Is there a standard for making SVI and VLANs on WLC9800?

[OliverDurston]

What is the criteria to create SVI and VLANs in the 9800.  If you take multiple AP management bands (vlan) to the same network  Do I have to need several SVI and/or Vlans?

[Georg Pauwen]

Hello,

I agree with @Ruben Cocheno, keep the management Vlan separate, for security reasons. Basically, for AP-related Vlans, pretty much the same criteria apply as for 'regular' wired Vlans. Do you want/need to separate traffic according to functional or departmental groups ? That is basically the use case for Vlans, wired or wireless...

[Joseph W. Doherty]

"Basically, for AP-related Vlans, pretty much the same criteria apply as for 'regular' wired Vlans."

One difference, you can often use a larger subnet on wireless.  However usually only useful on non independent APs, i.e. LWAPs.

[Ruben Cocheno]

@OliverDurston 

This depends of the setup, however you must have one SVI for managenent (if not using the mgmt). The remain SVI will depend of the Design but they are no mandatory.

[Rich R · Accepted solution]

You can only have one Wireless (AP) Management Interface on 9800 so you need an SVI for that.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#Wirelessmanagementinterface
"multiple AP management bands (vlan)" is not supported on 9800.

You can have other SVI's for specific control plane and management purposes but the only one required is the Wireless Management Interface.

Centrally switched clients require a VLAN but SVI is not recommended.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#Wirelessclientinterfaces
So you will need a VLAN for each SVI and for the client VLANs.
Client SVI is only required for doing DHCP relay from the 9800 but it is still recommended to rather do this on the next hop switch/router/firewall, not on the 9800, keeping all client interfaces as layer 2 VLAN only.  If you do configure client SVI's then the 9800 does not provide any isolation between client SVIs so you have to work around that by using ACLs.