For what it's worth the feedback I've received from Cisco is that AVC can impact performance. In my scenario, it was the WLC's even though they are speced to support 6000 AP's we had to limit the capacity to 80%. By using AVC on flex connect AP's you most likely shifting more CPU requirement for the AP as well. Later gen AP's such as the 2800's you will most likely not see being impacted by this, although I havent personally tested this. ... View more

Hi There,   Double-check your certificates on the 2012 server the NPS is hosted on and what certificate the NPS is using. I've had situations before where the Windows server had multiple certificates and the NPS chose the incorrect certificate or the GPO would auto-enrol a cert on the NPS after you fixed it. Ensure your certs template on the CA are compatible with 2012 servers. Also if you don't pick up any NPS errors in event viewer related to a client, you most certainly have an issue with your certificates, either the client, NPS or CA. The WLC setup is the easiest and simplest part of the setup as it's simply forwarding and receiving the RADIUS requests from the client and NPS. Therefore the configuring WPA2/AES with 802.1X and the IP's of your RADIUS servers is pretty much the basic requirement you need to get the 802.1X authentication to work. The tricky part can be your template on the CA, check this guide from page 58 that will show you how to setup your templates correctly on the CA: https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Aug2014/CVD-CampusDot1XDesignGuide-AUG14.pdf ... View more

What version of Prime are you using? ... View more

For your solution, you can consider to have two VLAN’s for your branch. One that will allow you to route only to the ISE/DNS when authenticating and one VLAN that will be applied in your change of authorization to move users to this VLAN that will route them out to the local internet breakout.   Keep in mind you will need to enable VLAN DHCP Release as per the document below. https://www.cisco.com/c/en/us/td/docs/security/ise/2-2/admin_guide/b_ise_admin_guide_22/b_ise_admin_guide_22_chapter_01110.html    <<< Please help the community by marking useful posts helpful, or accept as a solution if it resolved your issue >>> ... View more

Ensure your AP get sufficient PoE power. For example, if you have a 2800 series model AP, you will need PoE+ or 802.11at ... View more

This link should provide what you are looking for, check under Solution – AAA Override of VLAN Name step 1-12: https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-1/Flex-7500/Flex_7500_DG.html#pgfId-131938 <<< Please help the community by marking useful posts helpful, or accept as a solution if it resolved your issue >>> ... View more

Have you tried to clear the CAPWAP settings on one of the AP's? ... View more

When using the AIR-ANT2535SDW-R at 8meters you won't get the optimal performance out of it as it's not designed to be that high. In warehouse environments where AP's normally need to be installed higher than 6m, directional antennas is a better option. ... View more

You can run one of the following commands should you want to verify security strength after the upgrade:   (Cisco Controller) >show certificate? all Display all installed certificate details compatibility Enable compatibility mode for inter-switch ipsec eap Display EAP cert. details ipsec Display IPSec cert. details lsc Display Locally Significant Certificate (LSC) ssc Display Self Signed Device Certificate (SSC) summary Display SSL certificates webadmin Display Web Administration cert. details webauth Display Web Authentication cert. details     <<< Please help the community by marking useful posts helpful, or accept as a solution if it resolved your issue >>> ... View more

@Austin Godbey wrote: First 3 things I checked. Times are up to date, new licenses and eval licenses won't work, and country code matches both WLCs. When you say new licenses and eval licenses won't work, does the vWLC show how many AP's it can support?   You can confirm by doing a "show license all" in the CLI       <<< Please help the community by marking useful posts helpful, or accept as a solution if it resolved your issue >>> ... View more

You will really need to understand your environment as elements such as trees and building can have a major impact on your AP quantity. You will have to go and do an AP on a stick surveys to get a better understanding of how the RF will react in the environment you want to deploy. I've done surveys around sports fields and could get 800m diameter out of a Cisco 1570 with 8dbi Omni antennas, but if I've gone into a suburb that has trees all over the place I can forget of getting the same result. There are a lot of things you will need to consider when designing for a mesh, I would recommend (if not already) go through the mesh design guide: https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/Enterprise-Mobility-8-5-Design-Guide/Enterprise_Mobility_8-5_Deployment_Guide/Chapter-8.html <<< Please help the community by marking useful posts helpful, or accept as a solution if it resolved your issue >>> ... View more

Meraki only support bandwidth shaping and not features such as shaping users after they consumed X amount of MB.   I've doubled checked as on the Meraki Dashboard under the MX64 and the MR33, both their bandwidth shaping features don't support your request.   Find reference below of what you can configure. https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/Traffic_and_Bandwidth_Shaping     <<< Please help the community by marking useful posts helpful, or accept as a solution if it resolved your issue >>> ... View more

What channels are your RAPs using? ... View more

What version of code are you running on the 7500 and can you also provide a debug output on the wlc: debug capwap errors debug capwap events ... View more

Also provide: show wlan (WLAN id)   ... View more