WLC WLAN Commands

Synopsis

netapi wlc get-wlans
netapi wlc create-wlan <PROFILE> --id <ID> [OPTIONS]

Commands

get-wlans

List all configured WLANs.

netapi wlc get-wlans
Sample Output
ID   Profile                   SSID                      Status
--------------------------------------------------------------------
1    HomeRF                    HomeRF                    Enabled
2    IoT_Net                   IoT_Net                   Enabled
3    Guest_Net                 Guest_Net                 Enabled
4    Domus-Secure              Domus-Secure              Enabled

create-wlan

Create a new WLAN profile.

netapi wlc create-wlan <PROFILE> --id <ID> [OPTIONS]

Options

Option Default Description

--id, -i

Required

WLAN ID (1-512)

--ssid, -s

Profile name

SSID broadcast name

--security, -S

wpa2-psk

Security type: open, wpa2-psk, wpa3-psk, dot1x

--psk, -p

-

Pre-shared key (for PSK security types)

--auth-list, -a

-

Authentication method list (for dot1x)

--mac-filtering, -m

-

MAC filtering list for iPSK (e.g., ISE-AuthZ)

--enabled/--disabled

--disabled

Enable WLAN after creation

--save

False

Save configuration after creation

Examples

Basic WPA2-PSK WLAN
netapi wlc create-wlan Guest-Network --id 10 \
    --security wpa2-psk \
    --psk "GuestPass2026!" \
    --enabled --save
802.1X Enterprise WLAN
netapi wlc create-wlan Corp-Secure --id 1 \
    --security dot1x \
    --auth-list ISE-AUTH \
    --enabled --save
iPSK WLAN with MAC Filtering
netapi wlc create-wlan DOMUS_IoT --id 5 \
    --security wpa2-psk \
    --psk "FallbackPSK2026!" \
    --mac-filtering ISE-AuthZ \
    --enabled --save

iPSK (Identity PSK) Deployment

iPSK enables per-device pre-shared keys via RADIUS MAC authentication. Each device gets a unique PSK stored in the iPSK Manager database, providing device-level authentication without requiring 802.1X infrastructure on the endpoint.

Architecture

Device (MAC: AA:BB:CC:DD:EE:FF)
    |
    | 1. Associates to WLAN with fallback PSK
    v
WLC (MAC-Filtering enabled)
    |
    | 2. RADIUS Access-Request (MAC as username)
    v
ISE (Policy Set: IoT WIFI iPSK)
    |
    | 3. ODBC lookup to iPSK-Manager
    v
iPSK-Manager MySQL Database
    |
    | 4. Returns: Cisco-AVPair = "psk=<device-specific-psk>"
    v
WLC
    |
    | 5. Client re-authenticates with device-specific PSK
    v
Device (Connected with unique PSK)

Step-by-Step: Deploy DOMUS_IoT WLAN

1. Create WLAN on WLC

# Create the WLAN with MAC filtering
netapi wlc create-wlan DOMUS_IoT --id 5 \
    --security wpa2-psk \
    --psk "IoTFallback2026!" \
    --mac-filtering ISE-AuthZ \
    --enabled --save

2. Create Policy Profile

# Create policy profile with AAA override for VLAN assignment
netapi wlc create-policy-profile POLICY-DOMUS_IoT \
    --vlan 40 \
    --aaa-override \
    --save

3. Verify ISE Policy Set

# Check IoT WIFI iPSK policy set exists
netapi ise get-policy-sets | grep -i iot

# Check authorization profile exists
netapi ise get-authz-profile Domus_IoT_Profile

4. Add Device to iPSK-Manager

Via web portal (recommended):

  1. Navigate to ipsk-manager.inside.domusdigitalis.dev

  2. Add new endpoint with MAC address

  3. Assign to appropriate endpoint group

  4. PSK is auto-generated or manually set

Via MySQL direct:

# SSH to iPSK Manager
ssh ipsk-manager.inside.domusdigitalis.dev

# Add device
MAC="9C:83:06:CE:89:46"
NAME="Evan_Samsung"
PSK="DevicePSK2026!"
sudo mysql ipsk -e "
  INSERT INTO endpoints (macAddress, password, pskValue, fullName, accountEnabled, createdDate)
  VALUES ('$MAC', LOWER(REPLACE('$MAC',':','')), '$PSK', '$NAME', 1, NOW());
"

5. Verify Authentication

# Check auth history after device connects
netapi ise dc auth-history 9C:83:06:CE:89:46 --hours 1

# Check active session
netapi ise mnt session 9C:83:06:CE:89:46

ISE Configuration Requirements

For iPSK to work, ISE needs:

  1. ODBC Identity Source: iPSKManager configured with MySQL connection

  2. Policy Set: Matching Called-Station-ID endsWith <SSID>

  3. Authentication Rule: Using iPSKManager ODBC as identity source

  4. Authorization Profile: With VLAN and dACL assignments

ISE Policy Set Condition

# Update policy set to include new SSID
# Condition: Called-Station-ID endsWith "DOMUS_IoT"
netapi ise get-policy-sets

See Also