C9115 running Embedded Controller

[mumbles202]

This is my first time using the 9115s and looking to see where some settings would be.  I was able to create a policy and key in a vlan under the access tab, but was curious if there is an option for named vlan/vlan groups from the gui like in a 9800?  Also, I can't seem to find the location to do a backup of the configuration from the GUI.  I can ssh to the unit and grab the show tech wireless but don't see where to export/download the configuration file in case a restore is needed.

[balaji.bandi]

have you tried going to advanced mode

https://www.cisco.com/c/en/us/products/collateral/wireless/embedded-wireless-controller-catalyst-access-points/white-paper-c11-743398.html

[mumbles202]

Thanks for the reply.  I thought there was an advanced before I upgraded to 17.6.4 code but not seeing it now, unless I'm looking in the wrong place. 

NVM - found it under preferences.  I see where to add another SVI under Layer 2 --> Vlans, but not seeing vlan/vlan group that I'd then be able to select from drop-down under my Policy.  Exported the configuration (show tech wireless) and ran it through the configuration analyzer (not 100% sure it works for the embedded controller as well as a standard 9800) and I'm seeing this error:

Authentication: Profile(s) with AAA Policy pointing to non-existing value. Profile: Guest_Wireless,Profile: Staff_Wireless,Profile: default-policy-profile

Action: Check the configuration item, and change/replace it with an existing value

But looking at the configuration I have this:

wireless profile policy Guest_Wireless
 no central association
 no central dhcp
 no central switching
 vlan 100
 no shutdown
wireless profile policy Staff_Wireless
 no central association
 no central dhcp
 no central switching
 vlan 20
 no shutdown


wireless profile policy default-policy-profile
 no central association
 no central dhcp
 no central switching
 description "default policy profile"
 http-tlv-caching
 ipv4 flow monitor default-flow-monitor input
 ipv4 flow monitor default-flow-monitor output
 no shutdown
wireless tag site default-site-tag
 description "default site tag"
 no local-site
wireless tag policy default-policy-tag
 description "default policy-tag"
 wlan Guest policy Guest_Wireless
 wlan Staff policy Staff_Wireless
wireless tag rf default-rf-tag
 description "default RF tag"
wlan Guest 2 Guest
 security ft
 security wpa psk set-key ascii 0 Guest_Wireless!
 no security wpa akm dot1x
 security wpa akm psk
 security wpa akm sae
 security wpa wpa3
 security pmf optional
 no shutdown
wlan Staff 1 Staff
 security ft
 security wpa psk set-key ascii 0 Success123!
 no security wpa akm dot1x
 security wpa akm psk
 security wpa akm sae
 security wpa wpa3
 security pmf optional
 no shutdown

[balaji.bandi]

don't have device access now to provide the right direction for you, I am sure there should be.

[mumbles202]

---

@balaji.bandi wrote:

don't have device access now to provide the right direction for you, I am sure there should be.

---

Thanks. I just want to setup a simple SSID with PSK and have users get an ip on vlan 20 or 100 depending on which SSID they are connected to. Is the above corrector am I missing something?

[Rich R]

Remember the EWC on AP only supports flexconnect local switching and the EWC and AP can only use IPs on the native (untaggged) vlan - no vlan support on the WLC itself because it does not support central switching at all, only management.

So all VLAN definitions must be in the flexconnect profile and then it's same as always.  If you use vlan names (you can also use numbers - just type the VLAN ID) then those names must be defined in the flexconnect profile.

[mumbles202]

Thanks for the reply.  At the moment I'm not able to test the configuration to confirm I get an ip, but I have all the interfaces facing APs set as trunks so running in FlexConnect should be fine. 

Does the above configuration appear correct?  I'm not sure if the Configuration Analyzer works for the 9100 series running the embedded controller.