Wireless Configuration & WLC GUI

Overview

CCNA exam topics 2.9 (interpret wireless LAN GUI) and 5.10 (configure/verify WLAN with WPA2 PSK in the GUI) require hands-on familiarity with AireOS-style WLC workflows — dynamic interfaces, WLAN profiles, Security/QoS/Advanced tabs, and client verification.

The exam expects you to read GUI screenshots and configure WPA2-PSK — not deep WLC CLI. Practice identifying SSID, interface binding, security type, QoS profile, and operational status.

Lab topology pattern (Internal + Guest)

Typical CCNA lab:

SSID	VLAN	Dynamic interface	Security
Internal	100	INTERNAL (staff subnet)	WPA2-PSK
Guest	200	GUEST (isolated subnet)	WPA2-PSK

Traffic path: client → AP → CAPWAP → WLC → dynamic interface → distribution switch → default gateway.

Underlay: switch + DHCP option 43

Before APs join the WLC:

Create VLANs and SVIs on the distribution switch
Configure DHCP pools per VLAN
Add DHCP option 43 with the WLC management IP so lightweight APs auto-discover the controller

DHCP option 43 (conceptual)

! On the DHCP server / switch acting as DHCP option 43 hex f1040a000001 ! Encodes WLC IP — format varies by platform; verify in lab docs

WLC initial setup

First boot wizard configures:

Management interface IP and default gateway
Country code (regulatory domain — affects allowed channels/power)
Admin credentials
Optional initial WLAN (often change later in GUI)

Access GUI via HTTPS to the management IP → choose Advanced for full menus.

WLC ports vs interfaces

WLC ports (physical)	Purpose
Service port	Out-of-band management — access switch port, single VLAN
Distribution ports	Trunks to wired network — client/data traffic
Console	Local CLI recovery
Redundancy port	HA pair to standby WLC

WLC interfaces (logical)	Purpose
Management	Telnet, SSH, HTTP/S, RADIUS, NTP, syslog, CAPWAP
Virtual	DHCP relay, web authentication to clients
Dynamic	Maps WLAN → VLAN (create one per SSID/subnet)
Service-port	Bound to physical service port if used

Create dynamic interfaces first

Controller → Interfaces → New — define name, VLAN ID, IP, netmask, gateway. Repeat for each WLAN subnet (INTERNAL, GUEST) before creating WLANs.

WLAN creation — GUI workflow

WLANs → Create New → configure four tabs → Apply after each.

General tab

Setting	CCNA detail
Profile name	Internal label (e.g. `INTERNAL-WLAN`)
SSID	Broadcast name clients see
WLAN ID	1–512
Status	Enabled
Interface / Interface Group	Select dynamic interface — maps to VLAN
Radio policy	All, 802.11a, 802.11g, etc.

Security tab — WPA2 PSK (topic 5.10)

Step	Setting
1	Layer 2 Security: WPA+WPA2
2	Encryption: AES, WPA2 Policy
3	Authentication Key Management: enable PSK
4	PSK format ASCII, password ≥ 8 characters
5	Check PSK Enable

WPA2-Enterprise contrast: Select 802.1X instead of PSK — requires RADIUS under Security → AAA.

WPA3 awareness: Modern controllers may show WPA3-Personal (SAE) — verify encryption type and operational status in GUI screenshots.

QoS tab

Profile	Use
Platinum	Voice
Gold	Video
Silver	Best effort (default)
Bronze	Background bulk

Advanced tab (awareness)

FlexConnect, client session timeout, DHCP required, client exclusion, peer-to-peer blocking, web authentication / web passthrough for guest portals.

Guest WLAN example

Create second WLAN bound to GUEST dynamic interface, enable status, set WPA2-PSK — mirror Internal steps with isolated VLAN.

Verify client connectivity

Monitor → WLANs — confirm SSID enabled, policy shows WPA2 PSK.

Monitor → Clients — associated clients, IP, WLAN name.

Symptom	GUI check
SSID missing	WLAN disabled or AP not joined
Auth failure	PSK typo, WPA2-PSK not enabled
No IP	Wrong dynamic interface / DHCP scope
Guest reaches internal	Wrong VLAN binding or missing ACL

Exam trap

Hidden SSID and MAC filtering appear in Advanced options but do not replace WPA2/WPA3 encryption.

When interpreting GUI screenshots (topic 2.9), verify in order: WLAN status → SSID → interface binding → Layer 2 security → QoS profile → AP registration state.

Additional GUI areas (awareness)

Menu	Purpose
Wireless → Access Points	AP registration, per-AP settings
Management	Mgmt-via-wireless toggle, HTTP/S access
Security → Access Control Lists	CPU ACL rules on WLC

VPN and WAN tie-in

Branch sites often reach a centralized WLC over site-to-site IPsec. FlexConnect allows local switching when the VPN/CAPWAP path is down. See WAN, VPN & GRE for IPsec tunnel mode vs WPA2-PSK (Layer 2 wireless security).

Exam checklist

Create dynamic interface before WLAN
Configure WPA2-PSK: WPA+WPA2, AES, PSK enabled
Bind WLAN to correct interface/VLAN
Interpret GUI: status, SSID, security policy, QoS level
Know DHCP option 43 purpose for AP discovery
Distinguish WLC ports vs logical interfaces

How the sources were combined