Hello Haitham, you can do this under Maps  /  Wireless Maps  /  Site Maps after uploading the floor map than select planning mode under the select a command in right side top.. the link and video link will help you step by step how to do this. https://www.youtube.com/watch?v=m7XTgt8LahY http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-1-4/user/guide/pi_ug/wireless-maps.pdf HTH good luck ... View more

looks like you'r almost there, why do not you try to like this; apgroup1------test1(SSID only)-----AP1 apgroup2------test2(SSID Only)-----AP2 apgroup2-----test3(SSID Only)------AP3 just do not add all 3 ssids in each apgroup, add only 1 proposed ssid in each apgroup and add only single AP in each as you planned. forget about default apgroup!! you can not edit it.. just move you Aps to other apgroups. HTH, please rate if you find helpful.  John ... View more

Thank you Ric yes the users are on different subnets than wlc mgmt subnet. No there is no firewall inbetween users and wlc is there any way to block them accessing wlc   mgmt ip through the wlc itself??   thank you   ... View more

Hi dridi, can you plz explain that how did you deployed this AP, is this connected to a POE switch or using power injector? try to check the ethernet cable test if it is connected through a switch!   HTH ... View more

Hi Roy, yeah your existing devices support guess access, and the only things you need to do are, configure a new vlan for guest users, map that vlan within all the route to wlc and internet. allow internet on that vlan's ip subnet configure a dynamic interface using that vlan in the WLC configure new ssid in controller ...GUEST map the dynamin interface guest if you want preshared key security for your guest than configure any PSK key under WLAN--GUEST--layer2 security and hit apply if you want to configure a web-auth authentication. than you either choose layer2 security or choose none to keep it open for guest users...(no Password) configure layer3 security as web-auth using this document fom link http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-vlan/70937-guest-internal-wlan.html   HTH   ... View more

Hi tdaly, yeah, you can do your setup as hotel using any web-auth gateway router OR you can buy cisco ISE for BYOD deployment. this is the one procedure. and if you dont want to buy any other appliances, you can use your ACS as radius server to integrate with WLC and AD OU/group for 802.1x auth for students and teachers SSIDs. you can map diffrent vlans to different ssid as well.   HTH ... View more

Thank you for our reply. i have Cisco MSE 3355 and the above link shows that 3355 does not support with CMX 10.0 and  will support for upcoming release.   any thought on the work around please. ... View more

Thank you Rasika for your reply.   but what about the building maps, can i upload them direct in MSE ? i would have WAP distributed on those maps right? but without prime can i do that through MSE itself using 10.0 code?   thank you ... View more

Hi,   thank you for your reply Dhiresh Yadav. can someone plz put a little more light and guide me for the best practice to utilize my guest anchor controller with CA deployment, where i would have 3850 as MA and 5508 as MC and another 5508 as guest anchor in DMZ. i am a bit of confuse and don't get the correct idea to accomplish this task. i have Cisco ISE also for the same guests traffic for CWA and posture assessments etc. how do i setup this in order to have a smooth guest access network? i want to utilize guest anchor controller too!!! as wel as ISE also!!! how would be configuration and integration steps here in this kind of setup within converged access wireless deployment? any thoughts plz ... View more

Hi Dhiyadav, thank you for your reply it cleared some doubts that were in my mind but i need your more support to guide me a converged access deployment which i am going to deploy within few days. i have  2x5508 in HA as MC 30x3850 switches, and all will be used as MA(s) with multiple SPGs 2X5508  1:1 as an anchor controller 1xISE 1.3 for guest access 1xCPI for wireless mgmt and monitoring purpose 1xMSE3355 with wips and context aware licenses 200x cisco 3702i WAP 50x WSSI module for monitoring the channels can you please put a light on the design and guide me that which are the best possible solutions to get this job done very smoothly. i will also let you know about my proposed design scenario but for sure i need your recommendations as well :) so, i will use 2x5508 wlcs in HA as a MC which are AP-Count and HA licensed.. 3850 switches will be MA and i ll configure SPGs per floor switches stacks  WAPs will join on these 3850 MAs base on each floor i would have 2 ssid like employee and guest i will configure them on each 3850 stack MA along with their SVIs for users access like (empolyee and guest ssid) here my question is for guest ssid and its vlan... do i configure it here or on anchor controller??? i want ISE to be integrated with wireless for employee 802.1x and for guest web Auth. so, how i will integrate ISE with wireless. i mean weather i will integrate it anchor controller or with each 3850 MA??? between foreign and anchor controller i will use new mobility instead of old EOIP!!! where shall place ISE in my network, in DMZ or with Core switch? my target for guest users to do not have access to any corporate network sources ? MSE: can i use both wips and context aware on the single MSE box? if yes, than what is the best practice for configuring them? are each 3850 MA will be added in MSE? WSSI module . will be used for monitoring purpose for wips and context aware profiles. all access point will be worked in local mode for serving users access. thank you     ... View more