• VMware Virtual Machine version 11, minimum of ESXi 6.0 Update 2.

• Red hat Enterprise RHEL 7.1 & 7.2, Ubuntu 14.04, 16.04 LTS

Scale and sizing, suggests the following minimum virtual resource requirement:

High Availability is supported on the C9800-CL VM hosts using virtual redundant ports, in SSO configuration.

The following VMware features and operations are not supported in all versions of the Cisco Catalyst Wireless Controller, but can still be used or performed on non-supported versions at the risk of encountering dropped packets, dropped connections, services, and other error statistics:

• Distributed Resource Scheduling (DRS)

• Fault Tolerance

• Resume

• Snapshot

• Suspend

• vMotion

• vNIC teaming

• L2 LAG

• SRIOV

Cisco C9800-CL deployment OVA Template (OVA)

C9800-CL-universalk9.BLD_V***.ova

Cisco C9800-CL deployment image

C9800-CL-universalk9.BLD_V***.iso

Cisco C9800-CL Upgrade and Patches (bin)

C9800-CL-universalk9.upgrade***.bin

You can use the provided OVA file package to deploy the Cisco wireless controller to the VM. The OVA package includes an OVF file that contains a default VM configuration based on a Cisco IOS XE release and the supported hypervisor.

The following apply when deploying the OVA package to the VM:

• The single OVA package creates a VM with options for 3 types of virtual wireless controllers, small/medium/large. Selecting a profile specifies the required virtual CPU and memory. Hard disk will be the same of 8GB for any wireless controller type. It is not recommended to change the virtual CPU and memory configuration after deployment.

• When deploying using the OVA template, the VM will bootstrap with three interfaces: one interface is for out of band management, one is for wireless management (usually mapped to a trunk interface on the switch side) and the third one is for HA to connect to the SSO peer.

• You can monitor the installation process on the virtual VGA console or the console on the virtual serial port. A virtual serial port is optional and can be added after deploying the OVA. At FCS the serial console port is not supported for large scale deployments; in the Appendix A you find how to configure it in case you want to use it.

The Cisco C9800 maps the GigabitEthernet network interfaces to the logical virtual network interface card (vNIC) name assigned by the VM. The VM in turn maps the logical vNIC name to a physical MAC address.

When the Cisco C9800 is booted for the first time, the router interfaces are mapped to the logical vNIC interfaces that were added when the VM was created. The figure below shows the relationship between the vNICs and the Cisco C9800 interfaces.

• GigabitEthernet 1 -> Device Management interface: map it to the out of band management network

• GigabitEthernet 2 -> Wireless Management interface: map it to your network to reach APs and services. Usually this interface is a trunk to carry multiple vlans

• GigabitEthernet 3 -> High Availability interface: map it a separated network for peer to peer communication for SSO

Note	Do not connect 2 interface to a single subnet as that causes network loop.

Below shows an example for using the Hypervisor physical port (e.g. vmnic2, connected to a switch trunk), and is mapped to vSwitch0 as intended for the C9800 VM management interface. An optional interface intended for use in redundant HA configuration (e.g. vmnic3) is named RP and mapped to vSwitch3.

Note

If testing 2 x C9800s in the same UCS and using RP ports for HA, it is not necessary to connect the physical RP mapped physical adapters at all. However, if active and standby C9800s are on separate hypervisors, then the RP mapped physical ports need to be connected to the network and is L2 adjacent/reachable to each other.

Let’s configure the minimal configuration to then connect to the web GUI interface of C9800-CL and use the DAY 0 guided flow to get the controller fully operational.

At FCS, DAY 0 assumes that the box has two separated virtual interfaces (one for device management and one for wireless management and client traffic) and that the first login happens on the device management (out of band) interface. The wireless management interface is configured via the DAY 0. If you have a different setup and for example you want to use only one interface, please see the next section on how you can skip DAY 0 guided flow and configure the initial settings using CLI.

Connect to the CLI via the VGA console and follow these steps for the basic configuration:

• Terminate the configuration wizard (this is the general ios CLI wizard and it’s not specific for wireless)

Would you like to enter the initial configuration dialog? [yes/no]: no
Would you like to terminate autoinstall? [yes]:yes

• Optinally set the hostname:

WLC(config)#hostname C9800

• Add login credentials using the following command:

C9800(config)#username <name> privilege 15 password <yourpwd>

• Add an IP address on the device Management interface. The example assumes you have mapped GigabitEthernet 1 to the out of band/device management network during VM bootstrap:

C9800(config)#interface g1
C9800(config-if)#no switchport
C9800(config-if)#ip address 10.58.55.5 255.255.255.0

• Add the route to the remote network where you want to manage the C9800-CL from

C9800(config)#ip route 10.58.0.0 255.255.0.0 10.58.55.254

Verify that you can ping your management station and then from there just https://<IP of the device management interface>. Use the credentials you have entered earlier. Since the box has never been configured, the web GUI will redirect you to the DAY 0 page. Please see the DAY 0 section later in the document

To simplify the bootstrap process of a Catalyst wireless controller, a Day-0 wizard will appear after a virtual instance is deployed, with network connectivity but without any other wireless configuration.

To connect to the DAY 0 GUI, just login to the defined Device Management interface using https.

To login use the username and password credentials given during the C9800 instance creation described in the previous sections.

Once logged in, the user is presented with a simplified configuration flow to set the basic parameters and have the controller fully operational. In the first page, enter the required information:

These are: Deployment mode, Country code, Date and Time, NTP (optional) and AAA Server (optional).

Note how for the VM you can chose standalone or active/standby if you want to configure SSO.

Then enter the wireless Management interface configuration:

Notice that you can only select an interface that is different from the one you used to access the GUI (so you can either select gig 2 or gi3 in this case). You can configure the interface Gigabit 2 by choosing the vlan, the IP address and the default gateway. This will automatically configure the interface as trunk, the SVI interface for wireless management and the default gateway. Click Next

In the next page you can add a WLAN (optional) so that clients can connect. In this example the PSK dialogue is shown:

In the next page the user can set some basic RF parameters and the AP certificate.

A trustpoint is basically a certificate authority who you trust, and it is called a trustpoint because you implicitly trust this authority. A trustpoint certificate is a self-signed certificate, hence the name trustpoint, since it does not rely on the trust of anyone else or other party. A trustpoint is needed for AP to join the C9800-CL and the user can decide to auto generate one during DAY 0, or can toggle the “Generate Certificate” to NO and then it will have to configure its own certificate authority at DAY 1 for APs to join.

Click Summary to review the configuration and then click Finish. The configuration and trustpoint will be pushed to the device and the user will be logged out. The 9800-CL controller will not reboot but it will take about 60s to prompt the user to login again; enter the same credentials:

This time it will skip the DAY 0 page since the box has already an initial configuration, and the user will be redirected to the main Dashboard for DAY 1 configuration.

At the time of this document, installing .ova file of C9800-CL using GUI does not work. There are issues specific to VMware 6.5 and C9800-CL OVA file deployment in which deployment will fail with a warning displaying "A required disk image was missing." In addition, an error is seen "Failed to deploy VM: postNFCData failed: Cannot POST to non-disk files.” There are two options to install C9800-CL on VMware ESXi 6.5)

• Installing .iso file of C9800-CL using ESXi embedded GUI (ESXI 6.5 client version 1.29.0 is tested and required)

• Installing .ova file of C9800-CL using OVF tool

The Cisco virtual 9800 Wireless Controller can be deployed in Linux KVM using an ISO file (download from Cisco website), with the support for the following distribution:

• Linux KVM, Ubuntu, Red Hat, CentOS

This guide will not cover every aspect of Linux or KVM components, only the general set of instructions needed to deploy a virtual wireless controller on KVM.

By default, ESXi (6.x) security profile does not have VM serial port mode enabled and is required for serial console to C9800 virtual machine (if configured).

Go to the ESXi server > Configuration > Software > Security Profile > Firewall > Properties. Enable VM serial port connected over network.