This document provides information on the most frequently asked questions (FAQ) about the Cisco Wireless LAN Controller (WLC).

A. Follow these guidelines when you use CAPWAP:

• If your firewall is currently configured to allow traffic only from access points that use LWAPP, you must change the rules of the firewall to allow traffic from access points that use CAPWAP.

• Make sure that the CAPWAP UDP ports 5246 and 5247 (similar to the LWAPP UDP ports 12222 and 12223) are enabled and are not blocked by an intermediate device that could prevent an access point from joining the controller.

• If access control lists (ACLs) are in the control path between the controller and its access points, you need to open new protocol ports to prevent access points from being stranded.

The access points use a random UDP source port to reach these destination ports on the controller. In controller software release 5.2, LWAPP was removed and replaced by CAPWAP, but if you have a new out-of-the-box access point, it could try to use LWAPP to contact the controller before it downloads the CAPWAP image from the controller. Once the access point downloads the CAPWAP image from the controller, it uses only CAPWAP to communicate with the controller.

Note: After 60 seconds of trying to join a controller with CAPWAP, the access point falls back to using LWAPP. If it cannot find a controller using LWAPP within 60 seconds, it tries again to join a controller using CAPWAP. The access point repeats this cycle of switching from CAPWAP to LWAPP and back again every 60 seconds until it joins a controller.

An access point with the LWAPP recovery image (an access point converted from autonomous mode or an out-of-the-box access point) uses only LWAPP to try to join a controller before it downloads the CAPWAP image from the controller.

A. Yes. LAG with VSS, or a stacked switch (3750/2960) setup, will work as long as the fragments of an IP packet are sent to the same port. The idea is that if you go to multiple switches, the ports must belong to the same L2 “entity” with regards to load balancing decisions.

Q. How does a WLC switch packets?

A. When there is a master controller enabled, all newly added access points with no primary, secondary, or tertiary controllers assigned associate with the master controller on the same subnet. This allows the operator to verify the access point configuration and assign primary, secondary, and tertiary controllers to the access point using the All APs > Details page.

The master controller is normally used only when adding new access points to the Cisco Wireless LAN solution. When no more access points are being added to the network, Cisco WLAN solution recommends that you disable the master controller.

A. The 4400 WLC is an appliance that attaches to your network but does not function like a router. There must be a Layer 3 device to route packets between VLANs. The WLC maps the SSID of the clients to the VLAN subnet and puts them back out on the management interface for the upstream routers to route packets.

A. From the wireless LAN controller GUI, click Monitor > Summary. In the Summary page, the Software Version field shows the version of firmware that runs on the wireless LAN controller.

In order to find the version of firmware that runs on the WLC through the WLC CLI, use the command show run-config.

(Cisco Controller) >show run-config

Press Enter to continue...

System Inventory
Burned-in MAC Address............................ 00:0B:85:33:52:80

Press Enter to continue Or <Ctl Z> to abort

System Information
Manufacturer's Name.............................. Cisco Systems Inc.
Product Name..................................... Cisco Controller
Product Version.................................. 4.0.217.0
RTOS Version..................................... 4.0.217.0
Bootloader Version............................... 4.0.217.0
Build Type....................................... DATA + WPS
Compact Flash Size............................... 256 MB

In order to view the active boot image, use the command show boot

(Cisco Controller) >show boot
Primary Boot Image............................... 4.0.217.0 (active)
Backup Boot Image................................ 4.0.155.5

A. Once the WLC is upgraded, it must be rebooted for the changes to take effect. Within this time, connectivity to the WLC is lost. LAPs registered to a WLC lose their association to the WLC, so service to the wireless clients is interrupted. When you upgrade the controller's software, the software on the controller's associated access points is also automatically upgraded.

When an access point loads software, each of its LEDs blinks in succession. Up to 10 access points can be concurrently upgraded from the controller. Do not power down the controller or any access point during this process; otherwise, you might corrupt the software image. Upgrading a controller with a large number of access points can take as long as 30 minutes, depending on the size of your network. However, with the increased number of concurrent access point upgrades supported in software release 4.0.206.0 and later, the upgrade time should be significantly reduced. The access points must remain powered, and the controller must not be reset during this time.

A. After you perform these functions on the controller, you must reboot the controller in order for the changes to take effect:

• Enable or disable link aggregation (LAG)

• Enable a feature that is dependent on certificates (such as https and web authentication)

• Add new or modify existing SNMP v3 users

• Install a license, change the license feature set, or change the priority of an AP-count evaluation license on a controller

A. This is an expected behavior. With WLC version 6.0, the 5508 controller supports only up to 250 lightweight access points. With version 7.0.98.0, a single Cisco 5500 Series Wireless Controller can support up to 500 Cisco Aironet APs.

Q. How does roaming occur in a WLC environment?

A. The local user database stores the credentials (username and password) of all the local network users. These credentials are then used to authenticate the users. You can configure local network users either through the GUI or the CLI. You can enter up to 24 alphanumeric characters. All the special characters can be used when you configure username and passwords though CLI, but the single quote character cannot be used when you configure username and password through GUI.

From the CLI, use these commands to create a local net user:.

• config netuser add <username> <password> wlan <wlan_id> userType permanent description <description> —Adds a permanent user to the local user database on the WLC.

• config netuser add <username> <password> {wlan | guestlan} {wlan_id | guest_lan_id} userType guest lifetime seconds description <description>—Adds a guest user on a WLAN or wired guest LAN to the local user database on the WLC.

From the GUI, you can configure local net users from the Security > AAA > Local Net Users page.

A. Local Net users are not automatically deleted. You have to delete them manually. In order to delete the user, go to the Security > AAA > Local Net Users page. In order to remove a user, place the mouse over the icon and click Remove. If a local net user is configured as a guest user, you must specify the life time, after which the user is automatically deleted. The configurable range is between 60 seconds and 2592000 seconds.

A. You can place up to 24 regular WLCs (Cisco 2000, 4100, and 4400 series) in a single mobility group. You can configure up to 12 Wireless Services Module (WiSM) blades in one mobility group. Therefore, up to a maximum of 3600 access points (APs) are supported in a single mobility group.

Note: With WLC release 5.1, there can be up to 72 WLCs in a Mobility domain.

A. No, IPX protocol is not supported on any platforms of the Cisco WLC.

A. The wireless LAN controller GUI is fully compatible with Microsoft Internet Explorer version 6.0 SP1 (or later) and Mozilla Firefox 2.0.0.11 (or later).

Note: Opera and Netscape are not supported.

Note: Internet Explorer 6.0 SP1 (or later) and Mozilla Firefox 2.0.0.11 (or later) are the only browsers supported for accessing the controller GUI and for using web authentication.

A. A single anchor WLC supports up to 71 EoIP tunnels with one tunnel per internal WLC. These WLCs can be of different mobility groups.

A. The major differences between the 2100 and 4400 Series WLCs are in the features they support.

This Hardware features is not supported on 2100 series WLCs

• Service Port (separate out-of-band management 10/100-Mbps Ethernet interface)

These software features are not supported on 2100 Series WLCs:

• VPN termination (such as IPSec and L2TP)

• VPN passthrough option

• Termination of guest controller tunnels (origination of guest controller tunnels is supported)

• External web authentication web server list

• Layer 2 LWAPP

• Spanning tree protocol

• Port mirroring

• AppleTalk

• QoS per-user bandwidth contracts

• IPv6 pass-through

• Link aggregation (LAG)

• Multicast-unicast mode

A 4400 Series WLC supports all the forementioned hardware and software features.

A. Only the Airespace 1200, 1250, the Cisco 1000 Series, and the Cisco 1500 Series LAPs work with the 4100 Series WLCs.

A. Yes, this can be done with the - (hyphen) key. Use this key to re-enter the previous parameter value.

For example, you use the WLC configuration wizard in order to configure the WLC from scratch.

Instead of entering the username as admin, you enter it as adminn. In order to correct this, enter - (hyphen key) at the next prompt, then click Enter. The system returns to the previous parameter.

(Cisco Controller)

Welcome to the Cisco Wizard Configuration Tool
Use the '-' character to backup
System Name [Cisco_e8:38:c0]: adminn
Enter Administrative User Name (24 characters max): -

System Name [Cisco_e8:38:c0] (31 characters max):

A. This is an expected behavior. When enabled, the Management via Wireless feature allows a wireless client to reach or manage only the WLC to which its associated access point is registered. The client cannot manage other WLCs, even though these WLCs are in same mobility groups. This is implemented for security, and recently was tightened down to just the one WLC in order to limit exposure.

The Cisco WLAN Solution Management over Wireless feature allows Cisco WLAN Solution operators to monitor and configure local WLCs using a wireless client. This feature is supported for all management tasks, except uploads to and downloads from (transfers to and from) the WLC.

This can be enabled through the WLC CLI with the config network mgmt-via-wireless enable command.

On the GUI, click Management; from the left-hand side click Mgmt Via Wireless, and check the box Enable Controller Management to be accessible from Wireless Clients.

Note: When you enable this option, you can expose the data. Ensure that you have enabled a proper authentication and encryption scheme.

A. Yes, it is possible to create a mobility group between a Catalyst 3750 Switch with an integrated controller and a 4400 WLC.

A. These are the 2 basic requirements that need to be maintained when you use mobility anchor in order to configure WLCs for guest access.

• The mobility anchor of the local WLC must point to the anchor WLC, and the mobility anchor of the anchor WLC must point only to itself.

  Note: You can configure configure redundant anchor WLCs. Local WLC uses them in the order WLCs are configured.

• Make sure you configure the same security policy for the service set identifier (SSID) on both the local and anchor WLCs. For example, if the SSID is "guest" and you turn on web authentication on the local WLC, make sure the same SSID and security policy is also configured on the anchor WLC.

• For the mobility anchor feature to work well, make sure that the anchor WLC and the local WLC use the same IOS version.

A. The interoperability of a WLC can be improved through these options:

• Proprietary features reduce the chance of interoperability between third party devices. These are the proprietary features of Cisco:

  • Aironet IE - Aironet IE contains information, such as the access point name, load, number of associated clients, and so on sent out by the access point in the beacon and probe responses of the WLAN. CCX clients use this information to choose the best access point with which to associate.

  • MFP: Management Frame Protection is a feature introduced to protect the management frames, such as de-authentication, disassociation, beacons, and probes wherein the access point adds a Message Integrity Check Information Element (MIC IE) to each of the management frames. Any discrepancy in the MIC IE generates an alert.

  These features are enabled by default for any WLAN that is created on the WLC. In order to disable these features, click the WLANs menu in the WLC. A list of WLANs configured on the WLC displays. Click the WLAN to which the client wants to associate. Under the Advanced Tab of WLANs > Edit page, uncheck the boxes that correspond to Aironet IE and MFP.

• Short Preamble—A short preamble improves the throughput performance and is enabled by default. Certain devices, such as SpectraLink Phones can work only with long preambles. In such cases, it helps in association to uncheck short preambles. In order to disable the short preamble, click the Wireless menu of the WLC GUI. Then click the 802.11b/g > network menu on the left-hand side. Uncheck the Short Preamble box.

• Enable the broadcast service set identifier (SSID) on the WLAN—With the broadcast SSID enabled, the WLAN/SSID information is sent in the beacons. This also help the clients that perform passive scans (those that do not transmit probe request), as well as clients configured without an SSID to associate with the WLC through this WLAN.

  Note: Make sure that you have strong authentication mechanisms in place since unintended clients can associate to your wireless network.

• Disable aggressive load balancing globally on the WLC.

A. Yes. 4400 series WLC models (such as 4402 and 4404) can be managed by CiscoWorks.

A. The 4400 Series wireless LAN controller supports up to 625 rogues, which includes acknowledged rogues, while the 2100 Series supports 125 rogues.

A. The WLC does not send email, but it can send traps to the Network Management System (NMS) stations, such as HP OpenView (HPOV). HPOV can perform things such as running scripts to send email on receipt of particular traps.

HPOV is a Hewlett Packard product range that consists of an extensive portfolio of network and systems management products. HPOV is most commonly described as a suite of software applications which allow large-scale system and network management of an organization's IT assets. HPOV includes hundreds of optional modules from HP as well as thousands of third parties which connect within the well-defined framework and communicate with one another.

A. No, the port speed on the WLC cannot be changed. These are set at 1000 mbps, full duplex speed only.

A. Through version 4.1, PEAP is not supported locally on the WLC. You need an external RADIUS server. With WLC version 4.2 and later versions, local EAP now supports PEAPv0/MSCHAPv2 and PEAPv1/GTC authentication.

A. Yes, you can place the LAP under NAT. On the AP side, you can have any type of NAT configured, but, on the WLC side, you can have only 1:1 (static NAT) configured. PAT cannot be configured on the WLC side because LAPs cannot respond to WLCs if the ports are translated to ports other than 12222 or 12223, which are meant for data and control messages.

A. Yes, you can place the LAP under NAT. On the AP side, you can have any type of NAT configured.

But on the WLC side, you can have only 1:1 (Static NAT) configured and the external NAT IP address configured on dynamic AP management interface (only for Cisco 5500 Series Controllers). PAT cannot be configured on the WLC side because LAPs cannot respond to WLCs if the ports are translated to ports other than 5246 or 5247, which are meant for control and data messages.

Note: Select the Enable NAT Address check box and enter the external NAT IP address if you want to be able to deploy your Cisco 5500 Series Controller behind a router or other gateway device that is using one-to-one mapping network address translation (NAT). NAT allows a device, such as a router, to act as an agent between the Internet (public) and a local network (private). In this case, it maps the controller's intranet IP addresses to a corresponding external address. The controller's dynamic AP-manager interface must be configured with the external NAT IP address so that the controller can send the correct IP address in the Discovery Response.

Note: With CAPWAP, WLC behind NAT is not supported with the 4400 series, 2100 series Wireless LAN Controllers and the WiSM.

A. Use the config 802.11b disable command command in order to disable or enable 802.11b/g transmissions for the whole network or for an individual Cisco radio

Note: You must use this command to disable the network before you use other config 802.11b commands. This command can be used any time the CLI interface is active.

Here is the syntax.

config 802.11b disable {network | Cisco_AP}

Here is an example on how to disable AP01 802.11b/g transmissions:

config 802.11b disable network

In order to disable AP01 802.11b/g transmissions, use this command:

config 802.11b disable AP01

Alternatively, you can use this command in order to disable the 802.11b data rates:

config 802.11b rate {disabled | mandatory | supported} rate

A. You can upgrade or downgrade the WLC software only between two releases. In order to upgrade or downgrade beyond two releases, you must first install an intermediate release. For example, if your WLC runs a 4.2 or 5.0 release, you can upgrade your WLC directly to Software Release 5.1.151.0. If your WLC runs a 3.2, 4.0, or 4.1 release, you must upgrade your WLC to an intermediate release prior to the upgrade to to 5.1.151.0. In order to know the upgrade path for any WLC version, refer to the Release Notes of the corresponding release.

Q. What is Beamforming?

A. You can download a login banner file using either the controller GUI or CLI. The login banner is the text that appears on the screen before user authentication when you access the controller GUI or CLI using Telnet, SSH, or a console port connection.

A. Coverage area of an AP is entirely controlled by the WLC. The WLC talks between its APs and manages their signal strength on the basis of how each AP senses other APs. However the client movement from one AP to other is entirely controlled by the client. The radio within the client determines when the client wants to move from one AP to the other. No setting on the WLC, AP, or the rest of your network can influence client's decision to roam to a different AP.

A. You can enable STP on the WLC to prevent loops. From the WLC GUI click Controller, then navigate to the Advanced submenu located on the left side of the application. Click the Spanning Tree option, and choose Enable for Spanning Tree Algorithm located on the right side of the application.

By default, STP need not be enabled to prevent loops. Because each interface that is mapped to a WLAN on the WLC is mapped to primary and backup ports. Only one port is used at a particular point of time. Traffic from the WLAN is forwarded only through the primary port. WLC never uses the secondary port when the primary port is active. WLC uses the secondary port only when the primary port is down, so loops will not occur by default.

Q. Is there any option to provide additional security to the network?

A. If you forget your password in WLC version 5.1 and later, you can use the CLI from the controller's serial console in order to configure a new user name and password. Complete these steps in order to configure a new user name and password.

1. After the controller boots up, enter Restore-Password at the user prompt.

   Note: For security reasons, the text that you enter does not appear on the controller console.

2. At the Enter User Name prompt, enter a new user name.

3. At the Enter Password prompt, enter a new password.

4. At the Re-enter Password prompt, re-enter the new password.

   The controller validates and stores your entries in the database.

5. When the User prompt reappears, enter your new username.

6. When the Password prompt appears, enter your new password.

   The controller logs you in with your new username and password.

Note: For WLCs that run earlier versions of firmware (prior to 5.1), there is no way to recover the password. If you use the Cisco Wireless Control System (WCS) in order to manage the WLC, wireless LAN controller Module (WLCM) or Wireless Services Module (WiSM), you should be able to access the WLC from the WCS and create a new administrative user without logging into the WLC itself. Or, if you did not save the configuration on the WLC after you deleted the user, then a reboot (power cycling) of the WLC should bring it back up with the deleted user still in the system. If you do not have the default admin account or another user account with which you can log in, your only option is to default the WLC to factory settings and reconfigure it from scratch.

• Check if the DHCP scope is enabled on the WLC. In order to check this, click the Controller Menu and click Internal DHCP server from the left-hand side.

• Generally, the DHCP server is specified on the interface, which maps to the WLAN. Make sure that the management interface address of the WLC is specified as the DHCP server on the interface that maps to the guest user WLAN. Alternatively, you can enable the DHCP Server override option on the WLANs > Edit page and specify the management interface address of the WLC in the DHCP server IP Addr field..

A. The Admin Status and the Broadcast SSID parameters are disabled by default. Complete these steps in order to enable Admin Status and Broadcast SSID:

1. Go to the WLC GUI and choose Controller > WLANs. The WLANs page appears. This page lists the WLANs that are configured.

2. Select the WLAN for which you want to enable broadcasting of the SSID and click Edit.

3. In the WLAN > Edit page, check Admin Staus in order to enable the WLAN. Also, check Broadcast SSID in order to ensure that the SSID is broadcast in the beacon messages sent by the AP.

A. One of the reasons can be that multicast mode is disabled on the WLC. Enable multicast mode on the WLC and check if you are able to access the Microsoft AD domain.

A. Yes, Layer 3 mobility works with an AP Group VLAN configuration. Currently, traffic sources from a Layer 3 roamed wireless client is put on the dynamic interface assigned on the WLAN or the interface of the AP Group VLAN..

A. With DHCP option 43, the DHCP server provides the IP address of the WLCs along with the IP address provided through DHCP. This can be verified from the LAP if the AP is a Cisco IOS based Lightweight Access Point Protocol (LWAPP) AP, such as the 1242 or 1131AG LAP. In these cases, issue the debug dhcp detail command on the AP side in order to see if the AP successfully receives the option 43 information and what it receives.

A. This is because the 1.1.1.1 virtual interface address acts as a DHCP proxy for the original DHCP server. If you want to see the original DHCP server address at the output of the ipconfig/all command, then disable the DHCP proxy feature in the WLC to which the client is associated. This can be disabled with the config dhcp proxy disable command.

This command will replace the 1.1.1.1 virtual interface address, which shows up itself as the DHCP server, with the actual DHCP server IP address that you defined on the interface or in the override option of the WLAN.

A. This is an expected behavior. These steps occur when a client is authenticated through the WLC in multiple ACS deployments:

1. Upon boot up, the WLC determines the active ACS.

2. When this active ACS does not respond to the RADIUS request from the WLC, the WLC searches and makes a failover to the secondary ACS.

3. Even when the primary ACS comes back up, the WLC does not fall back to it until the ACS to which the WLC is currently authenticating fails.

In such cases, reboot the WLC in order for the WLC to identify the primary ACS again and fallback to it. This fallback does not occur immediately after reboot. It might take some time.

A. SecureCRT works only with WLCs that run version 4.0.206.0 or later. Upgrade your WLC to this version. Then, you can use SecureCRT SH client in order to SSH into the WLC.

A. Encryption of configuration files is already available in WLCs. If you choose from the WLC GUI, Commands > Upload File, you see the Configuration File Encryption checkbox.

You can force the file to be encrypted through WCS in this way.

• From the WCS GUI, choose Configure controller. It displays the list of WLCs configured in the WCS. Click on a WLC.

• In the left-hand side, click the commands option. You receive a list of controller commands.

• Under Upload/Download Commands ,choose download config from the drop-down menu. At this time, you see this message: Note: Configuration file encryption key is not set. Downloading configuration file will fail if encryption key is needed. Please click here to setup encryption.

Basically, you can force the WCS to always set an encryption key for WLC configurations. Encryption is not enabled by default, but it can be enabled both in WLC and WCS, as needed.