Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

NTPS and BLE configuration

Updated: April 10, 2026

Want to summarize with AI?

Log in

Explains how NTP servers provide accurate time synchronization for network devices and ensure the operation of Cisco Hyperlocation services and describes how BLE configurations enable flexible beacon management for access points using per-AP profile and per-AP settings.

A network time protocol server is a network device that

  • provides authoritative time information to other devices on the network, and

  • enables accurate time synchronization across distributed systems and applications.

For Cisco Hyperlocation to work, synchronize the AP with accurate time. The controller sends NTP information to the AP to achieve this synchronization. The AP then uses the NTP server to synchronize its clock. Therefore, the AP needs connectivity to the NTP server.

APs can be geographically dispersed. Therefore, it is necessary to provide different NTP servers to different APs. Configure NTP server information for each AP profile. If you do not configure NTP information on the AP profile, the controller uses one of the global NTP peers in its configuration. If the controller acts as an NTP server, it uses its management IP address for synchronization. If the NTP server is unavailable, Cisco Hyperlocation is disabled.

Note

In scale setup, the NTP server should be configured on the respective AP profiles, so that the APs and CA servers used for LSC provisioning are time synchronized. If the NTP server is not configured, a few APs would fail in LSC provisioning.

Bluetooth Low Energy Configuration

The BLE configuration is split into two parts: per-AP profile and per AP. You can configure the BLE feature partially from the AP profile (by default, the AP profile BLE configuration is applied) and partially per AP (some or all the attributes are applied).

Table 1. BLE Configuration Details

Attribute

BLE Configuration Per AP Profile

BLE Configuration Per AP

Attributes with per-AP granularity (global for all the beacons)

  • Interval

  • Advertised transmission power

  • Interval

  • Advertised transmission power

Attributes with per-AP per0-beacon granularity

  • Transmission power

  • UUID

  • Status

  • Transmission power

  • UUID

  • Status

  • Major

  • Minor
Note

The default-ap-profile BLE configuration serves as the default BLE configuration because all APs join the default-ap-profile AP profile if the other profiles are removed.

For more information about Cisco Hyperlocation, see the following documents:

Best practices for NTP configuration

Follow these best practices when configuring NTP :

  • Configure multiple redundant NTP time sources to avoid reliance on a single server and improve reliability.

  • Use a loopback interface as the NTP source for consistency across device reboots and interface changes.

  • Enable NTP authentication to secure communications and prevent malicious time alterations.

  • Monitor NTP status and logs regularly; implement detection and alerting mechanisms using commands like show ntp status and show ntp associations.

  • Use the ntp panic-threshold-apply command to check the configuration sanity checks, which reject large clock changes and prevent network instability.

  • Address failure modes related to time-based authentication keychains by configuring overlapping key lifetimes to avoid routing disruptions.

  • Regularly monitor and validate NTP synchronization status with monitoring tools and SNMP traps.

  • Ensure operational practices include multiple NTP sources and configuration checks to prevent routing disruptions caused by time inaccuracies.

These practices help maintain accurate time synchronization, improve NTP security, and minimize the risk of network instability caused by incorrect time settings.

AP group NTP server

An AP group NTP server is a time synchronization mechanism that

  • ensures precise time alignment across all APs within an AP group to achieve location accuracy

  • reduces synchronization delays compared to using a WAN-based global NTP server, and

  • supports features that rely on accurate timing, such as Cisco Hyperlocation, BLE AoA, and Intelligent Capture.

If your controller and global NTP server are configured on the WAN, the APs may experience significant synchronization delays. These delays can reduce location accuracy.

When all APs in a group synchronize with the same NTP server, you can obtain accurate data for location calculations. Configure the NTP server locally for all APs in an AP group to improve synchronization among the APs.

Feature history

This table provides release and related information about the feature explained in this section.

This feature is also available in all the releases subsequent to the one in which they are introduced in, unless noted otherwise.

Table 2. Feature history for AP group NTP server

Feature Name

Release Information

Feature Description

AP group NTP server

Cisco IOS XE 17.6.1

From this release, the global NTP server configuration is replaced with per-AP-group NTP server configuration. Per-group NTP is now required for the Cisco Hyperlocation feature.

These commands are introduced:

  • ntpauth-key

  • timezonedelta

  • timezoneuse-controller

  • showap name ntp status

  • showap ntp status

  • showap timezone

Configure an AP group NTP server (CLI)

Set a Network Time Protocol (NTP) server for AP groups to ensure time synchronization.

Procedure

1.

Enter the global configuration mode.

Example:

Device# configure terminal
2.

Configure an AP profile and enter the AP profile configuration mode.

Example:

Device(config)# ap profile profile-name
3.

Set the IP address of the NTP server.

Example:

Device(config-ap-profile)# [no] ntp ip 9.0.0.4

The no form of this command removes the NTP server.
4.

Configure the NTP server per AP profile to support authentication.

Example:

Device(config-ap-profile)# [no] ntp auth-key index type type format format key encryption-type server-key

The no ntp auth-key command removes the NTP server from each AP profile.

Note

For an ASCII key, ensure that the length is fewer than 21 bytes. For a HEX key, the length must be fewer than 41 bytes and can use only numbers from 0–9 and characters a–f.

Configure AP timezone (CLI)

Set the correct timezone for APs to ensure accurate time-stamping and scheduling using commands.

Procedure

1.

Enter the global configuration mode.

Example:

Device# configure terminal
2.

Configure the AP profile and enter the AP profile configuration mode.

Example:

Device(config)# ap profile test
3.

Configure the timezone offset for AP.

Example:

Device(config-ap-profile)# timezone {use-controller | delta hour -12 | minute 2}

You can configure the AP timezone for each AP profile only. It is not possible to configure the timezone for individual APs.

To configure the timezone, you can either apply the current controller timezone or specify the time difference. By default, timezone is disabled.

BLE concurrent scanning and beaconing

A BLE concurrent scan and beacon feature is a wireless AP capability that

  • enables the BLE radio on an AP to scan for device signals and transmit beacons simultaneously

  • allows the radio to temporarily pause and return to scanning while sending beacon transmissions, and

  • supports seamless switching between scanning and beaconing operations to maximize BLE functionality.

To enable BLE concurrent scanning and beaconing, use Cisco Spaces and select Dual mode under Device Management > AP Beacon > Settings.

Note

If you use v-IBeacon, BLE concurrent scanning and beaconing is not supported. Supported advertisement profiles are iBeacon, Eddystone-URL, and Eddystone-UID.

Supported APs

This feature is supported only on:

  • Cisco Catalyst 9105AX APs.

  • Cisco Catalyst 9120AX APs.

  • Cisco Catalyst 9124AX APs.

  • Cisco Catalyst 9130AX APs.

  • Cisco Catalyst 9136AX APs.

  • Cisco Catalyst 916X APs.

Feature history

This table provides release and related information about the feature explained in this section.

This feature is also available in all the releases subsequent to the one in which they are introduced in, unless noted otherwise.

Table 3. Feature history for BLE concurrent scanning and beaconing

Feature Name

Release Information

Feature Description

BLE concurrent scanning and beaconing

Cisco IOS XE 17.9.1

From this release, BLE concurrent scanning and beaconing is supported on Cisco Catalyst Wi-Fi 6 APs in basic mode or Cisco IOx mode. The BLE radio on an AP can stop a scan for beacon transmission, and return to the scan after completing the beacon transmission.

Verify BLE concurrent scanning and beaconing

Use these commands to verify the status of concurrent scanning and beaconing.

To display the advertisement profile, scan counters, advertisement counters, and other information, enter this command from the AP console:

Device# show controllers IOTRadio ble 0 interface 
Active BLE host interface       : /dev/ttyiot0
BLE Radio Status                : Powered on
Device Status                   : Open
Device Mode                     : Native
Device resets                   : 4
Last Reset Reason               : Watchdog Timer Reset
Heart beat status               : On
                Scan Status : Enabled Active Transmit Profile : Eddystone URL
BLE MAC                         : 80:6F:B0:31:EF:74
Transmitted advertisement count
 since BLE enabled              : 0
Total scan records received     : 3617

To determine whether the transmit profile configuration was successfully pushed from Cisco Spaces to the AP, enter this command from the AP console:

Device# show controllers iOTRadio ble 0 broadcast
BLE Profile Config 
-------------------
                Active profile : Eddystone UID
Profile 0 (iBeacon)
UUID                     : 00000001023012120312032130012111
Interval (ms)            : 100
Power (dBm)              : 0
Advertised Power (dBm)   : -45
Minor                    : 29219
Major                    : 35826
TxPower byte             : 
Profile 1 (Eddystone UID)
Namespace (hex)          : 00000000000000000999
Instance-ID (hex)        : 000000000555
Profile 2 (Eddystone URL)
URL                      : 
Profile 3 (v-iBeacon)
v-iBeacon status         : Disabled
Chirping interval (ms)   : 100
Profile 4 (Custom Profile) 
Adv Data                 : 
00000000000000000000000000000000000000000000000000000000000000
Scan Data                : 
00000000000000000000000000000000000000000000000000000000000000
Simulator mode           : Disabled
Beacon-ID               Mac                             UUID Major Minor Status
        1 10:F9:20:FE:1D:8F 00000000000000000000000000000000     0     0      0
        2 10:F9:20:FE:1D:8E 00000000000000000000000000000000     0     0      0
        3 10:F9:20:FE:1D:8D 00000000000000000000000000000000     0     0      0
        4 10:F9:20:FE:1D:8C 00000000000000000000000000000000     0     0      0
        5 10:F9:20:FE:1D:8B 00000000000000000000000000000000     0     0      0
Beacon-ID Transmit power(dBm) Advertised power(dBm)
        1                 -21                  -256
        2                 -21                  -256
        3                 -21                  -256
        4                 -21                  -256
        5                 -21                  -256

To view the list of joined APs that support the BLE management feature, along with BLE details for each AP, enter this command from the controller:

Device# show ap ble summary 
AP Name AP Model   AP Ethernet MAC BLE       BLE    BLE mode      BLE MAC         BLE Profile     BLE Scan
                                   Interface Admin
                                   State     State
--------------------------------------------------------------------------------------------------------------------
AP794   C9130AXI-B 04eb.409e.xxxx  Open      Up     Base (Native) 806f.b031.xxxx  Eddystone URL   Enabled
AP50    C9130AXI-B 04eb.409e.xxxx  Close     Down   Base (Native) Unknown         Not Configured  Disabled
AP28    C9136I     687d.b45c.xxxx  Close     Down   Base (Native) Unknown         Not Configured  Disabled