topic Re: 9800 WLC Mesh AP Local MAC Auth Help - Fuzzy on the WLAN Setting. in Wireless

9800 WLC Mesh AP Local MAC Auth Help - Fuzzy on the WLAN Setting.

8uck5nort — Thu, 18 Jul 2024 16:15:26 GMT

Background:

I am setting up mesh wireless on a 9800.

I am going to import several mesh APs from a 5520 controller and add some new ones. I am using a converted configuration.

The converted config only has username, macaddress, mac. No WLAN specified.

Converted 5520 Example:

username 1a2b3c4d5e6f mac

This worked on a 9800 Example:

username 1a2b3c4d5e6d mac description my-meshtest-ap01

I did not specify any WLAN specific configuration. However, when I enter the mac using the 9800 GUI it makes me select a specific WLAN and there is no "any WLAN" option as there was on the 5520.

Now having said all that multiple people have entered in macs over the years on our 5520s using a combination of "any WLAN" and "ProductionWLAN(s)" Our mesh setup on the 5520 appears to not care what WLAN is specified and works with all WLAN assigned to the AP group the mesh AP is assigned.

So real fuzzy here one what this all means. I like to keep configuration settings to the bare minimum. If I don't need to specify the WLAN the I don't want to. I am also building out ansible playbooks to automate this process and supporting unnecessary code is potentially problematic, but that is a different conversation.

So why specify a WLAN at all when using local mac authen/author for mesh APs at all.? What does this setting actually do or was intended to do? Is this more important in a 9800 configuration vs a 5520?

Re: 9800 WLC Mesh AP Local MAC Auth Help - Fuzzy on the WLAN Setting.

Mark Elsen — Thu, 18 Jul 2024 18:49:33 GMT

- It could be a result of a somewhat stronger security architecture in the sense that the setting on 9800 restricts the particular VLAN(s) that can be bridged in the Mesh network ,

Re: 9800 WLC Mesh AP Local MAC Auth Help - Fuzzy on the WLAN Setting.

Rich R — Sat, 20 Jul 2024 09:38:38 GMT

MAC usernames can be used for client device local authentication (where the WLAN would matter) and also for mesh AP local authentication where the WLAN won't matter.

Be careful with using converted config - it should really only be used as a starting point and guideline for your new 9800 config because there are many features either not fully supported by the converter or not supported by the 9800 at all.

For 9800 mesh setup see:
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215100-join-mesh-aps-to-catalyst-9800-wireless.html (no WLAN specified)
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-12/config-guide/b_wl_17_12_cg/m_mesh_ewlc.html
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#OutdoorDeployments

Also take note of https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#MigrationfromAireOSWLCtoC9800

Re: 9800 WLC Mesh AP Local MAC Auth Help - Fuzzy on the WLAN Setting.

8uck5nort — Mon, 22 Jul 2024 13:28:32 GMT

Appreciate the replies. I was using the 9800 mesh documentation that is called out.

I guess I did not make the connection between the mac list being used for multiple purposes.

I am not sure why then the GUI makes you add a WLAN vs the CLI not requiring it.

The more I think about it I guess someone made a call when developing the GUI? I am assuming here on my conclusion. They made the assumption that this is the minimum fields needed to make the mac list usable whether for client auth or for mesh auth. From that angle it makes sense now. Appreciate the help with fleshing out the "Why?".

Re: 9800 WLC Mesh AP Local MAC Auth Help - Fuzzy on the WLAN Setting.

Rich R — Mon, 22 Jul 2024 16:32:47 GMT

> I am not sure why then the GUI makes you add a WLAN vs the CLI not requiring it.
The WLAN field is not mandatory on the GUI so you can leave it blank.
Agreed that it is a bit confusing - one of many things on the GUI that leave room for improvement.
As a rule I do everything I can on the CLI - quicker, clearer, simpler and more reliable - but that's just me. I hate waiting for screens to load and watching timers twirling every time I click on something or submit something.