How to do VLAN mapping per Flex Profile on a 9800 WLC

[tlarsen]

Hi,

I have a Flex Connect design on a new 9800 WLC.

I would like to know if I can have a different VLAN ID per SSID like the AireOS FlexConnect Group - WLAN VLAN mapping.

In my design the Flex Profile is equal to a Branch Office. So I would like to configure the following:

Branch Office A SSID X VLAN ID 1 

Branch Office B SSID X VLAN ID 2

Is that possible?

[balaji.bandi]

Look at the below document :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html

[tlarsen]

Hi,

I know that document:)

But i think that it's the Policy Profile that should be considered as a VLAN. And then when you do the Policy Tag (Branch Office) you map the WLAN to the Policy Profile (VLAN10). So if you need another Branch Offices with the same WLAN but a different VLAN you just do a new Policy Tag (new Branch Office) with a different Policy Tag (VLAN20) with the new VLAN.

Is that how you have different VLAN for the same WLAN?

Best regards

[Scott Fella · Accepted solution]

That is exactly how you have to do it if you vlan id’s are not consistent. Each branch should have its own site tag also as best practice. 

[Calin Cristea]

Hi Scott, i have the same problem. If i create 2 policies, how can i map the two Policy Tag to the same Access Point?

I want a SSID to be mapped to two vlans.

[Rich R]

> If i create 2 policies, how can i map the two Policy Tag to the same Access Point?
> I want a SSID to be mapped to two vlans.

@Calin Cristea you can't. 

Having an SSID mapped to 2 VLANs is called VLAN groups and can only be used for centrally switched SSIDs not for flexconnect local switching:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_conf_vlan_grp_vewlc.html

An AP can only have 1 policy tag.  See the links I provided in this answer yesterday to better understand the config structure on 9800:
https://community.cisco.com/t5/wireless/9800-wlc-same-vlans-on-multiple-sites-in-sd-wan-setup/m-p/5076587#M270636

[MHM Cisco World]

...

[Rich R]

..

[JPavonM]

I'm using a complete different approach to this scenario.

I create a unique Policy Profile setting the VLAN to a common name, let's say "corpvlan01".

Then the only thing that changes accross different sites is the Flex profile. On every Flex profile that is used for all APs under the same tag site, I map the previously created "corpvlan01" on the Policy profile to the site's VLAN Id.

This way you have a bunch of Policy profiles, but different Site Tags per site associated to every Flex Profile for that site.

Let me illustrate this with an example:

wireless profile policy LOCAL-CORP-TEST
 no central association
 no central dhcp
 no central switching
 description "Corp SSID locally switched"
 exclusionlist timeout 180
 idle-timeout 150
 ipv4 dhcp required
 session-timeout 300
 vlan corpvlan01
 no shutdown
!
wireless profile flex JESUSP-FLEX
 no arp-caching
 no local-auth ap radius
 native-vlan-id 666
 vlan-name corpvlan01
  vlan-id 13
!
wireless tag site JESUSP-SITE
 ap-profile ESMDR
 description ES,Madrid,JPavon,SoHo
 fabric control-plane default-control-plane
 flex-profile JESUSP-FLEX
 no local-site

HTH

-Jesus

[Scott Fella]

There are different way's to skin the cat, but at the end, depending on your end result, you should look at what works best for your implementation so that it's easy for changes and easy to troubleshoot.  Same issue with AireOS, you can make FlexConnect a nightmare with too many different configurations, or simplify it as much as possible.  Using different vlan id's becomes a nightmare to folks troubleshooting in my opinion and I would change that first.

[Rich R]

Agreed with Scott - better to use the same vlan at every site in my opinion.

[MHM Cisco World]

..