WLC Configuration for VyOS Integration

ssh 9800-wlc-01.inside.domusdigitalis.dev "show running-config" > /tmp/wlc-lab-config-$(date +%Y%m%d).txt

interface GigabitEthernet1
 switchport trunk native vlan 100
 switchport trunk allowed vlan 10,30,40,100
 switchport mode trunk
 negotiation auto
!
interface Vlan100
 ip address 10.50.1.40 255.255.255.0
 no ip proxy-arp
!
ip route 0.0.0.0 0.0.0.0 10.50.1.1

ssh 9800-wlc-01.inside.domusdigitalis.dev "show wlan summary"

ssh 9800-wlc-01.inside.domusdigitalis.dev "show wireless profile policy summary"

ssh 9800-wlc-01.inside.domusdigitalis.dev "show wireless tag policy summary"

ssh 9800-wlc-01.inside.domusdigitalis.dev "show aaa servers"

aaa group server radius ISE-GROUP
 server name ISE-1
 server name ISE-2
 ip radius source-interface Vlan100
 deadtime 5
 mac-delimiter hyphen
!
aaa authentication dot1x ISE-Auth group ISE-GROUP
aaa authorization network ISE-AuthZ group ISE-GROUP
aaa accounting identity ISE-ACCT start-stop group ISE-GROUP
aaa accounting network ISE-Acct start-stop group ISE-GROUP
!
aaa server radius dynamic-author
 client 10.50.1.20 server-key <RADIUS_KEY>

ssh 9800-wlc-01.inside.domusdigitalis.dev "show ap summary"

ssh 9800-wlc-01.inside.domusdigitalis.dev "show crypto pki certificates"

ssh 9800-wlc-01.inside.domusdigitalis.dev "show wireless profile rf summary"

configure terminal
interface GigabitEthernet1
 switchport trunk allowed vlan add 20,999
end
write memory

ssh 9800-wlc-01.inside.domusdigitalis.dev "show interfaces trunk"

configure terminal
!
! Remove stale tags with deleted WLAN references
no wireless tag policy HomeRF-Tag
no wireless tag policy IoT-Tag
!
end
write memory

configure terminal
!
wireless tag policy TAG-DOMUS-Home
 wlan DOMUS-Secure policy POLICY-DOMUS-Secure
 wlan DOMUS-IoT policy POLICY-DOMUS-IoT
 wlan DOMUS-Guest policy POLICY-DOMUS-Guest
!
end

configure terminal
!
ap 78bc.1a36.82c0
 policy-tag TAG-DOMUS-Home
!
end
write memory

ssh 9800-wlc-01.inside.domusdigitalis.dev "show ap tag summary"

configure terminal
aaa server radius dynamic-author
 client 10.50.1.21 server-key <RADIUS_KEY>
end
write memory

vlan 666
 name Native
! Native VLAN (unused, shutdown)

! CAPWAP from APs to WLC (within INFRA zone)
set firewall name INFRA-TO-INFRA rule 100 description "CAPWAP Control"
set firewall name INFRA-TO-INFRA rule 100 destination port 5246
set firewall name INFRA-TO-INFRA rule 100 protocol udp
set firewall name INFRA-TO-INFRA rule 100 action accept

set firewall name INFRA-TO-INFRA rule 101 description "CAPWAP Data"
set firewall name INFRA-TO-INFRA rule 101 destination port 5247
set firewall name INFRA-TO-INFRA rule 101 protocol udp
set firewall name INFRA-TO-INFRA rule 101 action accept

! SSO between WLC-01 and WLC-02
set firewall name INFRA-TO-INFRA rule 110 description "WLC SSO TCP"
set firewall name INFRA-TO-INFRA rule 110 destination port 9800
set firewall name INFRA-TO-INFRA rule 110 protocol tcp
set firewall name INFRA-TO-INFRA rule 110 action accept

set firewall name INFRA-TO-INFRA rule 111 description "WLC SSO UDP"
set firewall name INFRA-TO-INFRA rule 111 destination port 9800
set firewall name INFRA-TO-INFRA rule 111 protocol udp
set firewall name INFRA-TO-INFRA rule 111 action accept

! RADIUS from WLC to ISE
set firewall name INFRA-TO-SECURITY rule 100 description "RADIUS Auth"
set firewall name INFRA-TO-SECURITY rule 100 destination port 1812
set firewall name INFRA-TO-SECURITY rule 100 protocol udp
set firewall name INFRA-TO-SECURITY rule 100 action accept

set firewall name INFRA-TO-SECURITY rule 101 description "RADIUS Acct"
set firewall name INFRA-TO-SECURITY rule 101 destination port 1813
set firewall name INFRA-TO-SECURITY rule 101 protocol udp
set firewall name INFRA-TO-SECURITY rule 101 action accept

! CoA from ISE to WLC
set firewall name SECURITY-TO-INFRA rule 100 description "RADIUS CoA"
set firewall name SECURITY-TO-INFRA rule 100 destination port 1700,3799
set firewall name SECURITY-TO-INFRA rule 100 protocol udp
set firewall name SECURITY-TO-INFRA rule 100 action accept

ssh 9800-wlc-01.inside.domusdigitalis.dev "show redundancy"

Redundant System Information :
                 Hardware Mode = Duplex
              Configured Redundancy Mode = sso
              Operating Redundancy Mode = sso

             Current Processor Information :
               Active Location = slot 1
        Current Software state = ACTIVE

             Peer Processor Information :
              Standby Location = slot 2
        Current Software state = STANDBY HOT

ssh 9800-wlc-01.inside.domusdigitalis.dev "show chassis redundancy ha-intf summary"

# From workstation
ping -c3 10.50.1.40
ssh 9800-wlc-01.inside.domusdigitalis.dev "show clock"

ssh 9800-wlc-01.inside.domusdigitalis.dev "show ap summary"

ssh 9800-wlc-01.inside.domusdigitalis.dev "show ap capwap retransmit"

ssh 9800-wlc-01.inside.domusdigitalis.dev "show wireless client summary"

ssh 9800-wlc-01.inside.domusdigitalis.dev "test aaa group ISE-GROUP admin <password> new-code"

ssh 9800-wlc-01.inside.domusdigitalis.dev "show redundancy"
ssh 9800-wlc-01.inside.domusdigitalis.dev "show redundancy config-sync failures"

logging host 10.50.1.134
logging trap informational
logging source-interface GigabitEthernet1

snmp-server community public RO
snmp-server location "Home Enterprise - Wireless"
snmp-server contact "admin@inside.domusdigitalis.dev"

# From WLC
ping 10.50.1.1
ping 10.50.1.20
ping 8.8.8.8

# On VyOS - verify Option 43 configured
show configuration commands | grep vendor-option

# Expected output:
# set service dhcp-server shared-network-name 'DATA' subnet '...' option vendor-option cisco suboption 241 hex-string '0a320128'

# On WLC - Check CAPWAP discovery
debug capwap events enable
debug capwap errors enable

# Check if AP can reach WLC
# (from AP console)
ping 10.50.1.40

wireless profile policy <name>
  ipv4 dhcp required         <-- Problem
  ipv4 dhcp server 10.50.X.1 <-- Problem

# Check policy profile DHCP settings
show wireless profile policy detailed <policy-name> | include dhcp

# Working profile shows:
#   DHCP required: DISABLED
#   server address: 0.0.0.0

# Broken profile shows:
#   DHCP required: ENABLED
#   server address: 10.50.X.1

configure terminal
wireless profile policy <policy-name>
  shutdown
  no ipv4 dhcp required
  no ipv4 dhcp server
  no shutdown
  exit
write memory

# WLC - check client state
show wireless client mac-address <mac> detail | include State|VLAN|IPv4

# VyOS - check DHCP lease appeared
show dhcp server leases pool IOT

# Check RADIUS
test aaa group ISE-RADIUS <user> <password> new-code

# Debug 802.1X
debug dot1x all

# Check sync failures
show redundancy config-sync failures

# Force re-sync
redundancy config-sync bulk