WLC configuration

⚠️ WLC menus below follow Cisco AireOS controllers (like the 3504 and 5520) used in CCNA study material. Exact names vary by release. The switch commands are Cisco IOS / IOS XE. Nothing here was run in a lab.

A real-life situation

A new WLC1 arrives for the lab office. AP1 is already on SW1 port Gi1/0/10 in VLAN 30. Staff laptops must land in VLAN 10 (10.10.10.0/24) and guests in VLAN 20 (10.10.20.0/24). Your job: cable WLC1 to SW1, give it its addresses, and create the Staff and Guest WLANs.

What a WLC is made of: ports and interfaces

A WLC has ports (physical connectors) and interfaces (logical addresses in a VLAN, a bit like SVIs). This split is the part most people mix up.

Physical ports

Logical interfaces

Why it is built this way

The WLC is the meeting point between radio and wire. A WLAN is just a name and a set of rules. It needs to be "anchored" to a VLAN so clients get a normal address from the normal DHCP server and use the normal gateway (SW1). The dynamic interface is that anchor. This lets you put staff and guests on different VLANs and filter them with different ACLs, exactly like wired users.

LAG exists for the same reason as EtherChannel: one cable is a single point of failure and a bottleneck. With LAG, all DS ports act as one link, and every interface uses the LAG.

How to configure it, step by step

Step 1: the switch side (Cisco IOS)

AireOS LAG is static: it doesn't speak LACP or PAgP. So SW1 must use mode on. The trunk must carry the management VLAN and every client VLAN.

Step 2: first boot and the management interface

A new AireOS WLC starts a setup wizard on the console (newer releases also offer a web wizard). It asks for the system name, an admin user and password, the service port address, the management interface (IP, mask, gateway, VLAN), the virtual interface address, the mobility group, a first WLAN, the country code, and NTP. For the lab:

Step 3: turn on LAG

In the GUI: CONTROLLER › General › LAG Mode on next reboot: Enabled, click Apply, save, and reboot. After the reboot all DS ports are one LAG, and each interface shows LAG as its port. There is only one LAG per WLC.

Step 4: create the dynamic interfaces

CONTROLLER › Interfaces › New. Enter the name and VLAN, click Apply, then fill in the details page:

The WLC relays client DHCP requests to that server, much like ip helper-address on a router.

Step 5: create the WLAN

WLANs › Create New › Go. Choose Type WLAN, enter a Profile Name and an SSID, pick an ID, and click Apply. The edit page has four tabs:

A new WLAN is disabled until you tick Status: Enabled. Repeat for Guest with interface guest. Then Save Configuration (top right), or the WLC loses the changes on reboot.

The same can be done on the AireOS CLI. For example, the WLAN steps look like this:

On a Catalyst 9800 (IOS XE) controller the same idea is split into profiles: a WLAN profile (SSID and security), a policy profile (VLAN and QoS), joined in a policy tag that is applied to APs. The CCNA mainly uses the AireOS screens.

Step 6: secure management access

These follow the same logic as Passwords, local users and SSH on a router: encrypted access only, and central accounts.

How to verify it

SW1#show etherchannel summary
Flags:  D - down        P - bundled in port-channel
        I - stand-alone s - suspended
        R - Layer3      S - Layer2
        U - in use
...
Group  Port-channel  Protocol    Ports
------+-------------+-----------+-----------------------------------------------
1      Po1(SU)          -        Gi1/0/1(P)  Gi1/0/2(P)

(Cisco Controller) >show interface summary
Number of Interfaces.......................... 4

Interface Name                   Port Vlan Id  IP Address      Type    Ap Mgr Guest
-------------------------------- ---- -------- --------------- ------- ------ -----
guest                            LAG  20       10.10.20.5      Dynamic No     No
management                       LAG  99       10.10.99.10     Static  Yes    No
staff                            LAG  10       10.10.10.5      Dynamic No     No
virtual                          N/A  N/A      192.0.2.1       Static  No     No

(Cisco Controller) >show wlan summary
Number of WLANs.................................. 2

WLAN ID  WLAN Profile Name / SSID          Status    Interface Name
-------  --------------------------------  --------  --------------------
1        Staff / Staff                     Enabled   staff
2        Guest / Guest                     Enabled   guest

What goes wrong and how to troubleshoot it

Common mistakes

• Confusing ports and interfaces. Ports are physical; interfaces are logical, VLAN-based addresses.
• Using LACP active on the switch toward an AireOS WLC. LAG is static only.
• Forgetting to allow client VLANs on the trunk to the WLC.
• Giving the virtual interface a real, routed address that is used elsewhere.
• Leaving HTTP and Telnet enabled for management.

💡 Exam tip: know the WLC port types (DS, service, redundancy, console) and the interface types (management, dynamic, virtual, service port, redundancy management). Expect a question that LAG uses mode on (no LACP/PAgP) and bundles all DS ports. Be ready to recognise the WLAN tabs (General, Security, QoS, Advanced) and the QoS levels Platinum, Gold, Silver, Bronze.

Key takeaways

• Ports are physical; interfaces are logical addresses in VLANs.
• The management interface handles GUI/SSH, RADIUS and CAPWAP from APs.
• A WLAN is mapped to a dynamic interface, which decides the client VLAN.
• LAG bundles all DS ports; the switch uses channel-group … mode on.
• Create a WLAN in WLANs › Create New, enable it, and save the configuration.

Check yourself