Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

WLANs

Updated: April 10, 2026

Want to summarize with AI?

Log in

Explains wireless local area networks that enable control of lightweight access points with configurable SSIDs and profiles.

A WLAN is a wireless network feature that

  • enables control of wireless local area networks for lightweight access points

  • supports up to 16 advertised WLANs per access point with up to 4096 total configurable WLANs, and

  • allows selective advertisement using profiles and tags for better manageability.

An SSID identifies the specific wireless network that you want the device to access. You can configure WLANs with different SSIDs or with the same SSID.

WLAN configuration details

Each WLAN has a separate WLAN ID, a separate profile name, and a WLAN SSID.

Note

The wireless client max-user-login concurrent command will work as intended even if the no configure max-user-identity response command is configured.

Note

We recommend that you configure the password encryption aes and the key config-key password-encrypt key commands to encrypt your password.

Note

For C9105, C9115, and C9120 APs, when a new WLAN is pushed from the controller and if the existing WLAN functional parameters are changed, the other WLAN clients will disconnect and reconnect.

Wi-Fi multimedia (WMM) policy

Wi-Fi Multimedia (WMM) is used to prioritize different types of traffic. The WMM policy options include:

  • Disabled: Disables WMM on the WLAN.

  • Required: Requires client devices to use WMM. Devices that do not support WMM cannot join the WLAN.

  • Allowed: Devices that do not support WMM can join the WLAN but will not benefit from the 802.11n rates.

Note

For 802.11ax APs and higher (Cisco Catalyst 9117, 9124, 913x, 916x, 917x APs), WMM can not be Disabled. Only Required or Allowed options are supported.

Prerequisites for WLANs

You can associate up to 16 WLANs with each access point group and assign specific access points to each group. Each access point advertises only the enabled WLANs that belong to its access point group. The access point (AP) does not advertise disabled WLANs in its access point group or WLANs that belong to another group.

We recommend that you assign one set of VLANs for WLANs and a different set of VLANs for management interfaces to ensure that devices properly route VLAN traffic.

Restrictions for WLANs

This reference provides restrictions and limitations that apply when configuring and managing WLANs on wireless controllers.

  • Do not configure PSK as this configuration is not supported and impacts client join flow.

  • Ensure that TKIP or AES ciphers are enabled with WPA1 configuration, else ISSU may break during upgrade process.

  • When you change the WLAN profile name, then FlexConnect APs (using AP-specific VLAN mapping) will become WLAN-specific. If FlexConnect Groups are configured, the VLAN mapping will become Group-specific.

  • Do not enable IEEE 802.1X Fast Transition on Flex Local Authentication enabled WLAN, as client association is not supported with Fast Transition 802.1X key management.

  • Peer-to-peer blocking does not apply to multicast traffic.

  • In FlexConnect, peer-to-peer blocking configuration cannot be applied only to a particular FlexConnect AP or a subset of APs. It is applied to all the FlexConnect APs that broadcast the SSID.

  • The WLAN name and SSID can have up to 32 characters.

  • WLAN and SSID names support only the following ASCII characters:

    • Numerals: 48 through 57 hex (0 to 9)

    • Alphabets (uppercase): 65 through 90 hex (A to Z)

    • Alphabets (lowercase): 97 through 122 hex (a to z)

    • ASCII space: 20 hex

    • Printable special characters: 21 through 2F, 3A through 40, and 5B through 60 hex, that is: ! " # $ % & ' ( ) * + , - . / : ; < = > ? @ [ \ ] ^ _ ` { | } ~

  • WLAN name cannot be a keyword; for example, if you try to create a WLAN with the name as 's' by entering the wlan s command, it results in shutting down all WLANs because 's' is used as a keyword for shutdown.

  • You cannot map a WLAN to VLAN 0. Similarly, you cannot map a WLAN to VLANs 1002 to 1006.

  • Dual stack clients with a static-IPv4 address is not supported.

  • In a dual-stack with IPv4 and IPv6 configured in the Cisco 9800 controller, if an AP tries to join controller with IPv6 tunnel before its IPv4 tunnel gets cleaned, you would see a traceback and AP join will fail.

  • When creating a WLAN with the same SSID, you must create a unique profile name for each WLAN.

  • When multiple WLANs with the same SSID get assigned to the same AP radio, you must have a unique Layer 2 security policy so that clients can safely select between them.

  • The SSID that is sent as part of the user profile will work only if aaa override command is configured.

  • RADIUS server overwrite is not configured on a per WLAN basis, but rather on a per AAA server group basis.

  • Downloadable ACL (DACL) is supported only on the central switching mode. It is not supported for Flex Local switching or on the Cisco Embedded Wireless Controller.

  • You cannot mix open configuration models with CLI-based, GUI-based, or Catalyst Center-based configurations. However, if you decide to use multiple model types, they must remain independent of each other. For example, in open configuration models, you can only manage configurations that have been created using an open configuration model, not a CLI-based or GUI-based model. Configurations that are created using open configuration models cannot be modified using a GUI-based model, or CLI-based model, or any other model.

  • When you are configuring dot11bg 11g command and radio dot11bg or radio dot11g command, the clients can still connect in 5GHz radio. In this scenario, the client association needs to be blocked. This option is only available on a 2.4-GHz radio.

Caution

Some clients might not be able to connect to WLANs properly if they detect the same SSID with multiple security policies. Use this WLAN feature with care.

Band selection

A band selection is a wireless network feature that

  • facilitates the movement of dual-band client radios from congested frequency bands

  • enables clients to connect to less congested 5-GHz access points for improved network performance, and

  • reduces interference from other devices by optimizing which frequency band clients use.

The 2.4-GHz band is often congested. Clients using this band may experience interference from Bluetooth devices, microwave ovens, cordless phones, and co-channel interference from other access points due to the 802.11b/g channel limit of 3 nonoverlapping channels. By configuring band selection on devices, administrators can steer dual-band clients toward the 5-GHz band, improving overall network performance.

Off-channel scanning deferral

Off-channel scanning deferral is a wireless network feature that

  • temporarily postpones RRM off-channel scanning activities when important data transmission occurs

  • prevents performance impact on critical traffic by avoiding the normal 70-millisecond off-channel periods, and

  • can be configured on a per-WLAN basis with specific WMM UP class and time threshold parameters.

Off-channel scanning operations

A lightweight access point, in normal operational conditions, periodically goes off-channel and scans another channel. This is in order to perform RRM operations such as the following:

  • Transmitting and receiving Neighbor Discovery Protocol (NDP) packets with other APs.

  • Detecting rogue APs and clients.

  • Measuring noise and interference.

During the off-channel period, which normally is about 70 milliseconds, the AP is unable to transmit or receive data on its serving channel. Therefore, there is a slight impact on its performance and some client transmissions might be dropped.

While the AP is sending and receiving important data, it is possible to configure off-channel scanning deferral so that the AP does not go off-channel and its normal operation is not impacted. You can configure off-channel scanning deferral on a per-WLAN basis, per WMM UP class basis, with a specified time threshold in milliseconds. If the AP sends or receives, on a particular WLAN, a data frame marked with the given UP class within the specified threshold, the AP defers its next RRM off-channel scan. For example, by default, off-channel scanning deferral is enabled for UP classes 4, 5, and 6, with a time threshold of 100 millseconds. Therefore, when RRM is about to perform an off-channel scan, a data frame marked with UP 4, 5, or 6 is received within the last 100 milliseconds, RRM defers going off-channel. The AP radio does not go off-channel when a voice call sending and receiving audio samples is marked as UP class 6 for every active 20 milliseconds.

Off-channel scanning deferral does come with a tradeoff. Off-channel scanning can impact throughput by 2 percent or more, depending on the configuration, traffic patterns, and so on. Throughput can be slightly improved if you enable off-channel scanning deferral for all traffic classes and increase the time threshold. However, by not going off-channel, RRM can fail to identify AP neighbors and rogues, resulting in negative impact to security, DCA, TPC, and 802.11k messages.

DTIM period

A Delivery Traffic Indication Map (DTIM) period is a 802.11 network timing mechanism that

  • allows power-saving clients to wake up at the appropriate time if they are expecting broadcast or multicast data

  • determines when access points transmit buffered broadcast and multicast frames after beacon broadcasts, and

  • coincides with the DTIM broadcast interval.

DTIM period characteristics

In the 802.11 networks, lightweight access points broadcast a beacon at regular intervals, which coincides with the Delivery Traffic Indication Map (DTIM). After the access point broadcasts the beacon, it transmits any buffered broadcast and multicast frames based on the value set for the DTIM period.

Typical DTIM values and their transmission patterns:

  • DTIM value 1: Transmits broadcast and multicast frames after every beacon

  • DTIM value 2: Transmits broadcast and multicast frames after every other beacon

For instance, if the beacon period of the 802.11 network is 100 ms and the DTIM value is set to 1, the access point transmits buffered broadcast and multicast frames for 10 times every second. If the beacon period is 100 ms and the DTIM value is set to 2, the access point transmits buffered broadcast and multicast frames for 5 times every second. Either of these settings are suitable for applications, including Voice Over IP (VoIP), that expect frequent broadcast and multicast frames.

However, the DTIM value can be set as high as 255 (to transmit broadcast and multicast frames after every 255th beacon). The only recommended DTIM values are 1 and 2; higher DTIM values will likely cause communications problems.

Note

A beacon period, which is specified in milliseconds on the device, is converted internally by the software to 802.11 Time Units (TUs), where 1 TU = 1.024 milliseconds. Depending on the AP model, the actual beacon period may vary slightly; for example, a beacon period of 100 ms may in practice equate to 104.448 ms.

WLAN radio policies

A WLAN radio policy is a wireless network configuration feature that

  • allows broadcasting the WLAN on the corresponding slot

  • provides more granular control compared to existing WLAN features that broadcast on all applicable slots, and

  • is supported only on 5 GHz band.

WLAN radio policy functionality

The existing WLAN feature allows you to broadcast WLAN on a specified radio on all the applicable slots. With the WLAN Radio Policy feature, you can broadcast the WLAN on the corresponding slot.

Restrictions for WLAN radio policy

This topic lists the restrictions that apply to WLAN radio policy configuration.

  • WLAN is pushed to all the radios only if these configurations are used:

    • WPA3 + AES cipher + 802.1x-SHA256 AKM

    • WPA3 + AES cipher + OWE AKM

    • WPA3 + AES cipher + SAE AKM

    • WPA3 + CCMP256 cipher + SUITEB192-1X AKM

    • WPA3 + GCMP256 cipher + SUITEB-1X AKM

    • WPA3 + GCMP128 cipher + SUITEB192-1X AKM

Prerequisites for configuring Cisco client extensions

The software supports CCX versions 1 through 5, which enables devices and their access points to communicate wirelessly with third-party client devices that support CCX. CCX support is enabled automatically for every WLAN on the device and cannot be disabled. However, you can configure Aironet information elements (IEs).

If Aironet IE support is enabled, the access point sends an Aironet IE 0x85 (which contains the access point name, load, number of associated clients, and so on) in the beacon and probe responses of this WLAN, and the device sends Aironet IEs 0x85 and 0x95 (which contains the management IP address of the device and the IP address of the access point) in the reassociation response if it receives Aironet IE 0x85 in the reassociation request.

Peer-to-peer blocking

Peer-to-peer blocking is a WLAN security feature that

  • is applied to individual WLANs, where each client inherits the peer-to-peer blocking setting of the WLAN to which it is associated

  • enables you to have more control over how traffic is directed by allowing you to choose to have traffic bridged locally within the device, dropped by the device, or forwarded to the upstream VLAN, and

  • is supported for clients that are associated with local and central switching WLANs.

Note

Peer-to-peer blocking feature is VLAN-based. WLANs using the same VLAN has an impact, if Peer-to-peer blocking feature is enabled.

Diagnostic channels

A diagnostic channel is a troubleshooting feature that

  • enables testing of client and AP communication to identify network difficulties

  • allows corrective measures to be taken to make the client operational on the network, and

  • provides GUI or CLI configuration options for enabling diagnostic tests.

Configuration options

You can use the device GUI or CLI to enable the diagnostic channel, and you can use the device diag-channel CLI to run the diagnostic tests.

Note

We recommend that you enable the diagnostic channel feature only for non-anchored SSIDs that use the management interface. CCX Diagnostic feature has been tested only with clients having Cisco ADU card

AP names in beacon

AP names in beacon is a feature that

  • extends the maximum length for AP name from 16 to 32 characters

  • prevents AP name truncation in beacons, and

  • uses a vendor specific (VS) Information Element (IE) instead of CCX IEs.

The extended length matches the maximum length supported in the controller. This enhancement resolves issues where AP names were truncated due to a 16-character limit imposed by CCX Information Elements (IEs).

Feature history

Table 1. Feature history for AP names in beacons

Feature name

Release information

Feature description

AP names in beacons

Cisco IOS XE 17.18.2

AP names in beacon is a feature that allows AP names to be extended from 16 to 32 characters, prevents truncation of AP names in beacon frames, and uses a vendor-specific Information Element (IE) instead of the older CCX IEs.