topic Re: Flex Profile Maximal in Wireless

Flex Profile Maximal

hs08 — Wed, 03 Jun 2026 02:58:34 GMT

Hello,

My AP running using flex connect with WLC9800 and i will build dynamic vlan for this SSID. The vlan will be based on the department and i have more than 40 depts. The issue is when i create flex profile then i add vlan mapping then i got 'The maximum number of interfaces 16 have been added to the flex-profile.

How i can add more than 16?

Re: Flex Profile Maximal

Mark Elsen — Wed, 03 Jun 2026 05:28:29 GMT

_ @hs08 Why do you need to map more than 16 VLANs under Flex profile if there are only 16 possible SSIDs per AP? This is not only Cisco feature but most of the vendors.

Re: Flex Profile Maximal

hs08 — Wed, 03 Jun 2026 05:32:43 GMT

hi @Mark Elsen

I'm not going to create 16 SSID but only one SSID with dynamic vlan and the vlan belong to our department where i have more than 40 departements.

Re: Flex Profile Maximal

Mark Elsen — Wed, 03 Jun 2026 05:41:12 GMT

- @hs08 Ref : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html
>..... Note: A maximum of 16 locally switched VLANs can be mapped to a Flex profile.

Re: Flex Profile Maximal

Rich R — Sun, 07 Jun 2026 13:41:40 GMT

16 VLANs is a hard limit - there is nothing you can do to increase that @hs08

However - you do not need to map VLANs in the flex profile unless you want to refer to them by name.
If you reference the VLANs by VLAN ID (number) then they will simply work - but that is only the case for static SSID configuration.
~~I have not tested with dynamic VLAN assignment. Suggest you test it to confirm~~.

Edit: From the subsequent discussions below: for AAA VLAN override the VLAN does have to be defined in the flex profile which effectively limits the number of VLANs which can be used with VLAN override on flex locally switched WLANs. If the VLAN is not defined in the flex profile then the client will be put in the default VLAN defined in the policy profile regardless of what is specified in the AAA override.

The detailed behaviour is explained in the config guide with the VLAN override fallback option:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-18/config-guide/b_wl_17_18_cg/m_wlan_security_9800.html#Cisco_Concept.dita_9ce3bae6-d138-479f-aa0a-111c840a0e59
"If the AAA server assigns a VLAN policy to a client configured in the FlexConnect profile, the VLAN is resolved by the controller. If the VLAN is not configured on the FlexConnect profile, the behavior of the VLAN name and the VLAN ID is made consistent, with the help of the fallback feature, and the client receives the IP address from the wireless policy profile configuration.

FlexConnect mode behavior includes these characteristics:

If AAA VLAN is defined in FlexConnect profile, the client is assigned the AAA VLAN.
If AAA VLAN is not defined in the FlexConnect profile, FlexConnect VLAN Central Switching is configured, and VLAN is defined in the controller, and the client is assigned AAA VLAN and is centrally switched.
If AAA VLAN is not defined in the FlexConnect profile, FlexConnect VLAN Central Switching is configured, the VLAN is not defined in the controller, and the client is assigned a VLAN from the wireless policy profile.
If AAA VLAN is not defined in the FlexConnect profile, and FlexConnect VLAN Central Switching is not configured, the client is assigned a VLAN from the wireless policy profile."

Re: Flex Profile Maximal

aleabrahao — Wed, 03 Jun 2026 12:51:21 GMT

@Rich R , things work a little differently on the C9800. Even if you dynamically assign the VLAN when working with FlexConnect, you need to have the VLAN mapped in the Flex Profile.

@Mark Elsen , it's not about the number of WLANs, but rather the number of VLANs he wants to apply dynamically to a specific user depending on the department.

@hs08 , the only thing I can think of is creating a Flex Profile for each department, but I think that will be a problem because you would have to create a specific Site Tag for each department as well, so I think it's impractical.

Are these departments physically in the same place? Because if they are in different locations, you can standardize the VLAN.

For example, the HR Department is at site A and the Finance Department at site B, so you could use the same VLAN Tag (10 for example) with a different subnet.

Re: Flex Profile Maximal

Rich R — Wed, 03 Jun 2026 13:24:45 GMT

@aleabrahao you say "things work a little differently on the C9800. Even if you dynamically assign the VLAN when working with FlexConnect, you need to have the VLAN mapped in the Flex Profile."

We've had the discussion about the need to map VLANs in flex profile before and the answer (in general) is that it categorically is not necessary (at least for statically assigned VLANs). But I have never tested it with dynamic VLAN assignment so that might be an exception to the rule.

Are you saying that you have personally tested it and that dynamic VLAN assignment definitely does not work if the VLAN is not defined in the flex profile?

Re: Flex Profile Maximal

aleabrahao — Wed, 03 Jun 2026 13:33:12 GMT

@Rich R I not only tested it personally, but I also have it applied to my environment, so I can say this with confidence. If you read the documentation on how to configure dynamic VLANs with Flexconnect, you'll see that there's a step where you map the VLAN to the Flex Profile.

This statement is true for AirOS controllers, but unfortunately, on the 9800 series, the controllers work differently.

Re: Flex Profile Maximal

Rich R — Wed, 03 Jun 2026 13:43:41 GMT

Hmmm you didn't actually answer my question @aleabrahao - I understand that you have tested and use the positive use case (mapping configured) but have you tested the negative use case (without mapping configured). The fact that there is a step in the documentation does not make it necessary - the same applies to static - the documentation shows that step but it is not necessary (unless you need to use names). So again my question - very specifically: did you test without the flex profile mapping? And what was the outcome of that test?
Of course if you are using names instead of IDs then it will obviously be necessary so I guess the added question is whether that test used names or VLAN IDs?

Re: Flex Profile Maximal

aleabrahao — Thu, 04 Jun 2026 01:23:42 GMT

Yes, I tested it in both scenarios.

When you don't have the VLAN mapped, it's not that the VLAN isn't applied; the VLAN is applied correctly if you look at the user information. The issue is that without mapping it in Flex Profile, the AP doesn't understand this, and the IP assigned to the client is the default one configured for the SSID, not the one from the dynamically assigned VLAN.

I don't know if I was clear enough, but I tested it in both scenarios. 😉

Re: Flex Profile Maximal

Rich R — Wed, 03 Jun 2026 14:06:18 GMT

Ack 👍😁

Re: Flex Profile Maximal

hs08 — Wed, 03 Jun 2026 23:56:50 GMT

I agree, when no vlan mapping then the client will get vlan from default interface.

Re: Flex Profile Maximal

Rich R — Thu, 04 Jun 2026 07:35:27 GMT

Noted - so you are stuck with that maximum of 16.

Re: Flex Profile Maximal

Rich R — Thu, 04 Jun 2026 10:00:11 GMT

Note that there is an enhancement request for this:
CSCvz67977 - 9800 WLC / Support for more than 16 vlans in flex profile

This was last modified 2 years ago which means that the BU has effectively put it on hold.
If you want to help get it onto the BU roadmap then get your Cisco account team to submit a business case supporting it. The more customers supporting it (and the more $$$ they spend) will help to get it accepted for implementation. Looking at that bug, and the duplicate CSCvz60148, there are already 6 customer TAC cases attached (though not necessarily all followed up with business cases).

Re: Flex Profile Maximal

Stefan Mihajlov — Thu, 04 Jun 2026 15:47:19 GMT

@hs08 16 vlan limit is a strict constracint on WLC.. and you cannot exceed this number withing single profile... to scale ur single SSID acrodd departments, u must split ur deployment creating multiple flex profiles and site tags..

Re: Flex Profile Maximal

hs08 — Thu, 04 Jun 2026 23:43:50 GMT

If we split by creating mutiple flex profile then this not solve my issue because each AP only can connect to 1 flex profile. Imagine if the user move from 1 AP to another, then the client will have loss connection.

Re: Flex Profile Maximal

aleabrahao — Fri, 05 Jun 2026 02:32:09 GMT

@Stefan Mihajlov take a look at my first commentary, this is not a option, because you just can configure on flex profile for each access point.

To be honest, the best option on this case is reduced the number of VLANs.

Re: Flex Profile Maximal

Rich R — Fri, 05 Jun 2026 09:37:29 GMT

> To be honest, the best option on this case is reduced the number of VLANs.

Agreed with that - more than 16 VLANs is just extreme overkill.

Otherwise you have to change to central switching on WLC.

Re: Flex Profile Maximal

hs08 — Fri, 05 Jun 2026 10:15:16 GMT

this mean change from flex to local, right?

Re: Flex Profile Maximal

aleabrahao — Fri, 05 Jun 2026 10:34:00 GMT

No, reduce the number of VLANs. For Wi-Fi, it's unnecessary to have such a large volume of VLANs. If your firewall allows it, it's much easier to control whatever you want to control through rules according to the user group.