Wireless Management Interface

Wireless management interfaces

The Wireless Management Interface (WMI) is a mandatory Layer 3 interface on the controller that

  • supports all communications between the controller and access points,

  • enables Control And Provisioning of Wireless Access Points (CAPWAP) or inter-controller mobility messaging and tunneling traffic, and

  • serves as the default interface for in-band management and connectivity to enterprise services such as AAA, syslog, and SNMP.

You can use the WMI IP address to connect to the device using SSH or Telnet. You can also access the GUI through HTTP or HTTPS by entering the WMI IP address in a browser address field.

Supported Protocols

Starting from Cisco IOS XE Release 17.6.1, the controller can use Ethernet Service Port (SP) (Management Interface VRF or GigabitEthernet 0) for specific management or control plane protocols

Supported protocols for the WMI include:

  • Simple Network Management Protocol (SNMP)

  • RADIUS (both for user authentication to the controller and wireless client authorization)

  • TACACS+

  • Syslog

  • Network Time Protocol (NTP)

  • SSH, Network Configuration Protocol (NETCONF), or HTTPS

  • NetFlow

Best practices and restrictions for WMI

Best practices for WMI

  • IP Address Configuration: Configure the Wireless Management Interface (WMI) with a single IP address, either IPv4 or IPv6. Alternatively, use a dual-stack configuration for flexibility in addressing.

  • IPv6 Recommendations: Assign a static IPv6 address in WMI. Do not configure the IPv6 address using the ipv6 auto-config command for the WMI.

  • Always use a dedicated wireless management VLAN and configure the WMI as a Switched VLAN Interface (SVI).

  • If you configure the uplink port or port channel to the next-hop switch as a dot1q trunk, ensure the wireless management VLAN is allowed or tagged on the trunk.

This recommendation is applicable to all AP deployment modes (local, FlexConnect, or SDA).

The recommendation is not applicable for certain scenarios:

  • The WMI is a Layer 3 port on a controller deployed in a public cloud.

  • The WMI is a loopback interface for embedded wireless controller in Cisco Catalyst 9000 switches.

Restrictions

  • Only one WMI is allowed on a controller.

  • Use only a Layer 2 interface or anA SVI to configure the WMI.

  • Do not use a Layer 3 interface for guest anchor scenarios.

  • Use a Layer 3 interface for public cloud deployments only.

  • Use the WMI to terminate CAPWAP traffic.

  • The ipv6 auto-config command is not supported.

Change the WMI interface when RMI is configured

Occasionally, you may need to change the Wireless Management Interface (WMI). If Redundant Management Interface (RMI) is configured on your network, this task shows you how to change the WMI interface.

Procedure

Step 1

Remove all RMI configurations.

Step 2

Save the changes using the write memory command.

Step 3

Reload the controller.

Step 4

Change the WMI interface.

Step 5

Reconfigure the RMI to use the same interface as the WMI.

Step 6

Save the changes using the write memory command.

Step 7

Reload the controller.
The WMI interface is changed, and the RMI is reconfigured to match, maintaining operational consistency.

WMI Configuration Tasks

Migrate VLANs safely for wireless management

Safely migrate from VLAN A to VLAN B for wireless management, ensuring all devices—including those behind Workgroup Bridges (WGB)—continue to correctly receive multicast traffic.


Caution

Do not remove VLAN A or SVI A before creating VLAN B or SVI B and associating SVI B with WMI. This sequence is critical to prevent multicast traffic issues.

Procedure

Step 1

Create VLAN B on the relevant network switches.

Step 2

Configure SVI B (Switched Virtual Interface for VLAN B).

Step 3

Associate SVI B with the WMI interface.

Step 4

Verify multicast traffic is flowing correctly to all devices, including those behind WGBs.

Step 5

Once functionality is confirmed, remove VLAN A from the network configuration.

Step 6

Delete SVI A (Switched Virtual Interface for the old VLAN).

Step 7

Document changes and monitor for any multicast or connectivity issues.
The VLANs are migrated, and multicast traffic is properly received by all devices, including those behind WGBs.

Sample interface configuration

Layer 3 interface configuration:


                    interface GigabitEthernet2
                    no switchport
                    ip address <ip_address> <mask>
                    negotiation auto
                    no mop enabled
                    no mop sysid
                    end

Layer 2 interface configuration:


                    interface GigabitEthernet2
                    switchport trunk allowed vlan 25,169,504
                    switchport mode trunk
                    negotiation auto
                    no mop enabled
                    no mop sysid
                    end

Configure the WMI interface of a controller (CLI)

Configure the WMI interface on a controller using the CLI.

Set up a controller, and assign a dedicated VLAN and interface for wireless management.

The examples assume the GigabitEthernet 2 interface connects to a trunk interface and that you want to configure multiple VLANs and dedicate one of them for the WMI interface.

Before you begin

  • Ensure you have physical console access (for the Cisco Catalyst 9800 Series Wireless Controller Appliance) or a virtual console access (Cisco Catalyst 9800 Series Wireless Controller for Cloud).

  • Determine your management VLAN, interface IP address, and credentials.

Procedure

Step 1

Access the CLI using Video Graphics Array(VGA) or monitor console from your preferred hypervisor.

Step 2

Terminate the configuration wizard.


Would you like to enter the initial configuration dialog? [yes/no]:
 no
Would you like to terminate autoinstall? [yes]:
 yes

Step 3

Enter the global configuration mode and configure the login credentials.


Device# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Device(config)# username <name> privilege 15 password <yourpwd>

Step 4

Set a hostname.

Device(config)# hostname C9800

Step 5

Configure the VLAN for the wireless management interface.


Device(config)# vlan 201
Device(config-vlan)# name wireless_management

Step 6

Configure the Layer 3 SVI for wireless management interface.


Device(config)# int vlan 201
Device(config-if)# description wireless-management-interface
Device(config-if)# ip address 172.16.201.21 255.255.255.192
Device(config-if)# no shutdown

Step 7

Configure an interface as trunk and allow the wireless management VLAN.


Device(config-if)# interface GigabitEthernet2  
Device(config-if)# switchport mode trunk
Device(config-if)# switchport trunk allowed vlan 201,210,211
Device(config-if)# shut
Device(config-if)# no shut

Note

 

VLANs 210 and 211 are added to the trunk to carry client traffic.

Step 8

Configure a default route or a more specific route to reach the device.


Device(config-if)# ip route 0.0.0.0 0.0.0.0 172.16.201.1

The controller is configured with a dedicated wireless management VLAN and SVI. You can access the device using SSH, telnet, or GUI. You can use the Cisco Catalyst Center or Cisco Prime Infrastructure to continue with the Day 0 configuration.

Verify WMI Settings

Verify if the Layer 3 interface is configured correctly.

Device# show run int vlan 201

Building configuration...

Current configuration : 128 bytes
!
interface Vlan201
 description wireless-management-interface
 ip address 172.16.201.21 255.255.255.0
 no mop enabled
 no mop sysid
end

Verify if the wireless management VLAN is active on the uplink to the network. In this case, the uplink is a trunk interface, so the VLAN needs to be active and forwarding state. 

Device# show interfaces trunk

Port        Mode             Encapsulation  Status        Native vlan  
Gi2         on               802.1q         trunking      1
.....
Port        Vlans allowed on trunk
Gi2         201,210-211
.....
Port        Vlans allowed and active in management domain
Gi2         201,210-211
....
Port        Vlans in spanning tree forwarding state and not pruned
Gi2         201,210-211
....

Verify if the wireless management interface is up.


Device# show ip int brief | i Vlan201
Vlan201   172.16.201.21  YES NVRAM  up  up

Verify if the selected interface has been configured as wireless management.

Device# show wireless interface summary

Wireless Interface Summary

Interface Name Interface Type VLAN ID IP Address     IP Netmask   NAT-IP Address MAC Address
--------------------------------------------------------------------------------------------------
Vlan201       Management       201   172.16.201.21  255.255.255.0  0.0.0.0      001e.e51c.a7ff