Skip to content

Cisco_WLC_setup.md

Latest commit

 

History

History
411 lines (267 loc) · 6.86 KB

Cisco_WLC_setup.md

File metadata and controls

411 lines (267 loc) · 6.86 KB

📡 Cisco WLC Setup Guide (Proxmox Lab)

📺 Installation Guide

Follow this video to install Cisco WLC on Proxmox:
https://www.youtube.com/watch?v=MeDwvj0LxhU

🛰️ 1. Access Point (AP) Onboarding

Onboard access points on:

  • 🛰️ R2_LAN
  • 🛰️ R4_LAN

🔧 Configure AP (via Console)

🏷️ Set Hostname

capwap ap hostname <hostname>

1.0

🌐 Configure IP Address

capwap ap ip <ip address> <subnet mask> <gateway>

1.1

🔗 Join WLC

capwap ap primary-base <WLC hostname> <WLC ip address>

1.2

✅ 2. Verify AP Join Status

Log in to WLC, go to Monitoring > Wireless > AP Statistics

  • Confirm AP status is Joined

2

⚙️ 3. Configure AP Join Profile

Go to Configuration > Tags & Profiles > AP Join. Click Add.

🧾 General Settings

  • 🏷️ Name
  • 🌍 Country Code
  • ⏱️ Time Zone → Use-Controller

3.0

🔐 Management Tab (Device)

Enable:

  • ✅ SSH
  • ✅ Serial Console

3.1

👤 User Tab

  • Username
  • Password
  • Secret

Click Update & Apply to Device

3.2

🔁 Repeat for: R4_LAN_AP_JOIN

🌐 4. Configure Flex Profile

📘 Mode Explanation

  • 🏢 Local Mode → All traffic tunneled to WLC (central switching)
  • 🛰️ FlexConnect Mode → Traffic switched locally at AP (best for branch sites / WAN failure)

⚙️ Configuration

Go to Configuration > Tags & Profiles > Flex → Click Add.

🧾 General Tab

  • Name
  • Native VLAN ID

4.0

🏷️ VLAN Tab

Click Add:

  • VLAN Name
  • VLAN ID

Click Save

Click Update & Apply to Device

4.1

🔁 Repeat for: R4_LAN_FLEX

🧩 5. Configure Policy Profile

Go to Configuration > Tags & Profiles > Policy → Click Add

🧾 General

  • Name
  • Status: ✅ Enabled
  • IP MAC Binding: ❌ Disabled

🌐 WLAN Switching Policy

  • Central Switching: ❌ Disabled
  • Central Authentication: ✅ Enabled
  • Central DHCP: ❌ Disabled

5.0

🔌 Access Policies

  • VLAN / VLAN Group

5.1

🔐 Advanced (AAA)

  • ✅ Allow AAA Override

Click Update & Apply to Device

5.2

🔁 Repeat for: R4_LAN_POLICY

📶 6. WLAN Configuration (PSK)

Go to Configuration > Tags & Profiles > WLANs → Click Add

🧾 General

  • Profile Name
  • SSID
  • WLAN ID
  • Status: ✅ Enabled
  • Broadcast SSID: ✅ Enabled

6.0

⚠️ If AP supports WiFi 6E → Enable 6GHz radio

🔐 Security

  • WPA2 + WPA3

⚠️ Required for 6GHz support

⚡ Fast Transition

  • Enabled

🔑 Auth Key Management

  • FT + SAE
  • SAE
  • PSK-SHA256
  • FT + PSK
  • PSK
  • 🔒 Pre-Shared Key: <YourWiFiPass>

Click Update & Apply to Device

6.1

6.2

🔁 Repeat for: R4_LAN_SSID_PSK

🔐 7. 📶 WLAN Configuration (AAA / 802.1X)

Go to Configuration > Security > AAA → Click + AAA Wizard

📡 RADIUS Settings

🖥️ Server

  • 🏷️ Name
  • 🌐 Server Address → (Cisco ISE IP)
  • 🔑 Key → (same as ISE)
  • 🔄 CoA: ❌ Disabled

Click Next

6.3

🔗 Server Group Association

  • 🏷️ Name
  • 📡 Assigned Servers

Click Next

6.4

🔐 Map AAA

  • ✅ Authentication

  • ❌ Authorization and Accounting

  • 🏷️ Name

  • 🔧 Type: dot1x

  • 📂 Group Type: group

  • 📡 Assigned Server Groups

Click Apply to Device

6.5

8. 📶 Create AAA WLAN

Go to Configuration > Tags & Profiles > WLANs → Click Add

🧾 General

  • Profile Name
  • SSID
  • WLAN ID
  • Status: ✅ Enabled
  • Broadcast SSID: ✅ Enabled

7.0

🔐 Security

  • WPA2 + WPA3

🔑 Auth Key Management

  • 802.1X-SHA256
  • 802.1X
  • FT + 802.1X

7.1

🔗 AAA Tab

Select Authentication List (RADIUS/ISE)

Click Apply to Device

7.2

🔁 Repeat for: R4_LAN_AAA

🏷️ 9. 🧩 Create Tags

Go to Configuration > Tags & Profiles > Tags → Click Add

🧩 Policy Tag

🧾 General

  • 🏷️ Name

🔗 WLAN-Policy Mapping

Click Add:

  • 📶 Select WLAN Profile
  • 🧩 Select Policy Profile

Click ✅ and Apply to Device

8.0

8.1

🔁 Repeat for: R4_LAN_POLICY_TAG

🌐 Site Tag

🧾 General

  • 🏷️ Name
  • 📡 AP Join Profile
  • 🏢 Enable Local Site: ❌ Disabled
  • 🌐 Flex Profile

Click Apply to Device

8.2

🔁 Repeat for: R4_LAN_SITE_TAG

🔐 10. 🛡️ Configure TACACS+ (Device Administration)

Go to Configuration > Security > AAA → Click + AAA Wizard

➕ TACACS Settings

🖥️ Server

  • 🏷️ Name
  • 🌐 Server Address → (Cisco ISE IP)
  • 🔑 Key → (same as ISE)

Click Next

9.0

🔗 Server Group Association

  • 🏷️ Name
  • 📡 Assigned Servers

Click Next

9.1

🔐 Map AAA

  • ✅ Authentication
  • ✅ Authorization
  • ❌ Accounting

🔑 Authentication (Login)

  • 🏷️ Name
  • 🔧 Type: login
  • 📂 Group Type: group
  • 🔁 Fallback to local: ✅
  • 📡 Assigned Server Groups

Click Authorization

9.2

🛡️ Authorization (Exec)

  • 🏷️ Name
  • 🔧 Type: exec
  • 📂 Group Type: group
  • 📡 Assigned Server Groups

Click Apply to Device

9.3

🔑 Apply AAA to Management Access

Go to:

AAA Advanced > AAA Interface

  • 📡 Select configured Authentication
  • 🛡️ Select configured Authorization
  • Apply to:
    • 💻 VTY
    • 🌐 HTTP

Click Apply

9.4

✅ Verification

  • 🔓 Logout from WLC
  • 🔐 Login using Admin-01 (created in Cisco ISE)

✅ Login should be successful via TACACS+

📌 Design Notes

  • 🛰️ FlexConnect used for branch resiliency
  • 🔐 WPA3 + 802.1X for secure wireless access
  • 🧩 Tags simplify large-scale AP deployment
  • 🔁 Centralized authentication via Cisco ISE

✅ Summary

This setup includes:

  • 🛰️ AP onboarding using CAPWAP
  • 🌐 FlexConnect configuration for branch sites
  • 🧩 Policy and VLAN mapping
  • 📶 WLAN setup (PSK & AAA)
  • 🔐 Integration with Cisco ISE (RADIUS & TACACS+)
  • 🏷️ Tag-based deployment (Policy Tag + Site Tag)