CISCO 8540 WLC licenses

[richter5087]

Noticed that the license is evaluation instead of perpetual? 

If we bought new AP, do we still need to buy licenses?

Cisco wireless controller 8540
Software version 8.2.151.0

[marce1000]

  - Ref : https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/config-guide/b_cg85.pdf
  >...To remove a license from the controller, enter the license clear license_name command. For
example, you might want to delete an expired evaluation license or any unused license. You
cannot delete unexpired evaluation licenses, the permanent base image license, or licenses that
are in use by the controller.

   - Note that the 8540 supports RTU based licensing , letting you adjust the AP count as much as you want but expecting to buy the real license amount in the end , 

 M.

[richter5087]

@marce1000 Appreciated your help, attached another screenshot for clearer picture.

Seen this RTU licenses, if I want to buy additional APs, let say 3802 series do I need to purchase the ap license?

[Leo Laohoo · Accepted solution]

Read the first three lines of CLI output. 

The 8540 is question was purchased for HA SSO.  The "base" perpetual license is only for 50 APs.  Any additional AP licenses will need to be purchase.

[richter5087]

Thanks for the reply, Master.

Any way to check the current in used licenses? as we plan to purchase new unit to replace the faulty old unit.
Replace 1 to 1 3702 to 3802, do we still need to buy license in this case?

[Leo Laohoo]

8540 is already past end-of-sale date.  Any "new" purchase would have to be used or refurbished.  

Replace the 8540 with the newer "9800X" (aka 9800M or 9800H).  Do not make any attempt to buy the 9800-40 or the 9800-80 because they are seriously and severely underpowered.   

Cisco Catalyst 9800 Series Configuration Best Practices

[marce1000]

  >... Do not make any attempt to buy the 9800-40 or the 9800-80 because they are seriously and severely underpowered.  
@Leo Laohoo Sorry Leo , but that is totally wrong , but if you maintain such statements then provide effective data , to make the argument , 

 M.

[Leo Laohoo]

---

@marce1000 wrote:
@Leo Laohoo Sorry Leo , but that is totally wrong , but if you maintain such statements then provide effective data , to make the argument , 

---

Back in December 2023, I was told by Cisco WNBU to keep the 9800-80 AP number BELOW 5,000.  No explanation was provided.  

Recently, beginning of May 2024, Cisco Catalyst 9800 Series Configuration Best Practices was amended with heavy emphasis given to the role of WNCD (aka "load balancer").  And it in this newly edited guide states:  

C9800 design is no different and, generally, Cisco recommends limiting the load to around 80% of the AP and client scale.

The 80% scale is just a recommendation to start planning the design and deployment of a catalyst wireless network as this is tested and validated number.

For C9800-80, for example, this means 4800 APs and/or around 50k clients. Does this mean that you cannot have six thousand APs on a single C9800-80? No, not really; Cisco has a lot of successful deployments at maximum scale. The 80% scale is just a recommendation to start planning the design and deployment of a catalyst wireless network.

---

So the 9800-80, marketed for being able to support "up to 6,000 APs", is recommended to stay below 4,800?   This is beginning to sound like the same issue faced with the CT5760.  (CT5760 was touted as being able to support up to 1,000 APs but it was so underpowered the "recommended" number of APs was cut to 50%.)

Loading a 9800-40 with 1,000 APs or a 9800-80 with 6,000 APs is easy.  Keeping it stable, however, now that's where the daily challenge lies!

In my humble opinion, this is marketing speak for a seriously underpowered platform.  

[Rich R]

Agreed with what Leo says - the latest Best Practices guide puts in writing what TAC have been telling customers for a while.  The WLCs struggle to perform to the data sheet spec.

The other example we experienced was that 9800 could not cope with https web auth redirects which 8540 was able to handle.  TAC told us the 9800 could not support the load and we had to disable https web auth redirects altogether otherwise thousands of customer connections were being dropped daily (with customer complaints) because the 9800 capacity for handling them was much worse than what the 8540 was handling without any difficulty.

And to add a bit more - a lot depends on what features you use and how the network is configured.  If you use the absolute minimum of features with all flexconnect local auth and switching (meaning minimizing load on WLC) and many sites spread evenly across all WNCd processes then it might be ok but if you're using web auth with central switching and other advanced features then that's when WLC is going to start struggling.  Part of this comes from the way the CPU is managed on IOS-XE compared to AireOS.  AireOS was better able to spread the CPU load across all available CPU cores while IOS-XE attaches a single WNCd process to a single core and tries to handle all the processing on that core severely limiting the processing capability even while other CPU cores are effectively idle.  It's inefficient architecture in my opinion.  There have been changes in recent IOS-XE releases to improve the WNCd load-balancing to try to mitigate that somewhat.  It will help but does not fully address the inherent limitation of the design which is that 1 CPU core can be maxed out while others sit idle.

The new 9800 models just recently announced https://www.cisco.com/c/en/us/products/collateral/networking/wireless/wireless-lan-controllers/cat-cw9800h1-cw9800h2-wireless-controllers-ds.html have essentially the same spec as 9800-40 and 9800-80 but boast "36% increase in performance" which probably tells a story itself.  If the original model was up to spec then they could have increased the capacity on the new model by 36% but they haven't so you can come to your own conclusions.

[Leo Laohoo]

@lachimip, @marce1000, @eglinsky2012, @richter5087 

Look at CSCwi10656 (IMGURL) because this bug reinforces my opinion that the plain 9800-40/9800-80 are severely under-powered.  The 9800X (aka 9800M & 9800H) does not guarantee that it is better in handling this bug.  

Found another one: CSCwj33979 (IMGURL) because this one is a gem!

[Rich R]

In fact I suspect that CSCwi10656 might have contributed to the problem we saw with https web auth redirection enabled.  At that time (Sep 2022) TAC didn't have a bug for it, they just told us to turn off https webauth redirection because the WLC could not cope. With 5 cases attached to the bug since November I guess they started to take it more seriously and looked into it with that bug!  I should point out we saw this issue with less than 1000 APs and less than 2000 connected clients on a 9800-80 so "Mostly seen on 9800-80. Smaller platforms will typically not get so many new clients connecting simultaneously" is a bit of a weak excuse.  It was a tiny fraction of what 9800-80 should have been able to cope with.

[Leo Laohoo]

---

@Rich R wrote:
Smaller platforms will typically not get so many new clients connecting simultaneously

---

Thanks, @Rich R.

Someone inside Cisco is trying to sugar-coat this.  The smaller platform, 9800-L, only has one WNCD queue.  The -40 and -80 has lots.  The software side has completely laid waste the -40 and -80.  With the 9800X (aka 9800M/9800H), there is no guarantee the situation is going to get any better especially when it is coupled with atrocious software.  

[Rich R]

Exactly - as I said above I think the architecture is the fundamental problem.  Adding extra CPU power will help a little, that's all.  They completely misunderstood how much processing the CPUs (control plane) on WLC have to handle and obviously never tested to scale.

[marce1000]

                >...Any way to check the current in used licenses?
  - Use the command show sysinfo and look for outputs related to licenses

 M.

[marce1000]

                    >...let say 3802 series do I need to purchase the ap license?
 - You can set the license count 'as many as you want' ; but officially you need to buy the right amount of licenses , to be 'cisco compliant'

 M.