cisco catalyst 9800 SSID configuration with different subnets

[Ahmed Gamal]

We have two datacenters, each hosting multiple Cisco Catalyst 9800 Wireless LAN Controllers deployed in both SSO (Stateful Switchover) and N+1 redundancy modes. These datacenters are connected to multiple IDF locations using Layer 3 routing between all the location . Each IDF has its own set of Wi-Fi subnets for different user groups (such as corporate users, guests, etc.).

Is there any way to use different subnets for each SSID in wireless controller , please check the demo diagram 

[Saikat Nandy]

If I have understood your requirement in a correct way then you would like to use same SSID in 2 different locations, each having their own subnet. If this is true, then yes it is possible. I would say keep the APs in flex mode... create different policy profiles and flex profiles with required vlan and map appropriate policy tag and site tag to the respective APs.

[Ahmed Gamal]

for flex connect access points we can i know what about the local access points there's any way 

[Saikat Nandy]

well probably a pretty broad question to answer just by looking at this diagram.. but if I think logically it might work..fact is that when AP is in local mode, all the client traffic will land to your controller interface..so you need L2 VLANs for sure.. since this is not straightforward, you can create SVIs for different VLANs in the controller and add the IP helper addresses.. create different policy profiles and separate Policy TAGs for respective location APs..and I hope your underlying routing will take care of the rest. Test this with one SSID first..

[Scott Fella]

@Ahmed Gamal 

I think you really need to look at your design overall and really understand the validated design for Cisco.  Do you really want to send traffic to your DC vs at the local site, do you have enough bandwidth for all that traffic including guest?  If you do want to send traffic out the DC and you have two DC's in different locations, you need to look at if you will span the vlans across the two or not, I doubt you want to, but who knows. Also understand failover, if you plan to have a failover to another DC in case the other DC is not reachable, the devices will have to obtain another ip if the vlan's are in different subnets.  So does that make sense to have.... maybe just have two, the SSO pair and then the N+1 in the same DC tied to specific sites.  If you do FlexConnect, you need to make sure you look at the limitations per say as there is also a max support number of AP's and clients you can have in Flex per site, unless you have FlexConnect High Scale Mode.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-17/config-guide/b_wl_17_17_cg/m-sniffer-cg.html?bookSearch=true#Cisco_Concept.dita_806fe241-834b-4994-a6c9-61725d091eef

Don't build a design until you know 100% how Cisco recommends how to implement their solution, the pros and cons of your requirements, ease of troubleshooting for the customer/staff, how wil patching and upgrading be in your final design.  Folks tend to build things out and then it looks great until you have issues and you have to upgrade of failover. 

Take your time, if you are new to Cisco Wireless, you can always work with your Cisco Wireless SE and have them help and explain what can work and what isn't recommended.

[Rich R]

You've stated you want to do this with APs in Local Mode - the crucial point here is that means the WLANs are Centrally Switched on the WLC.

Your diagram shows Corporate using the same VLAN 10 with different subnets 10.10.10.0/24 and 10.20.10.0/24 which is not possible when Central Switching (unless you started doing something really stupid like secondary addressing but I would say do not even consider that).  It is possible to have the same SSID (WLAN) using 2 different subnets but they will need to be in different VLANs.  You can re-use the same WLAN for both sites but attach different policy profiles - one using VLAN 10 and the other using new Corporate VLAN (eg 15) for the other Corporate subnet.  Same applies to the Guest WLAN/SSID.

Showing essential config only (rest removed for clarity).
vlan 10
 name corp_vl10
vlan 15
 name corp_vl15
vlan 20
 name guest_vl20
vlan 25
 name guest_vl25
!
wireless profile policy Corporate-vlan10
 vlan corp_vl10
wireless profile policy Corporate-vlan15
 vlan corp_vl15
wireless profile policy Guest-vlan20
 vlan guest_vl20
wireless profile policy Guest-vlan25
 vlan guest_vl25
!
wireless tag policy site1
 wlan Corporate policy Corporate-vlan10
 wlan Guest policy Guest-vlan20
wireless tag policy site2
 wlan Corporate policy Corporate-vlan15
 wlan Guest policy Guest-vlan25

Remember your WLC trunk port and corresponding switch port will need to allow all 4 of those VLANs and they'll obviously need to be defined on the switch too.  And of course the router/switch which provides the default gateway and DHCP relay for those VLANs will need to have them enabled too.

Not sure why @Saikat Nandy recommended using SVIs on the WLC!
WLC SVI is not recommended on 9800 (requires extra security config and routing controls) and is not best practice.  Refer to the Best Practices guide link below for the specific cases where SVI on WLC is actually needed.  It's recommended that in most cases your WLC VLANs should be layer 2 only and the layer 3 routing handled externally.