Cisco Virtual Wireless Controller Vs Hardware Controller

[Jacob Berger]

Our WiSM needs to be upgraded.

We were given a choice of virtual (cheaper)  or hardware controller.

We were told that the virtual controller is designed differently and the usual traffic does not go through the controller.

question:

how does this impact security or other features of cisco wireless solution?

and if you have any other comments/experience  with the virtual controller

THANKS

[patoberli · Accepted solution]

I can't really comment on the security question, other than, it depends on your network design :)

Regarding features, if you already manage a controller and know the required features, you find here a good comparison of all controllers and its features:

http://www.cisco.com/c/en/us/products/wireless/buyers-guide.html#~controllers

I think the feature in question was "Central Mode" which the virtual one lacks. The more modern (or actually the way it was before we had controllers) is "Flex Connect". In this mode the data will be put in the correct VLAN directly at the port the access point is connected to. That means that you will need to configure a Trunk port on the Switch for each AP. Depending on your building security, that could be seen as an issue. You could protect that with 802.1x between AP and Switch.

[Scott Fella]

Just to add, like patoberli mentioned, it's your design you need to look at. If you want almost a seemless migration, you would go with hardware (5508/8510).  The vWLC most likely you will have to redesign your wireless environment. 

-Scott

[Jacob Berger]

thanks

when you say that with a vWLC i would most likely need to redesign, why would that be the case?

whats different?

[Scott Fella]

vWLC design is for FlexConnect. Unless your access points are all in FlexConnect, then your okay, if not, then it's a redesign.

-Scott

[Jacob Berger]

seems like ill need to upgrade APs and config to FlexConnect

found this link

http://nexp.com.ua/technologies/wireless/access-points-migration-to-vwlc-tips-and-tricks/

could you throw in some vWLC vs 5508 pros and cons.

thanks

[Scott Fella · Accepted solution]

I personally don't like the vWLC:)  what you need to look at is the limitation on FlexConnect which is in the FlexConnect guide.  If you support the VM infrastructure then your good, but if not, well it just another step to get things fixed.  Look at the data sheet also for vWLC and look at the max number of clients and access points and make sure that fits in your design.  FlexConnect vs local mode. Do a search on that and that will provide you some pros and cons also.

-Scott

[patoberli]

If you go with Flex Connect, you will need to reconfigure every single switchport an access point is connected to. Currently you probably have an access-port with a fixed VLAN. With Flex Connect you have a trunk port (probably?) with a native VLAN and if you value security, with a list of allowed VLANs.

This is something that you have to consider. Also, if you do secure the port with an allowed VLAN list, you will need to modify this list every time you want to allow a new VLAN on the access point, on every single switchport. This can be very time consuming, depending on how many switches/accesspoints you have.