Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Application visibility and control

Updated: April 10, 2026

Want to summarize with AI?

Log in

Explains how application visibility and control enables real-time identification, monitoring, and management of network applications using deep packet inspection and Flexible NetFlow integration.

Application visibility and control is a wireless network feature set that

  • enables real-time identification and monitoring of applications using deep packet inspection

  • allows creation of policy rules to manage application bandwidth and usage, and

  • integrates with Flexible NetFlow (FNF) to report traffic statistics per application or protocol.

Application visibility and control (AVC) is a subset of the Flexible NetFlow (FNF) package. AVC provides traffic information. The AVC feature uses a distributed approach that benefits from NBAR running on the AP or controller. The goal is to run deep packet inspection (DPI) and report the results using FNF messages.

The NBAR2 engine analyzes and recognizes traffic flows. Each specific flow is marked with the detected protocol or application. You can use this per-flow information for application visibility through FNF. After application visibility is established, you can define control rules with policing mechanisms for a client.

Guidelines for application visibility and control

  • Using AVC rules, bandwidth for a particular application can be limited for all clients joined on the WLAN. These bandwidth contracts coexist with per-client downstream rate limiting. The per-client limits take precedence over the per-application rate limits.

  • The FNF feature is supported in wireless deployments. It relies on NetFlow enablement on the controller for all modes: FlexConnect, local and Fabric.

  • In local mode, NBAR runs on the controller hardware. Client traffic flows through the data plane of the controller using the AP CAPWAP tunnels.

  • In FlexConnect or Fabric mode, NBAR runs on the AP. Only statistics are sent to the controller . In these two modes, APs regularly send FNFv9 reports to the controller . The FNF feature uses these reports to provide application statistics reported by AVC.

  • In Fabric mode, FNF cache is not populated. The system relays FNFv9 reports as they arrive. As a result, some flow monitor configuration parameters, such as cache timeout, are not used.

The behavior of the AVC solution changes based on the wireless deployment mode. The next sections describe the commonalities and differences in all scenarios.

Local Mode

  • NBAR is enabled on the controller .

  • AVC does not push the FNF configuration to the APs.

  • Roaming events are ignored.

    However, AVC supports Layer 3 roaming in local mode because traffic flows through the anchor controller, where NBAR first processed the client's traffic when the client joined.

  • IOSd needs to trigger NBAR attach.

  • The solution supports flow monitor cache and NetFlow exporter.

FlexConnect Mode

  • NBAR is enabled on an AP.

  • AVC pushes the FNF configuration to the APs.

  • Context transfer for roaming is supported in AVC-FNF.

  • Flow monitor cache is supported.

  • NetFlow exporter is supported.

Fabric Mode

  • NBAR is enabled on an AP.

  • AVC pushes the FNF configuration to the APs.

  • Context transfer for roaming is supported in AVC-FNF.

  • Flow monitor cache is not supported.

  • NetFlow exporter is supported. For the C9800 on Catalyst switches for SDA, FNF cache is not available on the device.

Prerequisites for application visibility and control

  • The APs should be AVC capable.

    However, this requirement does not apply in Local mode.

  • Configure the application visibility feature with FNF to enable AVC control (QoS).

Restrictions for application visibility and control

  • IPv6 packet classification, including ICMPv6 traffic, is not supported in FlexConnect mode or Fabric mode. It is supported in Local mode.

  • Layer 2 roaming is not supported across controller .

  • Multicast traffic is not supported.

  • AVC is supported only on the following APs:

    • Cisco Catalyst 9100 Series Access Points

    • Cisco Aironet 1800 Series Access Points

    • Cisco Aironet 2700 Series Access Point

    • Cisco Aironet 2800 Series Access Point

    • Cisco Aironet 3700 Series Access Points

    • Cisco Aironet 3800 Series Access Points

    • Cisco Aironet 4800 Series Access Points

    • Cisco Industrial Wireless 3702 Access Point

  • AVC is not supported on Cisco Aironet 702W, 702I (128 M memory), and 1530 Series APs.

  • Only applications recognized by App Visibility can be used for applying QoS control.

  • Data link is not supported for NetFlow fields in AVC.

  • You cannot map the same WLAN profile to both the AVC-not-enabled policy profile and the AVC-enabled policy profile.

  • AVC is not supported on the management port (Gig 0/0).

  • NBAR-based QoS policy configuration is allowed only on wired physical ports. Policy configuration is not supported on virtual interfaces. For example, VLAN, port channel and other logical interfaces.

  • NBAR cannot classify traffic accurately when SaaS applications use end-to-end encryption, QUIC, or DoH because encryption affects classification. In these cases, encrypted traffic including DoH and QUIC without SNI prevents NBAR from sending the correct Protocol ID, which causes traffic classification issues.

When AVC is enabled, the profile supports a maximum of 23 rules, including the default DSCP rule. If the number of rules exceeds 23, the AVC policy will not be sent to the AP.

Configure AVC

Enable monitoring and policy enforcement for application usage on the wireless network.

Procedure

1.

Create a flow monitor using the record wireless avc basic command.
2.

Create a wireless policy profile.
3.

Apply the flow monitor to the wireless policy profile.
4.

Create a wireless policy tag.
5.

Map the WLAN to the policy profile.
6.

Attach the policy tag to the APs.

Create a flow monitor (CLI)

The NetFlow configuration requires a flow record, a flow monitor, and a flow exporter. Make this configuration your first step in the overall AVC configuration.

Note

In FlexConnect mode and Local mode, the default values for cache timeout active and cache timeout inactive commands do not provide optimal AVC performance. Set both values to 60 in the flow monitor.

For Fabric mode, the cache timeout configuration does not apply.

Procedure

1.

Enter the global configuration mode.

Example:

Device# configure terminal
2.

Create a flow monitor.

Example:

Device(config)# flow monitor monitor-name fm_avc
3.

Specify the basic IPv4 or IPv6 wireless AVC flow template.

Example:

Device(config-flow-monitor)# record wireless avc {ipv4 | ipv6} basic
Note

If you want to have both Application Performance Monitoring (APM) and AVC-FNF in the device simultaneously, use the record wireless avc {ipv4 | ipv6} assurance command, which is a superset of the fields contained in record wireless avc {ipv4 | ipv6} basic command. If the containing flow monitor is configured with the local exporter using destination wlc local command, AVC-FNF will populate the statistics exactly as that of the record wireless avc {ipv4 | ipv6} basic configuration. As a result, both APM and AVC-FNF can be configured simultaneously with two flow monitors per direction, per IP version, in local (central switching) mode.

Note

The record wireless avc basic command is same as record wireless avc ipv4 basic command. However, record wireless avc ipv4 basic command is not supported in FlexConnect or Fabric modes. In such scenarios, use the record wireless avc basic command.
4.

Set the active flow timeout in seconds.

Example:

Device(config-flow-monitor)# cache timeout active value 60
5.

Set the inactive flow timeout in seconds.

Example:

Device(config-flow-monitor)# cache timeout inactive value 60

Configure a flow monitor (GUI)

Set up a flow monitor and export data to a collector using a pre-configured flow exporter.

Before you begin

Ensure you have already created a flow exporter.

Procedure

1.

Choose Configuration > Services > Application Visibility and go to the Flow Monitor tab.
2.

In the Monitor area, click Add to add a flow monitor.
3.

In the Flow Monitor window, add a flow monitor and a description.
4.

Select the Flow exporter from the drop-down list to export data from the flow monitor to the collector.

Note

To export wireless NetFlow data, use these templates:

  • ETA (Encrypted Traffic Analysis)

  • wireless avc basic

  • wireless avc basic IPv6
5.

Click Apply to Device to save the configuration.

Create a flow record (CLI)

The default flow record cannot be edited or deleted. If you require a new flow record, create one and map it to the flow monitor from the CLI.

Procedure

1.

Create a flow record.

Example:

Device(config)# flow record flow_record_name record1
Note

When a custom flow record is configured in FlexConnect and Fabric modes, the optional fields (fields that are not present in record wireless avc basic) are ignored.
2.

(Optional) Describe the flow record as a maximum 63-character string.

Example:

Device(config-flow-record)# description IPv4flow
3.

Specify a match to the IPv4 protocol and specify a match to the IPv4 source address-based field.

Example:

Device(config-flow-record)# match ipv4 protocol
Device(config-flow-record)# match ipv4 source address
4.

Specify a match to the IPv4 destination address-based field and specify a match to the transport layer's source port field.

Example:

Device(config-flow-record)# match ipv4 destination address
Device(config-flow-record)# match transport source-port
5.

Specify a match to the transport layer's destination port field and specify a match to the direction the flow was monitored in.

Example:

Device(config-flow-record)# match transport destination-port
Device(config-flow-record)# match flow direction
6.

Specify a match to the application name.

Example:

Device(config-flow-record)# match application name
Note
This action is mandatory for AVC support because this allows the flow to be matched against the application.
7.

Specify a match to the SSID name identifying the wireless network and collect the counter field's total bytes.

Example:

Device(config-flow-record)# match wireless ssid
Device(config-flow-record)# collect counter bytes long
8.

Collect the counter field's total packets and collect the BSSID with the MAC addresses of the APs that the wireless client is associated with.

Example:

Device(config-flow-record)# collect counter packets long
Device(config-flow-record)# collect wireless ap mac address
9.

Collect the MAC address of the client on the wireless network.

Example:

Device(config-flow-record)# collect wireless client mac address

Create a flow exporter (CLI)

Define export parameters for a flow exporter so AVC statistics are visible on the controller embedded wireless controller. This is an optional procedure for configuring flow exporter parameters.

Note

For the AVC statistics to be visible at the controller, you should configure a local flow exporter using these commands:

  • flow exporter my_local

  • destination local wlc

Also, your flow monitor must use this local exporter for the statistics to be visible at the controller .

Procedure

1.

Create a flow monitor.

Example:

Device(config)# flow exporter flow-export-name export-test
2.

Describe the flow record as a maximum 63-character string.

Example:

Device(config-flow-exporter)# description IPv4flow
3.

Example:

Device(config-flow-exporter)# destination {hostname/ipv4address | hostname/ipv6address | local wlc}
4.

Specify the local controller to which the exporter sends data.

Example:

Device(config-flow-exporter)# destination {hostname/ipv4address | hostname/ipv6address | local wlc}
5.

(Optional) Configure the destination UDP port to reach the external collector.

Example:

Device(config-flow-exporter)# transport udp port-value 1024

The default value is 9995.

Note

This step is required only for external collectors; not required for local controller collector.
6.

(Optional) Specify the application table timeout option, in seconds.

Example:

Device(config-flow-exporter)# option application-table timeout 500

The valid range is from one to 86400.
7.

Return to privileged EXEC mode.

Example:

Device(config-flow-exporter)# end
8.

(Optional) Verify your configuration.

Example:

Device# show flow exporter

Configure a policy tag (CLI)

Establish a policy tag to control wireless device and SSID behavior.

Policy tags allow you to associate specific policy profiles with APs, enabling customized wireless network behavior.

Procedure

1.

Enter the global configuration mode.

Example:

Device# configure terminal
2.

Configure policy tag and enter policy tag configuration mode.

Example:

Device(config-policy-tag)# wireless tag policy policy-tag-name rr-xyz-policy-tag
3.

Save the configuration and exit configuration mode and return to privileged EXEC mode. end

Example:

Device(config-policy-tag)# end

Attach a policy profile to a WLAN interface (GUI)

Link the appropriate policy configuration to a WLAN interface for centralized control. Use the GUI to ensure new or modified policy profiles are correctly associated with WLANs before deployment.

Procedure

1.

Choose Configuration > Tags & Profiles > Tags.
2.

On the Manage Tags page, click the Policy tab.
3.

Click Add to open the Add Policy Tag window.
4.

Enter a name and description for the policy tag.
5.

Click Add to map WLAN and policy.
6.

Select the WLAN profile to map with the appropriate policy profile, and click the tick icon.
7.

Click Save & Apply to Device.

Attach a policy profile to a WLAN interface (CLI)

Assign a policy profile to a WLAN interface to control traffic and services for that WLAN.

Procedure

1.

Create a policy tag.

Example:

Device(config)# wireless tag policy avc-tag
2.

Attach a policy profile to a WLAN profile.

Example:

Device(config-policy-tag)# wlan wlan_avc policy avc_pol

What to do next

  • Do not attach different AVC policy profiles to the same WLAN across different policy tags.

    This is an example of incorrect configuration:

    wireless profile policy avc_pol1
ipv4 flow monitor fm-avc1 input
ipv4 flow monitor fm-avc1 outputno shutdown
wireless profile policy avc_pol2
ipv4 flow monitor fm-avc2 input
ipv4 flow monitor fm-avc2 output
no shutdown
wireless tag policy avc-tag1
wlan wlan1 policy avc_pol1
wireless tag policy avc-tag2
wlan wlan1 policy avc_pol2

    This example violates the restriction stated earlier, that is, the WLAN wlan1 is mapped to 2 policy profiles, avc_pol1 and avc_pol2. This configuration is incorrect because the WLAN wlan1 must be mapped to either avc_pol1 or avc_pol2 throughout the configuration..

  • Conflicting policy profiles on the same WLAN are not supported. For example, policy profile (with and without AVC) applied to the same WLAN in different policy tags.

    This is an example of an incorrect configuration:

    wireless profile policy avc_pol1
no shutdown
wireless profile policy avc_pol2
ipv4 flow monitor fm-avc2 input
ipv4 flow monitor fm-avc2 output
no shutdown
wireless tag policy avc-tag1
wlan wlan1 policy avc_pol1
wireless tag policy avc-tag2
wlan wlan1 policy avc_pol2

    In this example, a policy profile with and without AVC is applied to the same WLAN in different tags.

  • Run the no shutdown command on the WLAN after completing the configuration.

  • If the WLAN is already in no shutdown mode, run the shutdown command, then run the no shutdown command.

Attach a policy profile to an AP (CLI)

Assign a specific policy profile to an AP through commands.

Procedure

1.

Enter AP configuration mode.

Example:

Device(config)# ap ap-ether-mac 34a8.2ec7.4cf0
2.

Specify the policy tag that is to be attached to the AP.

Example:

Device(config)# policy-tag avc-tag

Verify the AVC configuration (CLI)

Review and validate the Application Visibility and Control (AVC) configuration on a device.

Procedure

1.

Display information about the top applications and the users who use them.

Example:

Device# show avc wlan wlan_avc top 2 applications {aggregate | downstream | upstream}
Note

To collect accurate statistics, ensure that wireless clients are connected to the WLAN and transmitting data. After 90 seconds, run the command.
2.

Display information about the top applications for the client.

Example:

Device# show avc client 9.3.4 top 3 applications {aggregate | downstream | upstream}
Note

Ensure that wireless clients are connected to the WLAN and transmitting data. Wait 90 seconds for statistics to become available, then run the command.
3.

Display information about the top applications and the users who uses them.

Example:

Device# show avc wlan wlan_avc application app top 4 aggregate
4.

Display a summary of all the APs attached to the controller .

Example:

Device# show ap summary
5.

Display a summary of all the APs with policy tags.

Example:

Device# show ap tag summary