L3 connection to a WLC

[Mitrixsen]

Hello, everyone.

I am studying Wireless deployments for my ENCOR exam and I am reading the following document:
https://www.cisco.com/en/US/docs/solutions/Enterprise/Mobility/emob30dg/TechArch.html#wp1000163

It mentions that:

As mentioned earlier in the distributed WLC model, the WLCs are typically at the distribution layer of the campus network. If this is done, Cisco does not recommend that the WLC connect to the distribution layer via a Layer 2 connection.

My question is, I understand that we can configure our SSIDs to map to different VLANs on the WLC. If we deploy a WLC and the connection to the WLC is layer 3, can you still deploy multiple SSIDs that would map to different VLANs or how would it be handled in this case? Considering that the connection is no longer a trunk there.

Thank you
David

[bigevilbeard · Accepted solution]

Been a while, but reading the doc it notes rhat Cisxo does not recommend a layer 2 connection between a wlc and the distribution layer. A layer 2 connection can create large broadcast domains and a some potential stp issues, however using a layer 3 connection this provides better network segmentation and scalability.

Hope this helps.

[MHM Cisco World · Accepted solution]

If all AP use local SW not central SW then yes no need l2' you need l3 to interconnect wlc to server like ISE.

If any AP run central SW then it mandatory to have l2.

In end WLC not do inter-vlan routing or any routing so traffic from AP is forward by wlc to l3 device via l2 link for routing 

MHM

[Rich R · Accepted solution]

That is a very old document (you can tell by the style, layout, fonts etc)! It refers to the 3750G switch which went End of Support 7 years ago!
https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3750-series-switches/eol_c51-696372.html

Best practice for 9800 series WLCs is literally the opposite - the WLC should only be used for L2 leaving L3 to the next hop switch/firewall/router.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#Wirelessclientinterfaces
For centrally switched traffic, it is mandatory to configure a Layer 2 VLAN (or a pool of VLANs) mapped to the SSID, but the corresponding Layer 3 interface (SVI) is not needed. This is different from AireOS, in which a dynamic interface (Layer 3 interface and related IP address) is required. The recommendation for C9800 is not to configure an SVI for client VLAN, unless ... (read on in the link above)