cisco catalyst 9800 SSID configuration with different subnets

[Ahmed Gamal]

We have two datacenters, each hosting multiple Cisco Catalyst 9800 Wireless LAN Controllers deployed in both SSO (Stateful Switchover) and N+1 redundancy modes. These datacenters are connected to multiple IDF locations using Layer 3 routing between all the location . Each IDF has its own set of Wi-Fi subnets for different user groups (such as corporate users, guests, etc.).

Is there any way to use different subnets for each SSID in wireless controller , please check the demo diagram 

[Saikat Nandy]

If I have understood your requirement in a correct way then you would like to use same SSID in 2 different locations, each having their own subnet. If this is true, then yes it is possible. I would say keep the APs in flex mode... create different policy profiles and flex profiles with required vlan and map appropriate policy tag and site tag to the respective APs.

[Ahmed Gamal]

for flex connect access points we can i know what about the local access points there's any way 

[Saikat Nandy]

well probably a pretty broad question to answer just by looking at this diagram.. but if I think logically it might work..fact is that when AP is in local mode, all the client traffic will land to your controller interface..so you need L2 VLANs for sure.. since this is not straightforward, you can create SVIs for different VLANs in the controller and add the IP helper addresses.. create different policy profiles and separate Policy TAGs for respective location APs..and I hope your underlying routing will take care of the rest. Test this with one SSID first..

[Rich R]

You've stated you want to do this with APs in Local Mode - the crucial point here is that means the WLANs are Centrally Switched on the WLC.

Your diagram shows Corporate using the same VLAN 10 with different subnets 10.10.10.0/24 and 10.20.10.0/24 which is not possible when Central Switching (unless you started doing something really stupid like secondary addressing but I would say do not even consider that).  It is possible to have the same SSID (WLAN) using 2 different subnets but they will need to be in different VLANs.  Your can re-use the same WLAN for both sites but attach different policy profiles - one using VLAN 10 and the other using new Corporate VLAN (eg 15) for the other Corporate subnet.  Same applies to the Guest WLAN/SSID.

Showing essential config only (rest removed for clarity).
vlan 10
 name corp_vl10
vlan 15
 name corp_vl15
vlan 20
 name guest_vl20
vlan 25
 name guest_vl25
!
wireless profile policy Corporate-vlan10
 vlan corp_vl10
wireless profile policy Corporate-vlan15
 vlan corp_vl15
wireless profile policy Guest-vlan20
 vlan guest_vl20
wireless profile policy Guest-vlan25
 vlan guest_vl25
!
wireless tag policy site1
 wlan Corporate policy Corporate-vlan10
 wlan Guest policy Guest-vlan20
wireless tag policy site2
 wlan Corporate policy Corporate-vlan15
 wlan Guest policy Guest-vlan25

Remember your WLC trunk port and corresponding switch port will need to allow all 4 of those VLANs and they'll obviously need to be defined on the switch too.  And of course the router/switch which provides the default gateway and DHCP relay for those VLANs will need to have them enabled too.

Not sure why @Saikat Nandy recommended using SVIs on the WLC!
WLC SVI is not recommended on 9800 (requires extra security config and routing controls) and is not best practice.  Refer to the Best Practices guide link below for the specific cases where SVI on WLC is actually needed.  It's recommended that in most cases your WLC VLANs should be layer 2 only and the layer 3 routing handled externally.