topic I would connect both WLC in Wireless

Advice to place wlc 5520 in campus.

patel_ankit1 — Mon, 05 Jul 2021 13:49:52 GMT

I purchased 1 controller for my campus. And I place with both core primary & secondary. Is it right place to deploy? & How can I route traffic for corporate clients & guest?

Put the controller in the

Leo Laohoo — Sat, 08 Apr 2017 02:19:12 GMT

Put the controller in the core.

Hello!

Alexey Belousov — Sat, 08 Apr 2017 10:23:15 GMT

Hello!

If I understand the question, you have one WLC and two cores ( primary and secondary).

If you can use LAG between primary and secondary ( stack, VPC, VSS) - use LAG to connect WLC to primary and secondary.

If not, basic scenario - connect WLC to one core: primary or seconsary (no matter how many links).

But if you want, you can configure on WLC two AP-Manager interfaces and assign one AP-manager to one phisical port WLC and second AP-manager to second phisical port WLC. Connect one Phisical port to one core, second phisical port no second core.

See below (Configuring Multiple AP-Manager Interfaces on Wireless LAN Controller (WLC)

https://supportforums.cisco.com/document/118311/configuring-multiple-ap-manager-interfaces-wireless-lan-controller-wlc

You can place WLC to DMZ or

Alexey Belousov — Sat, 08 Apr 2017 10:29:48 GMT

You can place WLC to DMZ or Core. WLC is not route traffic , WLC is connected by 802.1q trunk to dmz or core switch. Core or DMZ have to route traffic. If you will use central switching - all traffic will go to WLC, if you will use local switching, all wireless client traffic will go out from AP directry.

Thank you ableousov. I

patel_ankit1 — Sun, 09 Apr 2017 02:40:38 GMT

Thank you ableousov. I appreciate your answer.

I did lag on both core.

I'm planning to create 3 ssids & interfaces. Can you advice me how to route traffic from & to.

1) Ssid A- corporate users route traffic through core.

2) Ssid B - limited Guest users route traffic through core.

3) said C- BYOD users route to direct internet. Not through core switch.

How can I do through controller to pass it?

Great!

Alexey Belousov — Sun, 09 Apr 2017 08:58:49 GMT

Great!

WLC do not route traffic (this is not usual router). It takes packet from wireless client and put in to VLAN with this manner: SSID1 -> VLAN1, SSID2->VLAN2. The core switches need to provide first-hop unicast and multicast routing for each wireless VLAN (if they route traffic). See blow:

http://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design-Guide/Enterprise_Mobility_8-1_Deployment_Guide/cuwn.html#65102

I think in your case , core need to route ssidA(vlanA) and ssidB (vlanB) traffic directly and pass through itself ssidC(vlanC) traffic to internet gateway (router) without routing by 802.1q trunk.

All traffic goes through WLC

Alexey Belousov — Sun, 09 Apr 2017 09:07:33 GMT

All traffic goes through WLC by default (central switching).

CAPWAP provides the configuration and management of APs and WLANs in addition to encapsulation and forwarding of WLAN client traffic between an AP and a WLAN controller (WLC).

http://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design-Guide/Enterprise_Mobility_8-1_Deployment_Guide/cuwn.html#45944

Thanks Abelousov!

patel_ankit1 — Mon, 10 Apr 2017 17:41:56 GMT

Thanks Abelousov!

Can you share information to how can i apply lag setting from 2port 10g fiber wlc5520 to both N9k cores?

thanks,

On WLC you just need to

Alexey Belousov — Mon, 10 Apr 2017 18:47:57 GMT

On WLC you just need to configure "config lag enable " and reboot it. On N9K you need to configure VPC and static etherchannel. Try to google configuration guide on cisco.com. All guides are in public access.

Thank you Alexey,

patel_ankit1 — Tue, 11 Apr 2017 13:49:17 GMT

Thank you Alexey,

Here is another thing,We change topology and see attachment below.

Can we still perform LAG? if it is, then how can i configure with one wlc interface to core & another interface with checkpoint FW?

According to topology design, Internet traffic are handover through AP>wlc>fw>internet & corp traffic are AP>wlc>core>

If you share with me how to configure each ssid & it's vlan interface with wlc to fw respectively?

thanks,

Hello!

Alexey Belousov — Tue, 11 Apr 2017 14:30:59 GMT

Hello!

Can we still perform LAG

Yes, if you configure VPC on core.

if it is, then how can i configure with one wlc interface to core & another interface with checkpoint FW?

You need to do this on core. VLAN 11,15-16 go tgrough core to FW (L3 Gateway). for VLAN 12,20 L3 Gateway - Core.

If you share with me how to configure each ssid & it's vlan interface with wlc to fw respectively?

Look here:

https://mrncciew.com/2013/02/27/configuring-dynamic-interfaces-on-wlc/

In your case, I think, I would put all interfaces WLC behind FW (FW will be L3 gateway for all WLC interfaces). And FW then would control all traffic flows.

I agree with you Alexey, But

patel_ankit1 — Wed, 12 Apr 2017 13:52:19 GMT

I agree with you Alexey, But Can we place

1) One WLC interface to Core 1 switch

2) second WLC interface directly to checkpoint FW?

thanks,

I would connect both WLC

Alexey Belousov — Wed, 12 Apr 2017 14:36:50 GMT

I would connect both WLC physical interfaces to core (for LAG) and forward all VLANs from WLC through core on L2 OSI Layer (without L3 interfaces on core).

So with this manner, Do i

patel_ankit1 — Wed, 12 Apr 2017 20:29:54 GMT

So with this manner, Do i have to create same VLANs on core switch & do i have to give respective ip to this vlans? and where i can configure Gatway ip? so i can place on controller to send it there?

thank you,

I suppose, you can physically

Alexey Belousov — Thu, 13 Apr 2017 07:47:25 GMT

I suppose, you can physically connect WLC to core, but logically - to FW. Gateway will be on FW. Core will pass through VLANs from WLC, these VLAN will go to "outside" interface (you need to create same VLANs on core, but shold not create IP interface for this VLAN on core). VLANs from FW you can route on core, because they will be "inside".