Wifi 6 | Cisco C9120AXE - Range problem compared to my older AP3702 Wifi 5, why ??

[Elrick Landon]

Hello to all,

I switched from wifi 5 (2x AP3702, model AIR-CAP3702E-E-K9) to wifi 6 (2x AP9120, model C9120AXE-E).
Only change, the antenna on one of them, smaller but normally more powerful, better range than others.

 

For a reason I don't know, the range of the AP Wifi 6 is less important than the AP Wifi 5 !
How can i improve/optimize the range/wearing by modifying parameters on my AP or if I have to add more antenna on this model?

Best Regards.

Many thanks for your help in advance.

[Scott Fella]

Antennas have different gains that will increase or decrease the ovderall EIRP.  What you need to look at is the gain for the antennas you are using and making sue the TX Power (TPC) is the same when you are doing your testing.  Cisco makes their ap's to provide similar coverage when using their access points and antennas.  If you are seeing coverage holes, its best to rethink your density and ap placement and remediate that.  Required coverage a few years ago changes with newer technologies, the faster the protocol, the closer the device has to be to the access point.  Swapping older ap's in a network to newer model ap's means you still have an old RF design.  

[Elrick Landon]

I would like to point out that the APs have not changed their location compared to before.

Do you think I should test the TX power with each type of antenna to try to understand?
If I don't find any difference, is it possible that the AP9120 provide less power than the 3702?

Is there any way to increase this TX power from software to fix it? if possible, how to do it?

[Scott Fella]

I would like to point out that the APs have not changed their location compared to before.

This is what I'm trying to explain... if the locations has not changed through the years, its an old RF design.  Everyone need to reassess their wireless when they change out their ap's to ensure they have coverage per the new requirements and density because of change.

---

Do you think I should test the TX power with each type of antenna to try to understand?

---

Yes.  This is the only way to really understand the difference and to get a baseline

If I don't find any difference, is it possible that the AP9120 provide less power than the 3702?

Power or EIRP is determined by TX Power and antenna gain, not the access point

---

Is there any way to increase this TX power from software to fix it? if possible, how to do it?

---

---

On the controller, you can manually change the tx power of each ap.  I would not do this unless you understand what you are doing.  There are multiple places and ways you can change this either manually or using RRM to limit the min and max TX and or just set all ap's to a "power lever". This is all under the RF profile or in the ap if you manually want to change it.

[Elrick Landon]

How do you text TX power? which tools do you use? does an app exist on smartphone?

[Scott Fella]

There are many tools you can download for Wireless Signal Strength.  WiFi Pro Explorer is one I use, but also I have other tools like Ekahau and NetAlley handhelds that I have available.  Now, you need to get familiar with the GUI or the CLI and understand what the tx power is set to.  Antennas also have different patterns and down tilt angles.  If this was for indoor use, you should of gotten the 9120AXI model.  Not a fan of the external in indoor unless that ap's are in very high ceilings.  Again, there are other aspects to wireless than to try to reach areas for coverage.  Just because you blast the power and want to provide coverage in a greater area, doesn't mean that the client has the power to have their signal reach back to the ap.  I think you need to reassess your current ap locations and determine if that is still ideal or not.  This also is a main factor when you want to disable lower data rates to help tune the RF.  If you don't have great coverage at a given data rate, you will see the signal, but the clients will not connect.

So checking signal strength can help you determine the coverage, but you also need your various clients to also connect.  

[Elrick Landon]

I use 17.3.1.9 software version and i plan to upgrade it before make Signal Strength.

But i was not able to reach Web interface for unknow reason in http or https from my LAN (AP connected to LAN) or from my Smartphone connected on AP.

I didn't remember to have disable it... i'm just able to connect on it through console port.

See my configuration below... is it normal? does i miss something?

Many thank for your help in advance.

#show conf
Using 7953 out of 2097152 bytes
!
! Last configuration change at 04:09:19 cest Wed Jul 29 2020
! NVRAM config last updated at 16:51:32 cest Sat Sep 12 2020 by ******
!
version 17.3
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service call-home
no platform punt-keepalive disable-kernel-core
no platform punt-keepalive settings
platform console serial
!
hostname C9120******
!
boot-start-marker
boot-end-marker
!
no aaa new-model
clock timezone cest 1 0
clock summer-time cest recurring last Sun Mar 3:00 4 Sun Oct 3:00
no fips authorization-key
!
ip name-server 208.xx.xx.xx 208.xx.xx.xx
ip domain timeout 1
login on-success log
!
!
flow exporter default-flow-exporter
 destination local wlc
!
!
flow monitor default-flow-monitor
 exporter default-flow-exporter
 record wireless avc basic
!
!
parameter-map type webauth global
 type webauth
 cisco-logo-disable
!
access-session mac-move deny
password encryption aes
!
crypto pki trustpoint TP-self-signed-XXXXXXXXXXX
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-XXXXXXXXXXX
 revocation-check none
 rsakeypair TP-self-signed-XXXXXXXXXXX
!
crypto pki trustpoint SLA-TrustPoint
 enrollment terminal
 revocation-check crl
!
!
crypto pki certificate chain TP-self-signed-XXXXXXXXXXX
 certificate self-signed 01 nvram:IOS-Self-Sig#1.cer
crypto pki certificate chain SLA-TrustPoint
 certificate ca 01 nvram:CiscoLicensi#1CA.cer
!
crypto pki certificate pool
 cabundle nvram:ios_core.p7b
!
service-template webauth-global-inactive
 inactivity-timer 3600
service-template DEFAULT_LINKSEC_POLICY_MUST_SECURE
 linksec policy must-secure
service-template DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
 linksec policy should-secure
service-template DEFAULT_CRITICAL_VOICE_TEMPLATE
 voice vlan
service-template DEFAULT_CRITICAL_DATA_TEMPLATE
memory free low-watermark processor 12998
!
license udi pid C9800-AP sn XXXXXXXXXXX
device classifier
username XXXXXXXXXXX privilege 15 password 6 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
!
redundancy
 mode sso
!
!
interface GigabitEthernet0
 mac-address 0000.5e00.0101
 ip dhcp client client-id GigabitEthernet0
 ip dhcp client broadcast-flag clear
 ip address dhcp
 no negotiation auto
!
no ip http server
ip http authentication local
ip http secure-server
ip forward-protocol nd
ip tftp blocksize 8192
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0 250
ip dns server
!
!
control-plane
!
banner exec ^C
########################################################################################################
#                                                                                                      #
#      Welcome to the Cisco Catalyst 9800-AP Embedded Wireless Controller command line interface.      #
#                                                                                                      #
# Please see command reference guide for the complete list of supported commands for this release:     #
# https://www.cisco.com/c/en/us/td/docs/wireless/embedded_wireless_controller_configuration_guide.html #
#                                                                                                      #
########################################################################################################
^C
!
line con 0
 exec-timeout 0 0
 password 7 XXXXXXXXXXX
 login
 stopbits 1
line vty 0 4
 session-timeout 60
 exec-timeout 60 0
 login local
 length 0
 transport input none
line vty 5 15
 login local
 transport input none
!
call-home
 ! If contact email address in call-home is configured as sch-smart-licensing@cisco.com
 ! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
 contact-email-addr sch-smart-licensing@cisco.com
 profile "CiscoTAC-1"
  active
  destination transport-method http
ntp server 2.ciscome.pool.ntp.org
ntp server 1.ciscome.pool.ntp.org
ntp server 0.ciscome.pool.ntp.org
!
!
!
!
!
wireless aaa policy default-aaa-policy
wireless cts-sxp profile default-sxp-profile
wireless management interface GigabitEthernet0
wireless profile airtime-fairness default-atf-policy 0
wireless profile flex default-flex-profile
 description "default flex profile"
wireless profile image-download default
 description "default image download profile"
wireless profile mesh default-mesh-profile
 description "default mesh profile"
wireless profile policy "XXXXXXXXXXX"
 no central association
 no central dhcp
 no central switching
 http-tlv-caching
 session-timeout 86400
 no shutdown
wireless profile policy default-policy-profile
 no central association
 no central switching
 description "default policy profile"
 dhcp-tlv-caching
 http-tlv-caching
 ipv4 flow monitor default-flow-monitor input
 ipv4 flow monitor default-flow-monitor output
 no shutdown
wireless tag site default-site-tag
 description "default site tag"
 no local-site
wireless tag policy default-policy-tag
 description "default policy-tag"
 wlan "ELR +" policy "XXXXXXXXXXX"
wireless tag rf default-rf-tag
 description "default RF tag"
wireless country FR
wlan "ELR +" 1 "XXXXXXXXXXX"
 security ft
 security wpa psk set-key ascii 8 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 no security wpa akm dot1x
 security wpa akm psk
 security wpa akm sae
 security wpa wpa3
 security pmf optional
 no shutdown
ap dot11 24ghz rf-profile Custom_2.4Ghz
 channel add 2
 channel add 3
 channel add 4
 channel add 5
 channel add 7
 channel add 8
 channel add 9
 channel add 10
 channel add 12
 channel add 13
 description "Created by XXXXXXXXXXX"
 rate RATE_11M disable
 rate RATE_12M disable
 rate RATE_18M disable
 rate RATE_1M disable
 rate RATE_24M disable
 rate RATE_2M disable
 rate RATE_36M mandatory
 rate RATE_5_5M disable
 rate RATE_6M disable
 rate RATE_9M disable
 no shutdown
ap dot11 24ghz rf-profile Low_Client_Density_rf_24gh
 coverage data rssi threshold -90
 coverage level 2
 coverage voice rssi threshold -90
 description "pre configured Low Client Density rfprofile for 2.4gh radio"
 high-density rx-sop threshold low
 tx-power v1 threshold -65
 no shutdown
ap dot11 24ghz rf-profile High_Client_Density_rf_24gh
 description "pre configured High Client Density rfprofile for 2.4gh radio"
 high-density rx-sop threshold medium
 rate RATE_11M disable
 rate RATE_12M mandatory
 rate RATE_1M disable
 rate RATE_2M disable
 rate RATE_5_5M disable
 rate RATE_6M disable
 tx-power min 7
 no shutdown
ap dot11 24ghz rf-profile Typical_Client_Density_rf_24gh
 description "pre configured Typical Client Density rfprofile for 2.4gh radio"
 rate RATE_11M disable
 rate RATE_12M mandatory
 rate RATE_1M disable
 rate RATE_2M disable
 rate RATE_5_5M disable
 rate RATE_6M disable
 no shutdown
ap dot11 5ghz rf-profile Custom_5Ghz
 channel chan-width 80
 description "Created by XXXXXXXXXXX"
 rate RATE_12M disable
 rate RATE_18M disable
 rate RATE_24M disable
 rate RATE_36M mandatory
 rate RATE_6M disable
 rate RATE_9M disable
 no shutdown
ap dot11 5ghz rf-profile Low_Client_Density_rf_5gh
 coverage data rssi threshold -90
 coverage level 2
 coverage voice rssi threshold -90
 description "pre configured Low Client Density rfprofile for 5gh radio"
 high-density rx-sop threshold low
 tx-power v1 threshold -60
 no shutdown
ap dot11 5ghz rf-profile High_Client_Density_rf_5gh
 description "pre configured High Client Density rfprofile for 5gh radio"
 high-density rx-sop threshold medium
 rate RATE_6M disable
 rate RATE_9M disable
 tx-power min 7
 tx-power v1 threshold -65
 no shutdown
ap dot11 5ghz rf-profile Typical_Client_Density_rf_5gh
 description "pre configured Typical Density rfprofile for 5gh radio"
 no shutdown
ap dot11 5ghz edca-parameters fastlane
ap tag-source-priority 2 source filter
ap tag-source-priority 3 source ap
ap profile default-ap-profile
 description "default ap profile"
trapflags ap crash
trapflags ap noradiocards
trapflags ap register
end

[Scott Fella]

Elrick,

Is this working at all?  You do see the SSID and con connect to it correct?  Your only concern is that the signal doesn't compare to your existing ap?  Have you followed the EWC guide step by step, because you should be able to https to the EWC from a laptop or smartphone.  Also the controller piece is different from the ap piece in EWC.  So you should see access points connected if you issue a show ap summary.  If not, then you didn't complete the configuration for the EWC.

[Elrick Landon]

In fact, the IP taken from my DHCP is not the one used to access to Web GUI.

The AP take both IP, one for webui and other for the device itself.

I didn't remember that... it is normal ?

MAC @ is 00:00:5e:00:01:01, it seems to be a virtual IP address related to VRRP.

I dunno what is it exactly.

Do you know if it's possible to disable it ? or if i need to leave it like this ?

Maybe VRRP need to be disable on switch where the APs is connected ? If you can explain how to disable this feature, it's will be more simple to manage, unless it actually brings something

Best Regards.

[Scott Fella]

If you issue a show ap summary, the ap should show up if configured properly.  The EWC controller will have an ip and the ap itself would have a different ip.  Basically you configure the EWC with a static during the setup either through the UI or the cli, but the ap itself will pull dhcp.

[Elrick Landon]

Benefits to have both is not clear for me... My 2APs are connected on same switch, they has been used at home...

I don't see what it does for me in terms of fault tolerance in this particular case.

Is it possible to have only one IP address for each AP? Or is what I am describing the normal operation?

Personally, I would prefer that the AP setup have only one IP, if it is possible.

[Scott Fella]

The EWC controller will have an IP address that is shared if there is a failure and another ap takes over that function. The ap it’s self would have its own ip address. This is covered in the EWC guide. This allows you to manage the controller part with a defined IP address you use during the initial configuration. So basically if you have 20 access points, you would see 21 IP address allocated. 

[Leo Laohoo]

The bottom picture, where did that antenna come from?  Did that come from the 3702E?

[Elrick Landon]

yes it come from 3702, but same model is available for 9120

[saravlak]

do you observe issues on both 2.4 and 5ghz.
for optimal performance C9120AXE / C9120AXP - Require .AT power source.
The internal radio model and specs are different for both APs - 3700 uses Marvel and 9120 uses Broadcom chipset.
Both use Different radio firmware and AP OS.
Channel also matters, Ex: ch 36 Vs 161 gets a longer range compared to ch-36 using the same power level.