Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Denial of wireless client session establishment

Updated: April 10, 2026

Want to summarize with AI?

Describes a controller feature that stops client session establishment based on scheduled time periods to enable controlled network management without manual intervention.

Denial of wireless client session establishment is a controller feature that

allows the controller to stop client session establishment based on a particular time
helps control the network in efficient and controlled manner without any manual intervention, and
supports daily, weekly, and monthly recurrence schedules through calendar profiles mapped to policy profiles.

Supported recurrence types

In Cisco Catalyst 9800 Series Wireless Controller , you can deny the wireless client session based on these recurrences:

Daily
Weekly
Monthly

The Calendar Profiles created are then mapped to the policy profile. By attaching the calendar profile to a policy profile, you will be able to create different recurrences for the policy profile using different policy tag.

Note

You need to create separate Calendar Profile for Daily, Weekly, and Monthly sub-categories.

The following is the workflow for denial of wireless client session establishment feature:

Create a calendar profile.

Apply the calendar profile to a policy profile.

Note

A maximum of 100 calendar profile configuration and 5 calendar profile association to policy profile is supported.

Configuration limits and timing considerations:

Feature activation: If you boot up your controller, the denial of client session establishment feature kicks in after a minute from the system boot up.
Time change adaptation: If you change the system time after the calendar profile is associated to a policy profile, you can expect a maximum of 30 second delay to adapt to the new clock timings.

Note

You cannot use the no action deny-client command to disable action while associating the calendar profile to a policy profile.

If you want to disable the action command, you need to disassociate the calendar profile from the policy profile, and re-configure again.

Guidelines and limitations

Configure daily calendar profile (CLI)

Set up a calendar profile that defines daily recurring time periods for wireless network operations and power management.

Calendar profiles allow you to schedule specific time periods for wireless operations, such as controlling when certain wireless features are active. Daily calendar profiles apply the same time schedule every day.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure a calendar profile. Example: `Device(config)# wireless profile calendar-profile name calendar-profile-name` Example: `Device(config)# wireless profile calendar-profile name daily_calendar_profile` The calendar-profile-name refers to the name of the calendar profile.
	3.	Configure start and end time for the calendar profile. Example: `Device(config-calendar-profile)# start start-time end end-time` Example: `Device(config-calendar-profile)# start 09:00:00 end 17:00:00` The start-time is the start time for the calendar profile. You need to enter start time in HH:MM:SS format. The end-time is the end time for the calendar profile. You need to enter end time in HH:MM:SS format.
	4.	Configure daily recurrences for the calendar profile. Example: `Device(config-calendar-profile)# recurrence daily`
	5.	Return to privileged EXEC mode. Example: `Device(config-calendar-profile)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode. Note When the calendar profile kicks in, the AP power profile rules (for example, radio state and USB device state) that are defined for the Ethernet speed are not applied and continue to be as per the fixed power profile.

The daily calendar profile is configured and will apply the specified time schedule every day for wireless operations.

Configure weekly calendar profile (CLI)

Create a weekly calendar profile that defines recurring time windows for scheduled network operations or policies.

Calendar profiles allow network administrators to schedule when certain policies or operations should be active. A weekly calendar profile provides recurring time windows that repeat on specified days of the week, enabling automated time-based network management.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure a calendar profile. Example: `Device(config)# wireless profile calendar-profile name name` Example: `Device(config)# wireless profile calendar-profile name weekly_calendar_profile` The name refers to the name of the calendar profile.
	3.	Configure start and end time for the calendar profile. Example: `Device(config-calendar-profile)# start start-time end end-time` Example: `Device(config-calendar-profile)# start 18:00:00 end 19:00:00` The start-time is the start time for the calendar profile in HH:MM:SS format. The end-time is the end time for the calendar profile in HH:MM:SS format.
	4.	Configure weekly recurrences for the calendar profile. Example: `Device(config-calendar-profile)# recurrence weekly`
	5.	Configure days when the weekly calendar needs to be active. Example: `Device(config-calendar-profile)# day {friday \| monday \| saturday \| sunday \| thursday \| tuesday \| wednesday}` Example: `Device(config-calendar-profile)# day friday Device(config-calendar-profile)# day monday` Note You can configure multiple days using this command.
	6.	Return to privileged EXEC mode. Example: `Device(config-calendar-profile)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The weekly calendar profile is now configured and can be applied to network policies that require time-based scheduling and recurring weekly activation windows.

Configure monthly calendar profile (CLI)

Create a monthly calendar profile to schedule recurring network operations or denial of service events on specific dates each month.

Monthly calendar profiles enable you to define time-based policies that recur on specific dates within a month. This is useful for scheduled maintenance windows or automated network policy enforcement.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure a calendar profile. Example: `Device(config)# wireless profile calendar-profile name profile-name` Example: `Device(config)# wireless profile calendar-profile name monthly_calendar_profile` The profile-name refers to the name of the calendar profile.
	3.	Configure start and end time for the calendar profile. Example: `Device(config-calendar-profile)# start start-time end end-time` Example: `Device(config-calendar-profile)# start 18:00:00 end 19:00:00` The start-time is the start time for the calendar profile. You need to enter start time in HH:MM:SS format. The end-time is the end time for the calendar profile. You need to enter end time in HH:MM:SS format.
	4.	Configure monthly recurrences for the calendar profile. Example: `Device(config-calendar-profile)# recurrence monthly`
	5.	Configure a date for the calendar profile. Example: `Device(config-calendar-profile)# date date-value` Example: `Device(config-calendar-profile)# date 25` Note If the requirement is to perform denial of service in certain timing, such as, 2,10, and 25 of every month, all three days need to be configured using the date command. There is no range for date. You need to configure the dates as per your requirement.
	6.	Return to privileged EXEC mode. Example: `Device(config-calendar-profile)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The monthly calendar profile is configured and can be applied to schedule recurring network operations on the specified dates and times each month.

Map daily calendar profile to policy profile (CLI)

Enable time-based access control by associating a calendar profile with a policy profile to manage client session establishment during specific time intervals.

Calendar profiles define time-based restrictions that can be applied to policy profiles. When mapped together, they allow administrators to automatically deny or allow client connections based on scheduled time slots, providing granular control over network access.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Create policy profile for the WLAN. Example: `Device(config)# wireless profile policy profile-name` Example: `Device(config)# wireless profile policy default-policy-profile` The profile-name is the profile name of the policy profile.
	3.	Map a calendar profile to a policy profile. Example: `Device(config-wireless-policy)# calender-profile name calendar-profile-name` Example: `Device(config-wireless-policy)# calender-profile name daily_calendar_profile` The calendar-profile-name is the name of the calendar profile name created in the daily calendar profile configuration task. Note You need to disable Policy Profile before associating a calendar profile to a policy profile. Run this command: `Device(config-wireless-policy)# shutdown`
	4.	Configure deny client session establishment during calendar profile interval. Example: `Device(config-policy-profile-calender)# action deny-client` Note Client associations are denied daily between timeslot 9:00:00 to 17:00:00. For start and end time details, see the daily calendar profile configuration task.
	5.	Return to privileged EXEC mode. Example: `Device(config-policy-profile-calender)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The daily calendar profile is successfully mapped to the policy profile, enabling time-based client access control according to the configured schedule.

Map weekly calendar profile to policy profile (CLI)

Control wireless client access by mapping time-based calendar profiles to policy profiles, enabling scheduled denial of client sessions.

Weekly calendar profiles allow administrators to define specific time periods when client associations should be denied. This configuration is useful for implementing access control policies based on business hours or maintenance windows.

Before you begin

Ensure that a weekly calendar profile has been created before mapping it to a policy profile.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Create or enter the policy profile configuration mode. Example: `Device(config)# wireless profile policy profile-name` Example: `Device(config)# wireless profile policy default-policy-profile`
	3.	Map a calendar profile to the policy profile. Example: `Device(config-wireless-policy)# calender-profile name calendar-profile-name` Example: `Device(config-wireless-policy)# calender-profile name weekly_calendar_profile` Note You need to disable Policy Profile before associating a calendar profile to a policy profile. Use this command: `Device(config-wireless-policy)# shutdown`
	4.	Configure the action to deny client session establishment during calendar profile intervals. Example: `Device(config-policy-profile-calender)# action deny-client` Note Client associations are denied daily between timeslot 9:00:00 to 17:00:00. For start and end time details, see the weekly calendar profile configuration task. On Monday and Tuesday, clients are denied between 17:30:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00. On 25th of every month, clients are denied between 18:00:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.
	5.	Exit to privileged EXEC mode. Example: `Device(config-policy-profile-calender)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The weekly calendar profile is now mapped to the policy profile, and client session establishment will be denied during the configured time periods defined in the calendar profile.

Map monthly calendar profile to policy profile (CLI)

Control client session establishment by mapping calendar-based time restrictions to wireless policy profiles.

Monthly calendar profiles define time-based access restrictions that can be applied to wireless policy profiles. This allows administrators to automatically deny client associations during specified time periods based on daily, weekly, or monthly schedules.

Before you begin

A monthly calendar profile must be created before it can be mapped to a policy profile.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Create or enter policy profile configuration mode. Example: `Device(config)# wireless profile policy profile-name` Example: `Device(config)# wireless profile policy default-policy-profile` The profile-name is the profile name of the policy profile.
	3.	Map a calendar profile to the policy profile. Example: `Device(config-wireless-policy)# calender-profile name calendar-profile-name` Example: `Device(config-wireless-policy)# calender-profile name monthly_calendar_profile` The calendar-profile-name is the name of the calendar profile name created in the monthly calendar profile configuration task.
	4.	Configure deny client action for the calendar profile interval. Example: `Device(config-policy-profile-calender)# action deny-client` Note Every day client associations are denied between timeslot 9:00:00 to 17:00:00. For start and end time details, see the monthly calendar profile configuration task. On Monday and Tuesday, clients are denied between 17:30:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00. On 25th of every month, clients are denied between 18:00:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.
	5.	Return to privileged EXEC mode. Example: `Device(config-policy-profile-calender)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The monthly calendar profile is now mapped to the policy profile and will automatically deny client sessions during the configured time intervals.

Verify calendar profile configuration

Verify calendar profile configuration using show commands to view profile summaries and detailed information for specific profiles.

To view the summary of calendar profiles, use this command:

Device# show wireless profile calendar-profile summary
Number of Calendar Profiles: 3

Profile-Name                       
---------------------------------
monthly_25_profile                 
weekly_mon_profile                 
daily_calendar_profile

To view the calendar profile details for a specific profile name, use this command:

Device# show wireless profile calendar-profile detailed daily_calendar_profile
Calendar profiles                          : daily_calendar_profile
------------------------------------------------------------------
Recurrence                                : DAILY
Start Time                                : 09:00:00
End Time                                  : 17:00:00

Verify policy profile configuration

Verify policy profile configuration using specific show commands to view detailed parameters and calendar profile information.

To view the detailed parameters for a specific policy profile, use this command:

Device# show wireless profile policy detailed default-policy-profile
Tunnel Profile
  Profile Name                      : Not Configured
Calendar Profile
  Profile Name                      : monthly_25_profile
  Wlan Enable                       : Not Configured
  Client Block                      : Client Block Configured
  ----------------------------------------------------
  Profile Name                      : weekly_mon_profile
  Wlan Enable                       : Not Configured
  Client Block                      : Client Block Configured
  ----------------------------------------------------
  Profile Name                      : daily_calendar_profile
  Wlan Enable                       : Not Configured
  Client Block                      : Client Block Configured
  ----------------------------------------------------
Fabric Profile
  Profile Name                      : Not Configured

To view the configured calendar profile information under policy profile, use this command:

Device# show wireless profile policy all
Tunnel Profile
Profile Name : Not Configured
Calendar Profile
Profile Name : daily_calendar_profile
Wlan Enable : Not Configured
Client Block : Client Block Configured
----------------------------------------------------
Profile Name : weekly_calendar_profile
Wlan Enable : Not Configured
Client Block : Client Block Configured
----------------------------------------------------
Fabric Profile
Profile Name : Not Configured

Note
The anchor priority is always displayed as local. Priorities can be assigned on the foreign controller.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Denial of wireless client session establishment

Supported recurrence types

Guidelines and limitations

Guidelines and limitations

Guidelines and limitations

Configure daily calendar profile (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configure weekly calendar profile (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Configure monthly calendar profile (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Map daily calendar profile to policy profile (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Map weekly calendar profile to policy profile (CLI)

Before you begin

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Map monthly calendar profile to policy profile (CLI)

Before you begin

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Verify calendar profile configuration

Verify policy profile configuration