9800 WLC - 2 Flex Profile in a Site Tag?

[kdemir]

Hello,

I am using a Cisco 9800 WLC and want to configure 2 different guest ssids with different client vlans in a same AP.

I created 2 policy profile and 1 policy tag. Added 2 policy and wlans this policy tag.

I want to do that for site tag but site tag has flex profile on itself so i could not add 2 flex profile configured for different vlans to one site tag.

What should i do?

Thank you

[marce1000]

 - Review this documentation and compare your settings : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html , also : what error are you getting when you try to add the second flex profile ?

 M.

[kdemir]

hello,

can i add 2 different vlan to a flex profile and add this flex profile on my site tag. So i can add this iste tag to my AP. In this way can i use this 2 client vlans on an AP? like picture below:

[Rasika Nayanajith]

In your Flex Profile, you should be able to add any number of VLANs that is available at remote site & trunk to the port AP connected. Site tag can have only one Flex Profile and you really need one as well.

If you need different WLAN client get different VLAN, that is managed via "Policy Profile"

Refer below post for more detail
https://mrncciew.com/2023/01/21/9800-flexconnect-basics 

HTH
Rasika
*** Pls rate all useful responses ***

[kdemir]

So if i add 2 vlans in a flex profile, it means this 2 vlans can behave local when wlc connection is failed. This is the purpose of flex profile and i did this for this 2 vlans.

Am i right? Sorry for bother i am just trying to figure it out:)

[Rasika Nayanajith]

Yes, Even the WLC fails those AP able to connect wireless clients & put in to those local vlans. Typically you assign those 2 vlans for two different SSIDs

HTH
Rasika
*** Pls rate all useful responses ***

[kdemir]

This 2 vlans is assigned for 2 different ssids on the policy profile. In this case the vlan which assigned on the policy profile should not assigned to flex profile for same ssid-AP?

In other word policy profile vlan and flex profile vlan should be different for ssid or AP?

[JPavonM]

For that wou would need to configure a VLAN group and assign that to the Flex-Profile, but it seems to me this is not supported.

Or you can use AAA override and send the VLAN id after authentication.

[rajeshshankar671]

Review the constraints of the flex profile associated with the site tag. Flex profiles usually define a set of attributes, including VLANs. Determine if there's a way to accommodate both of your desired client VLANs within this flex profile.

[Flavio Miranda]

Hi @kdemir 

 On the Flex profle you have the alternative of creating two Vlans.

First Vlan - SSID X

Second Vlan - SSID Y

Then, you create Two Policy profile and you map each SSIDX and SSID Y  to the Vlans you added to the Flex Profile previously.

On the Policy Tag, you are going to Map the Two SSIDs to the Two Policy Profile you just created.

On the Site Tag, you can attach your Flex Profile.

And then you can apply your Site Tag ( Containing the Two Policy profile) and the Site Tag (Containing the Flex Profile) to the AP

[kdemir]

thank you @Flavio Miranda, so the vlan we added to policy profile and the vlan we added to flex profile should be different or can be same? How are the vlans(policy profile vlan and flex profile vlan that we added for the SSID) working, like redundant or they can be same?

[Flavio Miranda]

No, they must be the same. 

You add the vlan on the Flex  profile and then you attach them on the Policy profile. On the Policy profile, each SSID will have its own Vlan.

[kdemir]

Thank you Flavio, it helped me to understand the concept.

When i adding vlans to the flex profile i realized i can add same vlan with different name. Will it cause problems if someone add same vlan again to flex profile?

[Flavio Miranda]

You can use the same vlan, if you want. You may want to create 2 SSIDs in a site that have only one local vlan.