Introduces Cisco Workgroup Bridges, describing key operational concepts, listing restrictions, and providing instructions for configuring Workgroup Bridge on WLAN as well as monitoring status for effective network integration.

A workgroup bridge (WGB) is an access point mode that

provides wireless connectivity to wired clients connected on its Ethernet port
connects a wired network to an existing wireless infrastructure through a single wireless segment, and
learns the MAC addresses of its wired clients and reports them to the wireless LAN controller (WLC) using IAPP messaging.

The WGB establishes a single wireless connection to the root access point (AP). The root AP treats the WGB as a wireless client, allowing the wired devices behind the WGB to access the wireless network seamlessly. Suppose you have a group of wired devices in a conference room with no Ethernet drop available. You can connect these devices to a WGB, which allows them to communicate over the enterprise wireless network as if they were wireless clients.

Starting from Cisco IOS XE Cupertino 17.8.1, WGB is supported on the following Cisco Catalyst 9100 Series Access Points.

Cisco Catalyst 9105
Cisco Catalyst 9115
Cisco Catalyst 9120

Starting from Cisco IOS XE Dublin 17.10.1, WGB is supported on the following Cisco Catalyst 9100 Series Access Points.

Cisco Catalyst 9124
Cisco Catalyst 9130

From Cisco IOS XE Cupertino 17.9.1 onwards, WGB supports one radio for uplink (backhaul) connectivity and another radio for serving wireless clients. This feature is supported on the Cisco 11AX APs such as Cisco Catalyst 9105 APs, Cisco Catalyst 9115 APs, Cisco Catalyst 9120 APs.

OPEN and PSK security (WPA2 Personal) based wireless clients can be associated to WGB independent of its uplink connectivity, but they will not be able to pass traffic unless WGB has uplink connectivity. Radius server must be configured and the WGB should have uplink connectivity for authentication of wireless clients to 802.1x security (WPA2 Enterprise) WLAN. Both IPv4 and IPv6 traffic forwarding is supported for wireless clients. Static IP and Passive Client support is enabled by default on these WLANs.

These features are supported for use with WGB:

Table 1. WGB Feature Matrix
Feature	Cisco Wave 2 APs	Cisco 11AX APs
802.11r	Supported	Supported
QOS	Supported	Supported
UWGB mode	Supported	Not supported
IGMP Snooping or Multicast	Supported	Supported
802.11w	Supported	Supported
PI support (without SNMP)	Not supported	Not supported
IPv6	Supported	Supported
VLAN	Supported	Supported
802.11i (WPAv2)	Supported	Supported
Broadcast tagging/replicate	Supported	Supported
Unified VLAN client	Supported	Supported
WGB client	Supported	Supported
802.1x – PEAP, EAP-FAST, EAP-TLS	Supported	Supported
NTP	Supported	Supported
Wired client support on all LAN ports	Supported in all Wired-0, 1 and LAN ports 1, 2, and 3	Supported in all Wired-0, 1 and LAN ports 1, 2, and 3
Second radio wireless client support	Not supported	Supported

This table shows the supported and unsupported authentication and switching modes for Cisco APs when connecting to a WGB.

Note

Workgroup Bridge mode is supported on the WiFi6 Pluggable Module from Cisco IOS XE Bengaluru 17.6.1.

Table 2. Supported Access Points and Requirements
Access Points	Requirements
Cisco Aironet 2800, 3800, 4800, 1562, and Cisco Catalyst 9105, 9115, 9120, 9124, and 9130, IW6300 and ESW6300 Series	CAPWAP image starting from Cisco AireOS 8.8 release.

Restrictions for WGB

These are the restrictions for WGB:

Cisco Wave 2 and 802.11ax APs operating in WGB mode can connect only to a Cisco root APs with Aironet IE/CCX enabled on the WLAN. WGB connectivity to a non-Cisco root access point is not supported in this mode.

For non-Cisco root AP connectivity, use uWGB mode where applicable. However, uWGB mode supports only one wired client behind the WGB.
MAC filtering is not supported for wired clients.
Idle timeout is not supported for both WGB and wired clients.
Session timeout is not applicable for wired clients.
Web authentication is not supported.
The total number of clients supported by WGB (wired + wireless) is limited to 20 clients.
If you want to use a chain of certificates, copy all the CA certificates to a file and install it under a trust point on the WGB, else server certificate validation may fail.
Wired clients connected to a WGB inherit the WGB's QoS and AAA override attributes.
To enable the WGB to communicate with the root AP, create a WLAN and make sure that Aironet IE is enabled under the Advanced settings.
WPA2 Enterprise security works only if the uplink WLAN is enabled for FlexConnect local switching or Fabric enabled WLAN.
Radius override is not supported for wireless clients that are associated with WGB WLANs.
WGB does not support 802.1X wired client authentication when used with power injector.

The power-injector drops all EAPOL packets received from the wired client and does not forward it to the WGB's wired0 interface. In such cases, use PoE plus hub behind the wired0 interface and connect the wired clients to the hub.
After WGB reload, the WGB 802.1X wired clients behind a hub do not trigger authentication automatically, unless done manually.

After WGB is reloaded the WGB dot1x wired clients which are behind a hub remain authenticated or connected on their side and do not get notified that the WGB is reloaded. Clients are also not shown on the WGB bridge table. The client interfaces must be manually disabled and enabled back to trigger authentication.
When the 802.1X wired client Ethernet interface is disabled and then enabled again, client authentication might fail for some of dot1x wired clients, at times.

Configure a WGB on a WLAN (CLI)

Deploy a WGB so that connected wired devices can access the network via WLAN.

WGBs allow wired devices to join a wireless network by bridging their wired connections over Wi-Fi. This configuration is used in environments where direct wireless capability is not available for all devices.

Before you begin

Ensure WLAN security (such as authentication and encryption) is already configured.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Enter WLAN configuration submode. Example: `Device(config)# wlan profile-name` The profile-name is the profile name of the configured WLAN.
	3.	Configure the Cisco Client Extensions option and sets the support of Aironet IE on the WLAN. Example: `Device(config-wlan)# ccx aironet-iesupport`
	4.	Exit the WLAN configuration submode. Example: `Device(config-wlan)# exit`
	5.	Configure WLAN policy profile and enters the wireless policy configuration mode. Example: `Device(config)# wireless profile policy profile-policy`
	6.	Add a description for the policy profile. Example: `Device(config-wireless-policy)# description "test-wgb"`
	7.	Assign the profile policy to the VLAN. Example: `Device(config-wireless-policy)# vlan vlan-no`
	8.	Configure WGB VLAN client support. Example: `Device(config-wireless-policy)# wgb vlan`
	9.	Configure WGB broadcast tagging on a WLAN. Example: `Device(config-wireless-policy)# wgb broadcast-tagging`
	10.	Restart the policy profile. Example: `Device(config-wireless-policy)# no shutdown`
	11.	Exit the wireless policy configuration mode. Example: `Device(config-wireless-policy)# exit`
	12.	Configure policy tag and enters policy tag configuration mode. Example: `Device(config)# wireless tag policy policy-tag`
	13.	Map a policy profile to a WLAN profile. Example: `Device(config-policy-tag)# wlan profile-name policy profile-policy`
	14.	Exit policy tag configuration mode, and returns to privileged EXEC mode. Example: `Device(config-policy-tag)# end`

The WGB is now configured and can join the designated WLAN, bridging its wired clients to the wireless network.

Verify WGB status on the controller

Use these commands to verify the status of a WGB.

To display the wireless-specific configuration of active clients, use this command:

Device# show wireless client summary

To display the WGBs on your network, use this command:

Device# show wireless wgb summary

To display the details of wired clients that are connected to a particular WGB, use this command:

Device# show wireless wgb mac-address 00:0d:ed:dd:25:82 detail

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Cisco Workgroup Bridges

Restrictions for WGB

Configure a WGB on a WLAN (CLI)

Before you begin

Procedure

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Example:

Verify WGB status on the controller