Network Access · Topic 9 of 9
WLAN Configuration in the Controller GUI
Walk through creating a WLAN in a Cisco controller GUI: profile and SSID, interface mapping, security settings, QoS profiles and advanced options.
- 6 min
- Exam objective 2.9
- A WLAN ties an SSID to a VLAN, a security method and policies.
- The WLAN must be enabled, and the interface or VLAN must be set correctly.
- PSK uses one shared passphrase. 802.1X gives each user individual authentication, with a RADIUS server.
What it is
A WLAN on a controller ties an SSID to a VLAN, a security method and a set of policies.
On a Cisco wireless LAN controller (WLC), you create wireless networks, called WLANs, through a web interface. Each WLAN links an SSID (the network name clients see) to those settings. Once it is created, the controller pushes it to every access point that has joined.
You are expected to read the settings on the screen and understand how they affect client connectivity.
This topic walks through the usual steps and the meaning of each group of settings. This page follows the AireOS style of GUI, where a WLAN has General, Security, QoS, Policy Mapping and Advanced tabs. The Catalyst 9800 organises the same settings differently, so focus on what each setting does.
How it works
You create the WLAN, set its groups of options, enable it, and check that clients land in the right VLAN.
Creating the WLAN
You start by creating a new WLAN and giving it three basics:
- Profile name: an internal label for the WLAN.
- SSID: the name that clients see and connect to. It can be the same as the profile name, but it does not have to be.
- ID: a number that identifies the WLAN on the controller.
The WLAN must be enabled before clients can use it. A new WLAN is often created in the disabled state, so that you can finish the settings first.
The settings groups
The WLAN settings are split across several tabs or sections.
| Section | Typical settings |
|---|---|
| General | Status (enabled or disabled), SSID broadcast, and the interface or VLAN the clients are placed in |
| Security: Layer 2 | Security method such as WPA2 or WPA3, and the key management type such as PSK or 802.1X |
| Security: Layer 3 and AAA | Web authentication, and the authentication servers to use |
| QoS | The quality of service profile |
| Advanced | Session timeout, client limits, AAA override, load balancing and other policies |
General
The interface or VLAN mapping is one of the most important choices. It decides which VLAN, and so which IP subnet, the wireless clients join. If it is wrong, clients can connect to the SSID but receive an address from the wrong network, or none at all.
You can also decide whether the SSID is broadcast. Hiding it does not provide real security, because the name can still be discovered from the other traffic between the client and the AP.
Security
The Layer 2 security setting is where you choose how clients authenticate and how their traffic is encrypted. The main choices are:
- WPA2 or WPA3 with PSK (pre-shared key): all users share one passphrase. It is simple and suits small offices and home networks.
- WPA2 or WPA3 with 802.1X (Enterprise): each user authenticates with individual credentials, checked by a RADIUS server. It suits larger organisations.
- Open: no authentication or encryption. It may be used with a web login page for guests, which is configured under Layer 3 security.
For encryption, the usual choice is AES (CCMP). The settings must match what the clients support, or they cannot join. WPA2 PSK is covered again in the Security Fundamentals chapter.
QoS
The WLAN can be assigned a QoS profile that sets the priority of its traffic over the air. The four standard profiles are:
| Profile | Traffic |
|---|---|
| Platinum | Voice |
| Gold | Video |
| Silver | Best effort, the default |
| Bronze | Background, the lowest priority |
A WLAN that carries voice phones would use Platinum, and a guest WLAN might use Bronze so that it does not compete with business traffic.
Advanced
Under the advanced settings, you find options that adjust behaviour. Examples include:
- Session timeout: how long a client stays connected before it must authenticate again.
- AAA override: lets the authentication server assign a VLAN or policy to a user, replacing the WLAN defaults.
- Client load balancing: spreads clients across APs.
- Peer-to-peer blocking: stops wireless clients on the same WLAN from talking to each other.
- DHCP required: forces clients to use DHCP rather than a fixed address.
Thinking it through
When a client cannot connect, read the settings in order.
- Is the WLAN enabled?
- Does the SSID match?
- Does the security method match what the client is using?
- Is the right VLAN mapped, and does that VLAN have a DHCP server and a path to the network?
Most connectivity problems come from one of those four.
What to remember for the exam
Eight facts cover most questions on this topic.
- A WLAN ties an SSID to a VLAN, a security method and policies.
- The WLAN must be enabled, and the interface or VLAN must be set correctly.
- PSK uses one shared passphrase. 802.1X gives each user individual authentication, with a RADIUS server.
- The four QoS profiles are Platinum (voice), Gold (video), Silver (best effort) and Bronze (background).
- AAA override lets the server assign a VLAN or policy per user.
- Hiding the SSID is not real security.
- Security settings on the WLAN must match what the client supports.
- A wrong interface mapping gives clients the wrong subnet or no address.
Memorise the QoS order by metal rank, Platinum for voice, Gold for video, Silver for best effort and Bronze for background.
Common mistakes
These five mistakes are common.
Forgetting to enable the WLAN. The SSID will not appear until it is enabled.
Mapping the wrong VLAN. Clients connect but cannot reach the right network.
Mismatched security. A client set for WPA2 will not join a WLAN set only for a different method.
Choosing Platinum for everything. Giving all traffic top priority removes the advantage of having priorities.
Relying on SSID hiding. It hides the name from casual view and nothing more.
A client that joins the SSID but gets the wrong address is almost always a VLAN or interface mapping problem, not a security problem.
Check yourself
Work through these three prompts.
What do the SSID, interface mapping and security method each control in a WLAN?
The SSID is the name clients join, the interface mapping sets their VLAN and subnet, and the security method sets authentication and encryption.
How do PSK and 802.1X differ in how users authenticate?
With PSK all users share one passphrase. With 802.1X each user authenticates with individual credentials, checked by a RADIUS server.
Which QoS profile suits a voice WLAN, and which a guest WLAN?
Platinum for voice, and Bronze for guests so they do not compete with business traffic.
Topic 9 of 9 in Network Access
Test yourself on Network Access
The full Cisco CCNA 200-301 question bank has 1,206 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.