi-Fi 7 Access Points (APs) and later models.

The Cisco Wireless licenses consist of the following tiers:

• Cisco Wireless Essentials: The tier that provides fundamental features and functionalities that are essential to manage a network.

• Cisco Wireless Advantage: The tier that supports additional features and capabilities, and includes all the essential capabilities in addition to the advanced capabilities to manage a network.

For more information, see Cisco Wireless Licensing.

Smart Licensing

The Smart Licensing Using Policy feature is automatically enabled on the controller. This is also the case when you upgrade to this release. By default, your Smart Account and Virtual Account in Cisco Smart Software Manager (CSSM) are enabled for Smart Licensing Using Policy. For more information, see the "Smart Licensing Using Policy" chapter in the Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide.

For a more detailed overview on Cisco Licensing, see cisco.com/go/licensingguide.

Cisco Wireless Controller

For more information about the Cisco wireless controller, lightweight APs, and mesh APs, see these documents:

• Cisco Wireless Solutions Software Compatibility Matrix

• Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide

• Cisco Catalyst 9800 Series Wireless Controller Command Reference

• Cisco Catalyst 9800 Series Configuration Best Practices

• In-Service Software Upgrade Matrix

• Upgrading Field Programmable Hardware Devices for Cisco Catalyst 9800 Series Wireless Controllers

The installation guide for your controller is available at:

• Hardware Installation Guides

All Cisco Wireless Controller software-related documentation

Cisco Catalyst 9800 Series and Cisco Catalyst CW9800 Series Wireless Controller Data Sheets

• Cisco Catalyst 9800-CL Wireless Controller for Cloud Data Sheet

• Cisco Catalyst 9800-80 Wireless Controller Data Sheet

• Cisco Catalyst 9800-40 Wireless Controller Data Sheet

• Cisco Catalyst 9800-L Wireless Controller Data Sheet

• Cisco Catalyst CW9800H1 and CW9800H2 Wireless Controllers Data Sheet

• Cisco Catalyst CW9800M Wireless Controller Data Sheet

Cisco Embedded Wireless Controller on Catalyst Access Points

For more information about the Cisco Embedded Wireless Controller on Catalyst Access Points, see:

https://www.cisco.com/c/en/us/support/wireless/embedded-wireless-controller-catalyst-access-points/tsd-products-support-series-home.html

Wireless Product Comparison

• Compare specifications of Cisco wireless APs and controllers

• Wireless LAN Compliance Lookup

• Cisco AireOS to Cisco Catalyst 9800 Wireless Controller Feature Comparison Matrix

Cisco Access Points–Statement of Volatility

The STATEMENT OF VOLATILITY is an engineering document that provides information about the device, the location of its memory components, and the methods for clearing device memory. Refer to the data security policies and practices of your organization and take the necessary steps required to protect your devices or network environment.

The Cisco Aironet and Catalyst AP Statement of Volatility (SoV) documents are available on the Cisco Trust Portal.

You can search by the AP model to view the SoV document.

Cisco Prime Infrastructure

Cisco Prime Infrastructure Documentation

Cisco Connected Mobile Experiences

Cisco Connected Mobile Experiences Documentation

Cisco Catalyst Center

Cisco Catalyst Center Documentation

Cloud Monitoring for Cisco Catalyst 9800 Hardware Wireless Controllers

Cloud Monitoring for Catalyst