Step 1

Add a temporary floor to the legacy site, which is managed by the Cisco AireOS Wireless Controller.

Step 2

Discover the Catalyst 9800 Series Wireless Controller and provision the wireless controller to the legacy site that manages the newly added floor.

Step 3

Enter the interface details, such as VLAN for legacy flow.

Step 4

Configure a mobility tunnel between the Cisco AireOS Wireless Controller and the Catalyst 9800 Series Wireless Controller.

Step 5

Migrate the APs to the Catalyst 9800 Series Wireless Controller using one of the following methods:

1. Iterative migration: Only specific APs on a floor are migrated (Milpitas/Building 23/Floor2).

   1. On a single floor, identify some of the APs that need to be moved from the Cisco AireOS Wireless Controller to the Catalyst 9800 Series Wireless Controller.

      Do not select all the APs on a single floor.

   2. Create a new temporary floor (Floor 2_1) that is managed by the Catalyst 9800 Series Wireless Controller.

   3. Move the subset of APs to the Catalyst 9800 Series Wireless Controller using the AP config workflow.

      Through the workflow, the Catalyst 9800 Series Wireless Controller will be configured as the primary wireless controller.

   4. Once the subset of APs join the Catalyst 9800 Series Wireless Controller, provision the APs to Catalyst 9800 Series Wireless Controller, which is a part of Floor 2_1.

      At this point, a subset of APs are now managed by the Catalyst 9800 Series Wireless Controller, and the remaining APs are managed by the Cisco AireOS Wireless Controller. As a result, service is not disrupted on that floor.

   5. Iteratively move the remaining APs from the floor to the Catalyst 9800 Series Wireless Controller.

2. Floor-by-floor migration: An entire set of APs on a floor are migrated to the Catalyst 9800 Series Wireless Controller.

   1. Create a new temporary floor (Floor 2_1) that is managed by the Catalyst 9800 Series Wireless Controller.

   2. Move all the APs on a single floor to the Catalyst 9800 Series Wireless Controller.

   3. Provision the APs to the Catalyst 9800 Series Wireless Controller, which is a part of Floor 2_1.

   4. Provision the Catalyst 9800 Series Wireless Controller to manage Floor 2.

   5. Either iteratively or by entire floor, provision the APs to Floor 2.

   6. Delete the temporary floor, Floor 2_1.

   7. Repeat the first six steps in substep b for your desired sites, buildings, and floors.

   8. Delete the temporary floor created in Step 1.

Step 6

(Optional) Remove the Cisco AireOS Wireless Controller from the inventory using the config cleanup option.

Step 1

Perform a readiness check using the Cisco Prime Infrastructure Cisco DNA Center Assessment and Readiness Tool (PDART).

Step 2

Once you have assessed the readiness of the migration, use the PDMT to migrate your sites and devices from Cisco Prime Infrastructure to Cisco DNA Center.

Step 1

Log in to the Cisco DNA Center web console using an IP address or a fully qualified domain name.

Step 2

From the top-left corner, click the menu icon and choose System > Settings.

Step 3

In the left pane, from the External Services drop-down list, choose Authentication and Policy Servers.

Step 4

From the Add drop-down list, choose ISE.

Step 5

Enter the server details in the required fields.

Step 6

Click Add to create the Cisco ISE server within Cisco DNA Center.

Step 7

Click Accept.

Step 1

Login to the Cisco DNA Center web console using an IP address or a fully qualified domain name.

Step 2

From the top-left corner, click the menu icon and choose Design > Network Hierarchy.

Step 3

Click + Add Site > Add Area.

Step 4

In the Add Area dialog box, from the Parent drop-down list, enter the Area Name and choose the desired parent.

Step 5

Click Add.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Hierarchy.

Step 2

Click + Add Site > Add Building.

Step 3

In the Add Building dialog box, enter the Building Name and choose the desired area from the Parent drop-down list.

Step 4

Enter the building address or GPS coordinates using one of the following methods:

Step 5

Click Add.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Hierarchy.

Step 2

Click + Add Site > Add Floor.

Step 3

In the Add Floor dialog box, enter the Floor Name and choose the desired area from the Site drop-down list.

Step 4

Choose the appropriate space type from the Type (RF Model) drop-down list and enter the associated Floor Number.

Step 5

Choose the appropriate floor type from the Floor Type drop-down list and enter the associated Thickness (ft).

Step 6

Add the floor plan to the Floor Image area using one of the following methods:

Step 7

Click the Width (ft) radio button and enter the floor width in feet.

Step 8

Click the Length (ft) radio button and enter the floor length in feet.

Step 9

In the Height (ft) field, enter the ceiling height in feet.

Step 10

Click Add.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Hierarchy.

Step 2

In the left hierarchy pane from the Global drop-down list, choose the desired floor for the AP.

Step 3

Click Add/Edit.

Step 4

From the Planned AP Models drop-down list, click Add model.

Step 5

In the Select AP models to add dialog box, choose the AP model from the drop-down list.

Step 6

Click Add AP models.

Step 7

From the Planned AP Models drop-down list, choose the desired AP model.

Step 8

In the floor map, move your cursor to the desired location of the AP and click the location.

Step 9

In the Edit Planned AP slide-in pane, ensure the Planned AP Name matches the real AP host name.

Step 10

Click Save.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Hierarchy.

Step 2

In the left hierarchy pane, choose Global.

Step 3

Click Import > Import Maps.

Step 4

In the Import Maps dialog box, import the map using one of the following methods:

Step 5

Click Import.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Hierarchy.

Step 2

In the left hierarchy pane, choose the appropriate site for your map.

Step 3

Hover your cursor over the ellipsis icon () and choose Export Maps.

Step 4

In the Export Maps dialog box, enter the desired file name and click the Ekahau Project radio button.

Step 5

Click Export.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Hierarchy.

Step 2

In the left hierarchy pane, choose the appropriate site for your map.

Step 3

Hover your cursor over the ellipsis icon () and choose Import Ekahau Project.

Step 4

In the Import Ekahau Project dialog box, import the map using one of the following methods:

Step 5

Click Import.

Step 1

Log in to Cisco DNA Center using the IP address or the fully qualified domain name of your instance.

Step 2

From the top-left corner, click the menu icon and choose Design > Network Settings > Wireless.

The Wireless Network Settings dashboard is displayed.

Note

Wireless settings are hierarchical. Settings defined at lower levels of the site hierarchy override the settings defined in higher levels. By default, you are taken to the global level, which is the highest level of the site hierarchy. You must define the wireless interfaces at the global level of the site hierarchy.

Step 3

Click Add next to Wireless Interfaces.

The New Wireless Interface slide-in pane is displayed.

Step 4

Enter the Interface Name and VLAN ID for the wireless interface corresponding to the enterprise VLAN (employee), and then click Add.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Settings > Wireless.

Step 2

Click SSIDs.

Step 3

Hover your cursor over + Add and choose Enterprise.

Note

Enabling the neighbor list (802.11k) may cause some legacy devices to react incorrectly to unknown information. Most devices will ignore the 802.11k information (even if they do not support it), but a disconnection or a failure to associate may occur for some devices. It is advisable to test before enabling this option. In scenarios where clients would move in and out of coverage areas or when the client is battery operated and may go to sleep frequently, you may consider increasing the idle time out to 3600 seconds (60 minutes) to reduce the likelihood of client deletion.

For information about features that can be configured for enterprise wireless networks via Cisco DNA Center, see Enterprise Wireless Network Features Configurable via Cisco DNA Center.

Step 4

Enter the information for the Basic Settings and click Next.

The next screen in the workflow is displayed. You can either attach the enterprise wireless network to an existing wireless profile, or you can create a new wireless profile and attach the enterprise wireless network.

Note	For information about the settings for the enterprise wireless network configured for this deployment guide, see Enterprise Wireless Network Settings Configured in the Deployment Guide.

Step 5

Click + Add Profile to create and add a new wireless profile.

Step 6

In Profile Name, enter the name of the new wireless profile, and then click Associate Profile.

Step 7

Click the newly created profile and select the interface to be associated with this profile.

Step 8

Click Save, and then click Next.

Step 9

(Skip this step if SD-Access App is not deployed.) Under Fabric, select No.

Step 10

From the Select Interface drop-down menu, select the employee to terminate the lab3Employee SSID onto the employee VLAN (VLAN 160) created in the previous procedure.

Step 11

Under Guest Anchor option, choose No.

Step 12

Uncheck the Flex Connect Local Switching check box, and then click Save to save an existing profile.

Step 13

Click Next.

Step 14

Review the summary for the Network Profile, and click Save.

Step 15

From the top-left corner, click the menu icon and choose Design > Network Profiles.

Step 16

In the Wireless Profiles table, from the Sites column, click Assign Site for your desired profile.

Step 17

In the Global section, click > to display the Milpitas area.

Step 18

Choose the Milpitas area.

Step 19

Click OK to close the site hierarchy side panel.

Step 20

Click Edit under summary of Network Profiles Attach Template(s) to add CLI-based templates to the enterprise wireless network configuration.

Step 21

Click Save.

Step 22

Click Finish to add the lab3employee enterprise wireless network.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Settings > Wireless.

Step 2

Click SSIDs.

Step 3

Expand the sites, and then click on the desired site in the left pane.

Step 4

Select lab3employee SSID, and then click Edit.

Step 5

Click Next and configure the override settings for the selected site.

Step 6

Click Save in the last page to assign the profile to the site.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Settings > Wireless.

Step 2

Click SSIDs.

Step 3

Hover your cursor over + Add and choose Guest.

Step 4

Enter the information for the Basic Settings and click Next.

Step 5

Choose the Corporate Wireless profile.

Step 6

Click Edit in the Wireless Profile side panel to add the guest wireless network.

Step 7

Under Fabric, choose No.

Step 8

Select Yes next to Do you need a Guest Anchor for this Guest SSID.

1. From the top-left corner, click the menu icon and choose Design > Network Settings.

2. Click the Wireless tab.

3. From the left hierarchy tree, choose Global.

4. Click Anchor Groups.

   The Anchor Groups window opens.

5. In the Anchor Group table, click Add.

6. In the Anchor Group Name field of the Anchor Group slide-in pane, enter the anchor group name.

7. To add a managed wireless controller as an anchor, click Add Managed WLC and do the following in the Add Managed WLC dialog box:

   1. Check the check box next to the name of the devices that you want to add as anchors.

      To search for a device, in the Search Table search field, enter either the partial name or the full name of the device and press Enter.

   2. Click Add.

8. (Optional) To add an external wireless controller as an anchor, click Add External WLC and do the following in the Add External WLC dialog box:

   1. In the Device Name field, enter the device name.

   2. From the Device Series drop-down list, choose a device series.

   3. In the Peer IP Address field, enter the peer IP address.

   4. (Optional) In the NAT IP Address field, enter the Network Address Translation (NAT) IP address.

   5. In the MAC Address field, enter the MAC address of the device.

   6. In the Mobility Group Name field, enter the mobility group name.

   7. (Optional) In the Hash field, enter the hash for the Cisco Catalyst 9800 Series Wireless Controller.

      Note	This field is available for only the Cisco Catalyst 9800-CL Wireless Controllers.

   8. Click Add.

9. (Optional) To add an existing external wireless controller as an anchor, click Add Existing External WLC and do the following in the Add Existing External WLC dialog box:

   1. Check the check box next to the name of the devices that you want to add as anchors.

      To search for a device, in the Search Table search field, enter either the partial name or the full name of the device and press Enter.

   2. Click Add.

10. (Optional) To set the priority for an anchor, from the Priority Order drop-down list, choose the priority for the anchor wireless controller.

11. Click Save.

    For more information, see the "Create an Anchor Group" topic in the Cisco DNA Center User Guide.

Step 9

From the Select Interface drop-down menu, select guest-dmz.

Step 10

Click Next.

Step 11

To add a new guest portal within Cisco ISE, click Create Portal.

Step 12

Enter the necessary information. You must at least name the guest portal.

Step 13

Click Save to create the new guest portal on the Cisco ISE server and return to the guest wireless network workflow.

Step 14

Click Next.

Step 15

Click Save.

Step 16

Click Sites in network profile summary page to bring up a panel displaying the site hierarchy.

Step 17

Under Global, click the >to display the Milpitas area.

Step 18

Select the Milpitas area.

Step 19

Click OK to close the site hierarchy side panel.

Step 20

Click + Add under Attach Template(s) to add the CLI-based templates to the enterprise wireless network configuration.

Step 21

Click Save in the Edit a Wireless Profile side panel to save the edits to the corporate wireless profile.

Step 22

Click Save to add the lab3guest guest wireless network to the corporate wireless profile.

For information about provisioning ISE Settings from Cisco DNA Center, see Provision Cisco ISE Settings from Cisco DNA Center.

Step 1

Choose Lab3_Guest_Portal to verify the portal details.

Step 2

Click the 1 rules link to check the authorization policy created by Cisco DNA Center.

Step 3

From the top-left corner, click the menu icon and choose Policy > Policy sets.

Step 4

Click Default.

Step 5

Go to Authorization Policy to verify the authorization policy pushed by Cisco DNA Center.

Step 1

Login to Cisco DNA Center web console using the IP address or fully qualified domain name of your instance.

Step 2

From the top-left corner, click the menu icon and choose Design > Network Settings > Wireless.

The Wireless Network Settings dashboard is displayed. An example is shown in the following figure.

Step 3

Enter the Interface Name and VLAN ID for the wireless interface corresponding to the enterprise VLAN (branchemployee).

Step 4

Click Add.

Repeat the procedure to add the wireless interface for the guest VLAN (guest-dmz). When completed, the two new wireless interfaces should appear in the Wireless Network Settings dashboard, as shown in the figure below:

Step 1

From the top-left corner, click the menu icon and choose Design > Network Settings > Wireless.

Step 2

Click SSIDs.

Step 3

Hover your cursor over + Add and choose Enterprise.

For information about features that can be configured for enterprise wireless networks via Cisco DNA Center, see Enterprise Wireless Network Features Configurable via Cisco DNA Center.

Step 4

Enter the information for the Basic Settings and click Next.

Note	For information about the settings for the enterprise wireless network configured for this deployment guide, see Enterprise Wireless Network Settings Configured in the Deployment Guide.

Step 5

Click + Add to add a new wireless profile.

Step 6

Enter the Wireless Profile Name.

Step 7

(Skip this step if SD-Access App is not deployed.) Under Fabric, select No.

Step 8

From the Select Interface drop-down menu, choose branchemployee.

Step 9

Check the box next to FlexConnect Local Switching.

Step 10

Enter VLAN ID 100 in Local to VLAN.

Step 11

Click Next.

Step 12

Click Save.

Step 13

Click Configure Network Profiles.

Step 14

Click Assign Sites in branch network profiles.

Step 15

Select the New York area.

Step 16

Click OK to close the site hierarchy side panel and return to the Create a Wireless Profile side panel.

Step 17

Click + Add under Attach Template(s) to add the CLI-based templates to the enterprise wireless network configuration.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Settings > Wireless > FlexConnect Settings.

Step 2

Configure Native VLAN and AAA override VLAN in the global settings.

Step 1

From the top-left corner, click the menu icon and choose Tools > Model Config Editor.

Step 2

Click Flex Configuration.

Step 3

Click Add and enter the design name.

Step 4

Enable IP Overlap.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Profiles.

Step 2

Click Edit branch5 network profile.

Step 3

Click the Model Config tab, and then click Add Model Config.

Step 4

Choose Wireless Controller as the Device Type.

Step 5

Click Wireless > Flex Configuration, and then select the configured model config.

Step 6

Click Add and save the changes.

Step 1

Step 2

From the top-left corner, click the menu icon and choose Design > Network Settings > Wireless.

Step 3

Click SSIDs.

Step 4

Hover your cursor over + Add and choose Guest.

For information about features that can be configured for guest wireless networks via Cisco DNA Center, see Guest Wireless Network Features Configurable via Cisco DNA Center.

Step 5

Enter the information for the relevant fields and click Next.

Step 6

Attach the guest wireless network to the existing branch5 wireless profile.

Step 7

From the Select Interface drop-down menu, choose branchguest-dmz.

Step 8

Click FlexConnect Local switching and enter Local Vlan 110.

Step 9

Click Next.

Step 10

Click Create Portal to add a new guest portal in Cisco ISE.

Step 11

Enter the relevant information.

Step 12

Click Save to create the new guest portal on the Cisco ISE server and return to the guest wireless network workflow.

Step 13

Click Next.

Step 14

Click Save.

Step 15

Click Configure Network Profiles.

Step 16

Click Assign Sites in Branch Network Profiles.

Step 17

Select the New York area. This should automatically check the child site locations: Branch 5 with Floor 1, Floor 2, and Floor 3.

Step 18

Click OK to close the site hierarchy side panel and return to the Create a Wireless Profile side panel.

Step 19

Click + Add under Attach Template(s) to add the CLI-based templates to the enterprise wireless network configuration.

Step 1

From the top-left corner, click the menu icon and choose Design > Network settings > Wireless Flex connect settings.

Step 2

Configure native VLAN and AAA override VLAN in global settings.

Note	You can override the native VLAN and AAA override VLAN in global settings at the area, building, and floor levels.

Step 1

From the top-left corner, click the menu icon and choose Tools > Model Config Editor.

Step 2

Click Flex Configuration.

Step 3

Click Add and provide design name as branch.

Step 4

Enable IP Overlap.

Step 1

From the top-left corner, click the menu icon and choose Design > Network Profile.

Step 2

Choose the Edit branch5 network profile.

Step 3

Click Model Config and add a model config.

Step 4

For Device Type, choose wireless controller.

Step 5

Click Wireless > Flex Configuration and choose the configured model config.

Step 6

Click Add and save the changes.

Step 1

From the Wireless Network Settings dashboard, locate the Wireless Radio Frequency Profile section.

Step 2

By default, the TYPICAL RF profile is set as the default RF profile. You will know this because it will appear as TYPICAL (Default) as shown in the following figure. To change the RF profile, check the check box next to the name of one of the available profiles, and then click the ✓ default button.

For this design and deployment guide, the TYPICAL RF profile was selected, indicating that the deployment is meant for an environment with medium client density.

The FlexConnect design for a remote office is now complete.

Step 1

Navigate to the AWS Marketplace.

Step 2

Locate the Cisco Catalyst 9800-CL Wireless Controller product page by searching the AWS Marketplace for "C9800-CL."

Step 3

Choose the Cisco Catalyst 9800-CL Wireless Controller for Cloud and click Continue to Subscribe.

Step 4

Choose the fulfillment option: Cloud Formation Template (recommended) or Amazon Machine Image (AMI).

Step 5

During the installation process, you will be prompted to select the following:

Step 6

Click Review and Launch and ensure that the information is accurate.

Step 7

Click Launch Instances.

Step 8

Go to AWS Console > EC2 services and wait for your instance to indicate a state of running. You will have to wait a few minutes before you can connect to your Catalyst 9800-CL Wireless Controller instance.

Step 9

Connect to the IP address assigned to your Catalyst 9800-CL Wireless Controller instance and use the WebUI wizard for Day 0 configuration and setup.

Step 10

Alternatively, connect to your instance using an SSH client, providing the necessary credentials or the private SSH key selected during setup.

Step 11

Once SSH has connected, you should see the IOS XE command prompt on the Catalyst 9800-CL Wireless Controller. You may now begin configuring your instance.

Step 1

Log in to the Cisco DNA Center web console using an IP address or a fully qualified domain name.

Step 2

From the top-left corner, click the menu icon and choose Design > Network Settings > Wireless.

Step 3

From the Wireless Network Settings dashboard, hover your cursor over + Add and choose Enterprise.

Step 4

Enter the necessary information and click Next.

Step 5

The next page in the workflow is displayed. You can attach the enterprise wireless network to an existing wireless profile, or you can create a new wireless profile and attach the enterprise wireless network.

Step 6

Click Add to add a new wireless profile.

Step 7

In the Wireless Profile Name field, enter the name of the new wireless profile. For this deployment guide, a wireless profile named corpevent-profile was created.

Step 8

From Fabric, click the No radio button.

Step 9

From the Select Interface drop-down list, choose Management.

Step 10

Check the FlexConnect Local Switching check box.

Step 11

In the Local to VLAN field, enter VLAN ID 16.

All branch employee traffic will be locally switched onto VLAN 16 of the branch switch.

Step 12

Click Associate Profile to attach the profile to wireless SSID.

Step 13

Click Next to review the summary, and then click Save.

Step 14

Click Configure Network Profile to go to the Network Profiles page to assign the site for the wireless profile.

Step 15

Click Assign Site.

Step 16

In the left hierarchy tree, choose Global > Milpitas area.

Step 17

Click OK to close the site hierarchy side panel and return to Create a Wireless Profile.

Step 1

Navigate to the main Cisco DNA Center dashboard.

Step 2

From the top-left corner, click the menu icon and choose Tools > Discovery.

The Discovery Dashboard is displayed.

Step 3

Click + Add Discovery to create a new discovery.

Step 4

From IP Address/Range, for Discovery Type, click the Range radio button.

Step 5

In the From field, enter the beginning IP address, and in the To field, enter the ending IP address.

Step 6

For Preferred Management IP, if a device has a loopback interface used for management, click the Use Loopback radio button. Otherwise, click the None radio button.

Step 7

Make sure the CLI, SNMP, and NETCONF credential toggle buttons are set to On.

Step 8

From the Advanced section, for Protocol Order, check the SSH check box.

Step 9

Click Start to begin the discovery.

The discovery details are displayed while the discovery runs. After discovery is complete, the discovery details are displayed.

Step 10

After the discovery process is complete, navigate to the main Cisco DNA Center dashboard.

Step 11

From the top-left corner, click the menu icon and choose Provision > Inventory.

Step 1

From the top-left corner, click the menu icon and choose Design > Image Repository.

The Image Repository window is displayed in the following figure.

Step 2

You can get a new image into the Cisco DNA Center image repository by doing one of the following:

Step 3

For your desired image, click download image icon. The image will begin to download from the Cisco website.

Step 4

Alternatively, click Import to import a new image.

The Import Image/Add-on dialog box is displayed.

Step 5

Click Choose File.

Step 6

Navigate to the Catalyst 9800-40 software image on your computer and choose the desired image.

Step 7

Under Source, click the Cisco radio button because this is a Cisco software image.

Step 8

Click Import to upload the image to the Cisco DNA Center image repository.

Step 9

Click Show Tasks to verify that the image was imported successfully.

Step 10

Close the Recent Tasks (Last 50) side panel.

Step 11

From the Image Repository window, click > next to Imported Images to expand the list of imported images.

Step 12

Click Assign next to the image file you just uploaded.

The Assign Device Family side-in pane is displayed.

Step 13

Choose the Cisco Catalyst 9800-40 Wireless Controller and click Assign to assign this image to its device family.

Step 14

Under the Family column in the list of devices in the main repository window, locate the Catalyst 9800-40 Wireless Controllers and expand the list of available images for the device.

Step 15

Click the star for Golden Image to mark the image as the preferred one for the Catalyst 9800-40 Wireless Controller platform.

Step 1

From the top-left corner, click the menu icon and choose Provision > Inventory.

Step 2

From the Focus drop-down list, choose Software Images.

Step 3

From the list of devices, locate one of the Catalyst 9800-40 Wireless Controllers (WLC-9800-1 or WLC-9800-2).

Step 4

Under the Software Image column for the Catalyst 9800-40 Wireless Controller, click Needs Update.

The Image Update Readiness Check slide-in pane is displayed.

Step 5

Click Re-Execute Check to rerun the readiness assessment.

Step 6

When you have corrected all checks which indicate a failure, close the Image Update Readiness Check slide-in pane.

Step 7

Repeat Step 1 through Step 6 for the other Catalyst 9800-40 Wireless Controller.

Step 8

Check the check boxes for both of the Catalyst 9800-40 Wireless Controllers (Wireless Controller-9800-1 and Wireless Controller-9800-2).

Step 9

From the Actions drop-down list, choose Software Image > Image Update.

1. Enter a unique name in the Task Name field.

   For this deployment guide, the name is entered as c9800update.

   

2. Click Next.

3. Check the check box for the device name to choose the device.

   

4. Click Next to proceed to the customized software distribution checks.

   

5. If customization is not needed, choosing the default Flash check is optional.

   

6. Click Next to proceed to Software Activation Checks. By default, Config register check and Startup config check are chosen.

7. Click Add a custom check to add additional custom checks.

   For this guide, only the default checks are chosen.

   

8. Click Next and choose the Device Activation order if there is more than one device.

   For this guide, there is only one device, so only that device is chosen.

   

9. Click Next to schedule the distribution and activation for a later time. To execute the distribution and activation immediately, click Now.

   If the software has not been distributed (downloaded from the Cisco DNA Center repository to the wireless controllers) you cannot choose the Now option. However, you can schedule the software to be activated immediately after the software distribution is complete, or you can schedule the software activation for a later date and time. If you schedule the activation time to be too close to the distribution time, you will receive a warning that the update may fail because the distribution of the image to the devices may not complete before the scheduled activation time.

   Note	It is always recommended to upgrade software images only during scheduled network operations change windows.

Step 10

Enable Software Activation After Distribution.

Alternatively, click the Later radio button and adjust the date and time for the image distribution.

Enabling Software Activation After Distribution will activate the image immediately after it is distributed. This action combines the download and activation of the image into a single scheduled process, rather than scheduling download and activation separately.

1. Click Next to proceed to the Summary window and review your selections before submitting the task to update the device image.

   

2. Click Submit.

   The status window is displayed, showing the progress of the update.

   

Step 11

Click Image Update Status, which takes you to the update progress window.

Alternatively, click the menu icon and choose Activities > Tasks. The scheduled task window is displayed.

You can expand the task to see the details regarding the distribution and activation of the image.

On successful completion of the task, an icon is displayed next to the task, indicating that the update was successful. Again, you can expand the task to see the details regarding the distribution and activation of the image.

Step 12

Close the scheduled tasks slide-in pane.

Step 13

From the top-left corner, click the menu icon and choose Provision > Inventory to go back to the inventory list in the main provisioning window.

Step 1

From the top-left corner, click the menu icon and choose Provision > Inventory.

Step 2

Locate and check the check box for the Catalyst 9800-40 Wireless Controller which will be the primary wireless controller of the HA SSO wireless controller pair.

Step 3

From the Actions drop-down list, select Provision > Configure WLC HA.

Step 4

Enter the required information in the respective fields and click Configure HA.

Step 5

Click OK to accept and put the two Catalyst 9800-40 Wireless Controllers in HA SSO mode.

Step 6

If you choose the wireless controller (WLC-9800-2), and from the Actions drop-down list, choose Provision > Configure WLC HA, you can see additional information about the Catalyst 9800-40 Wireless Controller HA SSO pair.

Note

If you click Disable HA, both Catalyst 9800-40 Wireless Controllers will revert to standalone mode, with the secondary wireless controller reset to factory settings. It is recommended that you establish console access to the wireless controllers before disabling HA. You will need to change the IP address and hostname of one of the wireless controllers to rediscover the controller in Cisco DNA Center after disabling HA.

Step 1

From the top-left corner, click the menu icon and choose Provision > Inventory.

Step 2

Locate and check the check box for C9800-40-CVD.cagelab.local.

Step 3

From the Actions drop-down list, choose Provision > Provision Device.

Step 4

In the Assign Site window, click Choose a Site. A slide-in pane is displayed, which shows the site hierarchy configured for Cisco DNA Center.

Step 5

Expand the site hierarchy for Milpitas and choose Building 23.

Note

The enterprise wireless controller HA SSO pair (C9800-40-CVD.cagelab.local) must be assigned to a building or floor within the Cisco DNA Center site hierarchy. It cannot be assigned to Milpitas area or to the global level of the site hierarchy, even though C9800-40-CVD.cagelab.local is assigned to Building 23 in this deployment guide. APs located on floors in other buildings are supported by the wireless controller. When the wireless controller is assigned to a site, the wireless controller is added as a device to Cisco ISE.

Step 6

Click Save to assign C9800-40-CVD.cagelab.local to Building 23.

Step 7

Click Next.

Step 8

In the Configuration window, choose Active Main for the wireless controller Role.

Step 9

Click Select Primary Managed AP locations.

Cisco DNA Center supports the ability to configure N+1 redundancy for APs and HA SSO for a wireless controller. As a result, you can configure both primary and secondary managed AP locations. Primary managed AP locations are sites that include buildings and/or floors, where the wireless controller will serve as the primary wireless controller within the AP high availability configuration. Secondary managed AP locations are sites where the wireless controller will serve as the secondary wireless controller within the AP high availability configuration. If the primary wireless controller or wireless controller HA SSO pair fail, APs will reestablish CAPWAP connections to the wireless controller.

For this guide, the Catalyst 9800-40 Wireless Controller HA SSO pair (C9800-40-CVD.cagelab.local) will be the primary wireless controller, managing APs on Floors 1 and Floor 2 of Building 23 and Building 24. No secondary managed AP locations will be configured because the wireless controller HA SSO pair already provides redundancy in a campus network, where all the APs are operating in a centralized mode deployment.

Step 10

Expand the site hierarchy and choose Floors 1 and Floor 2 for Building 23 and Floors 1 and Floor 2 for Building 24.

Step 11

Click Save.

Step 12

Enter the values for IP address, Gateway IP address, LAG/Port Number, and Subnet Mask (in bits) for each SSID.

Table 22. Enterprise Wireless Controller Settings

Field	Value
SSID Name	lab3employee
Interface Name	employee
VLAN ID	160
IP Address	10.4.160.2
Gateway IP Address	10.4.160.1
LAG/Port Number	1
Subnet Mask (in bits)	24
SSID Name	lab3guest
Interface Name	Guest-dmz
VLAN ID	125
IP Address	10.4.125.2
Gateway IP Address	10.4.125.1
LAG/Port Number	1
Subnet Mask (in bits)	24

Note

The guest-dmz interface is defined on the enterprise foreign wireless controller. When the anchor tunnel is up between the enterprise foreign wireless controller and the guest anchor wireless controller, guest wireless traffic is automatically terminated on the guest-dmz interface of the guest anchor wireless controller. However, if the anchor tunnel is down, guest wireless traffic is terminated on the guest-dmz interface of the enterprise foreign wireless controller. It is a best practice to specify an isolated Layer 2 VLAN for the guest-dmz interface on the enterprise foreign wireless controller, with no DHCP server to supply IP addresses to guest wireless devices. By doing so, if the anchor tunnel is down, guest wireless devices are isolated to a Layer 2 subnet with no network access.

Step 13

Click Next.

Step 14

Click Next.

Step 15

Click Deploy to deploy the configuration to the Catalyst 9800-40 Wireless Controller HA SSO pair (C9800-40-CVD.cagelab.local). A slide-in pane is displayed, asking if you wish to deploy the configuration now or schedule the configuration for later.

Step 16

Click the Now radio button and click Apply to apply the configuration. You will be redirected to the Inventory window in Provisioning. The provisioning status of the device will temporarily show Provisioning, but the status should change to Success after a few minutes. Click See Details below the provisioning status of the device for more information.

Cisco DNA Center will dynamically create two new WLAN profiles within the Catalyst 9800-40 enterprise Wireless Controller HA SSO pair (C9800-40-CVD.cagelab.local). Each WLAN profile has a dynamically generated name based on the SSID name specified in the corporate wireless profile. The following table shows the names of the WLAN profiles and their respective SSIDs, automatically generated by Cisco DNA Center during the provisioning of C9800-40-CVD.cagelab.local for this deployment guide.

Table 23. WLAN Profiles Dynamically Generated by Cisco DNA Center

WLAN Profile Name	SSID	WLAN ID
lab3guest_profile	lab3guest	17
lab3employee_profile	lab3employee	18

Note	It is best practice to create a custom profile for a site and create policy tags with user configured profile names to make the cross-verification process easier on the wireless controller. If default profiles are used, Cisco DNA Center will prefix the name with SSID.

An example of the WLAN configuration, as seen from the web-based GUI of C9800-40-CVD.cagelab.local is shown in the following figure.

The WLAN IDs corresponding to the two SSIDs, lab3guest and lab3employee, are 17 and 18, respectively. When APs are assigned the policy tag default-policy-tag, APs joined to Cisco Catalyst 9800 Series Wireless Controller will broadcast SSIDs of WLANs with IDs from 1 to 16. In order to avoid creating WLAN IDs which are broadcast with the default-policy-tag, Cisco DNA Center creates WLANs and SSIDs starting with a WLAN ID of 17 and higher.

During provisioning, Cisco DNA Center also creates two new policy profiles within the C9800-40-CVD.cagelab.local. The names of the new policy profiles match the names of the created WLAN profiles. An example of the configuration, as seen from the web-based GUI of C9800-40-CVD.cagelab.local is shown in the following figure.

At this point in the provisioning process, the policy profiles and the WLAN profiles are not mapped to any policy tag that has been applied to any AP.

Step 1

From the top-left corner, click the menu icon and choose Provision > Inventory.

Step 2

Locate and check the check box for C9800-CL-CVD.cagelab.local.

Step 3

From the Actions drop-down list, choose Provision > Provision Device.

Step 4

In the Assign Site window, click Choose a Site.

Step 5

Expand the site hierarchy for Milpitas and select Building 23.

Note

The guest wireless controller (C9800-CL-CVD.cagelab.local) must be assigned to a building or floor in the Cisco DNA Center site hierarchy. The controller cannot be assigned to Milpitas or to the global level of the site hierarchy, even though C9800-CL-CVD.cagelab.local is assigned to Building 23 in this deployment guide. APs located on floors in other buildings are supported by the wireless controller.

Step 6

Click Save to assign C9800-CL-CVD.cagelab.local to Building 23.

Step 7

Click Next.

Step 8

In the Configuration window, choose Guest Anchor for the wireless controller Role.

Step 9

Click Select Primary Managed AP locations.

For this deployment guide, the guest anchor wireless controller (C9800-Flex-CVD.cagelab.local) will manage APs on Floor 1, Floor 2, and Floor 3 in building branch5.

Step 10

Expand the site hierarchy and choose the desired sites within the site hierarchy.

Step 11

Click Save.

Step 12

Enter the values for IP address, Gateway IP address, LAG/Port Number, and Subnet Mask (in bits) for the SSID. The following table shows the values entered for this deployment guide.

Step 13

Click Next.

Step 14

Click Next.

The Summary window is displayed.

Step 15

Click Next in the device provisioning workflow.

Step 16

Click Next in the device provisioning workflow.

Step 17

You can expand each section to see the details of the configuration, which is based on the corporate wireless profile created in the Design the wireless network section of this deployment guide.

Step 18

Click Next to deploy the configuration to C9800-CL-CVD. A slide-in pane is displayed, asking if you want to deploy the configuration now or schedule the configuration for later.

Step 19

Click the Now radio button, and click Apply to apply the configuration. You will be redirected back to the Inventory window within Provisioning. The provisioning status of the device will temporarily show Provisioning, but the status will change to Success after a few minutes. Click See Details below the provisioning status of the device for more information.