Flex Profile Maximal

[hs08]

Hello,

My AP running using flex connect with WLC9800 and i will build dynamic vlan for this SSID. The vlan will be based on the department and i have more than 40 depts. The issue is when i create flex profile then i add vlan mapping then i got 'The maximum number of interfaces 16 have been added to the flex-profile.

How i can add more than 16?

[Mark Elsen]

 _ @hs08            Why do you need to map more than 16 VLANs under Flex profile if there are only 16 possible SSIDs per AP? This is not only Cisco feature but most of the vendors.

  M.

[hs08]

hi @Mark Elsen 

I'm not going to create 16 SSID but only one SSID with dynamic vlan and the vlan belong to our department where i have more than 40 departements.

[Mark Elsen]

  - @hs08               Ref : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html
                               >.....    Note:     A maximum of 16 locally switched VLANs can be mapped to a Flex profile.

  M.

[Rich R]

16 VLANs is a hard limit - there is nothing you can do to increase that @hs08 

However - you do not need to map VLANs in the flex profile unless you want to refer to them by name.

If you simply reference the VLANs by VLAN ID (number) then they will simply work - at least that is the case for static SSID configuration - I have not tested with dynamic VLAN assignment.  Suggest you test it to confirm.

[aleabrahao]

@Rich R , things work a little differently on the C9800. Even if you dynamically assign the VLAN when working with FlexConnect, you need to have the VLAN mapped in the Flex Profile.

@Mark Elsen , it's not about the number of WLANs, but rather the number of VLANs he wants to apply dynamically to a specific user depending on the department.

@hs08 , the only thing I can think of is creating a Flex Profile for each department, but I think that will be a problem because you would have to create a specific Site Tag for each department as well, so I think it's impractical.

Are these departments physically in the same place? Because if they are in different locations, you can standardize the VLAN.

For example, the HR Department is at site A and the Finance Department at site B, so you could use the same VLAN Tag (10 for example) with a different subnet.

[Rich R]

@aleabrahao you say "things work a little differently on the C9800. Even if you dynamically assign the VLAN when working with FlexConnect, you need to have the VLAN mapped in the Flex Profile."

We've had the discussion about the need to map VLANs in flex profile before and the answer (in general) is that it categorically is not necessary (at least for statically assigned VLANs).  But I have never tested it with dynamic VLAN assignment so that might be an exception to the rule.

Are you saying that you have personally tested it and that dynamic VLAN assignment definitely does not work if the VLAN is not defined in the flex profile?

[aleabrahao]

@Rich R I not only tested it personally, but I also have it applied to my environment, so I can say this with confidence. If you read the documentation on how to configure dynamic VLANs with Flexconnect, you'll see that there's a step where you map the VLAN to the Flex Profile.

This statement is true for AirOS controllers, but unfortunately, on the 9800 series, the controllers work differently.

[Rich R]

Hmmm you didn't actually answer my question @aleabrahao - I understand that you have tested and use the positive use case (mapping configured) but have you tested the negative use case (without mapping configured). The fact that there is a step in the documentation does not make it necessary - the same applies to static - the documentation shows that step but it is not necessary (unless you need to use names).  So again my question - very specifically: did you test without the flex profile mapping?  And what was the outcome of that test? 
Of course if you are using names instead of IDs then it will obviously be necessary so I guess the added question is whether that test used names or VLAN IDs?

[aleabrahao]

Yes, my friend, I tested it in both scenarios.

When you don't have the VLAN mapped, it's not that the VLAN isn't applied; the VLAN is applied correctly if you look at the user information. The issue is that without mapping it in Flex Profile, the AP doesn't understand this, and the IP assigned to the client is the default one configured for the SSID, not the one from the dynamically assigned VLAN.

I don't know if I was clear enough, but I tested it in both scenarios. 😉

[Rich R]

Ack 👍😁