Showing results for 
Search instead for 
Did you mean: 

WLC Config Analyzer


The WLC Config Analyzer home has moved to Cisco DEVNET.  See:


We also have a cloud version of the tool:


Historical info

(please use new forum for updates)

Wireless LAN Controller (WLC) Config Analyzer


Click here to Download

To request access, send an e-mail to Please include your username. Cisco employees do not need to request.

  • New version 4.0 Nov 2015
  • You may need to install .NET 3.5 before using it.External link to download:



March 31 2015. Version 3.6.5


  • Tool tips added on AP grid
  • AP MIC expiration warning
  • Flex Policies information on WLAN table


  • Minor parsing errors
  • Wrong text message on 100003
  • Wrong error on missing information on WLANS for custom web profiles

February 04, 2015. Version 3.6.4


  • Typos on messages
  • RF health exception if neighbor  AP had no power level
  • Incorrect calculation of side channel interference could lead to zero health
  • Incorrect parsing of mobility peers when new mobility is enabled
  • No text for message 2005
  • WLAN data rates nor parsed properly, display error
  • Message tab columns had incorrect order
  • NGWC:
    • Parsing error on coverage information line
    • Parsing error on peer to peer  wlan state
    • Corrected WLAN table display
    • Parsing of AP groups

January 15, 2015. Version 3.6.3



  • 11b channel monitor incorrectly parsed, leading to false positive report
  • 11b RF group peers not properly tracked
  • Corrected text for messages 40043, 30062 for clarity
  • Fixed false detection of telnet enabled on WLC
  • Added detection for parsing error on DCA Monitor channel line
  • Fixed password length check (120013)


December 17, 2014. Version 3.6.1



  • IOS-XE improved support: best practices, mobility parsing, GUI display. Partial support for RF summary, 3.7 RF information
  • Serial number in AP summary table
  • Filter per band in AP RF summary table
  • On Channel Neighbors count in AP RF summary



  • Power distribution graph level 1 not displayed
  • Exception while parsing 5760
  • RF Health calculation for Side channel noise in 5 Band
  • RF problem finder window scale issues on VMWare
  • High SNR client stats missing


November 20, 2014. Version 3.5.3

  • Fixed display of WPA AES state 
  • Fixed exception when there is a parsing error on power levels per radio

October 10, 2014. Version 3.5.2

  • Detecting Empty mesh BGN in AP config
  • Incorrect reporting of standalone TKIP in use, when there is no dot1x or PSK policies set
  • Corrected warning for empty IP Address on redundancy interfaces
  • Message wmm required for 11ac/11n not displayed when parsing a single wlc
  • Exception on 7.3 configs without RF profiles
  • Improved error reporting on parsing lines
  • Incorrect parsing of flex AP mode
  • Partial fix for window size problem on rf problem finder tool. Disable Aero interface in Windows if still having problems.
  • Handles gracefully AP list corruptions (adds AP creation in AP group information)
  • Properly parses Channel 14 Interference/Noise data as NA, in ETSI APs
  • Fix on Nearby list processing, if last line in AP is corrupted
  • Fix on parsing of system info\Management IP address
  • Fixed logic of message 30062 (false positive)
  • Fixed duplication of message 30057 for some scenarios
  • Fixed parsing of Static WEP state
  • Null error on best practices checks for some configs
  • Fixed parsing error on incorrect line separator
  • Fixed error on percentage display on best practices summary
  • 43 new checks
  • Best Practices score analysis
  • Flexgroup and FlexAP support
  • Displays DHCP proxy per interface, compares across controllers
  • Parsing, comparison between WLCs, and display of global user idle timeout
  • Parsing, comparison between WLCs, and display of WiFi direct, wlan sleep timer/sleeping client feature
  • Config Comparison across controllers of DCA mode, selection interval, metric contributors, channel list,  and channel width across controllers                   
  • Config Comparison across controllers of TPC mode, power threshold 
  • Mesh security mode parsing, comparison across controllers
  • Displays DCA metric contributions
  • New Security  Checks category
  • WLAN parsing of 11r, SKC, PMF, comparison across controllers
  • Parsing, comparison between WLCs, and display of critical management password policies                           
  • WLAN table rewrote for simplification on information displayed, less columns, adds support for 11r, PMF
  • Show values to the RXSOP and CA info messages
  • AP power state and flex group name to AP config table
  • New AP group CSV export            
  • 8.0 Support. Added RF profile DCA bandwidth, Fixed Parsing error on QinQ AP group info


July 19, 2014. Version 3.4.2

  • New Best Practices analysis tool. Focused on checking if "good to use" features are in place
  • WPS section parsing
  • SSH/Telnet/Fast SSID parsing and display
  • Checks for telnet enabled, DHCP proxy mismatch, NTP sync, Management over Wireless added
  • Improved readability of WLC/Site summary pages
  • Added QoS, Local profiling, dot1x info to wlan table 
  • New Report Center, to launch all supported report files. Disabled default report creation
  • Significant speed improvements for Neighbor calculation on large networks
  • Radius server line parsing error if line was incomplete
  • RF Index calculation exception on some files

June 27, 2014. Version 3.3.1

  • Added message summary per WLC/Site
  • HTML report  ad CSV file generation is now disabled by default
  • New Report Center being added (work in progress)
  • Correct library installation for Chart component on some PCs
  • Moved to .Net 3.5 client profile for lower memory/startup time
  • Exception error on RF Health calculation when unknown nearby data was found
  • Fixed RF Health metric for side channel noise/interference

June 27, 2014. Version 3.3.0

  • Added warning if TKIP standalone is used
  • WLAN table enhancements: displays encryption types, AVC
  • AP graph can be filtered by AP group
  • Improved message 60011 with compensated power data
  • New RF Health metric for ease of detection of problematic areas
  • Corrects parsing of 4.2 WLC files
  • Reduces problem on .Net library load (lower time when opening config set for first time)
  • Fixes problem on  AP manager check with vlan untagged scenario
  • Fixes problem on redundancy parameter parsing
  • Fixes logic of message 30065

April 23, 2014. Version 3.2.4

  • Added partial support for 5760/3850 NGWC controllers. You need to collect "sh tech and sh tech wireless" on same file for each controller (one file per ngwlc)
  • Added parsing and display of wlan count per radio on AP config
  • Updated warning for controllers with deferred or affected by security advisory versions
  • Parses, checks and displays Local EAP status per WLAN
  • Parses, checks and displays Rogue Policies, compares settings between controllers
  • Parses, checks and displays Clean Air config, compares settings between controllers
  • Chart for Client SNR distribution
  • Best practices 2.0 Checks
  1. Recommend to disable 1,2,5.5,11 data rates
  2. Warn if more than 4 SSIDs active per radio
  3. Recommend multicast multicast mode for all cases
  4. Warn if mobility group (same name) > 15 controllers, shows message to reflect that it should cover only the RF roaming space
  5. Recommend low radius timeout depending on usage scenario (not a general change)
  6. Warn if EAP identity if <10 sec, and when is needed
  7. Warn if using internal DHCP server due to scalability issues
  8. Warn if using local EAP, due to scalability on very large networks
  9. Recommend to change EAP retries to 4, timeout to 400ms
  10. Warn if tacacs timeout is short, recommend long times for OTP
  11. Recommend to have minimum rogue RSSI to -80
  12. Recommend to disable all rogue auto contain settings, unless absolutely needed for security reasons
  13. Recommend AVC enabled
  14. Warn if Fast SSID is not enabled for Apple Clients
  15. Warn if cleanair is not enabled
  • Parsing of Tacacs server entries with management timeout values
  • Parsing of User Idle timeout per wlan when it is disabled
  • Wrong detection of AP on high co-channel
  • Corrected redistribution of MS Chart Control (now properly included, and prerequisite)


March 21, 2014. Version 3.1.1

  • Application error when clicking AP name. Slot0 was not parsed
  • Multicast address message only displayed if multicast is enabled (30034)
  • RSSI client count calculation error for RF Summary

March 20, 2014. Version 3.1.0

  • Adds support for 7.4 to 7.6 versions
  • RLAN support
  • Displays Redundancy info for 7.6
  • Almost full parsing of WLAN configuration
  • Displays AP username in AP list
  • Parses and displays 802.11n, 802.11ac network status
  • Changes how text information is displayed, for ease of reading
  • Added Radius Auth Call Station ID support
New Checks
  • Warns if 11ac or 11n radios are present, but WMM is disabled on the WLAN            
  • Warns if 11ac or 11n radios are present, but 11n or 11ac support  is disabled on the controller              
  • Compares Radius Auth Call station ID across controllers
  • 78 parameters compared for matching WLANs across WLCs.
  • Warns if using HA, and no vlan tagging on management interface
  • Error while parsing mobility peers
  • Corrected that RSSI/SNR client percentage on RF summary per controller, are calculated for 1 controller, and not for all loaded
  • Corrected High RSSI client count per controller
  • Fixed wrong info on Radius aggressive failover status
  • Parsing of Radius servers on new versions
  • Parsing error on Mobility peers



RF Health Metric

New in Version 3.3.0

New experimental troubleshooting tool: “RF Health”
This is a modification of the RF index to change the format to a 0 to 100 metric, the higher the better, for a easier to use experience
it should work  properly to isolate what areas/Aps of the deployment are having a bad RF state, affecting clients.

RF Health will try to calculate different metrics applicable to RF quality on the AP, and convert to a single 100 based scale. It takes into consideration things like low SNR client count, co-channel interference, channel utilization for nearby Aps, noise, etc.
It currently supports 20/40 channel width, and handles properly bonding scenarios.
You can open “RF problem finder” to get details on the metric per type, per AP, for in depth analysis
Please provide your feedback on the metric, for additional improvements, change on default values, etc.


WLC Config Analyzer Checks



General Usage: (you can subscribe)

Bug reports/issues/features:

Fixing Voice Error Messages


WLC Config Analyzer FAQ

How to Use



Excellent tool, very helpful!


It seems to run OK and outputs the warnings in a browser, but then the program hangs with the task box  "processing: Calculating AP Index" showing. The program is unresponsive and has to be shut down in task manager.

Windows 7 64bit.

Did not chose any audits.

Task manager does not show any processing happening.

Any ideas?

Edit: Since I manually installed .NET 3.5 and rebooted, the program no longer hangs, though it does show me an error message regarding the AP index. (don't know if it was the reboot or .NET that helped).

Config file sent as requested.

Thank you.

Edit 2: The problem as identified by Javier was an AP stuck in a half programmed state. Tried exporting from a different controller and everything worked normally. Thanks for the quick support, it was much appreciated.

Javier Contreras
Cisco Employee

Hi Dale

could you send me the sh run config? you can attach and email

That would allow me to do local check on it



Hello Javier,

Thanks for your hard work and efforts on this config tool. I have a suggestion that might be worth investigating but could be more trouble than it’s worth. I’ll let you decide. I have a guest network (SSID) on my controllers I’m sure like everybody else. When I look at my stats and clients below SNR levels, these are mainly these guests that are using low power devices and might even be grabbing it from next to my facility(read far away from the AP). But that’s another problem for another time. :-)

I was wondering if there’s a way to allow us to selectively exclude the guest SSID which would then allow me to just view my company assets and get the reading based on just those devices on my production SSIDs.

Forgot to specifically mention that the error is 90026,Vocera percentage of clients detected at poor RF coverage.

Thanks again,


Javier Contreras
Cisco Employee

Hi Charles

     Thanks for the feedback and ideas....

     The SNR/RSSI levels are reported on a per-radio aggregation, not on per-SSID, so there is no direct way to exclude low SNR Clients, depending on which SSID they are...

     We can have how many clients are per SSID from the config, and how many are on the SNR historgram levels... but doing a correlation there, could lead to false negatives (like I can't just substract guest SSID from bad SNR totals... it would give bad results on most deployments)

      your proposal makes total sense... but the current agregation level present on the sh run does not allow that granularity :-(



In the RF summary I see the Client RSSI Distributions for the WLC.  Is there a way to see the RSSI distributions per AP? If not, the Client RSSI for the whole WLC (500 APs across an entire city for us) is of limited use when trying to figure out which APs/installations may need some additional APs added, or a redesign etc.

Javier Contreras
Cisco Employee

Hi Dale

yes, the current RSSI/SNR summary is client focused, not AP, so  it is not useful to find out which APs may be having coverage issues.

RF problem finder does not focus on low SNR, nor the graphs...

so yes, if you want to get APs that have lower than average SNR/RSS count, there is no easy way right now in the WLCCA.

I think I can add a "average SNR" count, then show how APs deviate from this value.  I can explore this, as this tool may be done on different ways: either as SNR/RSSI summaries vs network average, or by a graph showing deviation, etc. Let me see what is best for a large network representation.

I think your usage case makese sense: quick check on which areas may need additional coverage based on persistant low SNR/RSSI count.

One detail: this is covered on WCS/NCS coverage area exceptions, and/or in CHD in WLC



Coverage Hole Detection is a good suggest, we had forgotten about that counter. While it would be nice to see AP RSSI info in WLCCA it would still just be a snapshot of a single point in time, so CHD would be better in that it would capture all clients thoughout the day. Thanks for the tip we'll explore that today.

If you were to add AP RSSI to WLCCA by showing APs deviations from average, it might also be good to show client count for each AP (so the stats/importance is weighted).



Question: are there also plans to add the settings for the radius server like "fallback mode" in the config analyzer?

We have customers with a few 100 wlc's and this option can be usefull.

Javier Contreras
Cisco Employee


well, now there are plans :-)

it is a valid request, and makes total sense. Let me add this to the feature list for next releases


Rising star


I have returned to the forums after a long absence and have started to update some of the scripts I wrote in the past

Here is verison 1 of the script to automate/perform a "transfer upload datatype run-config" to a tftp server for the sake of pushing the output to WLC Config Analyser



Hello Javier,

I wanted to ask, if you plan to add support for the new IOS based WLCs as well?




Javier Contreras
Cisco Employee

Hi Patrick

yes for sure!

I am working on a 3.0 version, that will have support for 5760/3780... it is just matter of finding time to complete it

right now is on alpha version, with some missing features


michael kordek
Community Member

I'm trying to install the latest version of the Configuration Analyzer on a Win 7 laptop and am getting below errors:


* [9/2/2013 1:18:00 PM] : Activation of C:\Apps\WLC Analyzer\WLC Config Analyzer.application has started.

* [9/2/2013 1:18:01 PM] : Processing of deployment manifest has successfully completed.

* [9/2/2013 1:18:01 PM] : Installation of the application has started.

* [9/2/2013 1:18:01 PM] : Processing of application manifest has successfully completed.

* [9/2/2013 1:18:05 PM] : Found compatible runtime version 2.0.50727.

* [9/2/2013 1:18:05 PM] : Detecting dependent assembly Sentinel.v3.5Client, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=msil using Sentinel.v3.5Client, Version=, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=msil.

* [9/2/2013 1:18:05 PM] : Detecting dependent assembly System.Data.Entity, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil using System.Data.Entity, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil.

* [9/2/2013 1:18:05 PM] : Detecting dependent assembly WindowsBase, Version=, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil using WindowsBase, Version=, Culture=neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil.

* [9/2/2013 1:18:05 PM] : Detecting dependent assembly System.Core, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil using System.Core, Version=, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil.

* [9/2/2013 1:18:05 PM] : Request of trust and detection of platform is complete.

* [9/2/2013 1:18:06 PM] : Downloading of subscription dependencies is complete.

* [9/2/2013 1:18:06 PM] : Commit of the downloaded application has started.


Following errors were detected during this operation.

* [9/2/2013 1:18:06 PM] System.Runtime.InteropServices.COMException

- The application binding data format is invalid. (Exception from HRESULT: 0x800736B2)

- Source: System.Deployment

- Stack trace:

at System.Deployment.Internal.Isolation.IEnumSTORE_ASSEMBLY.Next(UInt32 celt, STORE_ASSEMBLY[] rgelt)

at System.Deployment.Internal.Isolation.StoreAssemblyEnumeration.MoveNext()

at System.Deployment.Application.ComponentStore.CollectCrossGroupApplications(Uri codebaseUri, DefinitionIdentity deploymentIdentity, Boolean& identityGroupFound, Boolean& locationGroupFound, String& identityGroupProductName)

at System.Deployment.Application.SubscriptionStore.CommitApplication(SubscriptionState& subState, CommitApplicationParams commitParams)

at System.Deployment.Application.ApplicationActivator.InstallApplication(SubscriptionState& subState, ActivationDescription actDesc)

at System.Deployment.Application.ApplicationActivator.PerformDeploymentActivation(Uri activationUri, Boolean isShortcut, String textualSubId, String deploymentProviderUrlFromExtension, BrowserSettings browserSettings, String& errorPageUrl)

at System.Deployment.Application.ApplicationActivator.ActivateDeploymentWorker(Object state)

Does anyone have any thoughts on why this is happening?




Not sure what the official way to submit a feature request is, but I'd really like to see the "compensated heard power" ported over to the "Highest Rx neighbor on-channel". Would be very useful for determining where too much CCI could occur. As it stands, I think the "Highest Rx Neigh. On Channel" is based on neighbor messages (power level 1).

Recognize Your Peers
Content for Community-Ad