Step 1

Choose Configuration > Tags & Profiles > Policy.

Step 2

On the Policy Profile page, click Add.

Step 3

In the Add Policy Profile window, in General tab, enter a name and description for the policy profile. The name can be ASCII characters from 32 to 126, without leading and trailing spaces. Do not use spaces as it causes system instability.

Step 4

To enable the policy profile, set Status as Enabled.

Step 5

Use the slider to enable or disable Passive Client and Encrypted Traffic Analytics.

Step 6

In the CTS Policy section, choose the appropriate status for the following:

Step 7

Specify a default SGT. The valid range is from 2 to 65519.

Step 8

In the WLAN Switching Policy section, choose the following, as required:

Step 9

Click Save & Apply to Device.

Step 1

Choose Configuration > Tags & Profiles > Flex.

Step 2

Click Add.

Step 3

Enter the Name of the Flex Profile. The name can be ASCII characters from 32 to 126, without leading and trailing spaces.

Step 4

In the Description field, enter a description for the Flex Profile.

Step 5

Click Apply to Device.

Step 1

Choose Configuration > Tags & Profiles > AP Join.

Step 2

On the AP Join Profile page, click Add.

Step 3

In the General tab, enter a name and description for the AP join profile. The name can be ASCII characters from 32 to 126, without leading and trailing spaces.

Step 4

Check the LED State check box to set the LED state of all APs connected to the device to blink so that the APs are easily located.

Step 5

In the Client tab and Statistics Timer section, enter the time in seconds that the AP sends its 802.11 statistics to the controller.

Step 6

In the TCP MSS Configuration section, check the Adjust MSS Enable check box to enter value for Adjust MSS. You can enter or update the maximum segment size (MSS) for transient packets that traverse a router. TCP MSS adjustment enables the configuration of the maximum segment size (MSS) for transient packets that traverse a router, specifically TCP segments with the SYN bit set.

Step 7

In the CAPWAP tab, you can configure the following:

1. In the High Availability tab, enter the time (in seconds) in the Fast Heartbeat Timeout field to configure the heartbeat timer for all access points. Specifying a small heartbeat interval reduces the amount of time it takes to detect device failure.

2. In the Heartbeat Timeout field, enter the time (in seconds) to configure the heartbeat timer for all access points. Specifying a small heartbeat interval reduces the amount of time it takes to detect device failure.

3. In the Discovery Timeout field, enter a value between 1 and 10 seconds (inclusive) to configure the AP discovery request timer.

4. In the Primary Discovery Timeout field, enter a value between 30 and 3000 seconds (inclusive) to configure the access point primary discovery request timer.

5. In the Primed Join Timeout field, enter a value between 120 and 43200 seconds (inclusive) to configure the access point primed join timeout.

6. In the Retransmit Timers Count field, enter the number of times that you want the AP to retransmit the request to the device and vice-versa. Valid range is between 3 and 8.

7. In the Retransmit Timers Interval field, enter the time duration between retransmission of requests. Valid range is between 2 and 5.

8. Check the Enable Fallback check box to enable fallback.

9. Enter the Primary Controller name and IP address.

10. Enter the Secondary Controller name and IP address.

11. Click Save & Apply to Device.

    Note

    The primary and secondary settings in the AP join profile are not used for AP fallback. This means that the AP will not actively probe for those controllers (which are a part of the AP join profile), when it has joined one of them. This setting is used only when the AP loses its connection with the controller, and then prioritizes which other controller it should join. These controllers have a priority of 4 and 5, following APs in the High Availability tab of the AP page. The APs that are added as the primary, secondary, and tertiary APs in the High Availability tab of the AP configuration page, are actively probed and are used for the AP fallback option.

1. In the Advanced tab, check the Enable VLAN Tagging check box to enable VLAN tagging.

2. Check the Enable Data Encryption check box to enable Datagram Transport Layer Security (DTLS) data encryption.

3. Check the Enable Jumbo MTU to enable big maximum transmission unit (MTU). MTU is the largest physical packet size, measured in bytes, that a network can transmit. Any messages larger than the MTU are divided into smaller packets before transmission. Jumbo frames are frames that are bigger than the standard Ethernet frame size, which is 1518 bytes (including Layer 2 (L2) header and FCS). The definition of frame size is vendor-dependent, as these are not part of the IEEE standard.

4. Use the Link Latency drop-down list to select the link latency. Link latency monitors the round-trip time of the CAPWAP heartbeat packets (echo request and response) from the AP to the controller and back.

5. From the Preferred Mode drop-down list, choose the mode.

6. Click Save & Apply to Device.

Step 8

In the AP tab, you can configure the following:

1. In the General tab, check the Switch Flag check box to enable switches.

2. Check the Power Injector State check box if power injector is being used. Power Injector increases wireless LAN deployment flexibility of APs by providing an alternative powering option to local power, inline power-capable multiport switches, and multiport power patch panels.

   Power Injector Selection parameter enables you to protect your switch port from an accidental overload if the power injector is inadvertently bypassed.

3. From the Power Injector Type drop-down list, choose power injector type from the following options:

   • Installed—This option examines and remembers the MAC address of the currently connected switch port and assumes that a power injector is connected. Choose this option if your network contains older Cisco 6-Watt switches and you want to avoid possible overloads by forcing a double-check of any relocated access points.

     If you want to configure the switch MAC address, enter the MAC address in the Injector Switch MAC Address text box. If you want the access point to find the switch MAC address, leave the Injector Switch MAC Address text box blank.

     Note

     Each time an access point is relocated, the MAC address of the new switch port fails to match the remembered MAC address, and the access point remains in low-power mode. You must then physically verify the existence of a power injector and reselect this option to cause the new MAC address to be remembered.

   • Override—This option allows the access point to operate in high-power mode without first verifying a matching MAC address. You can use this option if your network does not contain any older Cisco 6-W switches that could be overloaded if connected directly to a 12-W access point. The advantage of this option is that if you relocate the access point, it continues to operate in high-power mode without any further configuration. The disadvantage of this option is that if the access point is connected directly to a 6-W switch, an overload occurs.

4. In the Injector Switch MAC field, enter the MAC address of the switch .

5. From the EAP Type drop-down list, choose the EAP type as EAP-FAST, EAP-TLS, or EAP-PEAP.

6. From the AP Authorization Type drop-down list, choose the type as either CAPWAP DTLS + or CAPWAP DTLS.

7. In the Client Statistics Reporting Interval section, enter the interval for 5 GHz and 2.4 GHz radios in seconds.

8. Check the Enable check box to enable extended module.

9. From the Profile Name drop-down list, choose a profile name for mesh.

10. Click Save & Apply to Device.

1. In the Hyperlocation tab, check the Enable Hyperlocation check box.

2. Enter the Detection Threshold value to filter out packets with low RSSI. The valid range is –100 dBm to –50 dBm.

3. Enter the Trigger Threshold value to set the number of scan cycles before sending a BAR to clients. The valid range is 0 to 99.

4. Enter the Reset Threshold value to reset value in scan cycles after trigger. The valid range is 0 to 99.

5. Enter the NTP Server IP address.

6. Click Save & Apply to Device.

1. In the BLE tab, enter a value in the Beacon Interval field to indicate how often you want your APs to send out beacon advertisements to nearby devices. The range is from 1 to 10, with a default of 1.

2. In the Advertised Attenuation Level field, enter the attenuation level. The range is from 40 to 100, with a default of 59.

3. Click Save & Apply to Device.

1. In the Packet Capture tab, choose an AP Packet Capture Profile from the drop-down list.

2. You can also create a new profile by clicking the + sign.

3. Enter a name and description for the AP packet capture profile.

4. Enter the Buffer Size.

5. Enter the Duration.

6. Enter the Truncate Length information.

7. In the Server IP field, enter the IP address of the TFTP server.

8. In the File Path field, enter the directory path.

9. Enter the username and password details.

10. From the Password Type drop-down list, choose the type.

11. In the Packet Classifiers section, use the option to select or enter the packets to be captured.

12. Click Save.

13. Click Save & Apply to Device.

Step 9

In the Management tab, you can configure the following:

1. In the Device tab, enter the IPv4/IPv6 Address of the TFTP server, TFTP Downgrade section.

2. In the Image File Name field, enter the name of the software image file.

3. From the Facility Value drop-down list, choose the appropriate facility.

4. Enter the IPv4 or IPv6 address of the host.

5. Choose the appropriate Log Trap Value.

6. Enable Telnet and/or SSH configuration, if required.

7. Enable core dump, if required.

8. Click Save & Apply to Device.

1. In the User tab, enter username and password details.

2. Choose the appropriate password type.

3. In the Secret field, enter a custom secret code.

4. Choose the appropriate secret type.

5. Choose the appropriate encryption type.

6. Click Save & Apply to Device.

1. In the Credentials tab, enter local username and password details.

2. Choose the appropriate local password type.

3. Enter 802.1x username and password details.

4. Choose the appropriate 802.1x password type.

5. Enter the time in seconds after which the session should expire.

6. Enable local credentials and/or 802.1x credentials as required.

7. Click Save & Apply to Device.

1. In the CDP Interface tab, enable the CDP state, if required.

2. Click Save & Apply to Device.

Step 10

In the Rogue AP tab, check the Rogue Detection check box to enable rogue detection.

Step 11

In the Rogue Detection Minimum RSSI field, enter the RSSI value.

Step 12

In the Rogue Detection Transient Interval field, enter the transient interval value.

Step 13

In the Rogue Detection Report Interval field, enter the report interval value.

Step 14

Check the Rogue Containment Automatic Rate Selection check box to enable rogue containment automatic rate selection.

Step 15

Check the Auto Containment on FlexConnect Standalone check box to enable the feature.

Step 16

Click Save & Apply to Device.

Step 1

Choose Configuration > Tags & Profiles > RF.

Step 2

On the RF Profile page, click Add.

Step 3

In the General tab, enter a name for the RF profile. The name can be ASCII characters from 32 to 126, without leading and trailing spaces.

Step 4

Choose the appropriate Radio Band.

Step 5

To enable the profile, set the status as Enable.

Step 6

Enter a Description for the RF profile.

Step 7

Click Save & Apply to Device.