Catalyst 9800 - Anchor WLC - How to prevent AP from joining Anchor WLC

[Martin Jelinek]

Hi all,

Is there any general recommendation how to prevent AP joining/associating with Anchor WLC?

I though about WMI, however WMI is used for management traffic as well (AAA, syslog, SNMP,...) and not only for WLC-AP communication.

But is there a command for 9800 WLC which simply refuse AP if any will try to join/associate?

I'm running IOS-XE 17.3.3.

Thank you for any hint.

Martin

[Leo Laohoo]

DHCP Option 43

[Martin Jelinek]

Hi Leo

this won't help you if an AP already knows "somehow" an IP of the Anchor WLC since it is being kept in the AP memory. So if AP has a problem with one WLC it will give a try to known controllers in the memory and if in memory is Anchor IP it will give a try...

In case of standardized environment it might be an option, but in case of widely spread environment with more controllers and administrators, it's a bit challenging.

Thanks

[Scott Fella · Accepted solution]

Well typically you would have the anchor in the dmz and not allow udp 5246/5247. You can also enable ap policy for mac authentication and make sure you have zero ap license.

[Martin Jelinek]

Yes, that we have in DMZ, so of course firewall ACL is an option, it is just still AP will give a try to associate even though FW will block/drop such connection. And apart of AP policy based on MAC address, most likely there is no other way around.

Thanks