WLC9800CL

[Allan001]

Good day all,

My name is Allan. I want some help configuring WLC-9800-CL HA. The controllers are already up, and I can access them on the ESXi server. The main issue is how to add three departments so that they can access Wi-Fi using different SSIDs. I have three departments listed below. 

HR > 10.10.x.x/24 - VLAN 3 

Finance >172.16.x.x/24 - VLAN 4 

Admin > 172.16.x.x/24 - VLAN 2 

Here is my thinking, I will create three WLANs in the controller with their respective SSIDs. In the controller, again configure three SVIs 10.10.x.254, 172.16.x.254, and 172.16.x.254. 

After that, I will create static or default routes for each subnet, pointing to the gateway. Then Configure Gi2 of the controllers as a trunk and allow the three VLANs. 

Then on the Core Switch, where I have the SVIs for these Subnets, I will add DHCP option 43 for each subnet. 

Kindly advise if this is correct; if not, please point me in the right direction. 

I really appreciate any help you can provide.

Allan

[balaji.bandi · Accepted solution]

You are in the right direction - Make sure Switch SVI as Gateway when you configure your DHCP for users' IP addresses.

configuring SSID PolicyTAG / SITE TAG / RF TAG   - if you did not come across this before?

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213911-understand-catalyst-9800-wireless-contro.html

[Allan001]

Hi Balaji,

Thank you so much for getting back to me so quickly. I will go through the URL provided; you are a lifesaver. If I am stuck somewhere, I will respond to this thread again.

Thank you!

Allan001

[balaji.bandi]

No worries, thanks for sharing your feedback. you should be good...

make sure if you doing anchoring/mobility , MAC Address should be same for HA Active and standby (if not when it failover mobility will not work)

[marce1000]

  - Also note that  before  production use , during and or later you can always have a checkup  of the  WLC-9800-CL HA   configuration with the CLI command : show  tech   wireless , (on the current master) have the output analyzed by  https://cway.cisco.com/tools/WirelessAnalyzer/  , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer.              This procedure is strongly advised.

 M.

[Allan001]

Hi, Marce 1000,

Thank you very much. I will test with the command " show tech wireless". 

Much appreciated.

Allan001

[Allan001]

Hi MArce1000,

Thank you very much. I will test with the "show tech wireless" command in
green.

Much appreciated.

Allan001

[Rich R]

Just one comment to add:
> In the controller, again configure three SVIs 10.10.x.254, 172.16.x.254, and 172.16.x.254. 

As per 9800 best practices guide (link in my signature below) it is not recommended to configure SVI on 9800 except where specifically required for specific features which only work with SVI on WLC.  You should simply be bridging the WLAN traffic to the VLAN with the SVIs on your switch.

[Allan001 · Accepted solution]

Good day, Rich,

Thank you so much for the info provided. I have taken note of your advice!

Thank you!

[Scott Fella · Accepted solution]

@Allan001 do you happen to have a radius server like Cisco ISE or something else?  You might be able to just create your vlans, but then have one SSID and then depending on the OU the user belongs to, you can define the vlan.  This is assuming you are using 802.1x.

[Allan001]

Hi Scott, 

Thank you so much for the technical advice. Unfortunately, we do not have ISE. We are using a different FW. So many solutions from the community team. Thank you!

Regards, 

Allan001