Expert · Wireless networking · topic 49 of 57 · 35 min
Configuring a WLAN on a WLC and troubleshooting Wi-Fi
Explanation
Why use the GUI?
A WLC has a CLI, but day-to-day WLAN setup is usually done in its web interface, and the CCNA exam expects you to recognise the GUI steps. The steps below follow the classic AireOS WLC GUI. The newer Catalyst 9800 controllers organise the same settings into a WLAN profile, a policy profile and a tag, but the ideas (VLAN, SSID, security, QoS) are the same; check the current Cisco guide for exact screens.
Step 1: a dynamic interface for the VLAN
Clients of a WLAN must land in a VLAN. The switch port to the WLC is a trunk, and the WLC needs an interface in that VLAN. Go to Controller > Interfaces > New. Enter an interface name (for example staff) and the VLAN ID (10), then click Apply. On the next page set the port (or LAG), the interface IP address, netmask and gateway, and the DHCP server address so clients can get addresses. Apply again.
Step 2 (Enterprise only): add the RADIUS server
Go to Security > AAA > RADIUS > Authentication > New. Enter the RADIUS server IP address, the shared secret (a password the WLC and RADIUS server both know), and port 1812. Make sure it is enabled, and add an accounting server on port 1813 if you use accounting.
Step 3: create the WLAN
Go to WLANs, choose Create New and click Go. Set Type to WLAN, then enter a Profile Name (the internal name the WLC uses, for example STAFF-PROFILE) and the SSID (the name users see, for example Office-Staff). Choose an ID and click Apply.
Step 4: General, Security, QoS and Advanced tabs
- General tab: set Status to Enabled and choose the dynamic interface (staff) under Interface/Interface Group. This maps the WLAN to VLAN 10.
- Security tab, Layer 2: choose WPA2, WPA3 or both (transition). For Personal, set Authentication Key Management to PSK (WPA2) or SAE (WPA3) and enter the passphrase. For Enterprise, choose 802.1X.
- Security tab, AAA Servers (Enterprise): select the RADIUS server you added in step 2.
- QoS tab: choose the profile that matches the traffic (see the table).
- Advanced tab: optional settings such as session timeout, client isolation (P2P blocking) for guests, or FlexConnect local switching.
- Click Apply, then Save Configuration so it survives a reboot.
| QoS profile | Use for |
|---|---|
| Platinum | Voice (Wi-Fi calling, IP phones) |
| Gold | Video |
| Silver | Best effort: normal data (the default) |
| Bronze | Background: guests, bulk downloads |
(WLC) > show wlan summary
Number of WLANs.................................. 2
WLAN ID WLAN Profile Name / SSID Status Interface Name
------- -------------------------------- -------- --------------
1 STAFF-PROFILE / Office-Staff Enabled staff
2 GUEST-PROFILE / Office-Guest Enabled guest
(WLC) > show client summaryTroubleshooting: work through the stages
A client joins Wi-Fi in stages: it associates with an AP, it authenticates, it gets an IP address by DHCP, and then it passes traffic. Find the first stage that fails, and you have found the area of the problem. The WLC Monitor > Clients page shows each client's state, AP, signal, VLAN and IP address.
| Symptom | Likely cause | What to check |
|---|---|---|
| Cannot connect, "incorrect password" | Wrong passphrase, or WPA3-only SSID with an old device | The passphrase, the security mode, transition mode for old clients |
| Enterprise login fails for everyone | RADIUS unreachable or wrong shared secret | Ping the RADIUS server from the WLC, check the secret and port 1812, check RADIUS logs |
| Connected but "no internet", address 169.254.x.x | DHCP failed: wrong VLAN, VLAN missing on the trunk, or DHCP scope full | Dynamic interface VLAN, allowed VLANs on the trunk, DHCP server and scope |
| Slow in one area | Interference or co-channel overlap | Channel plan (1, 6, 11 on 2.4 GHz), non-Wi-Fi interference, number of clients per AP |
| Strong signal but poor speed | AP power too high, so cells overlap and clients stay far away | Lower the power, let RRM manage it, add APs where needed |
| Phone keeps a weak AP while walking | Sticky client: the client does not roam | Lower AP power, set minimum data rates, update client drivers |
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Configuring a WLAN on a WLC and troubleshooting Wi-Fi · 1/8
In this lesson you build a WLAN on a Cisco wireless LAN controller, then learn to troubleshoot Wi-Fi in a sensible order.
Prefer a video by a teacher? Find free videos on “CCNA configure WLAN on Cisco WLC GUI WPA2 dynamic interface” on YouTube ↗
In real life: A school adds a teachers' WLAN
A CBSE school in Lucknow has a WLC and 30 lightweight APs. The IT teacher creates dynamic interface "teachers" for VLAN 20 with the school DHCP server, adds the RADIUS server that checks school accounts, then creates WLAN "Teachers" with WPA2/WPA3 Enterprise and the Silver QoS profile. On day one, teachers connect but get 169.254 addresses. show client summary shows them in VLAN 20; the cause is that VLAN 20 was not allowed on the trunk to the WLC. One line on the switch fixes it.
SW-CORE(config)# interface gigabitEthernet1/0/1
SW-CORE(config-if)# switchport trunk allowed vlan add 20Practice (0/3 done)
A WLAN carries mostly Wi-Fi voice calls. Which QoS profile should it use?
Write diagnose(client) that finds the first failing stage for a Wi-Fi client. client is a dict with "associated" (True/False), "authenticated" (True/False), "ip" (a string or None) and "rssi" (signal in dBm, a negative number). Check in this order and return the first that applies: - "no-association" if not associated - "auth-failed" if not authenticated - "no-dhcp" if ip is None or starts with "169.254." (an APIPA address means DHCP failed) - "weak-signal" if rssi is below -67 - otherwise "ok"
Write a WLAN design for a 3-floor office (about 40 staff per floor, an open-plan area and meeting rooms on each floor, staff use Wi-Fi calling, visitors need internet). Cover: SSIDs and their security, VLANs, AP placement and count approach, bands and channels, AP mode and switch ports, QoS, and how you would check it works.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- DHCP: automatic addressesIP services: DHCP, DNS, NAT and more
- VLANs: what they are and why we use themSwitching and VLANs
- Wireless security conceptsEthical Hacking and Penetration Testing (legal labs) · Deeper lab skills: passwords, privilege, Metasploit, wireless
- Layer 2 security: port security, DHCP snooping, DAINetwork security
- Security basics: threats, CIA and AAANetwork security
- Trunks and 802.1Q taggingSwitching and VLANs
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
In the WLC GUI, where do you map a WLAN to a VLAN?
Answer: By choosing a dynamic interface on the General tab
The dynamic interface chosen on the General tab places the WLAN's clients in that interface's VLAN.
Clients join the new SSID but get 169.254.x.x addresses. What is the most likely cause?
Answer: A DHCP problem, such as the VLAN missing from the trunk
A 169.254 (APIPA) address means DHCP failed; a wrong passphrase would stop the client before it got that far.
Every 802.1X user suddenly fails to log in, while the PSK guest SSID works. What should you check first?
Answer: Whether the WLC can reach the RADIUS server
All Enterprise logins failing together points to RADIUS: reachability, shared secret or port.
Users have a strong signal but slow Wi-Fi, and APs are all on maximum power. What is a likely fix?
Answer: Lower AP power so cells overlap less
Too much power causes overlapping cells, interference and sticky clients.
Which QoS profile is the default best-effort profile on a WLC?
Answer: Silver
Silver is best effort, used for normal data.
In WPA2 or WPA3 Enterprise, what checks each user's credentials?Related
Answer: A RADIUS server through 802.1X
Enterprise mode uses 802.1X with EAP, and a RADIUS server authenticates each user.
What does a dynamic interface on a WLC do?Related
Answer: Maps a WLAN to a VLAN with its own IP address
Dynamic interfaces are like SVIs: they place each WLAN's clients into a VLAN.
Which Wi-Fi standard is Wi-Fi 6?Related
Answer: 802.11ax
802.11ax is branded Wi-Fi 6 (and 6E when it uses the 6 GHz band).
Where do you configure ip helper-address?Related
Answer: On the router interface facing the DHCP clients
The relay must be on the interface that receives the clients' broadcasts, which is their default gateway.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- This is the last topic of “Wireless networking”. The module exam comes next.
- Module 10 exam: Wireless networking · 13 questions · 25 min, without help. 4 topics of this module still to finish first.
- Then the next module, Automation, SDN and cloud networking. 57 topics left in the course before the final exam.