Deploying enterprise wireless with a Cisco Wireless LAN Controller (WLC) is fundamentally different from configuring a home router. You’re not setting up one radio — you’re centrally managing dozens or hundreds of access points, each broadcasting multiple SSIDs, all governed by policies pushed from a single point of control. This guide walks through the full process, from understanding the architecture to typing the CLI commands that bring a WLAN live, using both the AireOS (5520/8540/vWLC) and the newer Catalyst 9800 IOS-XE platforms where the syntax differs.
Understanding the Split-MAC Architecture
Cisco enterprise wireless uses a split-MAC design under CAPWAP (Control and Provisioning of Wireless Access Points). The access point (AP) handles real-time 802.11 functions — beaconing, ACK frames, retransmission — while the controller handles everything else: authentication, mobility, RF management, QoS policy, and encryption key management. This split is why a lightweight AP is useless without a controller to join, and why controller configuration is where almost all the actual policy lives.
Traffic between AP and WLC travels over two CAPWAP tunnels:
- Control tunnel (UDP 5246) — carries management traffic: join requests, configuration, RF reports.
- Data tunnel (UDP 5247) — carries the actual client data frames, encapsulated from the AP back to the controller.
Understanding this matters because most early-stage troubleshooting (“AP won’t join,” “clients associate but get no IP”) traces back to one of these two tunnels being blocked somewhere in the network path.
Core Building Blocks of a WLAN
Before touching the CLI, understand the four objects that make up any WLAN configuration on a Cisco controller:
- Dynamic Interface — the VLAN/IP the WLAN’s traffic is mapped to on the controller.
- WLAN Profile — the logical container defining SSID name, profile name, and WLAN ID.
- Security Policy — WPA2/WPA3-Personal, WPA2/WPA3-Enterprise (802.1X), or open/web-auth.
- RF/AP Group — which physical APs broadcast this WLAN, and under what radio policy.
Lab Topology
- Cisco 5520 WLC or vWLC running AireOS 8.10 (management IP 10.10.1.5)
- Alternatively, a Catalyst 9800-CL running IOS-XE 17.9
- Access points already discovered and joined via DHCP Option 43 or DNS
- Core switch trunking VLANs 10 (corporate), 20 (voice), and 900 (guest) down to the WLC’s uplink port
Part 1: AireOS (Classic WLC) Configuration
Step 1 — Create the Dynamic Interface
(Cisco Controller) > config interface create Corp-Data 10
(Cisco Controller) > config interface address dynamic-interface Corp-Data 10.10.20.5 255.255.255.0 10.10.20.1
(Cisco Controller) > config interface port Corp-Data 1
(Cisco Controller) > config interface dhcp dynamic-interface Corp-Data primary 10.10.20.10
Verify:
(Cisco Controller) > show interface summary
Interface Name Port Vlan Id IP Address Type Ap Mgr
-------------------------------- ---- -------- --------------- ------- ------
Corp-Data 1 10 10.10.20.5 Dynamic No
management 1 1 10.10.1.5 Static Yes
Step 2 — Create the WLAN
(Cisco Controller) > config wlan create 10 CorpWiFi CorpWiFi
(Cisco Controller) > config wlan interface 10 Corp-Data
Step 3 — Configure Security (WPA2/WPA3-Enterprise with 802.1X)
(Cisco Controller) > config wlan security wpa akm 802.1x enable 10
(Cisco Controller) > config wlan security wpa wpa2 enable 10
(Cisco Controller) > config wlan security wpa wpa2 ciphers aes enable 10
(Cisco Controller) > config wlan radius_server auth add 10 1812 1 shared-secret
(Cisco Controller) > config wlan radius_server auth enable 10
For a simpler PSK-based branch office SSID instead:
(Cisco Controller) > config wlan security wpa akm psk enable 10
(Cisco Controller) > config wlan security wpa akm psk set-key ascii MyStrongPassphrase123! 10
Step 4 — Enable QoS, Band Selection, and Broadcast
(Cisco Controller) > config wlan qos 10 platinum
(Cisco Controller) > config wlan band-select allow 10
(Cisco Controller) > config wlan broadcast-ssid enable 10
Platinum QoS is typically reserved for voice; data SSIDs usually use Silver or Bronze. Use the level appropriate to the traffic type.
Step 5 — Assign to an AP Group (Optional but Recommended)
Rather than broadcasting every SSID from every AP, use AP groups to scope WLANs to specific floors or buildings.
(Cisco Controller) > config wlan apgroup create FloorTwoAPs
(Cisco Controller) > config wlan apgroup interface-mapping add FloorTwoAPs 10 Corp-Data
(Cisco Controller) > config ap group-name FloorTwoAPs AP-F2-01
(Cisco Controller) > config ap group-name FloorTwoAPs AP-F2-02
Step 6 — Enable the WLAN
(Cisco Controller) > config wlan enable 10
Step 7 — Verify
(Cisco Controller) > show wlan 10
Expected output (trimmed):
WLAN Identifier................................. 10
Profile Name..................................... CorpWiFi
Network Name (SSID).............................. CorpWiFi
Status............................................ Enabled
MAC Filtering..................................... Disabled
Interface......................................... Corp-Data
Security
802.11 Authentication:........................ Open System
Wi-Fi Protected Access (WPA/WPA2/WPA3)......... Enabled
WPA2 (AES)................................. Enabled
Auth Key Management
802.1x.................................... Enabled
Part 2: Catalyst 9800 (IOS-XE) Configuration
The 9800 platform uses IOS-XE CLI syntax and separates configuration into policy profiles, WLAN profiles, and policy tags — a more modular model than AireOS.
Step 1 — Create the WLAN
9800(config)# wlan CorpWiFi 10 CorpWiFi
9800(config-wlan)# security wpa akm dot1x
9800(config-wlan)# security wpa wpa2 ciphers aes
9800(config-wlan)# no shutdown
9800(config-wlan)# exit
Step 2 — Create the Policy Profile (maps WLAN to VLAN)
9800(config)# wireless profile policy Corp-Policy
9800(config-wireless-policy)# vlan 10
9800(config-wireless-policy)# no shutdown
9800(config-wireless-policy)# exit
Step 3 — Create a RADIUS Server and AAA Method
9800(config)# radius server ISE1
9800(config-radius-server)# address ipv4 10.10.1.20 auth-port 1812 acct-port 1813
9800(config-radius-server)# key MySharedSecret123
9800(config-radius-server)# exit
9800(config)# aaa new-model
9800(config)# aaa group server radius ISE-GROUP
9800(config-sg-radius)# server name ISE1
9800(config-sg-radius)# exit
9800(config)# aaa authentication dot1x ISE-METHOD group ISE-GROUP
Attach the method list to the WLAN:
9800(config)# wlan CorpWiFi
9800(config-wlan)# security dot1x authentication-list ISE-METHOD
Step 4 — Create the Policy Tag and Bind Everything Together
9800(config)# wireless tag policy Corp-PolicyTag
9800(config-policy-tag)# wlan CorpWiFi policy Corp-Policy
9800(config-policy-tag)# exit
Step 5 — Apply the Policy Tag to Access Points
9800(config)# ap F4CF.E2XX.XXXX
9800(config-ap-tag)# policy-tag Corp-PolicyTag
9800(config-ap-tag)# exit
Or apply to a whole AP filter/site tag for bulk deployment.
Step 6 — Verify
9800# show wlan summary
9800# show wireless tag policy detailed Corp-PolicyTag
9800# show ap tag summary
Expected show wlan summary output:
Number of WLANs: 1
ID Profile Name SSID Status Security
-- ------------ --------- ------ --------------
10 CorpWiFi CorpWiFi UP [WPA2][802.1x]
Real-World Enterprise Scenario: Multi-SSID Office Deployment
A typical mid-size office needs at least three WLANs:
| SSID | Purpose | VLAN | Security | QoS |
|---|---|---|---|---|
| CorpWiFi | Employee data | 10 | WPA2/3-Enterprise (802.1X) | Silver |
| CorpVoice | VoWiFi handsets | 20 | WPA2-Enterprise + CCKM | Platinum |
| GuestWiFi | Visitor internet | 900 | Open + Web-Auth | Bronze |
Each maps to its own dynamic interface/VLAN, and CorpVoice specifically needs Cisco Centralized Key Management (CCKM) enabled for fast roaming so handsets don’t drop calls moving between APs:
(Cisco Controller) > config wlan security wpa akm cckm enable 20
Optimization: RF and Band Steering
For dense deployments, tune the RF profile to reduce co-channel interference and push clients to 5 GHz:
(Cisco Controller) > config 802.11a channel global auto
(Cisco Controller) > config 802.11a txPower global auto
(Cisco Controller) > config wlan band-select allow 10
(Cisco Controller) > config band-select cycle-count 2
(Cisco Controller) > config band-select cycle-threshold 200
On the 9800, RF profiles are configured under ap dot11 5ghz rf-profile and applied via RF tags, giving per-building control over channel width, minimum RSSI, and DCA (Dynamic Channel Assignment).
Common Configuration Mistakes
- Forgetting
no shutdownon IOS-XE WLAN and policy profile objects — unlike AireOS, they’re created in a shutdown state by default. - Mismatched VLAN trunking — the switchport connecting to the WLC or AP must trunk every VLAN referenced by a dynamic interface/policy profile, or clients will associate but never get a DHCP lease.
- Using the same RF/AP group for all SSIDs on a large campus, causing unnecessary broadcast overhead on APs that don’t need every SSID.
- Skipping CCKM/802.11r on voice SSIDs, leading to audible gaps during handset roaming.
- Not setting a strong enough RADIUS shared secret or mismatching it between the WLC and the RADIUS server — this is the most common single cause of 802.1X clients failing authentication silently.
Troubleshooting
Check AP join status:
(Cisco Controller) > show ap join stats summary all
Check a specific client’s association and authentication state:
(Cisco Controller) > show client detail <MAC address>
Look for Policy Manager State: RUN — anything stuck at AUTHCHECK, DHCP_REQD, or WEBAUTH_REQD tells you exactly which stage is failing.
On IOS-XE:
9800# show wireless client mac-address <MAC address> detail
9800# show wireless client summary
Enable client debug (use sparingly in production, it’s verbose):
9800# debug wireless mac <client-mac> trace
FAQs
How many WLANs can a Cisco controller support? AireOS controllers typically support up to 512 WLANs system-wide, but only 16 can be broadcast simultaneously per AP radio due to beacon overhead — this is why AP groups matter for scoping.
What’s the difference between a WLAN profile and an SSID? The SSID is the broadcast network name clients see; the WLAN profile is the internal controller object (with its own ID and settings) that can, in some setups, share the same SSID name across multiple profiles for different AP groups.
Do I need a separate controller per site? No — a single controller (physical or virtual) can manage APs across multiple sites over a WAN, as long as CAPWAP control/data ports are reachable, though latency-sensitive designs sometimes prefer local controllers per site.
Should I use AireOS or Catalyst 9800 for a new deployment? Cisco has moved all new feature development to IOS-XE/Catalyst 9800; new deployments should default to 9800 unless there’s a specific compatibility reason to stay on legacy AireOS hardware.
Summary
Setting up a Cisco wireless LAN comes down to defining four things correctly and consistently: the VLAN/interface the traffic lands on, the WLAN profile itself, the security policy governing how clients authenticate, and the AP scope that determines where the SSID is actually broadcast. AireOS and Catalyst 9800 use different CLI syntax and object models — the 9800’s policy-tag/policy-profile separation is more modular — but the underlying concepts are identical. Once configured, show wlan, show client detail, and AP join statistics are your primary tools for confirming the deployment is healthy.
References
- Cisco: Wireless LAN Controller Configuration Guide, Release 8.10 — https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-10/config-guide/b_cg810.html
- Cisco: Catalyst 9800 Series Wireless Controller Software Configuration Guide — https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_17_1_cg.html
- Cisco: CAPWAP Configuration Guide — https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-3/b_capwap.html