Re: WLC Config Question - Page 2

jmhouse96 · ‎08-14-2018

I will be deploying a new Cisco Wireless network in the next few months and I have a question regarding controller setup. I have purchased 5 5520 controllers and will have 750-800 APs connected to them when all is said and done. Here is what I am trying to find a solution for.

There are about 8 critical APs that I need to work around for production issues in a distribution facility. When it comes time to upgrade controllers we have issues finding times to reboot these APs, so what is the best way to work through setting up my controllers for flexibility in upgrading these APs? I was planning to have 3 internal controllers and 2 anchors. If I need to change this up and only have 1 anchor controller that is fine too, but just looking for some suggestions here.

Leo Laohoo · ‎08-16-2018

@jmhouse96 wrote:

What do you mean less hassles?

Flexconnect dictates that you'll need to have an authentication server on site. This is in case the MPLS link goes down new users can get authenticated. The hassle is for managing X amount of authentication servers. All you need is one "kink" or one misconfigured server and you're day is over.

@jmhouse96 wrote:

but there is not any need for wireless in 75% of the building.

We have found a "sure fire" way of finding out if the site really needs wireless or not (site managers don't like to put wireless because it means it'll come out from their budget): Put a temporary wireless at the site for two months. At the end of the period, take the wireless away. Wait for the people to complain to the site manager.

jmhouse96 · ‎08-16-2018

Well you should have an authentication server on site and we do not have that today and will not have it at most sites after this deployment. Our long term WAN plan will move ISE, WLC, AD, DNS... to COLOs with a private MPLS between the sites. We will invest in the infrastructure more when we move to that WAN setup in the next couple of years. Either way the only two locations that will have local authentication as well as many other services will be the headquarters and one other location where we have our DR located.

This is not ideal, but unfortunately it is what I have. When remote offices lose the WAN link for the most part they do not have any local services. Almost everything requires DC access so no real need to add an ISE server and WLC in each location.

As for the comment about how to deal with paying for wireless in locations that don't have it today. We have a charge back setup that is weird and sometimes there are groups that can bypass that while others cannot. It is interesting since it is so inconsistent. You are right though it seems that is the best way to get it paid for when charge back works.

Leo Laohoo · ‎08-14-2018

Configure one controller, save the config. Export this config into a desktop. Change the IP addressing schemes and host name. Import to the next controller. Rinse-and-repeat.
As what Rasika says, enable HA if there are critical APs involved.