Advanced features and optimizations

Learn how to configure advanced features that enhance access point performance, mobility, security, and traffic handling.

Configure transmission rate with high throughput

To configure high throughput transmission rate for WGB in moving deployments, perform this task. You can manually limit the transmission rate using the high throughput modulation and coding scheme (MCS).

Procedure

	1.	Use the config dot11radio interface 802.11ax disable command to disable the 802.11ax standard on the specified dot11radio interface. Example: `Device# config dot11radio 1 802.11ax disable`
	2.	Use the config dot11radio interface 802.11ac disable disable command to disable the 802.11ax standard on the selected dot11radio interface. Example: `Device# config dot11radio 1 802.11ac disable`
	3.	Use the config dot11radio interface speed ht-mcs m4 m5 command to configure the desired HT MCS rate for the specified dot11radio interface. This action helps achieve the required transmission rates. Example: `Device# config dot11radio 1 speed ht-mcs m4 m5`
	4.	Use the debug wgb dot11 rate command to check the WGB Tx MCS rate.

Configure legacy rate for WGB

You can also configure legacy rates for WGB if required.

Procedure

Use the config dot11radio interface speed legacy-ratelegacy-rate command to cofigure the specific legacy rate on the dot11radio interface.

Device# config dot11radio 1 speed legacy-rate basic-6.0

Both 802.11 management and control frames use legacy rates.
Ensure that the WGB's legacy rates match or overlap with the Access Point's (AP) legacy rates to avoid WGB association failures.

802.11v features

The 802.11v is a wireless network management standard that:

enables network-assisted roaming to optimize client connectivity,
helps balance client load by providing guidance to client devices, and
improves wireless performance through enhanced management frames and procedures.

802.11v is part of the IEEE 802.11 family of Wi-Fi standards. It includes features such as network-assisted roaming, which allows network infrastructure (such as wireless controllers) to direct clients to better access points (APs), reducing congestion and improving overall network efficiency.

Roaming and management enhancements

The following sections detail how 802.11v supports roaming and client management:

Enhancement of roaming with 802.11v support: When 802.11v support is enabled on a Workgroup Bridge (WGB), it enhances roaming by enabling the WGB to proactively select optimal APs based on updated neighborhood information. The WGB can actively initiate roaming to suitable APs from dynamically updated lists, and periodic checks ensure that the WGB maintains the most accurate AP neighbor data.
Basic service set transition request frame: The Basic Service Set (BSS) Transition Request frame includes channel information of neighboring APs. Limiting scanning to these specified channels significantly reduces roaming latency in environments that use multiple channels.
Disassociate the client on the AP using WLC: The Wireless LAN Controller (WLC) can disassociate a client based on factors such as AP load, Received Signal Strength Indicator (RSSI), and data rate. The WLC can notify 802.11v-enabled clients of an impending disassociation through the BSS transition management request frame. If the client fails to re-associate with another AP within a configurable time, the disassociation is enforced.

Administrators can enable the disassociation-imminent configuration on the WLC, which activates the optional field within the BSS transition management request frame. For detailed information of 802.11v configuration on the WLC, see Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide .

Enable or disable 802.11v support

Enable 802.11v support on the WGB to optimize roaming performance by restricting channel scanning to those learned from the neighbor list.

Procedure

Enable or disable 802.11v support on WGB.

Option Description

Enable 802.11v support on WGB

Use the configure wgb mobile station interface dot11Radio radio_slot_id dot11v-bss-transition enable command.

Device# configure wgb mobile station interface dot11Radio 1 dot11v-bss-transition enable

Note

When 802.11v support is enabled, the WGB scans only the channels provided in the neighbor list, improving efficiency during roaming.

Ensure that the neighbor list is properly configured on the infrastructure side to facilitate seamless channel transitions.

Disable 802.11v support on WGB

Use the configure wgb mobile station interface dot11Radio radio_slot_id dot11v-bss-transition disable command.

Device# configure wgb mobile station interface dot11Radio 1 dot11v-bss-transition disable

Configure BSS transition query interval

Perform this task to configure the time interval at which the WGB sends BSS transition query messages to the parent AP. This ensures optimal network performance by managing the frequency of transition queries.

Procedure

Use configure wgb neighborlist-update-interval interval command to configure the time interval that WGB sends BSS transition query message to the parent AP.

Device# configure wgb neighborlist-update-interval 50

Note

The valid range is from 1 to 100 and the default value is 10. Configure the time interval in seconds format.

Verify neighbor list

Ensure the neighbor list received from the associated AP is accurate and up to date.

Procedure

Use show wgb dot11v bss-transition neighbour command to display the neighbor list received from the associated AP.

Device#show wgb dot11v bss-transition neighbour

Note

This command provides details about neighboring APs that the device can transition to as part of 802.11v wireless network enhancements.

Accurate neighbor lists can improve handoff and roaming efficiency for wireless clients.

Verify the channel list

Verify the channel list to ensure the device is correctly identifying channels from the dot11v neighbor, auxiliary radio scan, and residual channel scan. This step is crucial for troubleshooting connectivity or performance issues related to wireless networks.

Procedure

Use show wgb dot11v bss-transition channel command to check channel list from dot11v neighbor, aux radio scanned, and residual channel scanned.

Device#show wgb dot11v bss-transition channel

Note

This command is typically used in scenarios where you need to validate the channels identified by the WGB.

Clear neighbor list

Perform this task to clear the neighbor list for error condition recovery. This ensures optimal device performance by resolving potential connectivity issues related to neighbors.

Procedure

Use clear wgb dot11v bss-transition neighbor command to clear neighbor list to provide error condition recovery.

Device#clear wgb dot11v bss-transition neighbor

Note

This command is used specifically to reset the neighbor list in scenarios where error conditions need to be resolved.

Auxiliary scanning

Configure aux-scan mode as either scanning-only or handoff mode on WGB radio 2 (5 GHz) to improve roaming performance.

Scan-only mode

The scanning-only mode is a wireless access point operational mode that:

enables radio operation exclusively for scanning,
continuously monitors the wireless environment to collect data on network performance, interference, and rogue devices, and
allows configuration of scanning parameters such as channel lists and scanning intervals.

When slot 2 radio is configured in scanning-only mode, slot 1 (5G) radio is always selected as the uplink. Slot 2 (5G) radio continues to scan the configured SSID based on the channel list. By default, the channel list contains all supported 5G channels (based on reg domain). You can configure the scanning list manually, or the device can learn it from 802.11v.

When roaming is triggered, the algorithm looks for candidates in the scanning table and skips the scanning phase if the table is not empty. The WGB then associates to the selected candidate AP.

Configure scan-only mode

Enable the device to operate in scan-only mode, facilitating network monitoring and assessment without transmitting data.

Procedure

Use the configure dot11Radio 2 mode scan only command to configure scanning only mode.

Device# configure dot11Radio 2 mode scan only

Configure scanning table timer

Adjust the scanning table timer to optimize the candidate AP selection process and prevent roaming failures caused by outdated RSSI values.

Before you begin

The scanning table maintains a list of candidate APs detected by the device. By default, entries in this table expire after 1200 milliseconds. Modifying the expiration timer may help improve roaming efficiency by allowing more time for RSSI updates.

Procedure

Use the configure wgb scan timeout interval command to adjust the timer. By default, candidate AP entries in scanning table are automatically removed in 1200 ms.

Device#configure wgb scan timeout 1500

Note

Scanning AP expire time is from 1 to 5000.

From the scanning table, the AP selects the candidate with the best RSSI value. However, sometimes the RSSI values might not be updated and it lead to roaming failures.

Manually add or remove channels from the channel list

Perform this task to manually add or remove channels from the channel list to optimize wireless network performance or for specific configuration requirements.

Procedure

Add or remove channels from the channel list using one of the options.

Option	Description
Add a channel to the channel list	Use the configure wgb mobile station interface dot11Radio interface scan channel add command. `Device#configure wgb mobile station interface dot11Radio 1 scan 36 add`
Remove a channel from the channel list	Use the configure wgb mobile station interface dot11Radio interface scan channel delete command. `Device# configure wgb mobile station interface dot11Radio 1 scan 36 delete`

Verify scanning table

Perform this task to confirm the current AP scanning details and identify the best AP for optimal connectivity.

Procedure

Use show wgb scan command to verify the scanning table.

Device#show wgb scan
Best AP expire time: 5000 ms

************[ AP List ]***************
BSSID                RSSI   CHANNEL   Time
FC:58:9A:15:E2:4F     84     136       1531
FC:58:9A:15:DE:4F     37     136       41

***********[ Best AP ]****************
BSSID                RSSI   CHANNEL   Time
FC:58:9A:15:DE:4F    37     136       41

Auxiliary Scanning handoff mode

An Auxiliary Scanning handoff mode is a wireless radio configuration that

allows both radios (radio 1 and radio 2) to serve as uplink connections,
supports dynamic switching of roles and traffic between radios after each roaming event, and
enables efficient roaming by using a scanning radio to associate with the best available access point.

The Auxiliary Scanning list can be manually configured or learned automatically using the 802.11v standard. This handoff mode improves roaming performance by quickly associating with the best available access point.

Radio roles

The radio 2 shares the same MAC address with the radio 1 and supports scanning, association, and data serving. Both radios can operate in either a serving or scanning role. After each roaming event, the roles and traffic automatically switch between radio 1 and radio 2.

Roaming of AP

When roaming is triggered, the system algorithm checks the scanning database for the best AP to establish a connection. WGB always uses the radio in the scanning role to complete the roaming association with the new AP. This configuration reduces roaming interruptions to between 20 and 50 milliseconds.

This table shows an example of aux-scan handoff radio mode configuration on IW9165E:


Slot 0 (2.4 G)	Slot 1 (5G)	Slot 2 (5G only)	Slot 3 (scanning radio)
N/A	WGB	Scan handoff	N/A

This table shows how long roaming interruptions last for different methods when using three different modes:


Roaming interruption time	Normal channel setting	Auxiliary Scanning only	Auxiliary Scanning Handoff
Scanning	(40+20)*3=180 ms	0-40 ms	0 ms
Association	30-80 ms	30-80 ms	20-50 ms
Total	~210 ms	70-120 ms	20-50 ms

Guidelines and restrictions for Auxiliary Scanning

The different-parent threshold applies to both scan-only and handoff modes.
- In scan-only mode, roaming decisions are strictly based on selecting a different candidate BSSID. This supports combinations such as dual 2.4 GHz and dual 5 GHz.
- In handoff mode, the WGB can either roam to a different BSSID or switch radios while remaining on the same parent BSSID.
The same-parent threshold is only relevant when the WGB is operating in handoff mode.

Configure radio 2 in Aux-Scan handoff mode

Perform this task to configure the WGB slot 2 radio in auxiliary-scan handoff mode, ensuring seamless connectivity and optimized network performance.

Before you begin

Auxiliary-scan handoff mode allows the radio to scan for available access points without interrupting active connections. This feature is particularly useful for improving handoff reliability in environments with multiple access points.

Procedure

Use the configure dot11Radio radio-num mode scan handoff command to configure the WGB slot 2 radio to aux-scan mode:

Device# configure dot11Radio 2 mode scan handoff

(Optional) Use the show running-config command to view the radio configuration.

Device# show running-config
...
Radio Id                   : 1
   Admin state             : ENABLED
   Mode                    : WGB
   Spatial Stream          : 1
   Guard Interval          : 800 ns
   Dot11 type              : 11n
   11v BSS-Neighbor        : Disabled
   A-MPDU priority         : 0x3f
   A-MPDU subframe number  : 12
   RTS Protection          : 2347(default)
   Rx-SOP Threshold        : AUTO
   Radio profile           : Default
   Encryption mode         : AES128
Radio Id                   : 2
   Admin state             : ENABLED
   Mode                    : SCAN - Handoff
   Spatial Stream          : 1
   Guard Interval          : 800 ns
   Dot11 type              : 11n
   11v BSS-Neighbor        : Disabled
   A-MPDU priority         : 0x3f
   A-MPDU subframe number  : 12
   RTS Protection          : 2347(default)
   Rx-SOP Threshold        : AUTO
   Radio profile           : Default

Configure RSSI delta threshold for candidate BSSID

This section explains how the WGB evaluates candidate APs during auxiliary scans. By adjusting the RSSI delta threshold, you can control how much stronger a new signal must be before it triggers a roam or radio switch. This adjustment helps prevent unnecessary transitions when signal strengths are similar.

Procedure

	1.	Use the configure wgb mobile aux-scan delta-rssi different-parentthreshold command to configure the RSSI-delta threshold (in dB) when the candidate BSSID is different from the current BSSID. `Device# configure wgb mobile aux-scan delta-rssi different-parent 7` Default threshold value is 6 dB.
	2.	Use the configure wgb mobile aux-scan delta-rssi same-parentthreshold command to configure the RSSI-delta threshold (in dB) when the candidate remains on the same parent BSSID. `Device# configure wgb mobile aux-scan delta-rssi same-parent 7` Note This applies only in handoff mode. Default threshold value is 100 dB.

Verify WGB scan

Perform this task to confirm the current role of each radio and analyze the auxiliary scanning results, including the best AP selection and performance metrics.

WGB scan provides detailed information about the auxiliary scanning process for each radio. This data helps to determine the best AP based on signal strength (RSSI), channel, and scan time.

Procedure

Use the show wgb scan command to view the current role of each radio and the results of aux scanning.

Device#show wgb scan
Best AP expire time: 2500 ms

Aux Scanning Radio Results (slot 2)
************[ AP List ]***************
BSSID                RSSI   CHANNEL   Time
FC:58:9A:15:DE:4E     54     153       57
FC:58:9A:15:E2:4E     71     153       64

***********[ Best AP ]****************
BSSID                RSSI   CHANNEL   Time
FC:58:9A:15:DE:4E    54     153       57

Aux Serving Radio Results
************[ AP List ]***************
BSSID                RSSI   CHANNEL   Time
FC:58:9A:15:DE:4E     58     153       57
FC:58:9A:15:E2:4E     75     153       133

***********[ Best AP ]****************
BSSID                RSSI   CHANNEL   Time
FC:58:9A:15:DE:4E    58     153       57

Optimized roaming with dual-radio WGBs

Dual-radio WGBs are wireless workgroup bridges that

use two radios to enhance roaming efficiency,
minimize service disruption by skipping the active scanning phase with an existing scanning table, and
initiate roaming when beacon frames are missed or packet retry thresholds are reached.

From the Cisco IOS-XE 17.15.1 release, devices with dual-radio configurations have improved roaming efficiency. This reduces service downtime.

Trigger factors for roaming

Trigger factors for roaming include:

Low RSSI: Measures the power level that a wireless device, such as an AP, receives from a signal. Use RSSI values to determine the quality of the wireless connection to troubleshoot and optimize wireless networks.
Beacon miss-count: Indicates the number of consecutive beacon frames that a client device has missed from an AP in a wireless network.
Maximum packet retries: Specifies the maximum number of times a data packet can be retransmitted if the client device does not send an acknowledgement.

Configuration options for dual-radio

Here are the possible configurations for the IW9165E AP in a dual-radio setup:


Dual-radio	AP
5 GHz radio 1 + radio 2 (scanning only mode)	IW9165E
5 GHz radio 1 + radio 2 (aux-scan handoff mode)	IW9165E

Layer 2 NAT

One-to-one (1:1) Layer 2 NAT allows you to assign a unique public IP address to an existing private IP address (end device). This enables the end device to communicate with a public network.

Layer 2 NAT maintains two translation tables:

private-to-public subnet translations
public-to-private subnet translations

In industrial deployments, such as Human Machine Interfaces (HMIs) or robots, the same firmware is often programmed on every machine. This results in duplicate IP addresses across multiple devices. Layer 2 NAT resolves this issue by enabling devices with duplicate private IP addresses to communicate with public networks.

Configure Layer 2 NAT

The Layer 2 NAT (Network Address Translation) configuration commands are used to control IP address translation for wired clients within a VLAN at Layer 2.

These commands allow administrators to:

Enable or disable Layer 2 NAT globally on the device.
Define a default VLAN where NAT rules are applied.
Translate individual host addresses from private to public, or from public to private.
Translate entire subnets from private-to-public or public-to-private.

This configuration ensures seamless communication between private networks and external/public networks by dynamically or statically mapping IP addresses, while maintaining VLAN-based traffic segregation.

Procedure

	1.	Use the configure l2nat `{` enable `\|` disable`}` command to enable or disable Layer 2 NAT. `Device# configure l2nat enable`
	2.	Use the configure l2nat default-vlan vlan_id command to define the VLAN where all NAT rules are applied. `Device# configure l2nat default-vlan 10` Note If you do not specify a VLAN ID, VLAN 0 is used.
	3.	Use the configure l2nat `{` add `\|` delete`}` inside from host original_ip_addr to translated_ip_addr command to translate a private IP address of a wired client to a public IP address. `Device# configure l2nat add inside from host 192.168.1.10 to 203.0.113.10`
	4.	Use the configure l2nat `{` add `\|` delete`}` outside from host original_ip_addr to translated_ip_addr command to translate a public IP address to a private IP address. `Device# configure l2nat add outside from host 203.0.113.20 to 192.168.1.20`
	5.	Use the configure l2nat `{` add `\|` delete`}` inside from network original_nw_prefix to translated_nw_prefix subnet_mask command to translate a private subnet to a public subnet. `Device# configure l2nat add inside from network 192.168.1.0 to 203.0.113.0 255.255.255.0`
	6.	Use the configure l2nat `{` add `\|` delete`}` outside from network original_nw_prefix to translated_nw_prefix subnet_mask command to translate a public subnet to a private subnet. `Device# configure l2nat add outside from network 203.0.113.0 to 192.168.1.0 255.255.255.0`

Verify Layer 2 NAT Configuration

Use the following commands to verify Layer 2 NAT configuration, check translation statistics, and clear rules or counters for troubleshooting.

show l2nat entry: Displays the Layer 2 NAT running entries.
show l2nat config: Displays the Layer 2 NAT configuration details.
show l2nat stats: Displays the Layer 2 NAT packet translation statistics.
show l2nat rules: Displays the Layer 2 NAT rules from the configuration.
clear l2nat statistics: Clears packet translation statistics.
clear l2nat rule: Clears Layer 2 NAT rules.
clear l2nat config: Clears Layer 2 NAT configuration.
debug l2nat: Enables debugging of packet translation process.
debug l2nat all: Prints out the NAT entry match result when a packet arrives.

Caution

This command may create overwhelming log print in console. Console may lose response because of this command, especially when Syslog service is enabled with a broadcast address.

undebug l2nat: Disables debugging of packet translation process.

Configuration Example of Host IP Address Translation

In this scenario, the end client (172.16.1.36) connected to WGB needs to communicate with the server (192.168.150.56) connected to the gateway. Layer 2 NAT provides an address for the end client on the outside network (192.168.150.36) and an address for the server on the inside network (172.16.1.56).

Layer 2 NAT configuration example

This example displays Layer 2 NAT configuration details. In the output, I2O means 'inside to outside' and O2I means 'outside to inside.

Device# show l2nat config

L2NAT Configuration are:
===================================
Status: enabled
Default Vlan: 0
The Number of L2nat Rules: 4
Dir      Inside                    Outside                    Vlan
O2I      172.16.1.56               192.168.150.56             0
I2O      172.16.1.36               192.168.150.36             0
I2O      172.16.1.255              192.168.150.255            0
I2O      172.16.1.1                192.168.150.1              0

Layer 2 NAT rules example

This example displays the Layer 2 NAT rules.

Device# show l2nat rule

Dir      Inside                    Outside                    Vlan
O2I      172.16.1.56               192.168.150.56             0
I2O      172.16.1.36               192.168.150.36             0
I2O      172.16.1.255              192.168.150.255            0
I2O      172.16.1.1                192.168.150.1              0

Layer 2 NAT entries example

This example displays the current Layer 2 NAT entries.

Device# show l2nat entry

Direction            Original             Substitute             Age    Reversed
inside-to-outside    172.16.1.36@0        192.168.150. 36@0      -1     false
inside-to-outside    172.16.1.56@0        192.168.150. 56@0      -1     true
inside-to-outside    172.16.1.1@0         192.168.150. 1@0       -1     false
inside-to-outside    172.16.1.255@0       192.168.150. 255@0     -1     false
outside-to-inside    192.168.150.36@0     172.16.1.36@0          -1     true
outside-to-inside    192.168.150.56@0     172.16.1.56@0          -1     false
outside-to-inside    192.168.150.1@0      172.16.1.1@0           -1     true
outside-to-inside    192.168.150.255@0    172.16.1.255@0         -1     true

WGB wired clients example

This example displays the WGB wired clients over the bridge.

Before Layer 2 NAT is enabled:

Device# show wgb bridge
    ***Client ip table entries***
              mac vap     port vlan_id          seen_ip  confirm_ago  fast_brg
B8:AE:ED:7E:46:EB   0   wired0       0      172.16.1.36     0.360000      true
24:16:1B:F8:05:0F   0 wbridge1       0          0.0.0.0  3420.560000      true

After Layer 2 NAT is enabled:

Device# show wgb bridge
    ***Client ip table entries***
              mac vap     port vlan_id          seen_ip  confirm_ago  fast_brg
B8:AE:ED:7E:46:EB   0   wired0       0   192.168.150.36     0.440000      true
24:16:1B:F8:05:0F   0 wbridge1       0          0.0.0.0  3502.220000      true

Note

If the wired client in NAT experiences E2E traffic issues, you can restart the client registration process by using the clear wgb client single command:

Layer 2 NAT packet translation statistics example

This example displays the Layer 2 NAT packet translation statistics.

Device# show l2nat stats

Direction          Original              Substitute            ARP  IP   ICMP UDP  TCP
inside-to-outside  172.16.1.1@2660       192.168.150.1@2660    1    4    4    0    0
inside-to-outside  172.16.1.36@2660      192.168.150.36@2660   3    129  32   90   1
inside-to-outside  172.16.1.56@2660      192.168.150.56@2660   2    114  28   85   1
inside-to-outside  172.16.1.255@2660     192.168.150.255@2660  0    0    0    0    0
outside-to-inside  192.168.150.1@2660    172.16.1.1@2660       1    4    4    0    0
outside-to-inside  192.168.150.36@2660   172.16.1.36@2660      3    39   38   0    1
outside-to-inside  192.168.150.56@2660   172.16.1.56@2660      2    35   34   0    1
outside-to-inside  192.168.150.255@2660  172.16.1.255@2660     0    0    0    0    0

Note

To reset the statistics, you can use the clear l2nat stats command.

Configuration Example of Network Address Translation

In this scenario, Layer 2 NAT translates inside addresses in the 172.16.1.0/24 subnet to addresses in the 192.168.150.0/24 subnet, replacing only the network prefix during translation. The host bits remain the same.

The command used for this scenario is here:

Device# configure l2nat add inside from network 172.16.1.0 to 192.168.150.0 255.255.255.0

Native VLAN on Ethernet Ports

In a typical Workgroup Bridge (WGB) deployment, a single wired client connects directly to the WGB Ethernet port. Consequently, the wired client traffic must reside on the same VLAN as the WGB management VLAN. If you require the wired client traffic to be on a different VLAN than the WGB management VLAN, configure the native VLAN on the Ethernet port.

Configuring native VLAN ID per Ethernet port is not supported. Both Ethernet ports share the same native VLAN configuration.

Caution

When WGB broadcast tagging is enabled and a single wired passive client connects directly to the WGB Ethernet port, an issue may arise where the infrastructure downstream (DS) side client fails to ping the WGB behind the passive client. To resolve this, configure the following commands: configure wgb ethport native-vlan enable and configure wgb ethport native-vlan id X, where X is the same VLAN as the WGB management VLAN.

To verify your configuration, use the show wgb ethport config or show running-config command.

Configure Native VLAN on Ethernet Ports

The native VLAN configuration commands are used to manage how untagged traffic is handled on the Workgroup Bridge (WGB) Ethernet port.

These commands allow administrators to:

Enable or disable native VLAN configuration on the WGB Ethernet port.
Specify the native VLAN ID to ensure that untagged traffic is correctly assigned to the intended VLAN.

Procedure

	1.	Use the config wgb ethport ethport native-vlan `{` enable `\|` disable `}` command to enable or disable native VLAN configuration. `Device# config wgb ethport 1 native-vlan enable`
	2.	Use the config wgb ethport ethport native-vlan vlan_id command to specify the native VLAN ID. `Device# config wgb ethport native-vlan id 2735`
	3.	(Optional) Use the show wgb ethport config or show running-config command to verify your configuration. `Device# show wgb ethport config`

Low latency profile

Low latency profiles are configurations that optimize IEEE 802.11 networks to meet the low latency and Quality of Service requirements essential for IoT applications.

Enhanced Distributed Channel Access (EDCA): Prioritizes wireless channel access for latency-sensitive traffic to ensure consistent performance.
Aggregated MAC Protocol Data Unit (AMPDU): Combines multiple data frames into a single transmission to reduce overhead and improve efficiency.
Packet Retry: Ensures successful data delivery by retransmitting aggregated or individual packets based on network conditions.

IoT Application Support

These features collectively support the deployment of IoT devices and applications that demand low latency and high Quality of Service in wireless environments.

Enable or disable an optimized-video EDCA profile

Configure an optimized low-latency profile for video use cases to improve video performance by reducing delays and enhancing the quality of service.

This task focuses on enabling or disabling the optimized-video EDCA profile on a specific radio interface of WGB. The optimized-video profile ensures better handling of video traffic by prioritizing it in the network.

Procedure

Enable or disable the optimized-video EDCA profile on a specific radio interface of WGB using one of the options.

Option	Description
Enable optimized video EDCA profile	Use the configure dot11Radio radio_slot_id profile optimized-video enable command. `Device# configure dot11Radio 1 profile optimized-video enable`
Disable optimized video EDCA profile	Use the configure dot11Radio radio_slot_id profile optimized-video disable command. `Device# configure dot11Radio 1 profile optimized-video disable`

(Optional) Use the show controllers dot11Radio radio_slot_id command to verify the configuration:

Device# show controllers dot11Radio 1
EDCA profile: optimized-video
EDCA in use
=============
AC Type CwMin CwMax Aifs Txop ACM
AC_BE L 4 10 11 0 0
AC_BK L 6 10 11 0 0
AC_VI L 3 4 2 94 0
AC_VO L 2 3 1 47 0

Packet parameters in use
=============
wbridge1 A-MPDU Priority 0: Enabled
wbridge1 A-MPDU Priority 1: Enabled
wbridge1 A-MPDU Priority 2: Enabled
wbridge1 A-MPDU Priority 3: Enabled
wbridge1 A-MPDU Priority 4: Disabled
wbridge1 A-MPDU Priority 5: Disabled
wbridge1 A-MPDU Priority 6: Disabled
wbridge1 A-MPDU Priority 7: Disabled
wbridge1 A-MPDU subframe number: 3
wbridge1 Packet retries drop threshold: 16

Enable or disable optimized-automation EDCA profile

Enable the optimized low-latency profile for automation use cases to improve performance and efficiency in wireless network environments.

Procedure

Enable or disable the optimized-video EDCA profile on a specific radio interface of WGB using one of the options.

Option	Description
Enable optimized-automation EDCA profile	Use the configure dot11Radio radio_slot_id profile optimized-automation enable command. `Device# configure dot11Radio 1 profile optimized-automation enable`
Disable optimized-automation EDCA profile	Use the configure dot11Radio radio_slot_id profile optimized-automation disable command. `Device# configure dot11Radio 1 profile optimized-automation disable`

(Optional) Use the show controllers dot11Radio radio_slot_id command to verify the configuration:

Device# show controllers dot11Radio 1

EDCA profile: optimized-automation
EDCA in use
=============
AC Type CwMin CwMax Aifs Txop ACM
AC_BE L 7 10 12 0 0
AC_BK L 8 10 12 0 0
AC_VI L 7 7 3 0 0
AC_VO L 3 3 1 0 0

Packet parameters in use
=============
wbridge1 A-MPDU Priority 0: Enabled
wbridge1 A-MPDU Priority 1: Enabled
wbridge1 A-MPDU Priority 2: Enabled
wbridge1 A-MPDU Priority 3: Enabled
wbridge1 A-MPDU Priority 4: Disabled
wbridge1 A-MPDU Priority 5: Disabled
wbridge1 A-MPDU Priority 6: Disabled
wbridge1 A-MPDU Priority 7: Disabled
wbridge1 A-MPDU subframe number: 3
wbridge1 Packet retries drop threshold: 16

Configure customized-wmm EDCA profile

Customize the Wi-Fi Multimedia (WMM) profile to optimize traffic queues and improve QoS for specific types of network traffic.

WMM enhances the performance of Wi-Fi networks by prioritizing traffic based on the type of data being transmitted. Configuring a customized WMM EDCA (Enhanced Distributed Channel Access) profile allows you to fine-tune the performance parameters for voice, video, background, and best-effort traffic.

Procedure

	1.	Use the configure dot11Radio radio_slot_id profile customized-wmm enable command to enable the customized WMM profile. `Device# configure dot11Radio 1 profile customized-wmm enable`
	2.	Use the configure dot11Radio {0\| 1\|2}wmm {be\| vi\| vo\| bk}{cwmin cwmin_num \|cwmax cwmax_num \| aifs aifs_num \|txoplimit txoplimit_num} command to configure customized WMM profile parameters. `configure dot11Radio 1 wmm vo cwmin 3` Parameter descriptions: be—best-effort traffic queue (CS0 and CS3) bk—background traffic queue (CS1 and CS2) vi—video traffic queue (CS4 and CS5) vo—voice traffic queue (CS6 and CS7) aifs—Arbitration Inter-Frame Spacing, <1-15> in units of slot time cwmin—Contention Window min, <0-15> 2^n-1, in units of slot time cwmax—Contention Window max, <0-15> 2^n-1, in units of slot time txoplimit—Transmission opportunity time, <0-255> integer number, in units of 32us
	3.	(Optional) Disable the customized WMM profile. Use the configure dot11Radio radio_slot_id profile customized-wmm disable command to disable the customized WMM profile. `Device#configure dot11Radio 1 profile customized-wmm disable`

Configure EDCA parameters using Controller GUI

Configure Enhanced Distributed Channel Access (EDCA) parameters to optimize wireless channel access for voice, video, and other QoS traffic.

Procedure

	1.	Navigate to Configuration > Radio Configurations > Parameters. This page allows you to configure global parameters for 6 GHz, 5 GHz, and 2.4 GHz radios. Note You cannot configure or modify parameters, if the radio network is enabled. Disable the network status on the Configuration > Radio Configurations > Network page to continue.
	2.	In the EDCA Parameters section, choose an EDCA profile from the EDCA Profile drop-down list. EDCA parameters provide preferential wireless channel access for voice, video, and other QoS traffic.
	3.	Click Apply.

Configure EDCA parameters using Controller CLI

To optimize wireless network performance for IoT low-latency applications by adjusting Enhanced Distributed Channel Access (EDCA) parameters.

Perform these steps on the command-line interface (CLI) of a Cisco Wireless Controller.

Procedure

	1.	Use the configure terminal command to enter the global configuration mode. `Device# configure terminal`
	2.	Use the ap dot11 {5ghz \| 24ghz \| 6ghz } shutdown command to disable the radio network. `Device(config)# ap dot11 5ghz shutdown`
	3.	Use the ap dot11 {5ghz \| 24ghz \| 6ghz } edca-parameters iot-low-latency command to enable the iot-low-latency EDCA profile for the 5 GHz, 2.4 GHz, or 6 GHz network. `Device(config)# ap dot11 5ghz edca-parameters iot-low-latency`
	4.	Use the no ap dot11 {5ghz \| 24ghz \| 6ghz } shutdown command to enable the radio network. `Device(config)# no ap dot11 5ghz shutdown`
	5.	Use the end command to return to privileged EXEC mode. `Device(config)# end`
	6.	(Optional) Use the show ap dot11 {5ghz \| 24ghz \| 6ghz } network command to view the current configuration. `Device# show ap dot11 5ghz network EDCA profile type check : iot-low-latency`

A-MPDU

Aggregation is the process of grouping multiple packet data frames into a single larger frame for transmission, rather than sending them individually. This method enhances efficiency and reduces overhead in wireless communications. Two common aggregation methods are Aggregated MAC Protocol Data Unit (A-MPDU) and Aggregated MAC Service Data Unit (A-MSDU). A-MPDU parameters specifically define the size of the aggregated packet and the necessary spacing between aggregated packets, allowing the receiving WLAN station to properly decode the data.

Configure A-MPDU

Before you begin

Configure A-MPDU parameters to optimize the aggregation and transmission of packet data frames, ensuring efficient decoding by WLAN stations.

Procedure

	1.	Use the ap dot11 {5ghz \| 24ghz \| 6ghz } rf-profile profile-name command to configure profile-based A-MPDU parameters. `Device# ap dot11 5ghz rf-profile Video-Optimized`
	2.	Use the dot11n a-mpdu tx block-ack window-size window-size command to configure transmission block-acknowledgment (block-ack) window size. `Device(config-rf-profile)# dot11n a-mpdu tx block-ack window-size 64` Note RF profile level configured value takes preference over globally configured value.
	3.	Use the exit command to return to global configuration mode. `Device(config-rf-profile)# exit`
	4.	Use the ap dot11 {5ghz \| 24ghz \| 6ghz } dot11n a-mpdu tx block-ack window-size window-size command to configure transmission block-acknowledgment window size globally. `Device(config)# ap dot11 24ghz dot11n a-mpdu tx block-ack window-size 32`
	5.	Use the wireless tag rf rf-tag-name command to create an RF tag. `Device(config)# wireless tag rf Branch-RF-Tag`
	6.	Use the 5ghz-rf-policy rf-profile-name command to bind RF tags to RF profiles and to apply them to specific radios. `Device(config-wireless-rf-tag)# 5ghz-rf-policy Video-Optimized`
	7.	Use the end command to return to privileged EXEC mode. `Device(config-wireless-rf-tag)# end`
	8.	(Optional) Use the show controllers dot11Radio radio_slot_id command to show the configured A-MPDU length value. `Device# show controllers dot11Radio 1 Radio Aggregation Config: ========================= TX A-MPDU Priority: 0x3f TX A-MSDU Priority: 0x3f TX A-MPDU Window: 0x7f`

SNMP features

The Simple Network Management Protocol (SNMP) on WGB is a functional element that

facilitates monitoring and management of the WGB device through the SNMP protocol,
includes roles for information exchange (manager, agent, MIB), and
supports network health assessment and parameter configuration.

The SNMP framework on WGB includes:

SNMP Manager: Controls and monitors the activities of network devices using SNMP, typically implemented as a network management system (NMS).
SNMP Agent: The software component within the managed device that maintains and reports device data.
SNMP MIB: A collection of managed objects (variables) which can be queried or set by the SNMP manager.

SNMP process

This illustration shows the SNMP process. When an SNMP manager requests data, the agent receives the request and relays it to the subagent, which responds. The agent then sends an SNMP response packet to the manager.

SNMP versions

Cisco IOS software supports the following versions of SNMP:

SNMPv2c—The community-string-based administrative framework for SNMPv2. SNMPv2c is an update of the protocol operations and data types of SNMPv2p (SNMPv2 classic), and uses the community-based security model of SNMPv1.
SNMPv3—Version 3 of SNMP. SNMPv3 uses the following security features to provide secure access to devices:
- Message integrity—Ensuring that a packet has not been tampered with in transit.
- Authentication—Determining that the message is from a valid source.
- Encryption—Scrambling the contents of a packet to prevent it from being learned by an unauthorized source.

Supported SNMP MIB files

The Management Information Base (MIB) is a database containing objects that can be managed on a device. These managed objects, also called variables, can be set or read to provide information about network devices and interfaces. The objects are organized in a hierarchical structure and are grouped in collections identified by object identifiers. Access to MIBs is provided through network management protocols such as SNMP.

The MIB module provides network management information on IEEE 802.11 wireless device association management and data packet forwarding configuration and statistics.

An Object Identifier (OID) uniquely identifies a MIB object on a managed network device. The OID shows the object's location in the MIB hierarchy and provides a way to access the MIB object in a network of managed devices.

Supported OIDs

The list of objects that are supported by the SNMP Management and Information Base (MIB):

CISCO-DOT11-ASSOCIATION-MIB OIDs are given here.

Table 1. Supported OIDs
OID Object Name	OID	OID Type	OID Description
cDot11ParentAddress	1.3.6.1.4.1.9.9.273.1.1.1	String	Provides the MAC address of the parent access point.
cDot11ActiveWirelessClients	1.3.6.1.4.1.9.9.273.1.1.2.1.1	Gauge	The device on this interface is currently associating with the number of wireless clients.
cDot11ActiveBridges	1.3.6.1.4.1.9.9.273.1.1.2.1.2	Gauge	The device on this interface is currently associating with the number of bridges.
cDot11ActiveRepeaters	1.3.6.1.4.1.9.9.273.1.1.2.1.3	Gauge	The device on the interface is currently associating with the number of repeaters.
cDot11AssStatsAssociated	1.3.6.1.4.1.9.9.273.1.1.3.1.1	Counter	When device restarts, the object counts the number of stations associated with the device on the interface.
cDot11AssStatsAuthenticated	1.3.6.1.4.1.9.9.273.1.1.3.1.2	Counter	When the device restarted, it currently counts the number of stations authenticated with the device on the interface.
cDot11AssStatsRoamedIn	1.3.6.1.4.1.9.9.273.1.1.3.1.3	Counter	When the device restarted, the object counts the number of stations roamed from another device to the device on the interface.
cDot11AssStatsRoamedAway	1.3.6.1.4.1.9.9.273.1.1.3.1.4	Counter	This object counts the number of stations roamed away from the device on the interface since device re-started.
cDot11AssStatsDeauthenticated	1.3.6.1.4.1.9.9.273.1.1.3.1.5	Counter	This object counts the number of stations deauthenticated with this device on the interface since device re-started
cDot11AssStatsDisassociated	1.3.6.1.4.1.9.9.273.1.1.3.1.6	Counter	This object counts the number of stations disassociated with this device on the interface since device re-started
cd11IfCipherMicFailClientAddress	1.3.6.1.4.1.9.9.273.1.1.4.1.1	String	This is MAC address of the client attached to the radio interface that caused the most recent MIC failure
cd11IfCipherTkipLocalMicFailures	1.3.6.1.4.1.9.9.273.1.1.4.1.2	Counter	When the device restarted, the object counts the number of MIC failures encountered on the radio interface.
cd11IfCipherTkipRemotMicFailures	1.3.6.1.4.1.9.9.273.1.1.4.1.3	Counter	When the device restarted, the object counts the number of MIC failures reported by clients on the radio interface.
cd11IfCipherTkipCounterMeasInvok	1.3.6.1.4.1.9.9.273.1.1.4.1.4	Counter	When the device restarted, the object counts the number of TKIP Counter Measures invoked on the interface.
cd11IfCipherCcmpReplaysDiscarded	1.3.6.1.4.1.9.9.273.1.1.4.1.5	Counter	When the device restarted, the object counts the number of received unicast fragments discarded by replay mechanism on the interface.
cd11IfCipherTkipReplaysDetected	1.3.6.1.4.1.9.9.273.1.1.4.1.6		When the device restarted, the object counts the number of TKIP replay errors detected on this interface.
cDot11ClientRoleClassType	1.3.6.1.4.1.9.9.273.1.2.1.1.3	Counter	The role classification of the client
cDot11ClientDevType	1.3.6.1.4.1.9.9.273.1.2.1.1.4	EnumVal	The device type of the client.
cDot11ClientRadioType	1.3.6.1.4.1.9.9.273.1.2.1.1.5	EnumVal	The radio classification of the client.
cDot11ClientWepEnabled	1.3.6.1.4.1.9.9.273.1.2.1.1.6	EnumVal	Whether WEP key mechanism is used for transmitting frames of data for the client
cDot11ClientWepKeyMixEnabled	1.3.6.1.4.1.9.9.273.1.2.1.1.7	EnumVal	Whether this client is using WEP key mixing
cDot11ClientMicEnabled	1.3.6.1.4.1.9.9.273.1.2.1.1.8	EnumVal	Whether the MIC is enabled for the client
cDot11ClientPowerSaveMode	1.3.6.1.4.1.9.9.273.1.2.1.1.9	EnumVal	The power management mode of the client.
cDot11ClientAid	1.3.6.1.4.1.9.9.273.1.2.1.1.10	Gauge	This is the association identification number of clients or multicast addresses associating with the device.
cDot11ClientDataRateSet	1.3.6.1.4.1.9.9.273.1.2.1.1.11	String	Is a set of data rates at which this client can transmit and receive data
cDot11ClientSoftwareVersion	1.3.6.1.4.1.9.9.273.1.2.1.1.12	String	Cisco IOS software version
cDot11ClientName	1.3.6.1.4.1.9.9.273.1.2.1.1.13	String	Cisco IOS device hostname
cDot11ClientAssociationState	1.3.6.1.4.1.9.9.273.1.2.1.1.14	EnumVal	The object indicates the state of the authentication and association process
cDot11ClientVlanId	1.3.6.1.4.1.9.9.273.1.2.1.1.17	Gauge	The VLAN which the wireless client is assigned to when it is successfully associated to the wireless station.
cDot11ClientSubIfIndex	1.3.6.1.4.1.9.9.273.1.2.1.1.18	Integer	This is the ifIndex of the sub-interface which this wireless client is assigned to when it is successfully associated to the wireless station.
cDot11ClientAuthenAlgorithm	1.3.6.1.4.1.9.9.273.1.2.1.1.19	EnumVal	The IEEE 802.1x authentication methods performed between the wireless station and this client during association
cDot11ClientDot1xAuthenAlgorithm	1.3.6.1.4.1.9.9.273.1.2.1.1.21	Octet String	The IEEE 802.1x authentication methods performed between the wireless client and the authentication server.
cDot11ClientUpTime	1.3.6.1.4.1.9.9.273.1.3.1.1.2	Gauge	The time in seconds that this client has been associated with this device
cDot11ClientSignalStrength	1.3.6.1.4.1.9.9.273.1.3.1.1.3	Integer	The device-dependent measure the signal strength of the most recently received packet from the client.
cDot11ClientSigQuality	1.3.6.1.4.1.9.9.273.1.3.1.1.4	Gauge	The device-dependent measure the signal quality of the most recently received packet from the client.
cDot11ClientPacketsReceived	1.3.6.1.4.1.9.9.273.1.3.1.1.6	Counter	The number of packets received from this client.
cDot11ClientBytesReceived	1.3.6.1.4.1.9.9.273.1.3.1.1.7	Counter	The number of bytes received from the client.
cDot11ClientPacketsSent	1.3.6.1.4.1.9.9.273.1.3.1.1.8	Counter	The number of packets sent to the client.
cDot11ClientBytesSent	1.3.6.1.4.1.9.9.273.1.3.1.1.9	Counter	The number of bytes sent to the client.
cDot11ClientMsduRetries	1.3.6.1.4.1.9.9.273.1.3.1.1.11	Counter	The counter increases when it successfully transmits an MSDU after one or more retransmissions.
cDot11ClientMsduFails	1.3.6.1.4.1.9.9.273.1.3.1.1.12	Counter	The counter increments when the client fails to transmit an MSDU successfully because the number of transmit attempts exceeds a certain limit.

Configure SNMP parameters

This procedure describes how to configure Simple Network Management Protocol (SNMP) on the WGB. You can enable SNMPv2c or SNMPv3 depending on your network requirements. The steps include setting community strings or usernames, defining authentication and encryption methods, and enabling SNMP functionality on the device.

Configure all SNMP parameters before enabling the SNMP feature using the CLI command: configure snmp enabled.
All SNMP configurations will be automatically removed when the SNMP feature is disabled.

Procedure

	1.	Use the configure snmp v2c community-id length length command to enter the SNMP v2c community ID (SNMP v2c only). `Device#configure snmp v2c community-id 50`
	2.	Use the configure snmp version {v2c \| v3 } command to specify the SNMP protocol version. `Device# configure snmp version v3`
	3.	Use the configure snmp auth-method {md5 \| sha } command to specify the SNMP v3 authentication protocol (SNMP v3 only). `Device# configure snmp auth-method md5`
	4.	Use the configure snmp v3 username length length command to enter the SNMP v3 username (SNMP v3 only). `Device# configure snmp v3 username length 32`
	5.	Use the configure snmp v3 password length length command to enter the SNMP v3 user password (SNMP v3 only). `Device# configure snmp v3 password length 12` The valid range for length is 8 to 64 characters.
	6.	Use the configure snmp encryption {des \| aes \| none } command to specify the SNMP v3 encryption protocol (SNMP v3 only). `Device#configure snmp encryption des` Encryption values are des or aes . Use none if a v3 encryption protocol is not needed.
	7.	Use the configure snmp secret length length command to enter the SNMP v3 encryption passphrase (SNMP v3 only). `Device#configure snmp secret length 12` The valid range for length is 8 to 64 characters.
	8.	Use the configure snmp enabled command to enable SNMP functionality on the WGB. `Device#configure snmp enabled` To configure SNMP v2c, repeat Step 1, Step 2 and Step 8. To configure SNMP v3, repeat Step 2 through Step 8.
	9.	(Optional) Use the configure snmp disabled command to disable SNMP configuration. `Device# configure snmp disabled`

SNMP configuration examples

Configuring SNMP v2c:

Device#configure snmp v2 community-id 25
Device#configure snmp version v2c
Device#configure snmp enabled

Configuring SNMP v3 (security level AuthPriv):

Device#configure snmp auth-method md5
Device#configure snmp v3 username length 32
Device#configure snmp v3 password length 25
Device#configure snmp secret length 12
Device#configure snmp encryption aes
Device#configure snmp version v3
Device#configure snmp enabled

Configuring SNMP v3 (security level AuthNoPriv):

Device#configure snmp auth-method md5
Device#configure snmp v3 username length 32
Device#configure snmp v3 password length 32
Device#configure snmp encryption none
Device#configure snmp version v3
Device#configure snmp enabled

Verifying SNMP

Use the show snmp command to verify the SNMP configuration.

SNMP version v3

Device# show snmp

SNMP: enabled
Version: v3
Community ID: test
Username: username
Password: password
Authentication method: SHA
Encryption: AES
Encryption Passphrase: passphrase
Engine ID: 0x8000000903c0f87fe5f314

SNMP version v2c

Device# show snmp

SNMP: enabled
Version: v2c
Community ID: test
Username: username
Password: password
Authentication method: SHA
Encryption: AES
Encryption Passphrase: passphrase
Engine ID: 0x8000000903c0f87fe5f314

QoS ACL classification and marking

Quality of Service (QoS) ACL classification and marking identify network traffic using access control list (ACL) rules and assign a traffic class or priority value.

Classification uses ACLs to match traffic flows based on parameters such as source or destination IP address, protocol type, port numbers, or other header fields.
Marking occurs after classification, where packets are tagged with specific QoS values, such as DSCP, IP precedence, or CoS, to indicate their priority level.

Starting with Cisco Unified Industrial Wireless Software Release 17.14.1, you can classify packets from two wired ports and assign them to different access control driver queues. In addition to TCP and UDP, the WGB supports ethertype-based and DSCP-based classification to meet jitter and latency requirements.

Rule-based traffic classifications

A rule-based traffic classification is a network management technique that:

uses custom rules to classify incoming Ethernet packets by criteria such as 802.1p, DSCP, and protocol type,
assigns classified packets to priority queues on the wireless side for QoS enforcement, and
ensures critical services receive higher priority, reducing latency and optimizing network performance.

Rule configuration criteria

You can configure mapping rules using the following parameters:

Ethernet type (for example, Profinet)
Transport layer port numbers or port ranges
DSCP values
Source and destination IP addresses
Protocol types

Packet classification and assignment

As incoming packets arrive at the Ethernet port, WGB applies the defined rules to:

Identify critical services or traffic flows
Classify packets based on predefined criteria
Assign packets to the appropriate access control queues on the wireless network

Benefits of rule-based mapping

By using customized rule-based classification and mapping, you can:

Enforce QoS policies effectively
Prioritize critical applications and services
Reduce latency for time-sensitive traffic
Improve overall network performance and user experience

QoS and ACL traffic classification methods

Traffic classification is the process of distinguishing one type of network traffic from another by examining packet fields. It is enabled only when QoS is active. During classification, the device performs a lookup and assigns a QoS label to the packet. The QoS label defines the QoS actions to be applied and identifies the output queue for forwarding.

Classification relies on fields across packet layers
Packets are grouped into service classes based on Ethertype, DSCP, or TCP/UDP ports, and consistently treated within those classes.
The data plane records rule hits for analysis, while the control plane configures data forwarding.

Layer 2 classification fields

Layer 2 Ethernet frames use the Ethertype field (2 bytes) to carry classification information. This field normally indicates the type of data encapsulated in the frames.

Layer 3 classification fields

Layer 3 IP packets carry classification information in the Type of Service (ToS) field (8 bits). It has:

IP precedence values that range from 0–7, and
DSCP values that range from 0–63.

Layer 4 classification fields

Layer 4 TCP segments or UDP datagrams use the source or destination port fields for classification. These port numbers allow devices to classify traffic based on applications or services.

Traffic assignment to service classes

The system assigns traffic to a specific service class based on Ethertype, DSCP, or UDP/TCP port (or port range). Packets within a service class are treated consistently. WGBs classify packets from wired ports and map them to different driver queues according to user configuration.

Data plane role in classification

Data plane statistics provide counters showing how many times each rule is matched by traffic. These counters help administrators analyze rule effectiveness and optimize performance.

Control plane role in classification

The control plane is responsible for managing and configuring how data is forwarded through the network.

The following flowchart illustrates how packets from a WGB Ethernet port are classified and mapped to QoS rules based on existing profiles, Ethertype, port identifiers, and DSCP values.

Figure 2. Flowchart of traffic flows from WGB ethernet port

Legacy QoS mapping behavior

Summary

Access points assign traffic priority by retrieving VLAN-based TCI values, applying a fixed priority of 6 for Profinet, and using DSCP-to-dot1p mapping for IP and IPv6 traffic.

Workflow

Access points determine traffic priority based on ethertype using the following rules:

Retrieve TCI Priority: Access points retrieve the Tag Control Information (TCI) priority from the VLAN element for the specified ethertype 0x8100.
Assign TCI Priority for Profinet: For ethertype 0x8892 (profinet), access points assign the TCI priority as 6.
Set DSCP Priority for IP and IPv6: For ethertype 0x0800 (IP) and 0x86DD (IPv6), access points set the DSCP priority according to the default dscp2dot1p mapping table.

How Access Points assign QoS priorities

Summary

Access points assign QoS priorities based on protocol type and configured rules, with defaults applied for non-IP traffic or when no rules are set.

Workflow

Here's how the process of enabling QoS on access points works:

The access point determines the priority for an ethertype QoS mapping of 0x8892 (profinet) based on the configuration setting.
For ethertypes 0x0800 (IP) and 0x86DD (IPv6), the access point assigns priority according to mapping rules that consider either the port or DSCP:
- The access point checks the UDP/TCP port (or port range) rule.
- The access point checks the DSCP rule.
The access point assigns a user priority value of 0 to packets that are not IPv4/IPv6.
If no rule configuration is present, the QoS profile defaults to the legacy mapping behavior.
Note

If 802.1p priority exists, it overrides any customised rule.

Configure QoS Mapping Profile

This procedure allows you to define the different classification rules for configuring WGB QoS mapping.

Procedure

	1.	Use the config wgb qos-mapping profile-name enable command to enable the specified QoS mapping profile. `Device# configure wgb qos-mapping demo-profile enable`
	2.	Use the config wgb qos-mapping profile-name add ethtype hex hex-number priority priority command to add a mapping rule based on Ethernet type. `Device# configure wgb qos-mapping demo-profile add ethtype hex 8892 priority 5` Note If the specified profile does not exist, the command creates a new empty profile and adds the mapping rule to it. You can delete the rules based on ethernet type using the config wgb qos-mapping profile-name delete ethtype hex hex-number Note If the specified profile does not exist, the command displays a warning. If deleting the mapping rule leaves the profile empty, the profile is automatically removed.
	3.	Use the config wgb qos-mapping profile-name add [srcport number \| dstport number \| range start-number ending-number ] priority priority command to add a mapping rule based on port ID or range. `Device# config wgb qos-mapping voice-profile add dstport 5004 priority 6` Note If the specified profile does not exist, the command creates a new empty profile and adds the mapping rule. You can delete rules based on port-id/range using the config wgb qos-mapping profile-name delete [srcport number \| range start-number ending-number [dstport number \| range start-number ending-number ]] Note If the specified profile does not exist, the command displays a warning. If deleting the mapping rule leaves the profile empty, the profile is automatically removed.
	4.	Use the config wgb qos-mapping profile-name add dscp number priority priority command to add a mapping rule based on DSCP value. `Device# configure wgb qos-mapping demo-profile add dscp 63 priority 4` Note If the specified profile does not exist, the command creates a new empty profile and adds the mapping rule. You can delete a mapping rule based on DSCP value using the config wgb qos-mapping profile-name delete dscp number priority priority command. Note If the specified profile does not exist, the command displays a warning. If deleting the mapping rule leaves the profile empty, the profile is automatically removed. After deleting the DSCP mapping rule, the rules are reset to the default values of the DSCP mapping.
	5.	Use the config wgb qos-mapping profile-name disable command to disable the specified QoS mapping profile. `Device# configure wgb qos-mapping demo-profile disable` When disabled, the profile is cleared from the datapath but retained in the WGB configuration file. If the profile does not exist, a warning is issued and no new profile is created.
	6.	(Optional) Use the config wgb qos-mapping profile-name delete command to delete the specified QoS mapping profile. `Device# configure wgb qos-mapping demo-profile delete` When deleted, the profile is removed from both the datapath and the WGB configuration.

Verify Quality of Service Map

To verify the QoS mapping configuration on the Control Plane, run the show wgb qos-mapping .

Device# show wgb qos-mapping

Number of QoS Mapping Profiles: 2
====================================
Profile name : qos1
Profile status : active
Number of Rules: 8
Rules:
L4 srcport : 31000-31100, dstport : 6666-7777, priority : 7
L4 srcport : 23000, dstport : N/A, priority : 3
L4 srcport : N/A, dstport : 20000-20100, priority : 5
L4 srcport : N/A, dstport : 2222, priority : 2
L4 srcport : 12300-12500, dstport : N/A, priority : 6
IPv4/IPv6 dscp: 43, priority : 1
Ethernet type : 0x8892, priority : 0
L4 srcport : 8888, dstport : 9999, priority : 4

Profile name : qos2
Profile status : inactive
Number of Rules: 8
Rules:
L4 srcport : 31000-31100, dstport : 6666-7777, priority : 2
L4 srcport : 23000, dstport : N/A, priority : 6
L4 srcport : N/A, dstport : 20000-20100, priority : 4
L4 srcport : N/A, dstport : 2222, priority : 7
L4 srcport : 12300-12500, dstport : N/A, priority : 3
IPv4/IPv6 dscp: 43, priority : 0
Ethernet type : 0x8892, priority : 1
L4 srcport : 8888, dstport : 9999, priority : 5

To verify the WGB QoS mapping configuration on the Data Plane, run the show datapath qos-mapping rule .

Device# show datapath qos-mapping rule

Status: active
QoS Mapping entries
======= dscp mapping =======
Default dscp2dot1p Table Value:
[0]->0 [1]->0 [2]->0 [3]->0 [4]->0 [5]->0 [6]->0 [7]->0
[8]->1 [9]->1 [10]->1 [11]->1 [12]->1 [13]->1 [14]->1 [15]->1
[16]->2 [17]->2 [18]->2 [19]->2 [20]->2 [21]->2 [22]->2 [23]->2
[24]->3 [25]->3 [26]->3 [27]->3 [28]->3 [29]->3 [30]->3 [31]->3
[32]->4 [33]->4 [34]->4 [35]->4 [36]->4 [37]->4 [38]->4 [39]->4
[40]->5 [41]->5 [42]->5 [43]->5 [44]->5 [45]->5 [46]->5 [47]->5
[48]->6 [49]->6 [50]->6 [51]->6 [52]->6 [53]->6 [54]->6 [55]->6
[56]->7 [57]->7 [58]->7 [59]->7 [60]->7 [61]->7 [62]->7 [63]->7

active dscp2dot1p Table Value:
[0]->0 [1]->0 [2]->0 [3]->0 [4]->0 [5]->0 [6]->0 [7]->0
[8]->1 [9]->1 [10]->1 [11]->1 [12]->1 [13]->1 [14]->1 [15]->1
[16]->7 [17]->2 [18]->2 [19]->2 [20]->2 [21]->2 [22]->2 [23]->2
[24]->3 [25]->3 [26]->3 [27]->3 [28]->3 [29]->3 [30]->3 [31]->3
[32]->4 [33]->4 [34]->4 [35]->4 [36]->4 [37]->4 [38]->4 [39]->4
[40]->5 [41]->5 [42]->5 [43]->5 [44]->5 [45]->5 [46]->5 [47]->5
[48]->6 [49]->6 [50]->6 [51]->6 [52]->6 [53]->6 [54]->6 [55]->6
[56]->7 [57]->7 [58]->7 [59]->7 [60]->7 [61]->7 [62]->7 [63]->7

To verify the WGB QoS mapping statistics on Data Plane, run the show datapath qos-mapping statistics command.

Device# show datapath qos-mapping statistics

======= pkt stats per dscp-mapping rule =======
dscp up pkt_cnt
16 7 0

To clear the WGB QoS mapping statistics on Data Plane, run the clear datapath qos-mapping statistics command.

Note

The command clears packet count statistics per rule on data-plane.

Packet Capture: TCP dump utilities

TCP dump utilities are network packet analyzers that perform the following functions:

Capture packets transmitted over network interfaces.
Display and save packet data for monitoring and troubleshooting.
Enable in-depth analysis of wired network traffic on WGBs.

The TCP Dump on WGB chapter provides information on how to enable TCP dump through the WGB wired interface on the Catalyst IW9167EH .

Packet Capture Modes and Capabilities

The WGB packet capture utility supports the following modes and behaviors:

Default: Displays captured packets with header in real time on the WGB terminal.
Verbose: Parses and prints real-time packets on the WGB terminal, displaying headers and data in hexadecimal format.
Capture: Captures packets to file storage instead of printing them in real time.

Note

The TCP dump utility does not support the simultaneous capture of packets to storage and printing them on the WGB terminal.

Note

In default or verbose mode, the WGB terminal can print a maximum of 1000 packet entries.

Note

Every round of Packet Capture (PCAP) clears the existing PCAP file. Before any new PCAP session, transfer the current PCAP file to an external server to prevent it from being overwritten. PCAP stops automatically when the PCAP file reaches a size of 100 MB.

The utility supports various protocol filters for debugging, including:

Transmission Control Protocol, Internet Control Message Protocol (ICMP) and ICMPv6
Profinet with IP proto 0x8892
Address Resolution Protocol (ARP)
Internet Group Management Protocol (IGMP)
User Datagram Protocol
Dynamic Host Configuration Protocol (DHCP) with port 67 or port 68 and DHCPv6 with port 546 or port 547
Common Industrial Protocol (CIP) with TCP port 44818
Domain Name System (DNS) with port 53
Simple Network Management Protocol with port 161 or port 162

Filter expressions for a PCAP comprise at least one primitive, which consists of qualifiers followed by an identifier. The three kinds of qualifiers are:

Type: Specifies the type of the identifier (port, host, network, or range of ports).
Dir: Specifies the transfer direction of the packets.
Proto: Limits the capture to a specific protocol.

Note

When constructing filter expressions, use logical operators AND, OR, and NOT, and use parentheses to group expressions to ensure correct interpretation.

Enable wired packet captures

This procedure enables packet capture (PCAP) on a WGB to monitor wired traffic. It allows you to capture packets by protocol (IP, TCP, UDP), apply verbose output for detailed analysis, save packet data to PCAP files, and use custom filters (including VLAN) to analyze specific traffic across native and non-native VLANs.

Procedure

Enable PCAP using one of the options given here:

Option Description

Run PCAP with the default filter

Use the debug traffic wired [0| 1]{ip | tcp | udp}[verbose | capture] command.

Device# configure wgb mobile station interface dot11Radio 1 dot11v-bss-transition enable

[0| 1] specifies the wired interface number. If not selected, capture packets from all the wired interface.

Device# debug traffic wired 1 ip

APXXXX.XXXX.XXXX#reading from file /dev/click_wired_log, link-type EN10MB
(Ethernet)
1 08:35:50.529851 IP 209.165.200.213 > 209.165.200.1: ICMP echo request, id
13721, seq 1, length 64
2 08:35:50.534813 IP 209.165.200.1 > 209.165.200.213: ICMP echo reply, id
13721, seq 1, length 64

This option is the default and captures packets with IP protocol headers.

Device# debug traffic wired 1 udp verbose

APXXXX.XXXX.XXXX#reading from file /dev/click_wired_log, link-type EN10MB
(Ethernet)
1 08:25:59.696990 IP6 fe80::322c:712c:5787:f246.dhcpv6-client >
ff02::1:2.dhcpv6-server: dhcp6 solicit
0x0000: 3333 0001 0002 fc58 9a16 e428 86dd 6001
0x0010: 7b92 006d 1101 fe80 0000 0000 0000 322c
0x0020: 712c 5787 f246 ff02 0000 0000 0000 0000
0x0030: 0000 0001 0002 0222 0223 006d 00a6 010c
0x0040: d064 0008 0002 ffff 0006 001e 0034 0011
0x0050: 0015 0016 0017 0018 001f 0038 0040 0043
0x0060: 0052 0053 005e 005f 0060 0001 000a 0003
0x0070: 0001 fc58 9a16 e428 0014 0000 0027 0013
0x0080: 0006 4150 4643 3538 0439 4131 3604 4534
0x0090: 3238 0000 0300 0c00 0000 0100 0000 0000
0x00a0: 0000 00

The verbose option captures detailed information from UDP protocol packets.

Device# debug traffic wired 1 tcp capture

% Writing packets to "/pcap/APXXXX.XXXX.XXXX_capture.pcap0"
APXXXX.XXXX.XXXX#reading from file /dev/click_wired_log, link-type EN10MB
(Ethernet)

Run PCAP with the custom filter

Use the debug traffic wired [0| 1] filter expression [verbose | capture] command.

Enable only one PCAP process at a time. Do not use unsupported characters like " ` $ ^ & | \ > < ? ; and ~ in the filter expressions.

Device# debug traffic wired 0 filter icmp

APXXXX.XXXX.XXXX#reading from file /dev/click_wired_log, link-type EN10MB
(Ethernet)
1 10:38:59.948729 IP 209.165.200.213 > 209.165.200.1: ICMP echo request, id
16204, seq 1, length 64
2 10:38:59.954308 IP 209.165.200.1 > 209.165.200.213: ICMP echo reply, id
16204, seq 1, length 64

This option is the default and captures packets with IP protocol headers.

Device# debug traffic wired 1 filter icmp verbose

APXXXX.XXXX.XXXX##reading from file /dev/click_wired_log, link-type EN10MB
(Ethernet)
17:13:30.706493 IP 209.165.200.213 > 209.165.200.1: ICMP echo request, id 986,
seq 1, length 64
0x0000: fc58 9a17 afd4 f8e4 3b9d 7322 0800 4500
0x0010: 0054 57a0 4000 4001 889e c0a8 6cc8 c0a8
0x0020: 6c51 0800 940c 03da 0001 7f3d 5365 0000
0x0030: 0000 cea2 0000 0000 0000 1011 1213 1415
0x0040: 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425
0x0050: 2627 2829 2a2b 2c2d 2e2f 3031 3233 3435
0x0060: 3637
17:13:30.710567 IP 209.165.200.1 > 209.165.200.213: ICMP echo reply, id 986,
seq 1, length 64
0x0000: f8e4 3b9d 7322 fc58 9a17 afd4 0800 4500
0x0010: 0054 9102 0000 4001 8f3c c0a8 6c51 c0a8
0x0020: 6cc8 0000 9c0c 03da 0001 7f3d 5365 0000
0x0030: 0000 cea2 0000 0000 0000 1011 1213 1415
0x0040: 1617 1819 1a1b 1c1d 1e1f 2021 2223 2425
0x0050: 2627 2829 2a2b 2c2d 2e2f 3031 3233 3435
0x0060: 3637

The verbose option captures detailed information from UDP protocol packets.

Device# debug traffic wired 1 filter icmp capture

% Writing packets to "/tmp/pcap/APXXXX.XXXX.XXXX_capture.pcap0"
APXXXX.XXXX.XXXX#reading from file /dev/click_wired_log, link-type EN10MB
(Ethernet)

The capture option saves TCP packet information to a PCAP file.

Run PCAP in multiple VLANs using custom filter

Use the debug traffic wired [0| 1][ filter expression |ip } command.

Note

Some custom filters miss traffic in non-native VLANs. For example, the custom filter command debug traffic wired 0 filter icmp fails to capture downlink ICMP traffic in non-native VLANs

Device#debug traffic wired 0 filter "icmp or (vlan and icmp)"

1 12:27:40.833815 IP 209.165.200.102 > 209.165.200.1: ICMP echo request, id 27279, seq 1,
length 64
2 12:27:40.841331 IP 209.165.200.1 > 209.165.200.102: ICMP echo reply, id 27279, seq 1, length
64

Add VLAN to the filter expression to capture bidirectional traffic from a wired client on a non-native VLAN.

Device#debug traffic wired 0 ip

1 12:27:40.833815 IP 209.165.200.102 > 209.165.200.1: ICMP echo request, id 27279, seq 1,
length 64
2 12

Use the default IP filter to capture all IP traffic, including native and non-native VLANs.

To upload the packets to an external server, use the command given here: Use the copy pcap file-name.pcap0 {tftp| sftp}://server-ip [directory][file-name] command to upload the packets to an external server.


Device# copy pcap APXXXX.XXXX.XXXX_capture.pcap0 scp://iot@209.165.200.213:/capture/wgb_sniffer.pcap
copy ""/pcap/APXXXX.XXXX.XXXX_capture.pcap0"" to
"scp://iot@209.165.200.213:/capture/wgb_dhcp_sniffer_0_46_29.pcap" (Y/N)Y
iot@209.165.200.213 password:
APXXXX.XXXX.XXXX_capture.pcap0 0% 0 0.0KB/s --:-- ETA
APXXXX.XXXX.XXXX_capture.pcap0 100% 2530 916.5KB/s 00:00

Note

Complete the PCAP process and save the packets to a file before uploading. Use a TFTP, SFTP, or SCP server to transfer the PCAP file to an external server.

Disable wired packet captures

Procedure

	1.	Use the no debug traffic wired [0-3]{ip`\|` tcp`\|` udp}[verbose`\|` capture] command to disable PCAP with the default filter. `Device# no debug traffic wired 1 ip verbose`
	2.	Use the no debug traffic wired [0-3 ]filter expression [verbose`\|` capture] command to disable PCAP with the custom filter. `Device# no debug traffic wired 0 filter "icmp or (vlan and icmp)" capture` Note You can also use the no debug or undebug all command to terminate the capture process.

Verify wired packet capture

To verify the debug status, use the show debug command.

Device#show debug
traffic:
  wired tcp debugging is enabled

To view the captured internal wired packets stored in the file, use the show pcap command.

Note

After capturing packets to the file, use the show pcap command to view them.

Device#show pcap
reading from file /pcap/APXXXX.XXXX.XXXX_capture.pcap0, link-type EN10MB (Ethernet)
1  00:00:00.000000 IP 0.0.0.0 > 224.0.0.1: igmp query v2
2  09:41:48.903670 IP 209.165.200.189 > 209.165.200.1: ICMP echo request, id 29920, seq 1, length 64
3  09:41:48.908927 IP 209.165.200.1 > 209.165.200.189: ICMP echo reply, id 29920, seq 1, length 64
4  09:41:49.904914 IP 209.165.200.102 > 209.165.200.1: ICMP echo request, id 29920, seq 2, length 64
5  09:41:49.909009 IP 209.165.200.1 > 209.165.200.102: ICMP echo reply, id 29920, seq 2, length 64

To filter and view the basic content of captured packets sequentially, run the show pcap [filter expression] command.

Device#show pcap filter "src 209.165.200.189”
reading from file /pcap/APXXXX.XXXX.XXXX_capture.pcap0, link-type EN10MB (Ethernet)
 1  09:41:48.903670 IP 209.165.200.189 > 209.165.200.1: ICMP echo request, id 29920, seq 1, length 64
 2  09:41:48.908927 IP 209.165.200.1 > 209.165.200.189: ICMP echo reply, id 29920, seq 1, length 64

To filter and view the detailed content of a specific packet, run the show pcap [filter expression][detail no] command.

Device#show pcap filter "src 209.165.200.189" detail 2
2024-04-25 09:41:49.904914
000000 18 59 f5 96 af 74 00 50 56 85 8a 0a 08 00 45 00
000010 00 54 14 6c 40 00 40 01 b7 9d 64 16 53 72 64 16
000020 53 01 08 00 70 81 74 e0 00 02 d4 3e 2b 66 00 00
000030 00 00 50 24 04 00 00 00 00 00 10 11 12 13 14 15
000040 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25
000050 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35
000060 36 37

Port address translation

Port Address Translation (PAT), also known as Network Address and Port Translation (NAPT), is a network address translation method that:

translates multiple internal wired client private IP addresses and port numbers
to unique public IP addresses and port numbers
before sending packets to the external network.

A private IP address is used only within an internal network. A public IP address is globally unique and used on the Internet. NAPT mapping uses both the IP address and the port number. This allows packets from multiple internal hosts to map to the same external IP address with different port numbers.

From Release 17.16.1, PAT is supported on the IW9165E Workgroup Bridge (WGB) Access Points (APs) of each AGV.

From Release 26.1.1, you can use port numbers from 1 to 1024 on both TCP and UDP protocols, though these should be used with caution as they belong to the reserved category of ports; the valid port range is 1 to 65535.

NAPT operational details and limitations

NAPT supports TCP and UDP for communication between devices on the internal and external networks.

The following list outlines the limitations for WGB:

NAT is not supported for incoming packets with an 802.1Q VLAN tag behind the device.
Multicast traffic is not supported for NAT inside wired clients.
FTP traffic is supported in active mode; in passive mode, it is supported only when the FTP server is located within the NAT inside.
The TFTP protocol is supported only when the TFTP server resides inside the NAT.
Application Layer Gateway (ALG) is not supported.

The following list outlines the limitations for uWGB:

Access Control Lists (ACLs) are not supported.
The NAPT supports only one private LAN as the NAPT inside network.

Note

Profinet clients on the AGV must be configured with a unique IP address that belongs to the global subnet.

This image illustrates the concept of Network Address Port Translation (NAPT), demonstrating how a Wireless Gateway Bridge (WGB) translates incoming packets from an external network to an internal host by mapping external IP addresses and ports to internal ones.

Figure 3. NAPT Translation Between Internal and External Networks

NAPT rules and mapping tables

A NAPT rule and mapping table is a network translation mechanism that:

defines how a Workgroup Bridge (WGB) translates internal private addresses and ports to an external, routable address and port,
maintains a table that maps internal device traffic to corresponding global IP/port pairs, and
supports both TCP and UDP protocols for address and port translation.

The configuration supports a maximum of 256 IP NAT rules on WGB.

NAPT mapping table

The mapping table is created and managed based on the traffic and NAPT rules.

NAPT uses entries containing the source IP address, source port number, protocol type, destination IP address, and destination port number (TCP or UDP). These entries enable the system to translate addresses, filter packets, and index the NAPT mapping table.

Note

The maximum number of mapping entries in NAPT translation table is 4096.

This table shows an example of a NAPT mapping.

Table 2. NAPT Mapping Table
Protocol	Internal Local IP Address and Port	WGB Global IP Address	External Global IP Address and Port
TCP	192.168.0.10: 80	172.16.100.11	172.16.100.11: 61080

Upstream and downstream data flows

Upstream and downstream data flows are types of network traffic flows that:

use Network Address and Port Translation (NAPT) to translate source or destination addresses,
allow secure transfer of data between internal and external networks, and
maintain privacy and integrity of IP addresses.

Downstream data flow using NAPT

Downstream data flow refers to the flow of data from the external network to the AGV's internal network. The gateway (WGB or uWGB) manages communication between the external and internal networks..

When packets arrive with an external IP address and port number, the mapping table is checked to identify the corresponding internal destination.

The packets are then translated and forwarded to the internal network based on the destination IP address and port number.

The diagram illustrates how address and port translation manages both upstream (internal-to-external) and downstream (external-to-internal) traffic flows between private LAN clients and external networks.

Figure 4. Upstream and downstream data flow using NAPT in WGB

Figure 5. Upstream and downstream data flow using NAPT in uWGB

Upstream data flow using SNAT

Upstream data flow refers to the transfer of packets from internal networks to external networks. The gateway enables communication between the two networks.

All outgoing packets from the internal network are translated to the external network using Source Network Address Translation (SNAT).

For upstream traffic, SNAT replaces the source IP address and port numbers with the gateway’s IP address, ensuring that internal IP addresses are not exposed to the external network.

Configure NAPT on WGB

This procedure describes how to configure Source Network Address Translation (SNAT) for upstream data flow and Network Address and Port Translation (NAPT) for downstream data flow.

Complete Steps 1 to 3 to configure upstream data flow using SNAT.

Complete Steps 4 and 5 to configure downstream data flow using NAPT.

Procedure

	1.	Use the configure ip nat enable command to enable NAPT. `Device#configure ip nat enable` Use the configure ip nat disable command to disable the NAPT.
	2.	Use the configure ip nat address add ip inside- ip-address netmask netmask command to configure inside IPv4 address and netmask. `Device# configure ip nat address add ip 192.168.0.1 netmask 255.255.255.0`
	3.	(Optional) Use the configure ip nat inside port range min-port-number max-port-number command to configure SNAT port range for upstream data flow. `Device# configure ip nat inside port range 32000 33000` The valid range for the port is 1 to 65535. This range must not overlap with the SNAT port range. By default, the minimum port value is 30000 and the maximum is 59999. The minimum configurable value for both ranges is 1.
	4.	Use the configure ip nat outside port range min-port-number max-port-number command to configure NAPT port range for downstream data flow. `Device# configure ip nat outside port range 34000 62000` The valid range for the port is 1 to 65535. Note Ensure the NAPT and SNAT port ranges do not overlap. Do not use reserved ports 1233, 1234, or 20000.
	5.	Use the configure ip nat rule add inside ip inside-ip-address port inside-port-number outside port outside-port-number protocol `{` tcp`\|` udp`}` command to configure the NAPT mapping rule for downstream data flow. `Device#configure ip nat rule add inside ip 192.168.0.10 port 80 outside port 61080 protocol tcp` inside-ip-address is the internal wired client network IP address. inside-port-number is the internal wired client network TCP or UDP port number. Outside port number must be within the configured NAPT range. The valid range for the port is 1 to 65535. This range must not overlap with the NAPT port range.
	6.	(Optional) Use the show ip nat configuration command to view the current NAPT configuration. `Device# show ip nat configuration IP NAT Configuration are: ==================================== Status: enabled inside interface ip/netmask: 192.168.0.1/255.255.255.0 SNAT port range: 10000 - 20000 NAPT port range: 61000 - 65535 The number of ip nat rules: 1 Id Outside_port Inside_ip Inside_port Protocol 0 61080 192.168.0.10 80 tcp`
	7.	(Optional) Use the show ip nat tranlations command to view the current NAPT translation entries from the NAPT rule table. Device# show ip nat translations UDP: src_ip port dst_ip port => src_ip port dst_ip port direction expiry_time (192.168.0.10, 41278, 172.16.1.51, 22000) => (172.16.1.101, 30004, 172.16.1.51, 22000) [forward] exp: 290 (172.16.1.51, 22000, 172.16.1.101, 61080) => (172.16.1.51, 22000, 192.168.0.10, 41278) [reverse] exp: 290 ==================================== TCP: src_ip port dst_ip port => src_ip port dst_ip port direction expiry_time (192.168.0.10, 80, 172.16.100.3, 443) => (172.16.100.11, 30000, 172.16.100.3, 443) [forward] exp: 138 (172.16.100.3, 443, 172.16.100.11, 30000) => (172.16.100.3, 443, 192.168.0.10, 80) [reverse] exp: 138 In the output, 'forward' refers to the log details of data packets processed by the WGB, including the source, destination, and translation information. 'Reverse' refers to the log details of return traffic, ensuring that responses from the destination reach the original source by reversing the traffic direction. It ensures the response from the destination correctly reaches back to the source by reversing the direction of the original traffic.

Manage uWGB in NAPT deployment

Follow this procedure to manage uWGB in a NAPT deployment.

Before you begin

Ensure that all uWGB wired clients are in the private LAN.

Procedure

	1.	Use the configure dot11Radio 1 mode uwgb mac_address ssid-profile test_ssid command to configure radio mode to uWGB. `Device# configure dot11Radio 1 mode uwgb FC:58:9A:17:0D:52 ssid-profile testssid` You can choose any unique MAC address, or use the optional method given below to calculate a unique MAC address. Note Ensure that the MAC address does not conflict with existing devices on the network to prevent connectivity issues. To calculate the unique MAC address, add the offset value 0x12 to the base MAC address. To find the base MAC address, use the show controllers dot11Radio interface command, as shown in Step 2. Use the formula: base MAC address + offset = unique MAC address. Note Verify that the offset value is 0x12 or greater. For example, adding 0x12 to FC:58:9A:17:0D:40 results in FC:58:9A:17:0D:52.
	2.	(Optional) Use the show controllers dot11Radio 1 command to find the base MAC address. `Device#show controllers dot11Radio 1 wifi1 Link encap:Ethernet HWaddr FC:58:9A:17:0D:40 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:9109 errors:70 dropped:59043 overruns:0 frame:0 TX packets:27920 errors:13 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:2699 RX bytes:913806 (892.3 KiB) TX bytes:5399794 (5.1 MiB)`
	3.	(Optional) Use the show wgb dot11 associations command to verify the uWGB is in the WGB state. Device#show wgb dot11 associations Uplink Radio ID : 1 Uplink Radio MAC : FC:58:9A:17:0D:52 SSID Name : SSID_NAME Connected Duration : 56 hours, 37 minutes, 11 seconds Parent AP MAC : B0:B8:67:3D:5E:D6 Uplink State : CONNECTED Auth Type : PSK Key management Type : WPA2 Uclient mac : FC:58:9A:17:0D:52 Current state : WGB Uclient timeout : 60 Sec Dot11 type : 11ac Channel : 157 Bandwidth : 20 MHz Current Datarate (Tx/Rx) : 156/144 Mbps Max Datarate : 156 Mbps RSSI : 35 IP : 172.16.1.101/24 Default Gateway : 172.16.1.1 IPV6 : ::/128 Assoc timeout : 100 Msec Auth timeout : 100 Msec Dhcp timeout : 60 Sec'
	4.	Configure NAPT to enable end-to-end traffic flow for uWGB wired clients.

Configure NAPT on uWGB

This procedure describes how to configure Source Network Address Translation (SNAT) for upstream data flow and Network Address and Port Translation (NAPT) for downstream data flow.

Follow Step 1 through Step 4 to configure support for upstream data flow using SNAT.

Follow Step 5 and Step 6 to to configure support for downstream data flow using NAPT.

Procedure

	1.	Use the configure ip nat enable command to enable NAPT. `Device#configure ip nat enable` Note Use the configure ip nat disable command to disable the NAPT.
	2.	(Optional) Use the configure ip nat inside port range min-port-number max-port-number command to configure SNAT port range for upstream data flow. `Device# configure ip nat inside port range 32000 33000` The valid range for the port is 1 to 65535. This range must not overlap with the SNAT port range. By default, the minimum port value is 30000 and the maximum is 59999. The minimum configurable value for both ranges is 1. Note The SNAT port range is the source port that the uWGB uses when sending traffic from internal network to the external network. Ensure that the SNAT port range and the NAPT port range do not overlap.
	3.	Use the configure ip nat address add ip inside- ip-address netmask netmask command to configure the gateway IPv4 address for the internal wired client on the uWGB. `Device# configure ip nat address add ip 192.168.0.1 netmask 255.255.255.0`
	4.	Use the configure interface nat-outside address ipv4 static static-ip-address static-netmask gateway-ip-address command to configure external IPv4 address on the uWGB. `Device# configure interface nat-outside address ipv4 static 172.16.1.101 255.255.255.0 172.16.1.1` static-ip-address is the uWGB own public address gateway-ip-address is the uWGB external IP address. The outside port number is automatically generated for upstream data flow. The configuration supports the internal-to-external traffic flow.
	5.	Use the configure ip nat outside port range min-port-number max-port-number command to configure NAPT port range on the uWGB to receive traffic from the external network to the internal network. `Device# configure ip nat outside port range 34000 62000` The valid range for the port is 1 to 65535. This range must not overlap with the NAPT port range. The default minimum port value is 61000 and the maximum is 65535. The minimum configurable value for both ranges is 1.
	6.	Use the configure ip nat rule add inside ip inside-ip-address port inside-port-number outside port outside-port-number protocol `{` tcp`\|` udp`}` command to configure the NAPT mapping rule for downstream data flow. `Device#configure ip nat rule add inside ip 192.168.0.10 port 80 outside port 61080 protocol tcp` inside-ip-address is the internal wired client network IP address. inside-port-number is the internal wired client network TCP or UDP port number. Outside port number must be within the configured NAPT range.
	7.	(Optional) Use the show ip nat configuration command to view the current NAPT configuration. `Device# show ip nat configuration IP NAT Configuration are: ==================================== Status: enabled inside interface ip/netmask: 192.168.1.1/255.255.255.0 SNAT port range: 30000 - 59999 NAPT port range: 60000 - 65000 outside proxy ip/netmask/gateway: 172.16.1.101/255.255.255.0/172.16.1.1 The number of ip nat rules: 2 Id Outside_port Inside_ip Inside_port Protocol 0 61001 192.168.1.10 20001 udp 1 61002 192.168.1.10 20002 tcp`
	8.	(Optional) Use the show ip nat tranlations command to view the current NAPT translation entries from the NAPT rule table. Device#show ip nat translations ICMP: src_ip dst_ip port => src_ip dst_ip port direction expiry_time (172.16.1.1, 172.16.1.101, 30257) => (172.16.1.1, 192.168.1.10, 267) [reverse] exp: 272 (192.168.1.10, 172.16.1.1, 11) => (172.16.1.101, 172.16.1.1, 30001) [forward] exp: 272 ==================================== UDP: src_ip port dst_ip port => src_ip port dst_ip port direction expiry_time (192.168.1.10, 20000, 172.16.1.51, 35200) => (172.16.1.101, 61001, 172.16.1.51, 35200) [reverse] exp: 214 (192.168.1.10, 51184, 172.16.1.51, 22000) => (172.16.1.101, 30001, 172.16.1.51, 22000) [forward] exp: 161 (172.16.1.51, 35200, 172.16.1.101, 61001) => (172.16.1.51, 35200, 192.168.1.10, 20000) [forward] exp: 214 (172.16.1.51, 22000, 172.16.1.101, 30001) => (172.16.1.51, 22000, 192.168.1.10, 51184) [reverse] exp: 161 ==================================== TCP: src_ip port dst_ip port => src_ip port dst_ip port direction expiry_time (192.168.1.10, 44155, 172.16.1.51, 23000) => (172.16.1.101, 30002, 172.16.1.51, 23000) [forward] exp: 238 (172.16.1.51, 23000, 172.16.1.101, 30002) => (172.16.1.51, 23000, 192.168.1.10, 44155) [reverse] exp: 238 ==================================== In the output, 'forward' refers to the log details of data packets processed by the uWGB, including the source, destination, and translation information. 'Reverse' refers to the log details of return traffic, ensuring that responses from the destination reach the original source by reversing the traffic direction. It ensures the response from the destination correctly reaches back to the source by reversing the direction of the original traffic.

Delete NAPT mapping rule

This procedure describes how to delete NAPT configuration entries. You can remove a specific NAPT mapping rule by specifying the inside and outside parameters. You can also delete a rule by its rule ID or clear all NAPT rules from the configuration. Choose the method based on whether you want to remove a specific rule or reset the entire NAPT configuration.

Procedure

Delete NAPT mapping rule using one of the options given here:

Option Description

Delete a NAPT mapping rule

Use the configure ip nat rule delete inside ip inside- ip-address port inside-port-number outside port outside-port-number protocol { tcp| udp} command.

Device#configure ip nat rule delete inside ip 192.168.1.10 port 80 outside port 61080 protocol tcp

Delete the NAPT mapping rule as per the rule-id

Use the configure ip nat entry delete rule-id command.

Device# configure ip nat entry del 0

Note

You can use the show ip nat configuration command to view the rule-id.

Delete all the NAPT mapping rules

Use the configure ip nat entry delete all command.

Device# configure ip nat entry delete all

Delete NAPT IP address

This procedure explains how to delete the configured NAT IP addresses. You can remove the gateway IPv4 address assigned to the internal wired client. Alternatively, you can delete the external IPv4 address configured on the NAT outside interface.

Note

To remove all the NAPT configuration, you should also delete the IP address and interface.

Procedure

Delete the NAPT IP address using one of the options given here:

Option	Description
Delete gateway IPv4 address for the internal wired client	Use the configure ip nat address delete command. `Device#configure ip nat address delete`
Delete the external IPv4 address	Use the configure interface nat-outside address delete command. `Device#configure interface nat-outside address delete`

Configure transmission rate with high throughput

Procedure

Example:

Example:

Example:

Configure legacy rate for WGB

Procedure

802.11v features

Roaming and management enhancements

Enable or disable 802.11v support

Procedure

Configure BSS transition query interval

Procedure

Verify neighbor list

Procedure

Verify the channel list

Procedure

Clear neighbor list

Procedure

Auxiliary scanning

Scan-only mode

Configure scan-only mode

Procedure

Configure scanning table timer

Before you begin

Procedure

Manually add or remove channels from the channel list

Procedure

Verify scanning table

Procedure

Auxiliary Scanning handoff mode

Radio roles

Roaming of AP

Guidelines and restrictions for Auxiliary Scanning

Configure radio 2 in Aux-Scan handoff mode

Before you begin

Procedure

Configure RSSI delta threshold for candidate BSSID

Procedure

Verify WGB scan

Procedure

Optimized roaming with dual-radio WGBs

Trigger factors for roaming

Configuration options for dual-radio

Layer 2 NAT

Configure Layer 2 NAT

Procedure

Verify Layer 2 NAT Configuration

Configuration Example of Host IP Address Translation

Layer 2 NAT configuration example

Layer 2 NAT rules example

Layer 2 NAT entries example

WGB wired clients example

Layer 2 NAT packet translation statistics example

Configuration Example of Network Address Translation

Native VLAN on Ethernet Ports

Configure Native VLAN on Ethernet Ports

Procedure

Low latency profile

IoT Application Support

Enable or disable an optimized-video EDCA profile

Procedure

Enable or disable optimized-automation EDCA profile

Procedure

Configure customized-wmm EDCA profile

Procedure

Configure EDCA parameters using Controller GUI

Procedure

Configure EDCA parameters using Controller CLI

Procedure

A-MPDU

Configure A-MPDU

Before you begin

Procedure

SNMP features

SNMP process

SNMP versions

Supported SNMP MIB files

Supported OIDs