Deny Wireless Client Session Establishment Using Calendar Profiles

Denial of wireless client session establishment

Denial of wireless client session establishment is a controller feature that

  • allows the controller to stop client session establishment based on a particular time

  • helps control the network in efficient and controlled manner without any manual intervention, and

  • supports daily, weekly, and monthly recurrence schedules through calendar profiles mapped to policy profiles.

Supported recurrence types

In Cisco Catalyst 9800 Series Wireless Controller , you can deny the wireless client session based on these recurrences:

  • Daily

  • Weekly

  • Monthly

The Calendar Profiles created are then mapped to the policy profile. By attaching the calendar profile to a policy profile, you will be able to create different recurrences for the policy profile using different policy tag.


Note

You need to create separate Calendar Profile for Daily, Weekly, and Monthly sub-categories.

The following is the workflow for denial of wireless client session establishment feature:

  • Create a calendar profile.

  • Apply the calendar profile to a policy profile.

Note

A maximum of 100 calendar profile configuration and 5 calendar profile association to policy profile is supported.

Configuration limits and timing considerations:

  • Feature activation: If you boot up your controller, the denial of client session establishment feature kicks in after a minute from the system boot up.

  • Time change adaptation: If you change the system time after the calendar profile is associated to a policy profile, you can expect a maximum of 30 second delay to adapt to the new clock timings.


Note

You cannot use the no action deny-client command to disable action while associating the calendar profile to a policy profile.

If you want to disable the action command, you need to disassociate the calendar profile from the policy profile, and re-configure again.

Configure daily calendar profile (CLI)

Set up a calendar profile that defines daily recurring time periods for wireless network operations and power management.
Calendar profiles allow you to schedule specific time periods for wireless operations, such as controlling when certain wireless features are active. Daily calendar profiles apply the same time schedule every day.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Configure a calendar profile.

Example:

Device(config)# wireless profile calendar-profile name calendar-profile-name

Example:

Device(config)# wireless profile calendar-profile name daily_calendar_profile

The calendar-profile-name refers to the name of the calendar profile.

Step 3

Configure start and end time for the calendar profile.

Example:

Device(config-calendar-profile)# start start-time end end-time

Example:

Device(config-calendar-profile)# start 09:00:00 end 17:00:00

The start-time is the start time for the calendar profile. You need to enter start time in HH:MM:SS format.

The end-time is the end time for the calendar profile. You need to enter end time in HH:MM:SS format.

Step 4

Configure daily recurrences for the calendar profile.

Example:

Device(config-calendar-profile)# recurrence daily

Step 5

Return to privileged EXEC mode.

Example:

Device(config-calendar-profile)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Note

 

When the calendar profile kicks in, the AP power profile rules (for example, radio state and USB device state) that are defined for the Ethernet speed are not applied and continue to be as per the fixed power profile.

The daily calendar profile is configured and will apply the specified time schedule every day for wireless operations.

Configure weekly calendar profile (CLI)

Create a weekly calendar profile that defines recurring time windows for scheduled network operations or policies.
Calendar profiles allow network administrators to schedule when certain policies or operations should be active. A weekly calendar profile provides recurring time windows that repeat on specified days of the week, enabling automated time-based network management.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Configure a calendar profile.

Example:

Device(config)# wireless profile calendar-profile name name

Example:

Device(config)# wireless profile calendar-profile name weekly_calendar_profile

The name refers to the name of the calendar profile.

Step 3

Configure start and end time for the calendar profile.

Example:

Device(config-calendar-profile)# start start-time end end-time

Example:

Device(config-calendar-profile)# start 18:00:00 end 19:00:00

The start-time is the start time for the calendar profile in HH:MM:SS format.

The end-time is the end time for the calendar profile in HH:MM:SS format.

Step 4

Configure weekly recurrences for the calendar profile.

Example:

Device(config-calendar-profile)# recurrence weekly

Step 5

Configure days when the weekly calendar needs to be active.

Example:

Device(config-calendar-profile)# day {friday | monday | saturday | sunday | thursday | tuesday | wednesday}

Example:


Device(config-calendar-profile)# day friday
Device(config-calendar-profile)# day monday

Note

 

You can configure multiple days using this command.

Step 6

Return to privileged EXEC mode.

Example:

Device(config-calendar-profile)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The weekly calendar profile is now configured and can be applied to network policies that require time-based scheduling and recurring weekly activation windows.

Configure monthly calendar profile (CLI)

Create a monthly calendar profile to schedule recurring network operations or denial of service events on specific dates each month.
Monthly calendar profiles enable you to define time-based policies that recur on specific dates within a month. This is useful for scheduled maintenance windows or automated network policy enforcement.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Configure a calendar profile.

Example:

Device(config)# wireless profile calendar-profile name profile-name

Example:

Device(config)# wireless profile calendar-profile name monthly_calendar_profile

The profile-name refers to the name of the calendar profile.

Step 3

Configure start and end time for the calendar profile.

Example:

Device(config-calendar-profile)# start start-time end end-time

Example:

Device(config-calendar-profile)# start 18:00:00 end 19:00:00

The start-time is the start time for the calendar profile. You need to enter start time in HH:MM:SS format.

The end-time is the end time for the calendar profile. You need to enter end time in HH:MM:SS format.

Step 4

Configure monthly recurrences for the calendar profile.

Example:

Device(config-calendar-profile)# recurrence monthly

Step 5

Configure a date for the calendar profile.

Example:

Device(config-calendar-profile)# date date-value

Example:

Device(config-calendar-profile)# date 25

Note

 

If the requirement is to perform denial of service in certain timing, such as, 2,10, and 25 of every month, all three days need to be configured using the date command. There is no range for date. You need to configure the dates as per your requirement.

Step 6

Return to privileged EXEC mode.

Example:

Device(config-calendar-profile)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The monthly calendar profile is configured and can be applied to schedule recurring network operations on the specified dates and times each month.

Map daily calendar profile to policy profile (CLI)

Enable time-based access control by associating a calendar profile with a policy profile to manage client session establishment during specific time intervals.
Calendar profiles define time-based restrictions that can be applied to policy profiles. When mapped together, they allow administrators to automatically deny or allow client connections based on scheduled time slots, providing granular control over network access.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create policy profile for the WLAN.

Example:

Device(config)# wireless profile policy profile-name

Example:

Device(config)# wireless profile policy default-policy-profile

The profile-name is the profile name of the policy profile.

Step 3

Map a calendar profile to a policy profile.

Example:

Device(config-wireless-policy)# calender-profile name calendar-profile-name

Example:

Device(config-wireless-policy)# calender-profile name daily_calendar_profile

The calendar-profile-name is the name of the calendar profile name created in the daily calendar profile configuration task.

Note

 

You need to disable Policy Profile before associating a calendar profile to a policy profile. Run this command:

Device(config-wireless-policy)# shutdown

Step 4

Configure deny client session establishment during calendar profile interval.

Example:

Device(config-policy-profile-calender)# action deny-client

Note

 

Client associations are denied daily between timeslot 9:00:00 to 17:00:00. For start and end time details, see the daily calendar profile configuration task.

Step 5

Return to privileged EXEC mode.

Example:

Device(config-policy-profile-calender)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The daily calendar profile is successfully mapped to the policy profile, enabling time-based client access control according to the configured schedule.

Map weekly calendar profile to policy profile (CLI)

Control wireless client access by mapping time-based calendar profiles to policy profiles, enabling scheduled denial of client sessions.
Weekly calendar profiles allow administrators to define specific time periods when client associations should be denied. This configuration is useful for implementing access control policies based on business hours or maintenance windows.

Before you begin

Ensure that a weekly calendar profile has been created before mapping it to a policy profile.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create or enter the policy profile configuration mode.

Example:

Device(config)# wireless profile policy profile-name

Example:

Device(config)# wireless profile policy default-policy-profile

Step 3

Map a calendar profile to the policy profile.

Example:

Device(config-wireless-policy)# calender-profile name calendar-profile-name

Example:

Device(config-wireless-policy)# calender-profile name weekly_calendar_profile

Note

 

You need to disable Policy Profile before associating a calendar profile to a policy profile. Use this command:

Device(config-wireless-policy)# shutdown

Step 4

Configure the action to deny client session establishment during calendar profile intervals.

Example:

Device(config-policy-profile-calender)# action deny-client

Note

 

Client associations are denied daily between timeslot 9:00:00 to 17:00:00. For start and end time details, see the weekly calendar profile configuration task.

On Monday and Tuesday, clients are denied between 17:30:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.

On 25th of every month, clients are denied between 18:00:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.

Step 5

Exit to privileged EXEC mode.

Example:

Device(config-policy-profile-calender)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The weekly calendar profile is now mapped to the policy profile, and client session establishment will be denied during the configured time periods defined in the calendar profile.

Map monthly calendar profile to policy profile (CLI)

Control client session establishment by mapping calendar-based time restrictions to wireless policy profiles.
Monthly calendar profiles define time-based access restrictions that can be applied to wireless policy profiles. This allows administrators to automatically deny client associations during specified time periods based on daily, weekly, or monthly schedules.

Before you begin

A monthly calendar profile must be created before it can be mapped to a policy profile.

Procedure

Step 1

Enter global configuration mode.

Example:

Device# configure terminal

Step 2

Create or enter policy profile configuration mode.

Example:

Device(config)# wireless profile policy profile-name

Example:

Device(config)# wireless profile policy default-policy-profile

The profile-name is the profile name of the policy profile.

Step 3

Map a calendar profile to the policy profile.

Example:

Device(config-wireless-policy)# calender-profile name calendar-profile-name

Example:

Device(config-wireless-policy)# calender-profile name monthly_calendar_profile

The calendar-profile-name is the name of the calendar profile name created in the monthly calendar profile configuration task.

Step 4

Configure deny client action for the calendar profile interval.

Example:

Device(config-policy-profile-calender)# action deny-client

Note

 

Every day client associations are denied between timeslot 9:00:00 to 17:00:00. For start and end time details, see the monthly calendar profile configuration task.

On Monday and Tuesday, clients are denied between 17:30:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.

On 25th of every month, clients are denied between 18:00:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.

Step 5

Return to privileged EXEC mode.

Example:

Device(config-policy-profile-calender)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The monthly calendar profile is now mapped to the policy profile and will automatically deny client sessions during the configured time intervals.

Verify calendar profile configuration

Verify calendar profile configuration using show commands to view profile summaries and detailed information for specific profiles.

To view the summary of calendar profiles, use this command:

Device# show wireless profile calendar-profile summary
Number of Calendar Profiles: 3

Profile-Name                       
---------------------------------
monthly_25_profile                 
weekly_mon_profile                 
daily_calendar_profile

To view the calendar profile details for a specific profile name, use this command:

Device# show wireless profile calendar-profile detailed daily_calendar_profile
Calendar profiles                          : daily_calendar_profile
------------------------------------------------------------------
Recurrence                                : DAILY
Start Time                                : 09:00:00
End Time                                  : 17:00:00

Verify policy profile configuration

Verify policy profile configuration using specific show commands to view detailed parameters and calendar profile information.

To view the detailed parameters for a specific policy profile, use this command:

Device# show wireless profile policy detailed default-policy-profile
Tunnel Profile
  Profile Name                      : Not Configured
Calendar Profile
  Profile Name                      : monthly_25_profile
  Wlan Enable                       : Not Configured
  Client Block                      : Client Block Configured
  ----------------------------------------------------
  Profile Name                      : weekly_mon_profile
  Wlan Enable                       : Not Configured
  Client Block                      : Client Block Configured
  ----------------------------------------------------
  Profile Name                      : daily_calendar_profile
  Wlan Enable                       : Not Configured
  Client Block                      : Client Block Configured
  ----------------------------------------------------
Fabric Profile
  Profile Name                      : Not Configured

To view the configured calendar profile information under policy profile, use this command:

Device# show wireless profile policy all
Tunnel Profile
Profile Name : Not Configured
Calendar Profile
Profile Name : daily_calendar_profile
Wlan Enable : Not Configured
Client Block : Client Block Configured
----------------------------------------------------
Profile Name : weekly_calendar_profile
Wlan Enable : Not Configured
Client Block : Client Block Configured
----------------------------------------------------
Fabric Profile
Profile Name : Not Configured

Note
The anchor priority is always displayed as local. Priorities can be assigned on the foreign controller.

Guidelines and limitations

Guidelines and limitations

Guidelines and limitations