9800 WLC 802.x can i add more vlans than 16 to a flex dynamic assignment?

[newfabcom]

Hi, I am setting up a 9800 controller and I want to assign vlans dynamically using ISE. I have it set up and working, but I can only have 16 vlans in the list of vlans in the flex tag. If a vlan is not listed there, the wireless device joins the native vlan.

Is there any way to have more than 16 vlans dynamically assigned per AP in a flex environment? Can i add a vlan group to the flex list? Can i somehow have all vlans available instead of just the vlans on that list?

your help is appreciated.

Thank you

[newfabcom]

Hi, why does this limitation exist? why can't I dynamically switch 4000 vlans?

Why is no one else complaining about this?

Please help

[Scott Fella]

All my years doing this, I have never had a customer or myself ever need to have more than 16. Even 10 is too many and most designs don’t need this especially for one site.

[Cristian Matei]

Hi,

    I'm not sure if this restriction is technical related or marketing/business decision related. However, If you need more than 16 VLAN's on that site, probably you would need to go and deploy a WLC on that site and no longer run FlexConnect; FlexConnect came up for small branches, thus 16 VLAN's should be more than enough. Looks like you have a bigger branch :)

Regards,

Cristian Matei.

[Scott Fella]

Why would you need more than 16 for wireless subnets is my question. Even for a large branch the overall design doesn’t seem right. Again, only wireless vlans are needed. Even with dot1x override, devices should be organized by what traffic is allowed, not separate by device type or function, unless there is some use case or it was the way it was when you joined the company.

Like what was mentioned, put a controller then at the site and run local mode.

[newfabcom]

The way this network is set up is they have about 20 groups that all want to have access to the computers, printers and speakers in their groups. All groups have their own vlans and only the devices in their group are on their vlan.

The reason I want to use flexconnect is so that the traffic isn't tunneled back to the controller, it seems like everything feels faster if traffic is switched locally and let the C9300s handle it instead of tunneling it through the C9800.

Am i missing something? can I switch traffic locally without using flexconnect?

Thank you for your help

[Scott Fella]

FlexConnect is the only way you can switch traffic local. That means you are limited to the specs for FlexConnect. The only way you can get around this is to have a controller at the site and use local mode.

[newfabcom]

Thanks for that info, 

I have a WLC on the site, but as i understand, in local mode. all the traffic is tunneled through the WLC.

The wifi is high bandwidth usage.

In local mode, is all traffic tunneled through the WLC? couldn't a few very high bandwidth clients on wifi max out the ethernet on the WLC?

[Scott Fella · Accepted solution]

To be honest, I have seen installs with in large environments like hospitals where they just only had one port connected and never had issues. You can use up to 4 ports or even the mgig ports if you wish. I don’t think you will max out.

[mqontt]

i am wondering why was this possible to be done on AirOS, but now its not possible on iosXE release.

[Scott Fella]

They are not the same that is why.  If you have a question, it's best to open a new thread and put as much information as you can.  Sometimes, there are other way's to solve the issue besides trying to align with the old AireOS way's.