Interpret the wireless LAN GUI configuration for client connectivity, such as WLAN creation, security settings, QoS profiles, and advanced settings

Objective 2.9 (and its sibling 5.10) expects you to look at screenshots of a Cisco WLC’s web interface and understand what each setting does. The screenshots almost always come from the classic AireOS controller GUI (the 3504, 5520, 8540 series), though the newer Catalyst 9800 GUI is increasingly used. This section walks through creating a WLAN in the AireOS GUI, then notes where the same settings live on the 9800.

Concepts first: WLAN, SSID, and interfaces

On a WLC a WLAN is a configuration object that ties together:

• an SSID, the network name that clients see (up to 32 characters);
• a profile name, an internal label for the WLAN (does not need to match the SSID; often used to describe its purpose);
• a WLAN ID, a number from 1 to 512 (AireOS) that identifies the WLAN internally. WLAN IDs 1 to 16 are special: they are automatically pushed to every AP in the default AP group; higher IDs must be assigned via AP groups;
• an interface (a dynamic interface, which maps to a VLAN) where client traffic from that SSID is placed;
• a security policy, a QoS policy, and a set of advanced options.

A single WLC can host up to 512 WLANs, but each AP radio can advertise at most 16 SSIDs. Every extra SSID costs airtime for beacons, so real designs use three or four (corporate, guest, IoT, voice).

Before creating a WLAN you normally create the dynamic interface it will use: Controller > Interfaces > New, give it a name (employee), a VLAN ID (110), then set its IP address, mask, gateway, and DHCP server. Any WLAN can then map to employee, and clients on that WLAN get addresses in VLAN 110.

Creating a WLAN: the General tab

Navigate to WLANs in the top menu. The list shows existing WLANs with their ID, profile name, SSID, status, and security policy. Choose Create New from the drop-down and click Go. You are asked for:

• Type: WLAN (the normal choice; other options exist for guest LAN and remote LAN).
• Profile Name: for example CORP-EMPLOYEE.
• SSID: for example CorpWiFi. The GUI prefills it with the profile name; change it if they should differ.
• ID: pick the next free number.

Click Apply, and the WLAN’s edit page opens with four tabs: General, Security, QoS, and Advanced.

The General tab contains:

The two most tested items here are Status (a WLAN that clients cannot see is usually simply not enabled) and Interface (a WLAN mapped to the wrong interface puts clients in the wrong VLAN and they get the wrong DHCP scope or none at all).

The Security tab

The Security tab has three sub-tabs.

Layer 2 controls how the wireless link itself is secured. The Layer 2 Security drop-down offers:

Choosing WPA+WPA2 reveals WPA2 Policy and WPA2 Encryption (tick AES; TKIP is deprecated) and the Authentication Key Management section where you pick 802.1X (enterprise; a RADIUS server checks each user’s credentials) or PSK (personal; everyone shares one pre-shared key, entered in the box as ASCII or hex). Other options in that section include CCKM and FT (802.11r fast transition) for roaming, and MAC Filtering for MAC-address-based access. WPA3 is covered in Domain 5.

Layer 3 controls what happens after the wireless link is up but before the client gets network access. The main option is Web Policy, which enables web authentication: the client is redirected to a captive portal page (served from the WLC’s virtual interface address) and must enter credentials or accept terms. Guest networks use Layer 2 None with Layer 3 Web Policy. Options include Authentication, Passthrough (accept a banner), and Conditional or Splash Page Web Redirect.

AAA Servers lets you select which RADIUS servers (defined under Security

AAA > RADIUS) authenticate and account for this specific WLAN, overriding the global server list. This is where an 802.1X WLAN is pointed at Cisco ISE.

The QoS tab

Wireless is a shared medium, and the WLC can give some traffic priority. The QoS tab’s Quality of Service (QoS) drop-down chooses one of four profiles, named after metals, each capping the 802.11e/WMM user priority a client may use and mapping to a DSCP marking on the wired side:

The profile sets the ceiling for that WLAN: a client on a Bronze WLAN cannot mark its traffic as voice and jump the queue. Real voice WLANs use Platinum; guest WLANs use Bronze. The QoS tab also has WMM Policy (Disabled, Allowed, Required; WMM is the Wi-Fi Multimedia standard that enables the priority queues, and it must be Allowed or Required for 802.11n/ac data rates), the Application Visibility switch (Cisco AVC, which recognizes applications in the traffic), and per-user and per-SSID bandwidth contracts (rate limits in kbps for downstream and upstream).

The Advanced tab

The Advanced tab is a long page of check boxes. The ones the exam tends to reference:

Two of these deserve extra attention. AAA Override is the one that makes “one SSID, many VLANs” work: with it on, the RADIUS server can tell the WLC “this user belongs in VLAN 120” and the WLC places the client there regardless of the WLAN’s configured interface. Client Exclusion is the wireless equivalent of a lockout policy; the global exclusion policies (under Security > Wireless Protection Policies > Client Exclusion Policies) define what triggers it, such as excessive 802.11 association failures, excessive 802.1X authentication failures, IP theft, or excessive web authentication failures; the per-WLAN timeout (default 60 seconds) defines how long the client is banned.

Verifying client connectivity in the GUI

After the WLAN is enabled, the Monitor > Clients page lists every associated client with its MAC, IP address, AP name, WLAN, protocol, and status. Clicking a client shows its detail page: the security policy it negotiated, its VLAN, the RSSI/SNR (signal strength) values, and data rate. Monitor > Summary shows counts of APs and clients, and Wireless > Access Points lists each AP with its mode, IP, and operational status. A client stuck in the DHCP_REQD state has associated and authenticated but has not received an IP address, which points at the interface/VLAN mapping or the DHCP server, not at the wireless settings.

The same settings on a Catalyst 9800

On the IOS-XE-based Catalyst 9800 WLC the GUI is organized around profiles and tags rather than a single WLAN page:

• Configuration > Tags & Profiles > WLANs: the WLAN profile holds the SSID, WLAN ID, status, radio policy, and the Layer 2/Layer 3 security settings and AAA server selection.
• Configuration > Tags & Profiles > Policy: the policy profile holds the VLAN, QoS policy, session timeout, client exclusion, AAA override, and most of what AireOS puts under Advanced.
• A Policy Tag binds a WLAN profile to a policy profile, and the tag is applied to APs, which is how you control which APs broadcast which SSIDs.

The concepts and even the field names are the same; only the navigation differs. The exam objective says “interpret,” so focus on knowing what each field means, not the exact click path.