Now remember, Cisco has two different types of wireless controllers.
AeroS would be the legacy option.
We don't really see these being sold proactively anymore and yet we still have
a lot of them
out in production, which is why Cisco does still want us to understand how to
perform
AeroS configuration and we'll take a look at that later on.
For now, we're going to focus on the new platform, which is Cisco's iOS XE
platform
built on the Catalyst 9800 series. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
built on the Catalyst 9800 series.
Yeah, Catalyst used to just mean a bunch of switches.
Now it means pretty much everything to Cisco.
We have wireless LAN controllers, we have access points, and so the wireless
LAN controllers,
the Catalyst 9800s, but then we have 9100 access points.
And then we have Catalyst 8,000s, which are routers and all kinds of things
that fall
under the Catalyst umbrella these days.
But the point is that they're all running iOS XE.
AeroS, if we ever went to the CLI, required almost knowing a completely WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
AeroS, if we ever went to the CLI, required almost knowing a completely
different language
and whole way of coding or configuring rather, are wireless LAN controllers.
Well, iOS XE is going to feel like it's a switch.
We get onto the CLI, we can perform configuration commands, and furthermore,
architecturally,
it's like a switch as well.
This becomes clear when we talk about the interfaces that we need to configure
on our
9800.
So we're looking at our 9800, and in my lab environment, I have a 9800-L. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we're looking at our 9800, and in my lab environment, I have a 9800-L.
Cisco has quite a few different options.
For the 9800s, this is intended for very small or lab type of environments.
And then they also have the -40 and the -80 referring to throughput here, 40
gig and 80
gig.
And then they also have a -CL, which is a cloud software based controller.
But again, for demonstration purposes in my lab, I'm going to be using a 9800-L
.
Again, architecturally, all of these are the same. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Again, architecturally, all of these are the same.
So it doesn't really matter outside of the number of access points that I want
to be
able to support as well as the overall throughput of the system.
So this 9800 is going to have physical interfaces on the front.
And these physical interfaces are going to be able to connect into my switching
layer
to infrastructure.
Now I can connect a couple of these.
I could connect all four of these.
And then I can also decide if I want to configure port channels. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then I can also decide if I want to configure port channels.
So this is interesting because in the old ARAOS, it was either all bundled or
no bundle.
But with our 9800s, because this is basically an iOSXZ switch under the hood, I
could create
multiple port channels if I so desire, but for the most part, we're just going
to bundle
all of these together.
This should be a trunked connection.
And it should contain the VLAN list for all of the wireless VLANs that we want
to support.
So every time we talk about that concept of the point of presence for our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So every time we talk about that concept of the point of presence for our
wireless stations,
remember our wireless stations are out here communicating with access points
that could
be part of the layer two domain, keep in mind that this could be across a
routed boundary.
But either way, we recall that these capwap tunnels are going to be formed
between the
access point and the controller.
And so the client gets sort of poredled or warped through this tunnel.
And then once it gets to the other side, it gets dropped back onto the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then once it gets to the other side, it gets dropped back onto the network.
So this client, if it's on VLAN 10, is actually talking about the VLAN list
here that is going
to allow me to be dropped off under the layer two network where the wireless
LAN controller
is.
Now, in the next question we have to ask is what interface is terminating this
capwap tunnel?
This is important.
This is going to be a huge part of our access point discovery, because the
access point
is going to come out and try to find the IP address that it was told, either by WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going to come out and try to find the IP address that it was told, either by
DHCP
or DNS, or possibly by layer two broadcast, which is how we'll do it in our lab
environment.
But it needs to be able to discover this interface.
Well this interface in an 9800 is going to be an SVI, just a standard VLAN
interface.
Again, architecturally, it's like a switch under the hood and running iOS XE.
So I can configure an SVI, and by the way, I can do all of this via CLI or via
the graphical WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the graphical
user interface.
With iOS, most admins would use the graphical user interface, certainly if you
were going
to go for your wireless CCIE, you'd really want to know the CLI commands.
But I'll leave that there.
But with iOS XE, we can very comfortably use either one.
And because it's using APIs on the back end, we can actually switch back and
forth.
I could use the CLI one day, and then the graphical user interface the next day
if I
so desire, because it's all running the same commands under the hood. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so desire, because it's all running the same commands under the hood.
So what we're going to do here is we're going to start to build out our
wireless configuration.
Again, when I look at my lab environment, I do have this 9800-L.
This is going to be across the house for me.
It's actually my bedroom closet.
That's where I store my lab.
So the wireless LAN controller, the 9800-L, is just going to connect through my
home network,
which is a layer two network.
I don't have anything fancy going here, just a couple of switches to get to my WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I don't have anything fancy going here, just a couple of switches to get to my
office,
which is where the access point is.
If I can draw an access point, there we go.
So the AP is hanging out here in my office, and then we'll test the wireless
configuration.
Eventually, we get to the point that I could attach my laptop to the wireless.
So we're going to start simply by making sure that the wireless LAN controller
here has
an SVI and that the access point is able to form that capwap tunnel. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
an SVI and that the access point is able to form that capwap tunnel.
We want to make sure that we can discover the access point and get it connected
to the
wireless LAN controller.
It might also be worth noting that wireless LAN controllers have a couple of
out-of-band
interfaces.
The RP or redundancy port is going to allow me to connect to another wireless
LAN controller.
I don't have that in my environment, but in the real world, we very likely have
another
wireless LAN controller there because, as we've said, if the wireless LAN
controller goes
down, I lose my wireless network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
down, I lose my wireless network.
So having a redundant wireless LAN controller, a hot spare, is going to be
heavily advised
in production.
And again, in most situations, that's exactly what we're going to see.
We also have an SP known as a service port, and this is for the sake of
management.
It's my out-of-band management port, and it's going to also connect into the
same layer
two environment.
And so this is going to be my 192.168.50/24 subnet. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so this is going to be my 192.168.50/24 subnet.
We are going to find that we've got a .12 IP address that I used to log into
the graphical
user interface and possibly do some CLI commands that way as well.
But this SVI is going to need to also have an IP address in the same subnet.
We'll use .13.
So we want to configure this .13 address, and we'll go ahead and put this on V
LAN 10
as an SVI so that the access point can discover it. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
as an SVI so that the access point can discover it.
Now just as a little bit of a demonstration, you can see here I've got this
access point.
This is a .9136 relatively new at the time of this video.
Still a couple of years old, Cisco continues to come out with new access points
.
This happens to be a Wi-Fi 6 enabled access point with 6 GHz, so technically Wi
-Fi 6E.
But either way, this has got 2.4, dual 5 gig and a 6 gigahertz radio.
So this has four different radios in it on top of the RF ASIC. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So this has four different radios in it on top of the RF ASIC.
It's a wonderful access point.
I've got it plugged in via the network with power over ethernet.
And what we can find here is that this light is cycling colors.
When we see it cycling colors, it means it's looking for the wireless LAN
controller.
Now interestingly at this point, we actually have the access point connected to
the same
layer to network as the wireless LAN controller.
You might say, well why is it still looking for the wireless LAN controller?
It should be able to find it via broadcast.
And that is the plan for it to discover it via broadcast. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that is the plan for it to discover it via broadcast.
However, it can't discover just a wireless LAN controller.
Again, it needs to discover that SVI.
And the fact that we don't have an SVI means that we can't actually terminate
access points
and cap-wep tunnel specifically.
The SP, the management interface is not going to be looking to terminate access
point connections.
Even though technically speaking, it is seeing the broadcast messages from the
access point
on that SP because it's all part of the same layer to domain. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on that SP because it's all part of the same layer to domain.
It's not going to respond to it to say, hey, here I am, form a cap-wep tunnel
with me.
We have to configure something that is in band.