-
Cisco Wireless LAN Controller Command Reference, Release 7.4
-
Preface
-
Using the Command-Line Interface
- System Management Commands
- Ports and Interfaces Commands
- VideoStream Commands
- Security Commands
- WLAN Commands
- Lightweight Access Point Commands
- Mesh Access Point Commands
- Radio Resource Management Commands
- CleanAir Commands
- FlexConnect Commands
- Mobility Commands
-
Index
-
Feedback
CLI Commands
The Cisco Wireless LAN solution command-line interface (CLI) enables operators to connect an ASCII console to the Cisco Wireless LAN Controller and configure the controller and its associated access points.
- show Commands
- config Commands
- Integrated Management Module Commands in Cisco Flex 7500 Series Controllers
- debug Commands
show Commands
show capwap reap association
show capwap reap status
show flexconnect acl detailed
show flexconnect acl summary
show flexconnect group detail
To display the details for a specific FlexConnect group, use the show flexconnect group detail command.
Syntax Description
Examples
This example shows how to display the detailed information for a specific FlexConnect group:
> show flexconnect group detail 192.12.1.2 Number of Ap’s in Group: 1 00:0a:b8:3b:0b:c2 AP1200 Joined Group Radius Auth Servers: Primary Server Index ..................... Disabled Secondary Server Index ................... Disabledshow flexconnect group summary
show flexconnect office-extend
To display FlexConnect OfficeExtend access point information, use the show flexconnect office-extend command.
Syntax Description
Examples
This example shows how to display information about the list of FlexConnect officeExtend access points:
> show flexconnect office-extend summary Summary of OfficeExtend AP AP Name Ethernet MAC Encryption Join-Mode Join-Time ------------------ ----------------- ---------- ----------- ---------- AP1130 00:22:90:e3:37:70 Enabled Latency Sun Jan 4 21:46:07 2009 AP1140 01:40:91:b5:31:70 Enabled Latency Sat Jan 3 19:30:25 2009This example shows how to display the FlexConnect officeExtend access point’s link delay:
> show flexconnect office-extend latency Summary of OfficeExtend AP link latency AP Name Status Current Maximum Minimum -------------------------------------------------------------------------- AP1130 Enabled 15 ms 45 ms 12 ms AP1140 Enabled 14 ms 179 ms 12 msconfig Commands
config ap autoconvert
To automatically convert all access points to a FlexConnect mode or monitor mode upon joining the Cisco WLC, use the config ap autoconvert command.
Syntax Description
flexconnect
Configures all the access points automatically to FlexConnect mode.
Configures all the access points automatically to monitor mode.
Usage Guidelines
When access points in local mode connect to a Cisco 7500 Series Wireless Controller, they do not serve clients. The access point details are available in the controller. To enable access points to serve clients or perform monitoring related tasks when connected to the Cisco 7500 Series Wireless Controller, the access points must be in FlexConnect mode or monitor mode.
config ap flexconnect central-dhcp
To enable central-DHCP on a FlexConnect access point in a WLAN, use the config ap flexconnect central-dhcp command.
config ap flexconnect central-dhcp wlan_id cisco_ap [ add | delete] { enable | disable} override dns { enable | disable} nat-pat { enable | disable}
Syntax Description
wlan_id Wireless LAN identifier from 1 to 512.
cisco_ap Name of the Cisco lightweight access point.
add (Optional) Adds a new WLAN DHCP mapping.
delete (Optional) Deletes a WLAN DHCP mapping.
enable Enables central-DHCP on a FlexConnect access point. When you enable this feature, the DHCP packets received from the access point are centrally switched to the controller and then forwarded to the corresponding VLAN based on the AP and the SSID.
disable Disables central-DHCP on a FlexConnect access point.
override dns Overrides the DNS server address on the interface assigned by the controller. When you override DNS in centrally switched WLANs, the clients get their DNS server IP address from the AP and not from the controller.
enable Enables the Override DNS feature on a FlexConnect access point.
disable Disables the Override DNS feature on a FlexConnect access point.
nat-pat Network Address Translation (NAT) and Port Address Translation (PAT) that you can enable or disable.
enable Enables NAT-PAT on a FlexConnect access point.
disable Deletes NAT-PAT on a FlexConnect access point.
Examples
This example shows how to enable central-DHCP, Override DNS, and NAT-PAT on a FlexConnect access point:
> config ap flexconnect central-dhcp 1 ap1250 enable override dns enable nat-pat enableRelated Commands
config ap flexconnect local-split
config ap flexconnect web-auth wlan
config ap flexconnect web-policy acl
config ap flexconnect radius
config ap flexconnect vlan add
config ap flexconnect vlan native
config ap flexconnect vlan wlan
config ap flexconnect vlan enable
config ap flexconnect vlan disable
config ap flexconnect local-split
To configure a local-split tunnel on a FlexConnect access point, use the config ap flexconnect local-split command.
Syntax Description
wlan_id Wireless LAN identifier between 1 and 512.
cisco_ap Name of the FlexConnect access point.
enable Enables local-split tunnel on a FlexConnect access point.
disable Disables local-split tunnel feature on a FlexConnect access point.
acl Configures a FlexConnect local-split access control list.
acl_name Name of the FlexConnect access control list.
Usage Guidelines
This command allows you to configure a local-split tunnel in a centrally switched WLAN using a FlexConnect acl. A local split tunnel supports only for unicast Layer 4 IP traffic as NAT/PAT does not support multicast IP traffic.
Examples
This example shows how to configure a local-split tunnel using a FlexConnect acl:
> config ap flexconnect local-split 6 AP2 enable acl flex6Related Commands
config ap flexconnect central-dhcp
config ap flexconnect vlan enable
config ap flexconnect web-auth
config ap flexconnect web-policy acl
config ap flexconnect radius
config ap flexconnect vlan add
config ap flexconnect vlan native
config ap flexconnect vlan wlan
config ap flexconnect vlan disable
config ap flexconnect radius auth set
To configure a primary or secondary RADIUS server for a specific FlexConnect access point, use the config ap flexconnect radius auth set command.
Syntax Description
Specifies the primary RADIUS server for a specific FlexConnect access point.
Specifies the secondary RADIUS server for a specific FlexConnect access point.
secret
RADIUS server secret.
config ap flexconnect vlan
To enable or disable VLAN tagging for a FlexConnect access, use the config ap flexconnect vlan command.
Syntax Description
Command Default
Disabled. Once enabled, WLANs enabled for local switching inherit the VLAN assigned at the controller.
config ap flexconnect vlan add
config ap flexconnect vlan native
config ap flexconnect vlan wlan
config ap flexconnect web-auth
To configure a FlexConnect ACL for external web authentication in locally switched WLANs, use the config ap flexconnect web-auth command.
Syntax Description
wlan Specifies the wireless LAN to be configured with a FlexConnect ACL.
wlan_id Wireless LAN identifier between 1 and 512 (inclusive).
cisco_ap Name of the FlexConnect access point.
acl_name Name of the FlexConnect ACL.
enable Enables the FlexConnect ACL on the locally switched wireless LAN.
disable Disables the FlexConnect ACL on the locally switched wireless LAN.
Usage Guidelines
The FlexConnect ACLs that are specific to an AP have the highest priority. The FlexConnect ACLs that are specific to WLANs have the lowest priority.
config ap flexconnect web-policy acl
To configure a Web Policy FlexConnect ACL on an access point, use the config ap flexconnect web-policy acl command.
Syntax Description
add Adds a Web Policy FlexConnect ACL on an access point.
delete Deletes Web Policy FlexConnect ACL on an access point.
acl_name Name of the Web Policy FlexConnect ACL.
Examples
This example shows how to add a Web Policy FlexConnect ACL on an access point:
> config ap flexconnect web-policy acl add flexacl2Related Commands
config ap flexconnect central-dhcp
config ap flexconnect vlan enable
config ap flexconnect local-split
config ap flexconnect web-auth
config ap flexconnect radius
config ap flexconnect vlan add
config ap flexconnect vlan native
config ap flexconnect vlan wlan
config ap flexconnect vlan disable
config flexconnect acl
config flexconnect acl rule
To configure access control list (ACL) rules on a FlexConnect access point, use the config flexconnect acl rule command.
config flexconnect aclrule { action rule_name rule_index { permit | deny} | add rule_name rule_index | change index rule_name old_index new_index | delete rule_name rule_index | destination address rule_name rule_index ip_address netmask | destination port range rule_name rule_index start_port end_port | direction rule_name rule_index { in | out | any} | dscp rule_name rule_index dscp | protocol rule_name rule_index protocol | source address rule_name rule_index ip_address netmask | source port range rule_name rule_index start_port end_port | swap index rule_name index_1 index_2}
Syntax Description
config flexconnect group
config flexconnect group group_name { add | delete | ap { add | delete} ap-mac | radius { ap { authority { id hex_id | info auth_info} | disable | eap-fast { enable | disable} | enable | leap { enable | disable} | pac-timeout timeout | server-key { auto | key} | user { add { username password} | delete username}}} | server auth { add | delete} { primary | secondary} IP_address auth_port secret} | predownload { disable | enable} | master ap_name | slave { retry-count max_count | ap-name cisco_ap} | start { primary backup abort} | local-split { wlan wlan_id acl acl_name { enable | disable}} | multicast overridden-interface { enable | disable} | vlan { add vlan_id acl in-aclname out-aclname | delete vlan_id } | web-auth wlan wlan_id acl acl_name { enable | disable} | web-policy acl { add | delete} acl_name}
Syntax Description
Usage Guidelines
You can add up to 100 clients.
Beginning in Release 7.4 and later releases, the supported maximum number of RADIUS servers is 100.
Examples
This example shows how to add a FlexConnect group for MAC address 192.12.1.2:
> config flexconnect group 192.12.1.2 addThis example shows how to add a RADIUS server as a primary server for a FlexConnect group with the server index number 1:
> config flexconnect group 192.12.1.2 radius server add primary 1This example shows how to enable a local split ACL on a FlexConnect AP group for a WLAN:
> config flexconnect group flexgroup1 local-split wlan 1 acl flexacl1 enableconfig flexconnect group vlan
config flexconnect group web-auth
To configure Web-Auth ACL for a FlexConnect group, use the config flexconnect group web-auth command.
Syntax Description
config flexconnect group web-policy
To configure Web Policy ACL for a FlexConnect group, use the config flexconnect group web-policy command.
Syntax Description
config flexconnect join min-latency
To enable or disable the access point to choose the controller with the least latency when joining, use the config flexconnect join min-latency command.
Syntax Description
Enables the access point to choose the controller with the least latency when joining.
Disables the access point to choose the controller with the least latency when joining.
Usage Guidelines
When you enable this feature, the access point calculates the time between the discovery request and discovery response and joins the controller that responds first. This command is supported only on the following controller releases:This configuration overrides the HA setting on the controller, and is applicable only for OEAP access points.
config flexconnect office-extend
config flexconnect office-extend {{ enable | disable} cisco_ap | clear-personalssid-config cisco_ap}
Syntax Description
Command Default
OfficeExtend mode is enabled automatically when you enable FlexConnect mode on the access point.
Usage Guidelines
Currently, only Cisco Aironet 1130 series and 1140 series access points that are joined to a Cisco 5500 Series Controller with a WPlus license can be configured to operate as OfficeExtend access points.
Rogue detection is disabled automatically when you enable the OfficeExtend mode for an access point. OfficeExtend access points, which are deployed in a home environment, are likely to detect a large number of rogue devices. You can enable or disable rogue detection for a specific access point or for all access points by using the config rogue detection command.
DTLS data encryption is enabled automatically when you enable the OfficeExtend mode for an access point. However, you can enable or disable DTLS data encryption for a specific access point or for all access points by using the config ap link-encryption command.
Telnet and SSH access are disabled automatically when you enable the OfficeExtend mode for an access point. However, you can enable or disable Telnet or SSH access for a specific access point by using the config ap telnet or config ap ssh command.
Link latency is enabled automatically when you enable the OfficeExtend mode for an access point. However, you can enable or disable link latency for a specific access point or for all access points currently associated to the controller by using the config ap link-latency command.
Examples
This example shows how to enable the office-extend mode for the access point Cisco_ap:
> config flexconnect office-extend enable Cisco_apThis example shows how to clear only the access point’s personal SSID for the access point Cisco_ap:
> config flexconnect office-extend clear-personalssid-config Cisco_apconfig wlan flexconnect ap-auth
To configure local authentication of clients associated with FlexConnect on a locally switched WLAN, use the config wlan flexconnect ap-auth command.
Syntax Description
Configures local authentication of clients associated with an FlexConnect on a locally switched WLAN.
Usage Guidelines
Local switching must be enabled on the WLAN where you want to configure local authentication of clients associated with FlexConnect.
config wlan flexconnect learn-ipaddr
To enable or disable client IP address learning for the Cisco WLAN controller, use the config wlan flexconnect learn-ipaddr command.
Syntax Description
Command Default
Disabled when the config wlan flexconnect local-switching command is disabled. Enabled when the config wlan flexconnect local-switching command is enabled.
Usage Guidelines
If the client is configured with Layer 2 encryption, the controller cannot learn the client IP address, and the controller will periodically drop the client. Disable this option to keep the client connection without waiting to learn the client IP address.
NoteThe ability to disable IP address learning is not supported with FlexConnect central switching.
config wlan flexconnect local-switching
To configure local switching, central DHCP, NAT-PAT, or the override DNS option on a FlexConnect WLAN, use the config wlan flexconnect local switching command.
config wlan flexconnect local-switching wlan_id { enable | disable} { { central-dhcp { enable | disable} nat-pat { enable | disable} } | { override option dns { enable | disable} } }
Syntax Description
Usage Guidelines
When you enable the config wlan flexconnect local-switching command, the config wlan flexconnect learn-ipaddr command is enabled by default.
NoteThe ability to disable IP address learning is not supported with FlexConnect central switching.
Examples
This example shows how to enable WLAN 6 for local switching and enable central DHCP and NAT-PAT:
> config wlan flexconnect local-switching 6 enable central-dhcp enable nat-pat enableThis example shows how to enable the override DNS option on WLAN 6:
> config wlan flexconnect local-switching 6 override option dns enableconfig wlan flexconnect vlan-central-switching
To configure central switching on a locally switched WLAN, use the config wlan flexconnect vlan-central-switching command.
Syntax Description
Enables central switching on a locally switched wireless LAN.
Disables central switching on a locally switched wireless LAN.
Usage Guidelines
You must enable Flexconnect local switching to enable VLAN central switching. When you enable WLAN central switching, the access point bridges the traffic locally if the WLAN is configured on the local IEEE 802.1Q link. If the VLAN is not configured on the access point, the AP tunnels the traffic back to the controller and the controller bridges the traffic to the corresponding VLAN.
WLAN central switching does not support:
Integrated Management Module Commands in Cisco Flex 7500 Series Controllers
Use the imm commands to manage the Integrated Management Module (IMM) in the Cisco Flex 7500 Series Controllers.
imm address
imm dhcp
imm summary
Syntax Description
Examples
This example shows a typical summary of the IMM:
> imm summary User ID..........................................username1 Mode............................................. Shared DHCP............................................. Enabled IP Address....................................... 209.165.200.225 Subnet Mask...................................... 255.255.255.224 Gateway.......................................... 10.1.1.1debug Commands
debug capwap reap
To configure the debugging of Control and Provisioning of Wireless Access Points (CAPWAP) settings on a FlexConnect access point, use the debug capwap reap command.
Syntax Description
debug dot11 mgmt interface
debug dot11 mgmt ssid
debug dot11 mgmt state-machine
debug dot11 mgmt station
debug flexconnect aaa
To enable or disable the debugging of FlexConnect backup RADIUS server events or errors, use the debug flexconnect aaa command.
Syntax Description
debug flexconnect acl
debug flexconnect cckm
To enable or disable the debugging of FlexConnect Cisco Centralized Key Management (CCKM) fast roaming, use the debug flexconnect cckm command.
Syntax Description
Enables the debugging of FlexConnect CCKM fast roaming settings.
Disables the debugging of FlexConnect CCKM fast roaming settings.
debug flexconnect group
