Mesh network
A mesh network is a wireless network topology that
-
uses interconnected Cisco Aironet outdoor mesh APs and indoor mesh APs to relay data
-
provides scalability, central management, and seamless mobility between indoor and outdoor deployments, and
-
is coordinated and provisioned using Cisco Wireless Controller and Cisco Prime Infrastructure.
The Control and Provisioning of Wireless Access Points (CAPWAP) protocol manages the connection of mesh access points to the network, ensuring secure and efficient network operations.
End-to-end security
End-to-end security within the mesh network is supported by employing Advanced Encryption Standard (AES) encryption between wireless mesh APs and Wi-Fi Protected Access 2 (WPA2) clients. For connections to a mesh AP (MAP) wireless client, such as MAP-to-MAP and MAP-to-root access point, WPA2 is applicable.
Wireless mesh termination points
The wireless mesh terminates at two points on the wired network. The first location is where the root access point (RAP) is attached and all bridged traffic connects to the wired network. The second location is where the CAPWAP controller connects to the wired network. At this location, the WLAN client traffic from the mesh network connects to the wired network. The WLAN client traffic from CAPWAP is tunneled to Layer 2. Matching WLANs should terminate on the same switch VLAN as the wireless controllers. The security and network configuration for each of the WLANs on the mesh depend on the security capabilities of the network to which the wireless controller is connected.
In the new configuration model, the controller has a default mesh profile. This profile is mapped to the default AP-join profile, which is in turn is mapped to the default site tag. If you are creating a named mesh profile, ensure that these mappings exist and that the corresponding AP is added to the appropriate site-tag.
Mesh scenarios in IRCM
 Important |
These are the mesh scenarios in IRCM from Cisco IOS XE Amsterdam 17.3 up to Cisco IOS XE Cupertino 17.9, for the Cisco Wave 1 APs that are not supported:
|
Mesh RRM feature support and evolution across AP generations
Mesh AP families
The two families of mesh APs available are the Cisco Wave 1 APs and the Cisco Wave 2 APs and the AX APs. These families have different capabilities and features, and they are not fully compatible with each other. The Cisco Wave 1 APs do not support the same feature set as the Cisco Wave 2 and AX APs.
Both families of APs support background scanning. However, their implementations are not interoperable, so you cannot use both in a single mesh deployment.
Evolution in the mesh RRM feature across AP generations
Cisco Wave 1 APs have not received significant mesh RRM feature updates after the Cisco IOS XE Amsterdam 17.3 release. Mesh RRM features on Cisco Wave 2 and AX APs have gained many improvements in recent releases.
-
Cisco IOS XE Cupertino 17.9.1 introduced mesh RRM DCA using radio information only from RAPs.
-
Cisco IOS XE Dublin 17.11 introduced mesh background scanning and FastaAncestor find mode.
-
Cisco IOS XE 17.14 introduced mesh RRM DCA that uses radio information from the entire mesh tree.
Restrictions for mesh access points
Feature restrictions
For information about APs that support Mesh feature, see https://www.cisco.com/c/en/us/td/docs/wireless/access_point/feature-matrix/ap-feature-matrix.html.
-
Serial backhaul AP support with separate backhaul radios for uplink and downlink.
-
Public Safety channels (4.9-GHz band) support.
-
Passive Beaconing (Anti-Stranding)
Configuration considerations
Only Root APs support SSO. MAPs will disconnect and rejoin after SSO.
-
In a mixed regulatory domain mesh AP deployment, ensure that the Dynamic Channel Assignment (DCA) allowed channel list is supported by MAPs.
-
When you disable the admin state on the 2.4-GHz radio of mesh APs, and the root AP (RAP) backhaul radio is switched to 2.4-GHz, RAP will still use 2.4-GHz radio to serve the mesh backhaul connections, inspite of 2.4-GHz radio being in the disabled state.
The AP Stateful Switch Over (SSO) feature allows the access point (AP) to establish a CAPWAP tunnel with the Active controller and share a mirror copy of the AP database with the Standby controller. The overall goal for the addition of AP SSO support to the controller is to reduce major downtime in wireless networks due to failure conditions that may occur due to box failover or network failover.
Country codes
A country code is a regulatory compliance setting that
-
allows specification of the intended country of operation for controllers and APs
-
ensures adherence to local regulations about broadcast frequencies, channels, and power levels, and
-
maintains correct assignment of regulatory domains for each device.
In certain countries, there is a difference for indoor and outdoor APs in these areas:
-
Regulatory domain code
-
Set of channels supported
-
Transmit power level
Controllers and APs are designed for use in many countries with varying regulatory requirements. At the factory, the radios within the APs are assigned to a specific regulatory domain (such as -E for Europe). The country code then enables you to specify a particular country of operation (such as FR for France or ES for Spain). Configuring a country code ensures that the broadcast frequency bands, interfaces, channels, and transmit power levels of each radio are compliant with country-specific regulations.
Mesh interoperability between controllers
Mesh interoperability between controllers is a wireless mesh network capability that
-
enables MAPs to join an AireOS controller through a mesh network formed by APs connected to a Cisco Catalyst 9800 Series Wireless Controller
-
allows MAPs to join a Cisco Catalyst 9800 Series Wireless Controller through a mesh network formed by APs connected to an AireOS controller, and
-
supports MAP roaming between parent mesh APs connected to AireOS and Cisco Catalyst 9800 Series Wireless Controller using PMK cache.
Note |
For seamless interoperability, the AireOS controller and the Cisco Catalyst 9800 Series Wireless Controller must be in the same mobility group. Both controllers should use image versions that support Inter-Release Controller Mobility (IRCM). |
Indoor mesh interoperability with outdoor mesh
A mesh network is a wireless connectivity architecture that
-
enables both indoor and outdoor MAPs to connect and share coverage
-
allows seamless mobility groups between the two environments, and
-
supports management of all MAPs through a single controller.
The system supports interoperability between indoor MAPs and outdoor APs. By default, you should use indoor MAPs inside buildings. Deploy them outside only for temporary, short-haul coverage extensions, such as connecting a building to a nearby parking lot.
You can share mobility groups between indoor and outdoor networks, and you can manage all devices with a single controller. The same WLANs that you configure can be broadcast from both indoor and outdoor MAPs.
Enable wireless mesh profile (CLI)
To enable and configure a wireless mesh profile to support mesh networking functionality on your device.
Procedure
|
Step 1 |
Enter global configuration mode. Example: |
|
Step 2 |
Configure a mesh profile and enter mesh profile configuration mode. Example: |
|
Step 3 |
Enable the fast teardown of mesh network and configure the parameters of the feature. Example: |
The wireless mesh profile is enabled and configured with the fast teardown feature.
Device# configure terminal
Device(config)# wireless profile mesh mesh1
Device(config-wireless-profile-mesh)# fast-teardownAssociate wireless mesh to an AP profile (CLI)
Associate a mesh profile with an AP profile to enable mesh capabilities on compatible APs through CLI configuration.
Procedure
|
Step 1 |
Enter global configuration mode. Example: |
|
Step 2 |
Configure the AP profile to enter AP profile configuration mode. Example: |
|
Step 3 |
In AP profile configuration mode, configure the mesh profile. Example: |
Device# configure terminal
Device(config)# ap profile default-ap-profile
Device(config-ap-profile)# mesh-profile test1Verify mesh configuration
Use these show commands to verify the various aspects of mesh configuration:
-
show wireless mesh stats ap-name
-
show wireless mesh security-stats {all | ap-name}
-
show wireless mesh queue-stats {all | ap-name}
-
show wireless mesh per-stats summary {all | ap-name}
-
show wireless mesh neighbor summary {all | ap-name}
-
show wireless mesh neighbor detail ap-name
-
show wireless mesh ap summary
-
show wireless mesh ap tree
-
show wireless mesh ap backhaul
-
show wireless mesh config
-
show wireless mesh convergence detail bridge-group-name
-
show wireless mesh convergence subset-channels
-
show wireless mesh neighbor
-
show wireless profile mesh detailed mesh-profile-name
-
show wireless stats mesh security
-
show wireless stats mesh queue
-
show wireless stats mesh packet error
-
show wireless mesh ap summary
-
show ap name ap-name mesh backhaul
-
show ap name ap-name mesh neighbor detail
-
show ap name ap-name mesh path
-
show ap name ap-name mesh stats packet error
-
show ap name ap-name mesh stats queue
-
show ap name ap-name mesh stats security
-
show ap name ap-name mesh stats
-
show ap name ap-name mesh bhrate
-
show ap name ap-name config ethernet
-
show ap name ap-name cablemodem
-
show ap name ap-name environment
-
show ap name ap-name gps location
-
show ap name ap-name environment
-
show ap name ap-name mesh linktest data dest-mac
-
show ap environment
-
show ap gps location
For details about these commands, see the Cisco Catalyst 9800 Series Wireless Controller Command Reference document.
MAC authorization
Use this show command to verify the MAC authorization configuration:
Device# show run aaa
aaa authentication dot1x CENTRAL_LOCAL local
aaa authorization credential-download CENTRAL_AUTHOR local
username 002cc8de4f31 mac
username 00425a0a53b1 mac
ewlc_eft#sh wireless profile mesh detailed madhu-mesh-profile
Mesh Profile Name : abc-mesh-profile
-------------------------------------------------
Description :
Bridge Group Name : bgn-abbc
Strict match BGN : ENABLED
Amsdu : ENABLED
...
Battery State : ENABLED
Authorization Method : CENTRAL_AUTHOR
Authentication Method : CENTRAL_LOCAL
Backhaul tx rate(802.11bg) : auto
Backhaul tx rate(802.11a) : 802.11n mcs15
PSK provisioning
Use this show command to verify PSK provisioning configuration:
Device# show wireless mesh config
Mesh Config
Backhaul RRM : ENABLED
Mesh CAC : DISABLED
Outdoor Ext. UNII B Domain channels(for BH) : ENABLED
Mesh Ethernet Bridging STP BPDU Allowed : ENABLED
Rap Channel Sync : ENABLED
Mesh Alarm Criteria
Max Hop Count : 4
Recommended Max Children for MAP : 10
Recommended Max Children for RAP : 20
Low Link SNR : 12
High Link SNR : 60
Max Association Number : 10
Parent Change Number : 3
Mesh PSK Config
PSK Provisioning : ENABLED
Default PSK : ENABLED
PSK In-use key number : 1
Provisioned PSKs(Maximum 5)
Index Description
------ ------------
1 key1
Bridge group name
Use this show command to verify the bridge group name configuration:
Device# show wireless profile mesh detailed abc-mesh-profile
Mesh Profile Name : abc-mesh-profile
-------------------------------------------------
Description :
Bridge Group Name : bgn-abc
Strict match BGN : ENABLED
Amsdu : ENABLED
Background Scan : ENABLED
Channel Change Notification : DISABLED
Backhaul client access : ENABLED
Ethernet Bridging : ENABLED
Ethernet Vlan Transparent : DISABLED
Full Sector DFS : ENABLED
IDS : ENABLED
Multicast Mode : In-Out
Range in feet : 12000
Security Mode : EAP
Convergence Method : Fast
LSC only Authentication : DISABLED
Battery State : ENABLED
Authorization Method : CENTRAL_AUTHOR
Authentication Method : CENTRAL_LOCAL
Backhaul tx rate(802.11bg) : auto
Backhaul tx rate(802.11a) : 802.11n mcs15
Backhaul client access
Use this show command to verify the backhaul client access configuration:
Device# show wireless profile mesh detailed abc-mesh-profile
Mesh Profile Name : abc-mesh-profile
-------------------------------------------------
Description :
Bridge Group Name : bgn-abc
Strict match BGN : ENABLED
Amsdu : ENABLED
Background Scan : ENABLED
Channel Change Notification : DISABLED
Backhaul client access : ENABLED
Ethernet Bridging : ENABLED
Ethernet Vlan Transparent : DISABLED
...
Backhaul tx rate(802.11bg) : auto
Backhaul tx rate(802.11a) : 802.11n mcs15
Wireless backhaul data rate
Use this show command to verify the wireless backhaul data rate configuration:
Device# show wireless profile mesh detailed abc-mesh-profile
Mesh Profile Name : abc-mesh-profile
-------------------------------------------------
Description :
Bridge Group Name : bgn-abc
Strict match BGN : ENABLED
...
Authorization Method : CENTRAL_AUTHOR
Authentication Method : CENTRAL_LOCAL
Backhaul tx rate(802.11bg) : auto
Backhaul tx rate(802.11a) : 802.11n mcs15
Dynamic frequency selection
Use this show command to verify the dynamic frequency selection configuration:
Device# show wireless profile mesh detailed abc-mesh-profile
Mesh Profile Name : abc-mesh-profile
-------------------------------------------------
Description :
Bridge Group Name : bgn-abc
Strict match BGN : ENABLED
Amsdu : ENABLED
Background Scan : ENABLED
Channel Change Notification : DISABLED
Backhaul client access : ENABLED
Ethernet Bridging : ENABLED
Ethernet Vlan Transparent : DISABLED
Full Sector DFS : ENABLED
...
Backhaul tx rate(802.11a) : 802.11n mcs15
Intrusion detection system
Use this show command to verify the wireless backhaul data rate configuration:
Device# show wireless profile mesh detailed abc-mesh-profile
Mesh Profile Name : abc-mesh-profile
-------------------------------------------------
Description :
Bridge Group Name : bgn-abc
Strict match BGN : ENABLED
Amsdu : ENABLED
Background Scan : ENABLED
Channel Change Notification : DISABLED
Backhaul client access : ENABLED
Ethernet Bridging : ENABLED
Ethernet Vlan Transparent : DISABLED
Full Sector DFS : ENABLED
IDS : ENABLED
Multicast Mode : In-Out
...
Backhaul tx rate(802.11a) : 802.11n mcs15
Ethernet bridging
Use this show command to verify ethernet bridging configuration:
Device# show wireless profile mesh detailed abc-mesh-profile
Mesh Profile Name : abc-mesh-profile
-------------------------------------------------
Description :
Bridge Group Name : bgn-abc
Strict match BGN : ENABLED
Amsdu : ENABLED
Background Scan : ENABLED
Channel Change Notification : DISABLED
Backhaul client access : ENABLED
Ethernet Bridging : ENABLED
Ethernet Vlan Transparent : DISABLED
Full Sector DFS : ENABLED
IDS : ENABLED
Multicast Mode : In-Out
...
Backhaul tx rate(802.11a) : 802.11n mcs15
Multicast over mesh
Use this show command to verify multicast over Mesh configuration:
Device# show wireless profile mesh detailed abc-mesh-profile
Mesh Profile Name : abc-mesh-profile
-------------------------------------------------
Description :
Bridge Group Name : bgn-abc
Strict match BGN : ENABLED
Amsdu : ENABLED
Background Scan : ENABLED
Channel Change Notification : DISABLED
Backhaul client access : ENABLED
Ethernet Bridging : ENABLED
Ethernet Vlan Transparent : DISABLED
Full Sector DFS : ENABLED
IDS : ENABLED
Multicast Mode : In-Out
...
Backhaul tx rate(802.11a) : 802.11n mcs15
RRM on mesh backhaul
Use this show command to verify RRM on Mesh backhaul configuration:
Device# show wireless mesh config
Mesh Config
Backhaul RRM : ENABLED
Mesh CAC : DISABLED
Outdoor Ext. UNII B Domain channels(for BH) : ENABLED
Mesh Ethernet Bridging STP BPDU Allowed : ENABLED
Rap Channel Sync : ENABLED
Mesh Alarm Criteria
Max Hop Count : 4
Recommended Max Children for MAP : 10
Recommended Max Children for RAP : 20
Low Link SNR : 12
High Link SNR : 60
Max Association Number : 10
Parent Change Number : 3
Mesh PSK Config
PSK Provisioning : ENABLED
Default PSK : ENABLED
PSK In-use key number : 1
Provisioned PSKs(Maximum 5)
Index Description
------ ------------
1 key1
Preferred parent selection
Use this show command to verify preferred parent configuration:
Device# show wireless mesh ap tree
========================================================================
AP Name [Hop Ctr,Link SNR,BG Name,Channel,Pref Parent,Chan Util,Clients]
========================================================================
[Sector 1]
-----------
1542-RAP [0, 0, bgn-madhu, (165), 0000.0000.0000, 1%, 0]
|-MAP-2700 [1, 67, bgn-madhu, (165), 7070.8b7a.6fb8, 0%, 0]
Number of Bridge APs : 2
Number of RAPs : 1
Number of MAPs : 1
(*) Wait for 3 minutes to update or Ethernet Connected Mesh AP.
(**) Not in this Controller
AP role change
Use this show command to verify AP role change configuration:
Device# show wireless mesh ap summary
AP Name AP Model BVI MAC BGN AP Role
------- -------- ------- --- -------
1542-RAP 1542D 002c.c8de.1338 bgn-abc Root AP
MAP-2700 2702I 500f.8095.01e4 bgn-abc Mesh AP
Number of Bridge APs : 2
Number of RAPs : 1
Number of MAPs : 1
Number of Flex+Bridge APs : 0
Number of Flex+Bridge RAPs : 0
Number of Flex+Bridge MAPs : 0
Mesh leaf node
Use this show command to verify mesh leaf node configuration:
Device# show ap name MAP-2700 config general
Cisco AP Name : MAP-2700
=================================================
Cisco AP Identifier : 7070.8bbc.d3e0
Country Code : Multiple Countries : IN,US,IO,J4
Regulatory Domain Allowed by Country : 802.11bg:-AEJPQU 802.11a:-ABDJNPQU
AP Country Code : IN - India
AP Regulatory Domain
Slot 0 : -A
Slot 1 : -D
MAC Address : 500f.8095.01e4
...
AP Mode : Bridge
Mesh profile name : abc-mesh-profile
AP Role : Mesh AP
Backhaul radio type : 802.11a
Backhaul slot id : 1
Backhaul tx rate : auto
Ethernet Bridging : Enabled
Daisy Chaining : Disabled
Strict Daisy Rap : Disabled
Bridge Group Name : bgn-abc
Strict-Matching BGN : Enabled
Preferred Parent Address : 7070.8b7a.6fb8
Block child state : Disabled
PSK Key Timestamp : Not Configured
...
FIPS status : Disabled
WLANCC status : Disabled
GAS rate limit Admin status : Disabled
WPA3 Capability : Disabled
EWC-AP Capability : Disabled
AWIPS Capability : Disabled
Proxy Hostname : Not Configured
Proxy Port : Not Configured
Proxy NO_PROXY list : Not Configured
GRPC server status : Disabled
Subset channel synchronization
Use this show command to verify the subset channel synchronization configuration:
Device# show wireless mesh config
Mesh Config
Backhaul RRM : ENABLED
Mesh CAC : DISABLED
Outdoor Ext. UNII B Domain channels(for BH) : ENABLED
Mesh Ethernet Bridging STP BPDU Allowed : ENABLED
Rap Channel Sync : ENABLED
Mesh Alarm Criteria
Max Hop Count : 4
Recommended Max Children for MAP : 10
Recommended Max Children for RAP : 20
Low Link SNR : 12
High Link SNR : 60
Max Association Number : 10
Parent Change Number : 3
Mesh PSK Config
PSK Provisioning : ENABLED
Default PSK : ENABLED
PSK In-use key number : 1
Provisioned PSKs(Maximum 5)
Index Description
------ ------------
1 key1
Provisioning LSC for bridge-mode and mesh APs
Use this show command to verify the provisioning LSC for Bridge-Mode and Mesh AP configuration:
Device# show wireless profile mesh detailed default-mesh-profile
Mesh Profile Name : default-mesh-profile
-------------------------------------------------
Description : default mesh profile
Bridge Group Name : bgn-abc
Strict match BGN : DISABLED
Amsdu : ENABLED
Background Scan : ENABLED
Channel Change Notification : ENABLED
Backhaul client access : ENABLED
Ethernet Bridging : DISABLED
Ethernet Vlan Transparent : ENABLED
Full Sector DFS : ENABLED
IDS : DISABLED
Multicast Mode : In-Out
Range in feet : 12000
Security Mode : EAP
Convergence Method : Fast
LSC only Authentication : DISABLED
Battery State : ENABLED
Authorization Method : default
Authentication Method : default
Backhaul tx rate(802.11bg) : auto
Backhaul tx rate(802.11a) : auto
Specify backhaul slot for root AP
Use this show command to verify the backhaul slot for the Root AP configuration:
Device# show ap name 1542-RAP mesh backhaul
MAC Address : 380e.4d85.5e60
Current Backhaul Slot: 1
Radio Type: 0
Radio Subband: All
Mesh Radio Role: DOWNLINK
Administrative State: Enabled
Operation State: Up
Current Tx Power Level:
Current Channel: (165)
Antenna Type: N/A
Internal Antenna Gain (in .5 dBm units): 18
Use a link test on mesh backhaul
Use this show command to verify the use of link test on mesh backhaul configuration:
Device# show ap name 1542-RAP mesh linktest data 7070.8bbc.d3ef
380e.4d85.5e60 ==> 7070.8bbc.d3ef
Started at : 05/11/2020 20:56:28
Status: In progress
Configuration:
==============
Data rate: Mbps
Packets per sec: : 234
Packet Size: : 1200
Duration: : 200
Mesh CAC
Use this show command to verify mesh CAC configuration:
Device# show wireless mesh config
Mesh Config
Backhaul RRM : ENABLED
Mesh CAC : DISABLED
Outdoor Ext. UNII B Domain channels(for BH) : ENABLED
Mesh Ethernet Bridging STP BPDU Allowed : ENABLED
Rap Channel Sync : ENABLED
Mesh Alarm Criteria
Max Hop Count : 4
Recommended Max Children for MAP : 10
Recommended Max Children for RAP : 20
Low Link SNR : 12
High Link SNR : 60
Max Association Number : 10
Parent Change Number : 3
Mesh PSK Config
PSK Provisioning : ENABLED
Default PSK : ENABLED
PSK In-use key number : 1
Provisioned PSKs(Maximum 5)
Index Description
------ ------------
1 key1
Feedback