Cisco Wireless

---
name: cisco-wireless
description: "Expert coverage of Cisco Catalyst 9800 wireless controllers and Catalyst APs across all IOS-XE versions: deployment modes (centralized/FlexConnect/fabric/embedded), RRM, radioactive tracing, WLAN profiles, AP management, and Catalyst Center integration. Use for \"Cisco wireless\", \"C9800\", \"Catalyst 9800\", \"FlexConnect\", \"Catalyst AP\", \"CW9100\", \"CW9170\", \"DNA Spaces\", \"IOS-XE wireless\", \"CAPWAP\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `wireless` skill."
license: MIT
---

# Cisco Wireless

This skill covers Cisco Catalyst 9800 wireless LAN controllers and Catalyst AP families across all supported IOS-XE versions. Areas of expertise include:

- Catalyst 9800 WLC architecture (IOS-XE based, YANG/NETCONF/RESTCONF)
- Deployment modes: centralized (Local Mode), FlexConnect, SD-Access Fabric, Embedded WLC (EWC)
- AP families: CW9100 (Wi-Fi 6), CW9160/9166 (Wi-Fi 6E), CW9170/9178 (Wi-Fi 7)
- RRM (DCA, TPC, CHD, CleanAir, FRA)
- WLAN profiles, policy profiles, AP join profiles, tags
- Client troubleshooting with radioactive tracing
- Rolling AP upgrades and Nonstop Wireless (NSF)
- Catalyst Center (DNA Center) integration and DNA Spaces
- ISE integration for 802.1X, guest, BYOD

When a question is version-specific, consult the matching `references/versions/` file. When the version is unknown, provide general guidance and note where behavior differs by release.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Load `references/diagnostics.md` for radioactive tracing, show commands, WLC debug workflows
   - **Design / Deployment** -- Load `references/best-practices.md` for RF design, WLAN config, FlexConnect vs centralized, RRM tuning
   - **Architecture** -- Load `references/architecture.md` for 9800 WLC platforms, deployment modes, AP models, DNA Spaces
   - **Configuration** -- Apply tag/profile model guidance below
   - **Migration** -- Identify source platform (AireOS, Aruba, Mist) and map feature gaps

2. **Identify version** -- Determine which IOS-XE version. If unclear, ask. Version matters for feature availability (Wi-Fi 7 requires 17.15+, MLO requires 17.15+).

3. **Load context** -- Read the relevant reference file for deep knowledge.

4. **Analyze** -- Apply Cisco wireless-specific reasoning, not generic wireless advice.

5. **Recommend** -- Provide actionable guidance with CLI examples, GUI paths, or Catalyst Center workflows.

6. **Verify** -- Suggest validation steps (show commands, radioactive tracing, client connectivity tests).

## C9800 WLC Architecture

The Catalyst 9800 runs IOS-XE, providing full network operating system capabilities alongside wireless controller functions:

### Hardware Models

| Model | Scale | Form Factor | Use Case |
|---|---|---|---|
| C9800-L | 500 APs / 5,000 clients | 1RU small | Branch / small campus |
| C9800-40 | 2,000 APs / 32,000 clients | 1RU | Mid-size campus |
| C9800-80 | 6,000 APs / 64,000 clients | 2RU | Large campus / data center |
| C9800-CL | 6,000 APs | Virtual (ESXi/KVM/AWS/Azure) | Cloud or virtualized environments |
| C9800 Embedded | Varies | Catalyst 9000 switch-embedded | SD-Access fabric only |
| C9800 AP Embedded | ~100 APs (cluster) | Catalyst 9100 AP-embedded | Ultra-small sites |

### IOS-XE Wireless Advantages

Unlike legacy AireOS WLCs, C9800 provides:
- **YANG/NETCONF/RESTCONF**: Model-driven programmability for automation
- **gRPC/gNMI telemetry**: Real-time streaming of wireless metrics
- **Rolling AP upgrades**: Upgrade AP firmware without WLC downtime (staged per AP group)
- **Nonstop Wireless (NSF)**: Clients maintain connectivity during WLC HA failover
- **Full IOS-XE routing**: VRF, OSPF, BGP, QoS, ACLs available on the WLC itself
- **Commit/rollback model**: Configuration commit with automatic rollback timer

## Deployment Modes

### Centralized (Local Mode)
- APs tunnel both management and data traffic to WLC via CAPWAP
- WLC handles all authentication, policy enforcement, RF management
- All client data frames traverse the WLC -- requires adequate WLC capacity and LAN bandwidth
- Best for: campus deployments with low-latency LAN connectivity to WLC

### FlexConnect
- APs maintain CAPWAP control tunnel to WLC but can switch data locally
- Per-WLAN sub-modes:
  - **Local Switching**: Data frames switched at AP into local VLAN -- WLC sees only control traffic
  - **Central Switching**: Data frames tunneled to WLC (legacy behavior)
- **WAN survivability**: AP caches authentication state in standalone mode during WAN outage
- **VLAN mapping**: SSID mapped to local VLAN per AP or per AP group (FlexConnect VLAN override)
- C9800-CL in public cloud: FlexConnect with local switching is the only supported mode
- Best for: branch offices, remote sites, WAN-constrained locations

### SD-Access Fabric
- WLC embedded on Catalyst 9000 switch or standalone C9800 as fabric wireless controller
- APs operate in fabric mode; traffic encapsulated in VXLAN
- Group-based policy (SGT) consistent across wired and wireless
- Requires Catalyst Center (DNA Center) for fabric provisioning and policy management
- Best for: large enterprises requiring micro-segmentation and consistent wired/wireless policy

### Embedded WLC (EWC)
- WLC software embedded directly on a Catalyst 9100 AP
- One AP acts as "primary" WLC; supports up to ~100 APs in a cluster
- Seamless failover to standby EWC
- Best for: ultra-small sites without dedicated WLC hardware

## Tag and Profile Model

C9800 uses a hierarchical tag/profile model (unlike AireOS's flat configuration):

```
Site Tag ────────── Flex Profile (FlexConnect settings)
                  └─ AP Join Profile (AP-level settings)

Policy Tag ─────── WLAN Profile (SSID name, security, QoS)
                  └─ Policy Profile (VLAN, ACL, AAA, idle timeout)

RF Tag ──────────── 2.4 GHz RF Profile
                  └─ 5 GHz RF Profile
                  └─ 6 GHz RF Profile
```

- **WLAN Profile**: Defines SSID name, security mode (WPA2/WPA3), authentication type, QoS policy
- **Policy Profile**: Maps WLAN to VLAN, defines client ACLs, AAA overrides, session timeout, idle timeout
- **AP Join Profile**: Controls AP management (SSH, CDP, NTP), LED state, country code, AP mode
- **Flex Profile**: FlexConnect-specific settings (native VLAN, VLAN mapping, local auth fallback)
- **RF Profile**: Per-band radio settings (channel width, DCA channel list, TPC thresholds, data rates)
- **Tags bind profiles to APs**: Each AP is assigned one Site Tag, one Policy Tag, and one RF Tag

## RRM (Radio Resource Management)

| Function | Description |
|---|---|
| DCA (Dynamic Channel Assignment) | Assigns non-overlapping channels across APs to minimize co-channel interference |
| TPC (Transmit Power Control) | Adjusts AP transmit power for optimal cell overlap (~-65 to -67 dBm at cell edge) |
| CHD (Coverage Hole Detection) | Increases power or alerts when coverage gaps detected via client RSSI reports |
| CleanAir | Classifies non-Wi-Fi interference sources (microwave, Bluetooth, ZigBee) using dedicated silicon |
| FRA (Flexible Radio Assignment) | Dual-radio APs can dedicate both radios to 5 GHz when 2.4 GHz load is low |
| Load-Based CAC | Limits new associations when channel utilization exceeds configured threshold |

### RRM Groups
APs belong to RRM groups; within a group, WLC coordinates RF decisions globally. Custom RRM triggers and thresholds are configurable per group. In multi-WLC deployments, RRM groups can span WLCs for global RF coordination.

## AP Families

| Family | Wi-Fi Standard | Bands | Use Case |
|---|---|---|---|
| CW9100 | Wi-Fi 6 (802.11ax) | 2.4/5 GHz | Cost-effective enterprise indoor |
| CW9160/9162/9164/9166 | Wi-Fi 6E | 2.4/5/6 GHz | High-density, modern enterprise |
| CW9170/9172/9176/9178 | Wi-Fi 7 (802.11be) | 2.4/5/6 GHz | High-performance enterprise, MLO |
| CW9186 | Wi-Fi 7 outdoor | All bands | Outdoor campus, stadium, warehouse |

## ISE Integration

Cisco ISE provides the authentication and authorization backend for C9800:
- **802.1X**: EAP-TLS, PEAP, EAP-TTLS with ISE as RADIUS server
- **MAB**: MAC Authentication Bypass for IoT/headless devices
- **Guest**: CWA (Central Web Authentication) with ISE guest portal
- **BYOD**: My Devices portal with certificate provisioning
- **Posture**: Endpoint compliance checking via AnyConnect/Secure Client agent
- **AAA Override**: ISE returns VLAN, ACL, SGT via RADIUS attributes that override policy profile defaults

## Catalyst Center (DNA Center) Integration

Catalyst Center provides:
- **Provisioning**: Template-based WLC and AP provisioning
- **Assurance**: AI-driven network health monitoring, client 360 view
- **SD-Access**: Fabric wireless controller provisioning and SGT policy
- **Software Image Management (SWIM)**: Centralized AP/WLC image management and compliance
- **AI Network Analytics**: Anomaly detection, guided remediation, baseline comparison

## DNA Spaces

Cloud-based platform for wireless location analytics:
- Location tracking with floor map visualization and client/asset heatmaps
- Presence analytics (dwell time, repeat visits, footfall)
- IoT device profiling and management
- API for third-party location-based integrations
- Meraki Cloud Monitoring integration for unified Catalyst + Meraki visibility

## Common Pitfalls

1. **Mixing deployment modes per WLC** -- All APs on a WLC should use the same Site Tag deployment mode (all local or all FlexConnect). Mixing creates unpredictable behavior.

2. **FlexConnect VLAN mismatch** -- Ensure the local VLAN on the FlexConnect AP matches the switch trunk configuration. Misconfigured VLANs cause silent client failures.

3. **Forgetting RF Tag assignment** -- Default RF tag uses default RF profiles. Custom RF profiles have no effect until bound via a custom RF Tag and assigned to APs.

4. **AireOS migration confusion** -- C9800's tag/profile model is fundamentally different from AireOS's flat model. Do not try to replicate AireOS config 1:1; redesign using tags.

5. **Rolling upgrade without stagger** -- Configure AP upgrade groups to stagger updates (N+1 pattern). Upgrading all APs simultaneously causes a complete wireless outage during AP reboot.

6. **CleanAir without action** -- Enabling CleanAir detection without configuring interference mitigation actions wastes the data. Configure CleanAir persistent device avoidance.

7. **Over-tuning RRM** -- RRM defaults are optimized for most environments. Excessive manual overrides (static channels, fixed power) often create worse RF than letting RRM adapt dynamically.

8. **Ignoring 6 GHz AFC** -- For standard power 6 GHz operation, AFC (Automated Frequency Coordination) must be configured. Without AFC, APs operate in low-power indoor mode with reduced coverage.

## Version-Specific Guidance

| Version | Reference | What's version-specific |
|---|---|---|
| 17.15 | `references/versions/17.15.md` | Wi-Fi 7 support, MLO, 802.11be profiles, CW9170/9178 AP support |

## Reference Files

Load these when you need deep knowledge:
- `references/architecture.md` -- 9800 WLC platform details, deployment modes, AP models, DNA Spaces, CAPWAP internals. Read for "how does X work" architecture questions.
- `references/diagnostics.md` -- Radioactive tracing, show wireless commands, client troubleshooting, AP join debugging, WLC health monitoring. Read when troubleshooting.
- `references/best-practices.md` -- RF design, WLAN configuration, FlexConnect vs centralized selection, security, RRM tuning, upgrade procedures. Read for design and operations questions.