Single SSID w/ 1000+ Clients

[SchurmanRyan]

I'm working on setting up a single guest access SSID on a Cisco 5508 WLAN controller for clients to use on our campus.  When dealing with 1000+ clients, there are segmenting options such a single large subnet (/21 or so), AP groups w/ smaller subnets, and interface groups with smaller subnets (VLAN Select feature).  Which method is considered best practice?  Is there a "magic" number of clients where you would want to start using multiple smaller subnets instead of single large one? 

[Scott Fella · Accepted solution]

Ryan,

If your on 7.0.116.0 I would suggest using interface groups. It is easier than having to manage all the AP Groups if you ask me. If you any dhcp Mac reservations, interface group isn't for you. Since it performs a round robin on your selected interface, you will not know which interface a device will be placed on. Makes sense.

Sent from my iPhone

[SchurmanRyan]

Thanks for the advice Scott.  Do you have any recommended subnet size for the wireless VLANs?

[Scott Fella · Accepted solution]

I like just using /24.

Sent from my iPhone

[George Stefanick]

When having a 1,000 clients managing by a /24 it will mean more config work. Since the WLC proxys broadcast you can get away with a bit larger subnets. Ive seen /22 and even /21. Altough /21 are a bit much, but Ive seen them work on a busy WLAN before.

[Michael Burk]

We have a /21 in place for a guest network that breaches 1,000 leases on a daily basis.

Just make sure you have broadcast forwarding: disabled.

I did a packet capture on the wlan during a busy time of day and saw about 6 broadcast pps, so quite low.

[Daniel Ordóñez Flores]

Dear Scott.

I was reading the new post and I founf this, so I have this question, If a need to create a new WLAN and the scope is for 1500 user I can use interface group and not use a /21 ?

[George Stefanick]

Indeed.

If you have an existing WLAN or a new WLAN. You can add interface groups which will allow you to tie multiple wired side interfaces to a WLAN. The experience to the wifi client is the same, its just that clients will be dumped into different subnets.

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

[devils_advocate]

As George says, Interface Groups are the way to go as you can have lots of /24 interfaces, group these into an interface group and assign this group to your SSID. The controller uses a specific method to allocatate IP addresses fairly evenly among the DHCP scopes within the interfaces.

[Daniel Ordóñez Flores]

So... one WLAN can have different ip addressing?

[George Stefanick]

How it works is you have a single wlan. Today you select a single dynamic interface for that wlan. If you create an interface group you add multiple dynamic interfaces to the interface group. You then select the interface group to the wlan rather than the single dynamic interface you do today. As clients connect they round robin through the dynamic interfaces you selected for the WLAN.

Make sense?

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

[George Stefanick]

Thank you for supporting the rating system

Sent from Cisco Technical Support iPad App

[Leo Laohoo]

Another thing to consider when planning for >1k users is your DHCP lease time.  It would be good if you have a DHCP server which you can control yourself and configure the lease time to be a low number, like 3 to 4 hours.  The lower the number the better.  This way, you won't have to worry when someone tries to take down the wireless network.

I've tried 30 minutes but it's on a DHCP server I control.  So no big deal for me.