Mac Deryng

WN Blog 006 – Cisco Catalyst 9800 – Deployment with VMware ESXi

If you are geeky, crazy or just curious to try out first generation of Cisco products, new Catalyst 9800 Wireless LAN Controller, this guide might be useful to you 🙂

Jokes aside, C9800 feels like a solid product that is quickly gaining trust of wifi pros and gains traction in the enterprises.

It is a spiritual successor to Cisco AireOS WLCs that sits on the well known IOS-XE that everyone knows and loves :] Thankfully, it has nothing to do with Converged Access, that also was IOS-XE based.

C9800 code was re-written from scratch and offers almost full features parity with its AireOS counterpart.

It’s quite flexible too, meaning you can install it in a private cloud (VMware etc.) public cloud or use it as an on-prem appliance sitting on a switch or a standalone box. All versions offer exact same functionality (with some obvious limitations, like no central data switching when used in public cloud), so you really just need to decide what’s easiest for you to deploy and integrate and think about scale.

I thought that creating an with easy-to-follow ESXi installation steps guide would be a great start!

First of all, here is my lab environment:

Lab Environment

And installation steps below:

1. Download the WLC image

  • At the time of updating this post Gibraltar-16.11.1c(ED) is the latest TAC recommended version

2. Prepare VMware networking

  • C9800-CL requires 3 interfaces – make sure to have all the required VLANs / subnets ready!
    • OOB Mgmt. – not used in Cloud (VM) WLC version, but must be assigned to a vSwitch to bring the interface up
    • Mgmt. – used to manage the WLC and for APs registration. We’re using ESXi 6.0 here, so we have to enable either all 4095 VLANs (trunk) or just one specific VLAN (access). In newer ESXi versions it is possible to allow just selected VLANs on the VMware Distributed Switch trunk. So here we’ll allow all VLANs.
    • HA (L2) – used for HA/SSO and must be configured even when used in a standalone deployment
      • It is important to put C9800 interface that we intend to use as a Redundancy Port L2 HA inter-vWLC link into a seperate, unused VLAN! Note that ‘LAB-VM-L2-HA’ Port Group sits in VLAN 666. Only my two vWLCs’ HA RP ports will be put into that group.
ESXi vSwitches Configuration

3. Spin the OVA file

  • Choose the right size (I used smallest – 1k APs)
VM Size

4. Map WLC interfaces to VM networking

  • WLC Gigabit 1 -> OOB
  • WLC Gigabit 2 -> Mgmt.
  • WLC Gigabit 3 -> HA between WLC VMs
WLC to OVF Template Network Mapping

5. Set correct security parameters on the WLC Trunk interface

  • Promiscuous mode must be set to accept, otherwise tagged traffic won’t flow correctly! This step is easy to miss but it’s very important – WLC won’t pass traffic without ticking it 🙂 The C9800 uses multiple MAC address on the same VM, e.g. may be used by the SVI for wireless management (if bridge for centralised clients) or other SVI’s for loopback, etc., all of which will use different MAC address other that the one assigned to the vNIC of the VM.
  • Forged Transmits must also be set to accept, as having Forged Transmits set to reject will result in no connectivity due to host verifying the source MAC address which is transmitted by guest OS to match with the MAC address of the VM adapter. As this won’t match for C9800 instance, the ESXi host would drop the packet.
VM Trunk Promiscuous Mode and Forged Transmits

6. Boot the WLC using Virtual Console

The system will install, reboot, check if bootloader upgrade is needed, apply the config (empty at this point), etc. After few minutes, we should be presented with a familiar CLI.

Boot using Virtual Console

7. Terminate the configuration wizard

  • Would you like to enter the initial configuration dialog? [yes/no]: no
  • Would you like to terminate autoinstall? [yes]: yes

8. Set a host name

  • WLC> en
  • WLC# conf t
  • WLC(config)# hostname LAB-C9800CL

9. Add login credentials

  • LAB-C9800CL(config)# username admin privilege 15 secret <secret>

10. Configure the VLAN for wireless management interface

  • LAB-C9800CL(config)# vlan 11
  • LAB-C9800CL(config-vlan)# name wireless_management

11. Configure the SVI for wireless management interface

  • LAB-C9800CL(config)# interface vlan 11
  • LAB-C9800CL(config-if)# ip address
  • LAB-C9800CL(config-if)# no shut

12. Configure management interface

Note: since G1 is OOB, G2 is Mgmt. And G3 is HA in this VM, we’ll first configure G2 to access management plane of the WLC. All SSIDs I’m planning to use will leverage FlexConnect Local Switching (dropping data plane directly onto the switch on the AP level), therefore we don’t need to allow any other VLANs than 11 on this trunk. Still, we might want to test Central Switching, so let’s allow Wireless Users VLAN 20 (configured in later blogs) too:

  • LAB-C9800CL(config-if)# interface GigabitEthernet2
  • LAB-C9800CL(config-if)# switchport mode trunk
  • LAB-C9800CL(config-if)# switchport trunk allowed vlan 11,20
  • LAB-C9800CL(config-if)# no shut

13. Configure a default route (or a more specific route) to reach the device

  • LAB-C9800CL(config)# ip route

At this point WLC9800 Mgmt. interface should be pingable 🙂

Note: you might need to shut / no shut int g2 and shut / no shut int vlan 11 for the SVI to come up!

14. Configure country code

Note: wireless network needs to be disabled first. Country code configuration forces GUI to skip the DAY 0 flow as the C9800 needs a country code to be operational. You can enter up to a maximum of 20 countries.

  • LAB-C9800CL(config)# ap dot11 5ghz shutdown
    • Disabling the 802.11a network may strand mesh APs.
  • Are you sure you want to continue? (y/n)[y]: y
  • LAB-C9800CL(config)# ap dot11 24ghz shutdown
    • Disabling the 802.11b network may strand mesh APs.
  • Are you sure you want to continue? (y/n)[y]: y
  • LAB-C9800CL(config)# ap country GB
    • Changing country code could reset channel and RRM grouping configuration. If running in RRM One-Time mode, reassign channels after this command. Check customized APs for valid channel values after this command.
  • Are you sure you want to continue? (y/n)[y]: y

Don’t forget to re-enable the radios 🙂

  • LAB-C9800CL(config)# no ap dot11 5ghz shutdown
  • LAB-C9800CL(config)# no ap dot11 24ghz shutdown

Finally, validate all is up and happy:

  • LAB-C9800CL# show ap dot11 5ghz summary
  • LAB-C9800CL# show ap dot11 24ghz summary
Validate Radios Operational State

15. Create a certificate for the AP to join the virtual controller

Note: you must specify the interface for the wireless management, create certificate and verify certificate installation. If you skip the certificate/trustpoint configuration, APs will not be able to join. However, you can go to the GUI and configure it by importing the desired certificate.

  • LAB-C9800CL(config)# wireless management interface vlan 11
  • LAB-C9800CL(config)# exit
  • LAB-C9800CL# wireless config vwlc-ssc key-size 2048 signature-algo sha256 password 0 <pwd>
  • LAB-C9800CL# show wireless management trustpoint

At this point, it should be possible to access the WLC via GUI using HTTPS, IP set in step 9 and credentials set in step 7!

SSH will not work yet as the lines are not yet configured.

Credentials have already been set, so we can jump straight into the stuff that’s needed to make SSH work!

Domain name is needed for RSA key generation process.

We’ll also need to specify enable password to allow us to use privileged mode.

16. Configure access via SSH

  • LAB-C9800CL(config)# enable secret <secret>
  • LAB-C9800CL(config)# aaa new-model
  • LAB-C9800CL(config)# ip domain-name <domain-name>
  • LAB-C9800CL(config)# crypto key generate rsa general-keys modulus 1024
  • LAB-C9800CL(config)# line vty 0 530
  • LAB-C9800CL(config-line)# privilege level 15
  • LAB-C9800CL(config-line)# transport input ssh

Voilà! We are now ready to register our first AP to the new, shiny and sexy WLC 😀 Well done!

WN Blog 004 – Modulation & Encoding Techniques

Hey! In this short blog post we’ll share our notes about older modulation techniques used in WiFi (up to OFDM and 256 QAM).

To learn more about OFDMA and 1024 QAM (both used in WiFi 6), see our other blog post about 802.11ax here:

Modulation Summary

  • How to use wireless waves’ physical attributes like amplitude and phase to represent binary data and send it over a wireless medium
  • 802.11 Tx signals must use physical filters to limit the signals sent away from the main target frequency:
  • Radio and attached antenna is called radio chain
  • Possible ways of modulating the waveform:
    • Amplitude – uses strength of the signal to modulate it with power (AM)
    • Phase – timing of the signal between peaks
    • Frequency – how often the signal repeats in one second (Hz, MHz, GHz)
PPDU Sensitivity Required to Use Modulation Techniques

DSSS Chip Sequence

  • DSSS – Direct-Sequence Spread Spectrum
  • Each bit is transformed into sequence, called ‘chip’ or ‘symbol’
  • DSSS sends a single data bit as a string of chips
  • Barker 11 was one of the first encoding methods
    • 1=01001000111
    • 0=10110111000
    • Sending ‘1’ or ‘0’ is represented by 11 ‘chips’
    • 11 ‘chips’ is called a ‘symbol’
    • By expanding original data in this way; with some signal lost due to noise; the original data can still be understood
    • Each bit takes 2MHz of frequency width, sending 11 in parallel takes 22 MHz
    • Supports 1, 2, 5.5 and 11 Mbps data rates
  • Round at the top in spectrum analyzer

DBPSK / DQPSK Modulation

  • DBPSK – Differential Binary Phase Phase Shift Keying
    • alter the signal phase by 180 degrees
    • max 1Mbps
    • ‘0’ – no change in direction
    • ‘1’ – change in direction
BPSK Modulation
  • DQPSK – Differential Quadrature Phase Phase Shift Keying
    • alter the signal phase by 90 degrees in four quadrants
    • max 2Mbps
    • Each ‘chip’ represents 2 bits instead of one as in PSK (hence twice as quick)
QPSK Modulation

CCK Encoding

  • Complimentary Code Keying
  • Code word (wave shape) represents a symbol
  • 2 bits used to check consistency
  • Still uses one 22MHz wide wave
  • CCK 4 – coding 4 bits per symbol (in a 6-bit chip) gave 5.5 Mbps
  • CCK 8 – coding 8 bits per symbol (in a 6-bit chip) gave 11 Mbps
  • CCK loses some of the extra bits used by Barker code to recover information received in a noisy or low SNR environment
    • CCK achieves faster data rates at the expense of requiring a stronger, less noisy signal
PSK Rates with Different Encoding


OFDM Dividing Channel into 64 Tones (Subcarriers)
  • Orthogonal Frequency-Division Multiplexing
  • Alternative to DSSS
  • Square at the top in spectrum analyzer
  • Instead of sending one wide combo-channel transmission, frequencies are broken up into sub-channels (called sub-carriers or tones)
  • Using a 20 MHz wide spectrum, each sub-carrier is 312.5 KHz apart from one another
    • 64 waves (tones / sub-carriers), 312.5 KHz apart
      • 12 ‘Guard’ subcarriers are – used to help set one channel apart from another and to help receivers lock onto the channel
        • 6 head and 5 trail have no power / not used (isolate neighbouring channels)
        • 1 in the middle have no power / not used (identify centre of the signal)
      • 4 ‘Pilot’ subcarriers  – equally spaced and always transmitted to help receivers evaluate the noise state of the channel
      • 48 ‘Data’ subcarriers – devoted to carrying data
        • Each data subcarrier can ‘carry’ 1125 kbps
  • To differentiate between the small sub-carriers, adjacent sub-carriers will have 90 degree changed polarization
  • Data is sent simultaneously over subcarriers in parallel
  • Some of the subcarriers are used to protect/guard against interference and control the signal as a whole
  • Inside OFDM, each tone can use BPSK or QPSK
    • BPSK – allows 250 kbps per tone (250 x 48 = 12 000 kbps = 12 Mbps per OFDM wave)
    • QPSK – allows 500 kbps per tone (500 x 48 = 24 000 kbps = 24 Mbps per OFDM wave)
    • No Barker 11 coding used, repeating allowed
    • Depending on the percentage of repeated signals, total throughput is:
      • BPSK – 9 Mbps (25% repeat) or 6 Mbps (50% repeat)
      • QPSK – 18 Mbps (25% repeat) or 9 Mbps (50% repeat)
  • Used in 802.11 a/g/n/ac

QAM – Quadrature Amplitude Modulation (freaking brilliant!)

  • To go faster than 18 Mbps, OFDM uses another technique, called QAM
  • Uses 90 degrees phase shifts like QPSK, but now combines that with Amplitude Modulation (or changing the amplitude) to accomplish more possible differentiations of simultaneous transmission
  • So then with the 4 ‘quads’, depending on how many differing amplitudes are varied will determine how many signals can be sent and therefore how much additional data can be realized
  • 16-QAM (4^2) used in 802.11a/g/n
  • 64-QAM (4^3) used in 802.11a/g/n
  • 256-QAM (4^4) used in 802.11ac
  • EVM (Error Vector Magnitude) used for improved reliability
    • if you miss the spot, vector length from the centre of expected spot is measured and used to decide what you wanted to hit
  • Denser QAM requires better (quieter) environment, noise can prevent the signal from being understood
  • With more noise introduced, signal will have to downgrade
  • With more advanced QAM modulation (16 > 64 > 256 > 1024), it is more and more challenging to ‘hit’ the right spot to code the right data, therefore more SNR is required to decode it correctly

See some graphical representations of QAM below!

16-QAM Representation 1
16-QAM Representation 2
64-QAM Representation 1
QAM – Bits per Symbol

Now, try to imagine how much more complexity would using 1024-QAM modulation bring!