Free CCNA | Wireless Configuration | Day 58 | CCNA 200-301 Complete Course — Transcript

Full transcript

1. 0:01Welcome to Jeremy’s IT Lab.
2. 0:03This is a free, complete course for the CCNA.
3. 0:07If you like these videos, please subscribe to follow along with the series.
4. 0:11Also, please like and leave a comment, and share the video to help spread this free series
5. 0:15of videos.
6. 0:17Thanks for your help.
7. 0:19In this video we will look at wireless LAN configuration.
8. 0:22In the past three videos we covered a lot of theory about wireless networks.
9. 0:27Finally we’ll get hands-on and see how to actually build a wireless LAN.
10. 0:32We will cover exam topics 2.7, 2.8, and 2.9.
11. 0:352.9 in particular tells us what we need to be able to configure for the CCNA exam.
12. 0:43In addition, we will cover exam topic 5.10 which tells us we need to configure WLANs
13. 0:49using WPA2 PSK, pre-shared key, using the GUI.
14. 0:54Note that both topics 2.9 and 5.10 mention that we must use the GUI, graphical user interface.
15. 1:03Up to this point in the course we have only been using the CLI, command line interface,
16. 1:07to configure devices.
17. 1:10You can configure wireless LANs via the CLI too, but it’s much more common to use the
18. 1:14GUI, and that’s what Cisco expects you to know for the exam.
19. 1:18Here’s what we’ll cover.
20. 1:22First I’ll give an introduction to the network topology I’ll be using for today’s demonstration.
21. 1:27Then I’ll cover the necessary switch configurations, since we’ll be connecting all devices to
22. 1:32one central switch.
23. 1:34Then I’ll show the basic wireless LAN controller setup, so we will be able to access its GUI
24. 1:40and do the configurations you need to know for the CCNA.
25. 1:44Then I’ll show how to configure the WLC’s interfaces, and then we’ll configure some
26. 1:49wireless LANs.
27. 1:51Finally I’ll take a look at some additional features on the WLC.
28. 1:54There’s a lot to explore in the WLC and you only need to know the basics, so I’ll
29. 1:59just point out a few features you might want to be aware of.
30. 2:02As always, watch until the end of the video for a bonus practice question from Boson software’s
31. 2:08ExSim, the best practice exams for the CCNA.
32. 2:13For the first time in this course, I will be using a physical lab.
33. 2:17You can’t make a wireless lab with virtual devices alone.
34. 2:20With that said, a partially virtual lab is possible.
35. 2:24I could have, for example, used a virtual WLC instead of a physical one, but I was able
36. 2:29to get this hardware second hand for a cheap price, so I decided to use all physical devices.
37. 2:35Fortunately, you don’t have to purchase physical hardware to practice wireless configuration
38. 2:40for the CCNA.
39. 2:42Packet Tracer does offer some basic WLC and AP functionality.
40. 2:47It’s limited, but it’s good enough to practice what you need for the CCNA.
41. 2:52Anyway, in this topology I have one switch, one wireless LAN controller, and two wireless
42. 2:57APs.
43. 2:59By the way, I haven’t connected any power cables to the APs, but they are still receiving
44. 3:03power.
45. 3:05Can you guess how they are receiving power without a dedicated power cable?
46. 3:09The answer is PoE of course, power over ethernet.
47. 3:13A single ethernet cable is used to both pass data and provide power to the device.
48. 3:19You can see here on the switch that its interfaces are PoE capable.
49. 3:24Actually, the WLC itself also has two PoE capable ports, although I’m not using them
50. 3:29in this lab.
51. 3:30So, an AP could be directly connected to the WLC itself and receive power via PoE.
52. 3:38Here’s the network topology.
53. 3:41Note that the WLC connects to the switch via a LAG, link aggregation group.
54. 3:47You might remember from my EtherChannel video that LAG is just another term for EtherChannel.
55. 3:53But in the context of wireless LAN controllers, we always use the term LAG.
56. 3:58And also note that WLCs only support static LAG, no PAgP or LACP.
57. 4:04So, when we configure the switch’s interfaces to form the LAG we will use the command CHANNEL-GROUP
58. 4:101 MODE ON, not MODE ACTIVE or MORE DESIRABLE.
59. 4:15You don’t have to connect the WLC to the switch using a LAG, but it’s a good idea
60. 4:19to provide additional throughput and redundancy.
61. 4:23I will use three VLANs, three subnets, in this network.
62. 4:27VLAN10 is the management VLAN, its subnet will be 192.168.1.0/24.
63. 4:32VLAN 100 will be called ‘Internal’, its subnet will be 10.0.0.0/24.
64. 4:41And VLAN 200 will be called ‘Guest’.
65. 4:43Its subnet will be 10.1.0.0/24.
66. 4:45Note that only VLAN 100 and VLAN 200 will be mapped to a wireless LAN and advertised
67. 4:53by the APs.
68. 4:54VLAN 10 will just be used for connecting to the network devices, the WLC, switch, and
69. 5:00APs, and managing them for example via their CLI with an SSH connection.
70. 5:07VLAN100 will be mapped to an SSID, Internal, which the APs will advertise and clients can
71. 5:12connect to.
72. 5:14Same for VLAN200.
73. 5:16It will be mapped to an SSID called Guest and advertised by the APs.
74. 5:21Devices will be able to associate with that SSID too.
75. 5:24Now, in this video I won’t be doing any advanced policies to control traffic, but
76. 5:29in a real deployment you could limit the Guest SSID to Internet access only, whereas clients
77. 5:35associated with the Internal SSID could access all internal company resources, for example.
78. 5:42The switch will have an SVI in each VLAN, the .1 address of each subnet.
79. 5:47And the WLC will have an IP address in each VLAN too, the .100 of each subnet.
80. 5:53The APs will need an IP address in the management VLAN so they can communicate with the WLC,
81. 5:59but they will get their IP addresses via DHCP.
82. 6:01So, where’s the DHCP server?
83. 6:03The WLC could be the server, but I’ll configure the switch as both a DHCP server and an NTP
84. 6:11server for this network.
85. 6:13I want to remind you that, since we’re using a WLC, a split-MAC deployment, the switch’s
86. 6:20interfaces connecting to the APs are access ports.
87. 6:24Only the WLC needs to connect via a trunk port with all of the necessary VLANs.
88. 6:29However the APs will form CAPWAP tunnels to the WLC.
89. 6:32So, let’s say this client associated with the Internal WLAN wants to communicate with
90. 6:38its default gateway, which is SW1’s VLAN 100 SVI.
91. 6:41The traffic passes through the CAPWAP tunnel to the WLC.
92. 6:47On the WLC, the Internal WLAN is mapped to VLAN100, so it will forward the traffic in
93. 6:52VLAN100 to SW1.
94. 6:55SW1 then sends it back via the same path.
95. 6:59What if the client associated with the Internal WLAN wants to send traffic to the client associated
96. 7:04with the Guest WLAN?
97. 7:07It will send the traffic to its default gateway, SW1, following the same path as before.
98. 7:12SW1 routes it to VLAN 200 and sends it to the WLC, which will send it to the destination
99. 7:18client via the CAPWAP tunnel and the AP.
100. 7:20So, that’s just a quick review of how traffic travels in a split-MAC deployment like this.
101. 7:26So, let’s finally start our configurations, first SW1.
102. 7:32All of these configurations will be review for you, so let’s just quickly take a look
103. 7:35at them.
104. 7:36Here’s the first half of the configurations.
105. 7:40First I created the three VLANs, 10, 100, and 200, and gave them appropriate names.
106. 7:47Then I configured fastethernet 0/6, 7, and 8 as access ports in VLAN10.
107. 7:53F0/7 and 8 connect to the APs, so why do you think I configured F0/6 too?
108. 7:59It’s because I will later connect my PC to F0/6 to gain access to WLC1’s GUI.
109. 8:07A device’s CLI, command line interface, can be accessed via the console port, or connected
110. 8:12to over the network using Telnet or SSH.
111. 8:15However, the GUI, graphical user interface, cannot be accessed via the console port.
112. 8:21You must connect over the network, using HTTP or HTTPS.
113. 8:26I’ll show you how to do that when I move on to configure the WLC.
114. 8:30Anyway, I then configured SW1’s F0/1 and F0/2 as a static LAG, static etherchannel.
115. 8:38Remember that WLCs only support static LAG, no PAgP or LACP.
116. 8:43So, you must use the command CHANNEL-GROUP 1 MODE ON, not MODE DESIRABLE or MODE ACTIVE.
117. 8:51And finally I configured the port-channel interface as a trunk and allowed VLANs 10,
118. 8:55100, and 200.
119. 8:58And here’s the second half of the configurations.
120. 9:01I configured an SVI for each VLAN.
121. 9:04These will be used as the default gateway for their subnets.
122. 9:07I then configured a DHCP pool for each VLAN, and notice that I used the DEFAULT-ROUTER
123. 9:13command and specified SW1’s SVI IP addresses as the default gateway for each subnet.
124. 9:20The VLAN10 DHCP pool will be used by the APs to get their IP addresses, which they need
125. 9:25to communicate with the WLC.
126. 9:28Note that the VLAN10 pool has an additional command, OPTION 43 IP 192.168.1.100.
127. 9:36DHCP option 43 can be used to tell the APs the IP address of their WLC.
128. 9:43So, when the APs get an IP address from SW1, it will tell them ‘your WLC is at IP address
129. 9:49192.168.1.100’, and the APs will then try to communicate with the WLC and form their
130. 9:56CAPWAP tunnels.
131. 9:59Although in this case it’s actually not necessary.
132. 10:01The APs and WLC are in the same subnet, the same local VLAN, and APs will send broadcast
133. 10:07CAPWAP discovery messages to check if there are any WLCs in the local subnet.
134. 10:13The WLC will hear those broadcast messages, so the APs will be able to join the WLC.
135. 10:20But just be aware that DHCP option 43 might be necessary if the WLC is located somewhere
136. 10:26that it won’t be able to hear the broadcast discovery messages from the APs.
137. 10:31Remember that one for the exam, DHCP option 43.
138. 10:34So, that’s the VLAN 10 pool.
139. 10:38The VLAN 100 and VLAN 200 pools will be used by wireless clients.
140. 10:42SW1 will assign IP addresses to them using DHCP.
141. 10:45Okay, the final command I used on the switch is NTP MASTER.
142. 10:49This will make it an NTP server, and I’ll later tell the WLC to use SW1 as its NTP server.
143. 10:57Okay, that’s all of the configuration needed on SW1.
144. 11:03Now let’s finally configure the WLC.
145. 11:05I can’t connect to its GUI yet.
146. 11:08First I need to connect to its console port and do some basic setup in the CLI.
147. 11:13So, let’s take a look at that.
148. 11:16When the WLC first boots up you will be greeted with a configuration wizard.
149. 11:21So, you don’t actually need to know any CLI commands for the WLC to do this basic
150. 11:25setup, the wizard will walk you through it.
151. 11:28First, it asks me if I would like to terminate autoinstall.
152. 11:33Autoinstall can be used to automatically download the WLC’s configuration from a TFTP server.
153. 11:39I won’t do that, so I press enter to skip it.
154. 11:43Note that the value in the square brackets, yes in this case, is the default.
155. 11:47You don’t have to type yes, if you just hit enter it will assume ‘yes’.
156. 11:52Then I entered the system name, the host name, of WLC1, as well as a username and password
157. 11:58that I will use later to log in to the device.
158. 12:01It then asks me if I want to enable link aggregation, LAG.
159. 12:05Notice that there are two options in square brackets, yes and NO.
160. 12:10However, NO is in upper case letters, so it is the default.
161. 12:14If I just hit enter, the device will assume I mean NO, I don’t want to enable LAG.
162. 12:20However in this case I will be using a LAG to connect to the switch, so I selected yes.
163. 12:26Then I enter some values for the management interface.
164. 12:29Note that this isn’t a physical interface, a physical port.
165. 12:32It is a virtual interface in the WLC.
166. 12:36I gave it an IP of 192.168.1.100, a /24 netmask, specified SW1’s IP address of .1 as the
167. 12:44default gateway, gave it a VLAN ID of 10, and again specified SW1’s IP address of
168. 12:51.1 as the DHCP server.
169. 12:55Let’s continue with the WLC’s basic setup.
170. 12:58This is still part of the configuration wizard, so I’m answering questions instead of actually
171. 13:02inputting commands in the CLI.
172. 13:05These three options at the top are a bit beyond what you need to know for the CCNA, but let
173. 13:09me briefly explain them.
174. 13:12The virtual gateway IP is an IP address used when the WLC is communicating directly with
175. 13:16wireless clients such as when relaying DHCP requests.
176. 13:21The multicast IP address is used when forwarding traffic to its APs.
177. 13:26Note that I selected an IP address in the class D range, which is reserved for multicast
178. 13:30addresses.
179. 13:32And the mobility/RF group name is used when you have multiple WLCs and you want them to
180. 13:37work together.
181. 13:39I doubt you’ll be asked about these on the CCNA exam.
182. 13:43Next in the setup it asks us to configure a wireless LAN, starting with the SSID.
183. 13:47I’ll show you how to do this in the GUI soon, but first it requires us to make one
184. 13:53in this configuration wizard.
185. 13:55I use the SSID internal, and then I accept the default settings for the next question
186. 14:00about DHCP bridging mode, leaving it disabled.
187. 14:04For wireless clients’ DHCP requests to reach the DHCP server, SW1, they must pass through
188. 14:10WLC1 first.
189. 14:11If DHCP bridging mode is enabled, the WLC becomes totally transparent to the clients.
190. 14:18It will appear as if they are communicating directly to the server.
191. 14:22But that’s not necessary here, so I’ll leave it disabled.
192. 14:24I also accept the default for the next setting, allow static IP addresses.
193. 14:30This means that clients are allowed to use static IP addresses if they prefer.
194. 14:33They don’t have to use DHCP.
195. 14:36And finally I choose not to configure a RADIUS server now, and it gives me a warning.
196. 14:41The default WLAN security policy requires a RADIUS server.
197. 14:46We will change the WLAN security policy to use a pre-shared key, so we don’t need to
198. 14:50configure a RADIUS server.
199. 14:53Next I have to enter a country code, or a list of country codes, and I entered FR for
200. 14:58France.
201. 15:00Why did I select France?
202. 15:02This is actually very important and was a problem for me when getting this lab set up.
203. 15:07Because I live in Japan, I originally entered JP here, but then my APs weren’t able to
204. 15:11join with the WLC.
205. 15:14Here is the reason for that.
206. 15:16Look at the model name of this AP here.
207. 15:19Specifically, this E in the model name.
208. 15:22This E indicates the regulatory domain of the device, E meaning Europe.
209. 15:27If the regulatory domain of the country specified in the WLC configuration doesn’t match the
210. 15:33regulatory domain of the AP, the AP won’t be able to join the WLC.
211. 15:39You can check the regulatory domain of each country here.
212. 15:42In Canada or the US, for example, -A is used instead of -E. So, because my APs are -E,
213. 15:49I configured a country in Europe on my WLC.
214. 15:52I doubt that you have to know this for the CCNA exam, but if you have your own wireless
215. 15:56lab with second-hand devices, you should be aware of this or you might run into problems.
216. 16:01Okay, here’s the final section of the initial WLC setup.
217. 16:06I choose to enable 802.11b, a, and g, as well as auto-RF which allows the WLC to automatically
218. 16:14select which channels to use and how much transmit power to use.
219. 16:19This is much better than doing everything manually.
220. 16:21I then configure some NTP settings so my WLC has the correct time.
221. 16:27Finally I save the settings, and the device resets.
222. 16:30That’s all for the WLC initial setup.
223. 16:33So, now that the WLC’s initial setup is complete it has an IP address in the management
224. 16:40VLAN, VLAN 10.
225. 16:42So, instead of connecting my PC to the WLC’s console port and using the CLI, I will connect
226. 16:47my PC to the switch.
227. 16:49Remember, I configured SW1’s F0/6 interface in VLAN10, the management VLAN.
228. 16:55Now I will be able to use HTTP or HTTPS to access the WLC’s GUI in a web browser.
229. 17:02So, I enter WLC1’s IP address, 192.168.1.100, in a web browser.
230. 17:09However I get a warning that my connection is not private.
231. 17:13The error is certificate authority invalid.
232. 17:16This just means my PC doesn’t trust the certificate on my WLC.
233. 17:20But that’s not an issue.
234. 17:22Next I clicked on advanced here.
235. 17:25And now I get the option to proceed to 192.168.1.100.
236. 17:30If your browser gives you a warning like this when visiting a website you should be careful,
237. 17:35but I know that I’m just connecting to WLC1 on my local network, so there’s no issue
238. 17:39here.
239. 17:41And here is the login screen for the Cisco WLC.
240. 17:44So, I click on the login button.
241. 17:48And then I enter the admin username and password I created in the initial setup earlier.
242. 17:53And here is the dashboard for the WLC.
243. 17:58Let me point out a few things.
244. 18:00Notice that it shows which interfaces are up, the green ones, and which are down, the
245. 18:04red ones.
246. 18:06Those two green interfaces are forming a LAG and are connected to the switch.
247. 18:11Here there is a summary of some information about the controller, such as its management
248. 18:16IP, system name, up time, temperature, CPU and memory usage, etc.
249. 18:22And here is a summary of the access points that have joined the WLC.
250. 18:26Note that both of my APs have already joined.
251. 18:29Okay, now let’s actually do some configurations on the WLC.
252. 18:33First, I’ll go to the CONTROLLER tab up top here.
253. 18:39From the controller tab, I clicked on interfaces, and here you can see the WLC’s interfaces.
254. 18:46Note that these are not physical ports, but logical or virtual interfaces in the WLC.
255. 18:53In most contexts we can use the terms port and interface interchangeably.
256. 18:57However, in the context of WLCs, port means physical port and interface means logical
257. 19:04interface within the device
258. 19:08Before configuring the interfaces, let me briefly explain the ports and interfaces of
259. 19:13a WLC.
260. 19:14Again, WLC ports are the physical interfaces that cables connect to.
261. 19:20And interfaces are the logical interfaces within the WLC, like SVIs on a switch.
262. 19:27WLCs have a few different kinds of ports, let me introduce them.
263. 19:32The service port is a dedicated management port, it is used for out-of-band management.
264. 19:38That means keeping management traffic totally separate from regular data traffic, not using
265. 19:42the same physical interface.
266. 19:44My WLC doesn’t have a dedicated service port, so the management traffic will use the
267. 19:50same physical ports as the regular data traffic.
268. 19:54Note that the service port must connect to a switch access port because it only supports
269. 19:58one VLAN.
270. 20:00Also this port can be used to connect to the device while it is booting up, perform system
271. 20:05recovery, and other system management tasks like that.
272. 20:10Next are distribution system ports.
273. 20:13These are the standard network interfaces that connect to the distribution system, remember
274. 20:17that’s the 802.11 term for the wired network.
275. 20:21And these are the interfaces that are used for regular data traffic to and from the wireless
276. 20:25clients.
277. 20:27Note that these ports usually connect to switch trunk ports, and if multiple distribution
278. 20:31ports are used they can form a LAG, as I did in my network.
279. 20:36Then there is the console port, which can be either RJ45 or USB, or perhaps the WLC
280. 20:42has both.
281. 20:44And there might also be a redundancy port, which can be used to connect to another WLC
282. 20:49to form a high availability, HA, pair.
283. 20:53This means you have redundant WLCs, so if one fails the other one can continue to support
284. 20:58the network.
285. 20:59My WLC is a bit old, so it just has an RJ45 console port and four distribution system
286. 21:07ports.
287. 21:09These aren’t ports but it has a reset button and some status LEDs on the front as well.
288. 21:14To show you the other kinds of ports, let’s look at a more modern WLC from Cisco.
289. 21:20So, here is a pair of WLCs, let’s go through each of these numbers, from 1 to 9.
290. 21:27Number 1 is the service port.
291. 21:29Again, this can be used for out-of-band management, to keep the management traffic physically
292. 21:34separate from the data traffic.
293. 21:37Number 2 is an RJ45 console port, and number 3 is a USB console port.
294. 21:43Then there is another USB port.
295. 21:45This isn’t a network port, it’s just a regular USB port used to transfer files to
296. 21:50the WLC, for example a new OS version to update the software.
297. 21:54Next, number five is a distribution system port, and it supports multi-gigabit speeds,
298. 22:00beyond 1-gig.
299. 22:02And then four more distribution system ports, these ones are regular 1-gig ports.
300. 22:08Number 7 isn’t a port, it’s a reset button like on my WLC, and there are status LEDs
301. 22:13too indicating the status of the device, those are number 8 on this image.
302. 22:18And finally number 9 is the redundancy port.
303. 22:21You could connect these two WLCs by their redundancy ports and they would form a redundant
304. 22:26pair.
305. 22:28Okay, those are the different kinds of physical WLC ports.
306. 22:32WLCs have a few different kinds of interfaces, too.
307. 22:36The management interface is used for so-called management traffic, meaning communications
308. 22:41used to manage devices such as Telnet or SSH connections to the CLI, HTTP or HTTPS connections
309. 22:49to the GUI, RADIUS authentication traffic, NTP and Syslog traffic, etc.
310. 22:55Remember that, to connect to the GUI of the WLC, I accessed the management IP address
311. 23:01of 192.168.1.100.
312. 23:05CAPWAP tunnels between the APs and WLC are also formed to and from this interface.
313. 23:12Next there also might be a redundancy management interface.
314. 23:14When two WLCs are connected by their redundancy ports, one WLC becomes active and the other
315. 23:21becomes standby.
316. 23:23To manage the active WLC you can connect to the management interface, but to manage the
317. 23:28standby WLC you can use the redundancy management interface.
318. 23:32Next there is the virtual interface.
319. 23:35Remember I had to configure this IP address when initially setting up the WLC?
320. 23:39It’s used when communicating with wireless clients to relay DHCP requests, perform client
321. 23:45web authentication if necessary, etc.
322. 23:49Next there is a service port interface.
323. 23:52If the WLC’s service port is used, this interface is bound to it and used for out-of-band
324. 23:56management instead of the regular management interface.
325. 24:01And finally there are dynamic interfaces, these are used to map a wireless LAN to a
326. 24:06VLAN.
327. 24:07For example, traffic from the internal wireless LAN will be sent to the wired network from
328. 24:11the WLC’s Internal dynamic interface.
329. 24:14So, let’s go back to the GUI and configure a couple dynamic interfaces to be used for
330. 24:19our wireless LANs.
331. 24:22Here’s the interfaces menu again.
332. 24:25I’ll click New to create a new interface.
333. 24:30First I’ll make the interface for the Internal WLAN, and notice I’m mapping it to VLAN
334. 24:35100.
335. 24:36Then I’ll click on Apply.
336. 24:40I am then brought to this screen where I can enter more details.
337. 24:43The VLAN ID was already set to 100 from the previous screen, but I entered the IP address,
338. 24:49netmask, gateway, and DHCP server address.
339. 24:53That’s all I need to enter here, so I clicked on Apply.
340. 24:57By the way, feel free to pause the video at any point if you want to take a look at the
341. 25:01different settings available in any of these menus.
342. 25:04So, now the dynamic interface called ‘internal’ has been created.
343. 25:09I will map this interface to the Internal WLAN later, but now I have to create one more
344. 25:15interface.
345. 25:16That is the guest interface, so I click on New again.
346. 25:20and then at this screen I specify a name of Guest and I map it to VLAN 200, since that
347. 25:26will be used for the guest WLAN and VLAN.
348. 25:29Then I click apply.
349. 25:32Again at this screen I enter the IP information needed for the Guest interface, the IP address,
350. 25:38netmask, gateway, and DHCP server address, and then click apply to finish creating this
351. 25:43interface.
352. 25:45Okay, now the WLC has all of the interfaces it needs.
353. 25:50Finally let’s go to configuring some WLANs.
354. 25:53To do that, just click on the WLAN tab here at the top of the GUI.
355. 25:58So, here’s the WLANs tab.
356. 26:02Note that one WLAN, Internal, already exists.
357. 26:06That is because I made it during the initial setup in the CLI.
358. 26:10However, I still have to make some changes to this one.
359. 26:13For example, look at the security policies column on the right.
360. 26:17It is configured to use 802.1X authentication, so WPA enterprise mode.
361. 26:23But for the CCNA we have to configure Pre-shared key authentication, in others words WPA personal
362. 26:29mode.
363. 26:30So, if I click on the WLAN ID, the number 1 on the left, I am able to edit this WLAN.
364. 26:38The profile name is Internal, it’s a WLAN, the SSID is internal, and it’s enabled.
365. 26:45That all looks good.
366. 26:47Here’s the security policy.
367. 26:49As I said before I’ll have to change that, but it’s done on the security tab, not here.
368. 26:54Now, here’s a problem.
369. 26:57Currently the Internal WLAN is mapped to the management interface.
370. 27:01That’s not correct, we should map it to the Internal dynamic interface.
371. 27:05So, that’s what I did.
372. 27:08I selected the Internal interface here.
373. 27:11Now it’s time to go to the security tab and change that security policy to use a PSK
374. 27:17instead of 802.1X.
375. 27:19Here’s the security tab.
376. 27:23First up, notice what’s called the ‘layer 2 security’ setting.
377. 27:27This is where we can select things like WEP, 802.1X, different versions of WPA, etc.
378. 27:34Currently it’s WPA+WPA2, which is what we should select for the CCNA.
379. 27:41For your reference, here are the layer 2 security options available on my WLC.
380. 27:46Note that the newer WPA3 isn’t supported.
381. 27:48But that’s fine, we’re supposed to use WPA2 for the CCNA.
382. 27:54Next, look down here at authentication key management.
383. 27:58802.1X is selected.
384. 28:01This is what we want to change, it should be PSK.
385. 28:04So, I scrolled down a bit, de-selected 802.1X, and selected PSK, pre-shared key, instead.
386. 28:14Notice that the PSK can then be specified either in ASCII or in HEX.
387. 28:18HEX means hexadecimal, the same number system we learned for MAC addresses and IPv6 addresses.
388. 28:25ASCII means American Standard Code for Information Interchange.
389. 28:30Basically, it means you can enter your password using regular letters, numbers, and symbols.
390. 28:36So, I selected ASCII, entered a short password, clicked on apply, and then I got an error
391. 28:43message, stating that the PSK in ASCII format should be at least 8 characters in length.
392. 28:49This is to make sure the password is secure, not easy to crack.
393. 28:54So this time I entered a longer password, clicked on apply, and it worked.
394. 28:59We won’t configure any ‘Layer 3’ security methods, but for your reference I checked
395. 29:05the Layer 3 tab and you can see that my WLC supports something called Web Policy.
396. 29:13If I select web policy, various options appear, such as web authentication and passthrough.
397. 29:20Web authentication means that, after wireless clients get an IP address and try to access
398. 29:25a web page, they will have to enter a username and password to authenticate.
399. 29:30Web passthrough is similar, but no username or password are required.
400. 29:35Instead a warning or statement is displayed and the client just has to agree to gain access
401. 29:40to the Internet.
402. 29:42In either of these examples, the Layer 2 authentication can just be open.
403. 29:46This is common for public WiFi for example at a cafe.
404. 29:51Note that the conditional and splash page web redirect options are similar, but additionally
405. 29:57require 802.1X layer 2 authentication.
406. 30:00Anyway, as I said before we won’t configure any of these, so let’s move on without enabling
407. 30:05web policy.
408. 30:08There is also a AAA servers tab, but since we are using PSK authentication only there’s
409. 30:14no need to set up anything like a RADIUS server.
410. 30:17So, let’s go to the QoS tab now.
411. 30:21Here’s the QoS tab.
412. 30:24The only thing you need to be aware of here is the QoS setting, which is Silver, best
413. 30:29effort, by default.
414. 30:32Here are the options available.
415. 30:34This is how you can control what quality of service is provided to the wireless clients.
416. 30:39Platinum should be used for voice, for example WiFi IP phones.
417. 30:44Gold should be used for video traffic.
418. 30:47Silver is the default, and bronze is given the lowest priority, for what’s called ‘background’
419. 30:52traffic.
420. 30:53Anyway, in this case I’ll just leave it at silver, but for the exam definitely know
421. 30:57these four QoS settings, platinum, gold, silver, and bronze.
422. 31:02Okay, finally we’ll take a look at the advanced tab.
423. 31:08In this tab there are lots of different settings.
424. 31:10For example, you could configure a maximum number of clients allowed.
425. 31:15Currently it is 0, meaning there is no maximum.
426. 31:17Okay, I’ll scroll down to see other settings.
427. 31:22Here are some additional settings, for example if you want to enable FlexConnect you can
428. 31:26do it here.
429. 31:28But I won’t touch these advanced settings, so I will just click on Apply to finish editing
430. 31:32this WLAN.
431. 31:34Okay, the Internal WLAN is done.
432. 31:39Next I’ll click on Go here to create a new WLAN, the guest WLAN.
433. 31:44Okay, since we’re creating a new WLAN this time we have to specify the profile name,
434. 31:51SSID, and ID first.
435. 31:54The profile name is used to identify this WLAN in the WLC, and usually you’ll just
436. 31:59make it the same as the SSID, as I did in this case.
437. 32:03Note that the profile name and SSID don’t have to be the same, though.
438. 32:07Then there is the ID, a unique number that identifies the WLAN.
439. 32:12The Internal WLAN was 1, so I’ll make this one 2.
440. 32:16So, I’ll click on apply to move forward.
441. 32:20Okay, now we’re at that same page.
442. 32:24Since we already went through all of the settings for the Internal WLAN, I’ll go through this
443. 32:28quickly.
444. 32:29There are two things we should change on this general tab.
445. 32:32First, the status.
446. 32:34The Internal WLAN was already enabled, but this new one is not, so we should enable it
447. 32:39here.
448. 32:41And secondly, we should change the interface to the Guest interface we created earlier.
449. 32:45Okay, I changed the settings.
450. 32:48Now, the only other change we have to make is to change the security policy to use a
451. 32:53PSK on the security tab.
452. 32:55I’ve already shown you how to do that, so for the sake of time let’s skip over that.
453. 33:01Okay, now we have two WLANs, the internal WLAN and the guest WLAN.
454. 33:06So, let’s return to the monitoring dashboard and see if anything is different.
455. 33:12Here’s the dashboard again.
456. 33:14I scrolled down a bit, and you can see that we have 0 clients associated with the APs.
457. 33:19So, let’s change that.
458. 33:23On my iPhone you can see that the guest and internal WLANs are visible, so I’ll join
459. 33:27with a few of my devices.
460. 33:30Okay, now you can see that there are 3 clients associated with the APs.
461. 33:35To see a list of them, you can click clients, here on the sidebar.
462. 33:40Here’s that list of clients.
463. 33:43It shows their IP Addresses, which AP they are associated with, which SSID they are using,
464. 33:49etc.
465. 33:50Okay, we’ve looked at a lot in this video, but before we finish up let’s take a quick
466. 33:55look at a couple more things.
467. 33:57Let’s go to the wireless tab here.
468. 34:02The first thing we’re shown is a list of the APs that have joined with this WLC.
469. 34:07You can see their IP addresses, model numbers, MAC addresses, etc.
470. 34:11Let’s click on an AP name and check the settings.
471. 34:16Again, here you can see a lot of information about this specific AP.
472. 34:21Look here, AP mode local.
473. 34:24You should know what this is.
474. 34:26Let’s check the other options.
475. 34:29These are the operational modes I covered in earlier videos.
476. 34:33Local, flexconnect, monitor, rogue detector, etc.
477. 34:38This is where you can configure the AP’s operational mode, but I’ll leave it at the
478. 34:42default of local.
479. 34:44Okay, next let’s look at the management tab.
480. 34:49Here is the management tab.
481. 34:51First, you can see a summary of the management settings.
482. 34:54For example, SNMPv1 is disabled, but v2 and v3 are enabled.
483. 35:01Syslog is currently disabled.
484. 35:03HTTP and HTTPS connections are enabled.
485. 35:07Telnet connections are disabled.
486. 35:09To prove this I tried to Telnet from my PC to the WLC, but the connection failed.
487. 35:15Telnet is not a secure protocol, so it’s best to leave it disabled.
488. 35:19SSH is enabled, and management via wireless is disabled.
489. 35:25This means that a wireless client won’t be able to connect to the WLC and manage it.
490. 35:30Only a device connected to the wired network can.
491. 35:33Let’s change that setting by clicking on management via wireless here.
492. 35:40You can change that setting by checking this box here and then clicking apply.
493. 35:44If this is enabled, a wireless client, for example a laptop using WiFi, will be able
494. 35:51to connect to the WLC and make configuration changes.
495. 35:54Anyway, let’s look at one last thing, here on the security tab.
496. 35:59So, I clicked on the security tab and then Access Control Lists here.
497. 36:05Let’s configure an ACL to limit the management traffic allowed to access the WLC.
498. 36:11There are no ACLs at the moment, so I’ll click here to make a new one.
499. 36:17First I named the ACL MANAGEMENT_ACL, and left the type as the default IPv4.
500. 36:24Then I clicked apply to move forward.
501. 36:26Okay, now the ACL has been created, but as you can see here it still has no rules.
502. 36:33So, I’ll click here to add a new rule and specify what traffic can access the WLC.
503. 36:41This is where you specify things like the sequence number, source and destination IP,
504. 36:46protocol, DSCP marking, direction, etc.
505. 36:49So, I specified a sequence number, source and destination, and then clicked on apply
506. 36:55to make the rule.
507. 36:57I followed that process again to make two more rules, and now there are three rules
508. 37:02in this ACL.
509. 37:03Don’t worry about the exact contents of these rules I’m making, I just want to show
510. 37:09how to make an ACL.
511. 37:10So, now that the ACL is made let’s apply this ACL so that it limits access to manage
512. 37:17the WLC.
513. 37:18To do so, click here, CPU access control lists.
514. 37:25To apply the ACL, check enable CPU ACL here and select the appropriate ACL from the list.
515. 37:32then simply click on apply.
516. 37:34And that’s all.
517. 37:36So, CPU ACLs are used to limit access to the CPU of the WLC.
518. 37:42This limits which devices will be able to connect to the WLC via Telnet/SSH, HTTP/HTTPS,
519. 37:50retrieve SNMP information from the WLC, etc.
520. 37:53This doesn’t affect traffic passing through the WLC, only traffic destined directly for
521. 38:00the WLC.
522. 38:02Okay, there are so many more things I could show you in the WLC, but this video is getting
523. 38:08quite long and we’ve covered what we need to for the CCNA.
524. 38:12To practice for the CCNA you can just use the WLC and APs in packet tracer, that’s
525. 38:18no problem at all.
526. 38:19But if you’re interested in really exploring what you can do with a WLC, you can probably
527. 38:24get some second-hand hardware for cheap like I did and set up your own home lab.
528. 38:29But again, that’s not necessary for CCNA studies.
529. 38:34Before moving on to the quiz, let’s review what we learned in today’s video.
530. 38:40First I introduced the network topology we used for today’s video.
531. 38:44Then I showed the configurations I did on the switch, such as IP addresses, interface
532. 38:49settings, and DHCP pools.
533. 38:52Then I showed the basic WLC setup which is required to access the GUI.
534. 38:57Then I showed how to configure WLC interfaces.
535. 39:01Remember the difference between physical ports and logical interfaces.
536. 39:06Up to now I’ve always used the terms port and interface interchangeably, but when talking
537. 39:10about WLCs you should be specific.
538. 39:13I then showed how to configure WLANs on a WLC.
539. 39:18We configured the Internal WLAN and the Guest WLAN.
540. 39:22And finally we looked at some additional features, such as how to configure a CPU ACL to limit
541. 39:28management traffic to the WLC.
542. 39:32Make sure to watch until the end of the video for a bonus practice question from Boson Software’s
543. 39:36ExSim for CCNA, the best practice exams for the CCNA.
544. 39:40Okay, let’s go to quiz question 1.
545. 39:46Which WLC port can be used to form an HA pair with another WLC?
546. 39:51Pause the video now to select the best answer.
547. 39:55Okay, the answer is redundancy port.
548. 40:00The redundancy port in this image is number 9.
549. 40:03It can be used to connect the two WLCs together to form a high availability, HA pair.
550. 40:10One WLC will be active and the other will be standby, ready to take over if the active
551. 40:15one fails.
552. 40:16Okay, let’s go to question 2.
553. 40:21Which WLC interface type maps a WLAN to a VLAN?
554. 40:25Pause the video now to select the best answer.
555. 40:29Okay, the answer is A, dynamic interface.
556. 40:35Dynamic interfaces are used to send traffic between wireless clients and VLANs on the
557. 40:39wired network.
558. 40:41In this video, for example, we created two dynamic interfaces, Internal and Guest, and
559. 40:47used them to map the Internal and Guest WLANs to VLANs 100 and 200.
560. 40:52Okay, let’s go to question 3.
561. 40:57Which of the following is a type of Layer 3 authentication?
562. 41:01Pause the video now to select the best answer.
563. 41:06The answer is D, web authentication.
564. 41:10Web authentication can be configured under the layer 3 security tab of a WLAN.
565. 41:15It requires users to authenticate with a username and password before being permitted to access
566. 41:20the Internet.
567. 41:21Okay, let’s go to question 4.
568. 41:26Which WLC QoS setting should be used for video traffic?
569. 41:31Pause the video now to select the best answer.
570. 41:34Okay, the answer is B, gold.
571. 41:39Here are those QoS options again.
572. 41:41Silver, best effort, is the default, but Gold is recommended for video traffic.
573. 41:46Okay, let’s go to question 5.
574. 41:51Which WLC port type can form a LAG to pass standard data traffic?
575. 41:56Pause the video now to select the best answer.
576. 42:00Okay, the answer is B, distribution system port.
577. 42:06These ports are the standard network ports that the WLC uses to pass data traffic to
578. 42:10and from wireless clients.
579. 42:12Okay, that’s all for the quiz.
580. 42:14Now let’s take a look at a bonus question from Boson Software’s ExSim for CCNA.