Configure AP as WGB | Workgroup Bridges | Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Guides configuration of access points as Workgroup Bridges, including tasks to enter autonomous mode, set up Wave 2 APs, configure SSID and EAP profiles, authentication servers, 802.1X credentials, certificate enrollment, radio interface, timeouts, and bridge forwarding using CLI commands.

Configure Cisco Wave 2 APs or 11AX APs in WGB or CAPWAP AP mode (CLI)

Set up the AP mode and management configuration for Cisco APs using the CLI.

This task is applicable when you need to quickly reconfigure the AP operation mode between Workgroup Bridge and CAPWAP using the AP's command-line interface.

Procedure

	1.	Enter the privileged mode of the AP. Example: `Device> enable`
	2.	Move the AP in to the Workgroup Bridge mode. Example: `Device# ap-type workgroup-bridge`
	3.	Configure DHCP or static IP address using the configure ap address ipv4 dhcp or configure ap address ipv4 static ip-address netmask gateway-ipaddress command. Example: DHCP IP Address `Device# configure ap address ipv4 dhcp` Static IP Address `Device# configure ap address ipv4 static 10.10.10.2 255.255.255.234 192.168.4.1`
	4.	Configure an username for the AP management. Example: `Device# configure ap management add username username password password secret secret`
	5.	Configure the AP hostname. Example: `Device# configure ap hostname host-name`

The AP is successfully configured in the selected mode with the desired network and management settings.

Configure an SSID profile for Cisco Wave 2 and 11AX APs (CLI)

Set up secure Wi-Fi profiles for Wave 2 and 11AX APs, allowing client authentication and traffic management using the AP CLI.

This configuration is performed on the AP console and does not apply to the controller CLI. Choose authentication and QoS settings best suited for your environment.

Before you begin

Ensure you have access to the AP console and any preshared keys or EAP profiles needed for authentication.

Procedure

	1.	Create an SSID profile and specify authentication (open, PSK, or EAP) and key management options. Example: SSID profile with open authentication: `Device# configure ssid-profile test WRT s1 authentication open` SSID profile with PSK authentication: `Device# configure ssid-profile test WRT s1 authentication psk 1234 key-management dot11r` SSID profile with EAP authentication: `Device# configure ssid-profile test WRT s1 authentication eap profile test2 key-management dot11r` Choose the authentication protocol that matches your deployment requirements.
	2.	Attach the SSID profile to a radio interface. Example: `Device# configure dot11radio radio-interface mode wgb ssid-profile profle-name` Binds the SSID profile for wireless bridge operations.
	3.	(Optional) Configure the DTIM period for the SSID profile. Example: `Device# configure ssid-profile profile-name ssid ssid-name dtim-period ssid-name` Sets the delivery traffic indication message interval for broadcast/multicast traffic. Note Supported for wireless clients from Cisco IOS XE Cupertino 17.9.1 onwards.
	4.	(Optional) Create a QoS profile. Example: `Device# configure qos profile qos-profile gold` Gold, silver, platinum, and bronze options are available to prioritize traffic.
	5.	(Optional) Map the QoS profile to the SSID profile. Example: `Device# configure ssid-profile profile-name ssid ssid-name qos profile qos-profile-name` Enables traffic prioritization for the specified SSID profile. Note Supported for wireless clients from Cisco IOS XE Cupertino 17.9.1 onwards.
	6.	(Optional) Delete an SSID profile. Example: `Device# configure ssid-profile profile-name delete`
	7.	(Optional) Display summary of configured and connected SSIDs. Example: `Device# show wgb ssid`
	8.	(Optional) Display management, control, and data packet statistics for WGB SSIDs. Example: `Device# show wgb packet statistics`

The SSID profile is configured for the AP and mapped to the desired radio interface. Wireless clients can now connect using the specified authentication mode, traffic is prioritized according to QoS settings, and you can monitor SSID and packet statistics as needed.

Configure the authentication server (CLI)

Set up a primary or secondary RADIUS authentication server for network access control using CLI.

RADIUS servers provide centralized authentication, authorization, and accounting (AAA) management for users connecting to the network.

Before you begin

Ensure you have the IP address, port number, and shared secret for the RADIUS server you are configuring.

Procedure

Configure a RADIUS authentication server with a primary or secondary role, IP version (IPv4 or IPv6), port, server address, and shared secret.

Example:


Device# configure radius authentication primary | secondary add ipv4|ipv6 address radius-server-ip-address port radius-server-port-number secret radius-secret


Device# configure radius authentication primary add ipv4 address 192.168.1.2 port 1812 secret Cisco123

primary | secondary: specifies if the RADIUS server is primary or secondary.
ipv4 | ipv6: identifies the IP address type.
radius-server-ip-address: is the management IP address of the RADIUS server.
radius-server-port-number: is typically 1812 for authentication.
radius-secret: is a shared secret between the device and the RADIUS server (case-sensitive).

The RADIUS authentication server is now configured. The device can authenticate users against the designated server.

Configure dot1X credential (CLI)

Configure or remove a Dot1X credential profile, and manage WGB client authentication using CLI commands.

Dot1X credentials are used to authenticate devices securely to the network. You can create or remove these credentials as required, and clear authenticated Workgroup Bridge (WGB) clients using dedicated commands.

Before you begin

Ensure the device is in global configuration mode before issuing these commands.

Procedure

	1.	Configure a dot1X credential profile with username and password. Example: `Device(config)# configure dot1x credential profile-name username username password password`
	2.	Delete a dot1X credential profile. Example: `Device(config)# configure dot1x credential profile-name delete`
	3.	Deauthenticate a WGB client by clearing a WGB client session based on MAC address or clear all WGB clients. Example: `Device# clear wgb client single mac-address` To clear all WGB clients, use: `Device# clear wgb client all`

Dot1X credentials and WGB client sessions are managed according to your chosen operations.

Configure an EAP profile (CLI)

Use this procedure to create, manage, or delete EAP profiles on your device for authentication using the CLI.

An EAP profile defines the authentication method for wireless users. You can configure various methods and associate Trustpoints or credentials to strengthen security for wireless authentication.

Before you begin

Enable global configuration mode on the device and verify access to CLI.

Procedure

	1.	Configure an EAP profile and set the EAP method. Example: `Device# configure eap-profile profile-name method method-name` Configures an EAP profile with the chosen method. The method-name can be: fast leap peap tls
	2.	Associate a Trustpoint with the EAP profile. Use either the default or a specific name. Example: EAP profile to Trustpoint with MIC Certificate: `Device# configure eap-profile profile-name trustpoint default` EAP profile to Trustpoint with CA Certificate: `Device# configure eap-profile profile-name trustpoint name trustpoint-name` Configures an EAP profile with a Trustpoint for authentication.
	3.	Attach a CA Trustpoint to the EAP profile. Example: `Device# configure eap-profile profile-name trustpoint {default \| name trustpoint-name}` Attaches the CA Trustpoint. Note With the default profile, WGB uses the internal MIC certificate for authentication.
	4.	Configure the 802.1X credential profile for the EAP profile. Example: `Device# configure eap-profile profile-name dot1x-credential profile-name` Configures the 802.1X credential profile associated with the EAP profile.
	5.	(Optional) Delete an EAP profile. Example: `Device# configure eap-profile profile-name delete`
	6.	(Optional) Display the WGB EAP dot1x credential profile summary. Example: `Device# show wgb eap dot1x credential profile`
	7.	(Optional) Display the EAP profile summary. Example: `Device# show wgb eap profile`
	8.	(Optional) Display all configured EAP and dot1x profiles. Example: `Device# show wgb eap profile all`

The EAP profile is now configured as required. You can display or modify EAP profiles as needed to support different authentication strategies.

Configure manual-enrollment of a Trustpoint for WGB (CLI)

Manually configure and enroll a Trustpoint on a WGB to enable certificate-based security authentication via CLI.

A Trustpoint defines a Certification Authority (CA) used to issue certificates for device authentication. Manual enrollment is used when automatic enrollment via HTTP/SCEP is not available.

Before you begin

Ensure that the WGB configuration is complete and the required CA certificate is accessible. You must have administrator access to the CLI and all necessary server and certificate information.

Procedure

	1.	Configure a Trustpoint on the WGB and set the enrollment method to terminal. Example: `Device# configure crypto pki trustpoint ca-server-name enrollment terminal` Defines a new Trustpoint and specifies that certificate content will be entered manually.
	2.	Authenticate the Trustpoint and input the base 64 encoded CA certificate. Example: `Device# configure crypto pki trustpoint ca-server-name authenticate` Authenticates a Trustpoint by pasting the CA-signed certificate. End certificate input by typing quit on a new line.
	3.	Configure the private key size for the Trustpoint. Example: `Device# configure crypto pki trustpoint ca-server-name key-size key-length` Sets the RSA key pair length for the Trustpoint’s private key.
	4.	Configure the subject name attributes for the Trustpoint’s certificate. Example: `Device# configure crypto pki trustpoint ca-server-name subject-name name 2ltr-country-code state-name locality org-name org-unit email` Example: `Device# configure crypto pki trustpoint ca-server-US subject-name test US CA abc cisco AP test@cisco.com` Specifies certificate subject fields, matching your organization’s naming policy.
	5.	Generate a Certificate Signing Request (CSR) on the WGB and enroll the Trustpoint. Example: `Device# configure crypto pki trustpoint ca-server-name enroll` Generates the private key and a CSR; provide the CSR output to your CA server for certificate signing.
	6.	Import the signed certificate from the CA back into the WGB Trustpoint. Example: `Device# configure crypto pki trustpoint ca-server-name import certificate` Installs the issued device certificate. End certificate input with the quit command on a new line.
	7.	(Optional) Delete the Trustpoint if reconfiguration is needed. Example: `Device# configure crypto pki trustpoint ca-server-name delete` Removes a Trustpoint configuration from the device.
	8.	(Optional) Display the Trustpoint summary. Example: `Device# show crypto pki trustpoint` Shows all Trustpoints configured on the device.
	9.	(Optional) Display certificates associated with a Trustpoint. Example: `Device# show crypto pki trustpoint ca-server-name certificate` Inspect the contents of certificates for a specific Trustpoint.

Manual Trustpoint enrollment is now complete on the WGB. The device can use the certificates for secure authentication and establish connections as required for network operation.

Configure auto-enrollment of a Trustpoint for workgroup bridge (CLI)

Enable automatic certificate enrollment for secure communication by configuring a Trustpoint and CA enrollment in a WGB deployment.

Auto-enrollment of a Trustpoint streamlines certificate management for workgroup bridges by allowing automatic acquisition and renewal of CA certificates.

Before you begin

Ensure the device is running the appropriate WGB image and has connectivity to the CA server.

Procedure

	1.	Configure the Trustpoint and specify the CA server enrollment URL. Example: `Device# configure crypto pki trustpoint ca-server-name enrollment url ca-server-url` Enrolls a Trustpoint in WGB using the CA server URL.
	2.	Authenticate the Trustpoint by fetching the CA certificate from the CA server. Example: `Device# configure crypto pki trustpoint ca-server-name authenticate` Fetches the CA certificate for Trustpoint authentication.
	3.	Set the private key size for the Trustpoint. Example: `Device# configure crypto pki trustpoint ca-server-name key-size key-length` Example: `Device# configure crypto pki trustpoint ca-server-Us key-size 60`
	4.	Configure the subject name for the trustpoint. Example: `Device# configure crypto pki trustpoint ca-server-name subject-name name 2ltr-country-code state-name locality org-name org-unit email` Example: `Device# configure crypto pki trustpoint ca-server-US subject-name test US CA abc cisco AP test@cisco.com` Customize the subject name parameters as needed for your deployment.
	5.	Enroll the Trustpoint to request a signed certificate from the CA server. Example: `Device# configure crypto pki trustpoint ca-server-name enroll` Initiates the certificate enrollment request to the CA server.
	6.	Enable auto-enrollment and specify the renewal percentage threshold. Example: `Device# configure crypto pki trustpoint ca-server-name auto-enroll enable renew-percentage` Example: `Device# configure crypto pki trustpoint ca-server-US auto-enroll enable 10` Use disable to turn off auto-enroll if needed.
	7.	(Optional) Delete the Trustpoint if it is no longer required. Example: `Device# configure crypto pki trustpoint ca-server-name delete` Removes the Trustpoint from the configuration.
	8.	(Optional) Display the summary of Trustpoints. Example: `Device# show crypto pki trustpoint` Lists all configured Trustpoints and their status.
	9.	(Optional) Display the certificate for a specific Trustpoint. Example: `Device# show crypto pki trustpoint ca-server-name certificate` Shows the certificate configured for the specified Trustpoint.
	10.	(Optional) Display the PKI timer information. Example: `Device# show crypto pki timers` Displays timer settings related to PKI operations.

The Trustpoint is now auto-enrolled and managed on the WGB, ensuring secure and automated certificate renewal.

Configure manual certificate enrollment using TFTP server (CLI)

Manual certificate enrolment allows devices to obtain certificates from a TFTP server, which is essential for secure communications.

Procedure

	1.	Specify the enrollment method to retrieve the CA certificate and client certificate for a Trustpoint in WGB. Example: `Device# configure crypto pki trustpoint ca-server-name enrollment addr/file-name`
	2.	Authenticate the CA certificate from the specified TFTP server. Example: `Device# configure crypto pki trustpoint ca-server-name authenticate` Retrieves the CA certificate and authenticates it from the specified TFTP server. If the file specification is included, the WGB will append the extension “.ca” to the specified filename.
	3.	Configure the private key size for the Trustpoint. Example: `Device# configure crypto pki trustpoint ca-server-name key-size key-length`
	4.	Set the subject name for the Trustpoint. Example: `Device# configure crypto pki trustpoint ca-server-name subject-name test US CA abc cisco AP test@cisco.com`
	5.	Generate a private key and certificate signing request (CSR). Example: `Device# configure crypto pki trustpoint ca-server-name enroll` Generate a private key and Certificate Signing Request (CSR) and write the request out to the TFTP server. The filename to be written is appended with the extension “.req”.
	6.	Import the signed certificate into WGB using TFTP at the console terminal, which retrieves the granted certificate. Example: `Device# configure crypto pki trustpoint ca-server-name import certificate` The WGB will attempt to retrieve the granted certificate using TFTP using the same filename and the file name appended with “.crt” extension.
	7.	(Optional) Display the Trustpoint summary. Example: `Device# show crypto pki trustpoint`
	8.	(Optional) Display the content of the certificates that are created for a Trustpoint. Example: `Device# show crypto pki trustpoint trustpoint-name certificate`

Import the PKCS12 format certificates from the TFTP server (CLI)

Importing PKCS12 format certificates is essential for establishing secure communications in network devices.

Procedure

Import the PKCS12 format certificate from the TFTP server.

Example:

Device# configure crypto pki trustpoint ca-server-name import pkcs12 tftp addr/file-name password pwd

Example:

Device# configure crypto pki trustpoint ca-server-US import pkcs12 tftp://10.8.0.6/all_cert.p12 password ******

(Optional) Display the Trustpoint summary.

Example:

Device# show crypto pki trustpoint

(Optional) Display the content of the certificates created for a Trustpoint.

Example:

Device# show crypto pki trustpoint trustpoint-name certificate

Example:

Device# show crypto pki trustpoint ca-server-US certificate

Configure radio interface for workgroup bridges (CLI)

From the available two radio interfaces, before configuring WGB or UWGB mode on one radio interface, configure the other radio interface to root AP mode.

Procedure

	1.	Configure a radio interface as root AP. Example: `Device# configure dot11Radio radio-int mode root-ap` Example: `Device# configure dot11Radio 0/3/0 mode root-ap` Maps a radio interface as root AP. Note When an active SSID or EAP profile is modified, you need to reassociate the profile to the radio interface for the updated profile to be active.
	2.	Configure the WLAN at the root AP mode radio. Example: `Device# configure dot11radio value wlan add ssid-profile-name ssid-number` Example: `Device# configure dot11radio dotradiovalue wlan add ssid-profile-name ssid-number` Enter the SSID profile name and SSID number between 1 and 16. Value can be 0 or 1.
	3.	Delete WLAN from the radio configuration. Example: `Device# configure dot11radio dotradiovalue wlan delete ssid-profile-name` Enter the SSID profile name. Value can be 0 or 1.
	4.	Configure a radio channel to broadcast the SSID. Example: `Device# configure dot11radio value channel channel-number width` Example: `Device# configure dot11radio value channel channel-number width` The channel numbers are between 1 and 173. The channel width values are 20, 40, 80, and 160. Note Only 20MHz channel width is supported on radio 0 (2.4-GHz band). If radar is detected on a configured channel on radio 1, then the channel automatically changes to a non-DFS channel with a channel width of 20MHz. The administrator must reset the radio to bring it back to the configured channel.
	5.	Configure the periodic beacon interval in milliseconds. Example: `Device# configure dot11radio dotradiovalue beacon-period beacon-interval` The value range is from 2 to 2000 milliseconds.
	6.	Map a radio interface to a WGB SSID profile. Example: `Device# configure dot11Radio 0/3/0 mode wgb ssid-profile ssid-profile-name`
	7.	Map a radio interface to a UWGB SSID profile. Example: `Device# configure dot11Radio radio-int mode uwgb mac-addr ssid-profile ssid-profile-name`
	8.	Configure a radio interface. Example: `Device# configure dot11Radio radio-int mode enable` After configuring the uplink to the SSID profile, we recommend that you disable and enable the radio for the changes to be active.
	9.	Configure a radio antenna. Example: `Device# configure dot11Radio radio-int antenna a-antenna`
	10.	Configure the radio interface encryption mode. Example: `Device# configure dot11Radio radio-int encryption mode ciphers aes-ccm`
	11.	Configure the device channel rate. Example: `Device# configure wgb mobile rate basic 6 9 18 24 36 48 54`
	12.	Configure the threshold duration and signal strength to trigger scanning. Example: `Device# configure wgb mobile period seconds thres-signal`
	13.	Configure the static roaming channel. Example: `Device# configure wgb mobile station interface dot11Radio 0/3/0 scan channel-number add`
	14.	(Optional) Delete the mobile channel. Example: `Device# configure wgb mobile station interface dot11Radio 0/3/0 scan channel-number delete`
	15.	(Optional) Disable the mobile channel. Example: `Device# configure wgb mobile station interface dot11Radio 0/3/0 scan disable`
	16.	(Optional) Configure the beacon miss-count. Example: `Device# configure wgb beacon miss-count value` Note When you set the beacon miss-count value to 10 or lower, then the beacon miss-count gets disabled. Set the value to 11 or higher to enable this function.
	17.	(Optional) Display the Wi-Fi station statistics. Example: `Device# show wgb wifi wifi-interface stats`
	18.	(Optional) Display the radio antenna statistics. Example: `Device# show controllers dot11Radio radio-interface antenna`
	19.	(Optional) Display the mobile station channels scan configuration. Example: `Device# show wgb mobile scan channel`
	20.	(Optional) Display the configuration that is stored in the NV memory. Example: `Device# show configuration`
	21.	(Optional) Display the running configuration in the device. Example: `Device# show running-config`

Configure workgroup bridge timeouts (CLI)

Use this task to configure various timeout values that control workgroup bridge (WGB) behavior, improving reliability and performance.

Set specific timeout limits for association, authentication, EAP, DHCP response, and channel scan processes.

Timeout values affect how long the WGB waits for events before triggering corrective actions or failure notices.

This task applies to Cisco devices in environments where precise timeout management is needed for workgroup bridge operations and troubleshooting.

Before you begin

Ensure you have privileged EXEC access on the device.

Verify device compatibility and active WGB configuration.

Procedure

	1.	Configure the WGB association response timeout. Example: `Device# configure wgb association response timeout response-millisecs` The valid range is 300 to 5000 milliseconds. The default value is 5000 milliseconds.
	2.	Configure the WGB authentication response timeout. Example: `Device# configure wgb authentication response timeout response-millisecs` The valid range is 300 to 5000 milliseconds. The default value is 5000 milliseconds.
	3.	Configure the Universal WGB client response timeout. Example: `Device# configure wgb uclient timeout timeout-secs` The valid range is 1 to 65535 seconds. The default value is 60 seconds.
	4.	Configure the WGB EAP timeout. Example: `Device# configure wgb eap timeout timeout-secs` The valid range is 2 to 60 seconds. The default value is 3 seconds.
	5.	Configure the WGB channel scan timeout. Example: `Device# configure wgb channel scan timeout {fast \| slow \| medium}` Select scan speed according to site requirements.
	6.	Configure the WGB DHCP response timeout. Example: `Device# configure wgb dhcp response timeout timeout-secs` The valid range is 1000 to 60000 milliseconds. The default value is 60 seconds.
	7.	Display the WGB association summary. Example: `Device# show wgb dot11 association` Display associated WGB clients and related statistics.

The configured timeout parameters apply immediately and affect how the WGB responds to events and failures.

For example, to set the WGB association response timeout to 4000 milliseconds:

Device# configure wgb association response timeout 4000

What to do next

Verify timeout settings by using display commands and monitoring WGB behavior.

Adjust timeouts as needed for specific network or client stability.

Configure bridge forwarding for workgroup bridge (CLI)

Before you begin

The Cisco Wave 2 and 11AX APs as Workgroup Bridge recognizes the Ethernet clients only when the traffic has the bridging tag.

We recommend setting the WGB bridge client timeout value to default value of 300 seconds, or less in environment where change is expected, such as:

Ethernet cable is unplugged and plugged back.
Endpoint is changed.
Endpoint IP is changed (static to DHCP and vice versa).

If you need to retain the client entry in the WGB table for a longer duration, we recommend you increase the client WGB bridge timeout duration.

Procedure

	1.	Add a WGB client using the MAC address. Example: `Device# configure wgb bridge client add mac-address` Example: `Device# configure wgb bridge client add F866.F267.7DFB`
	2.	Configure the WGB bridge client timeout. Default timeout value is 300 seconds. The valid range is from 10 to 1000000 seconds. Example: `Device# configure wgb bridge client timeout timeout-secs` Example: `Device# configure wgb bridge client timeout 400`
	3.	Display the WGB wired clients over the bridge. Example: `Device# show wgb bridge`
	4.	Display the WGB Gigabit wired clients over the bridge. Example: `Device# show wgb bridge wired gigabitEthernet interface` Example: `Device# show wgb bridge wired gigabitEthernet 0/1`
	5.	Display the WGB bridge radio interface summary. Example: `Device# show wgb bridge dot11Radio interface-number` Example: `Device# show wgb bridge dot11Radio 0/3/1`