7.2 WLAN Profile Creation, Client Access Policies & QoS Mapping

7.2 WLAN Profile Creation, Client Access Policies & QoS Mapping

Core Blueprint Focus: Configuring wireless local area networks on the Cisco Catalyst 9800 requires mastering the interplay between 802.11 Media Access Control (MAC) parameters and end-to-end Quality of Service (QoS). Network engineers must know how to tune radio policies, enforce 802.11w Protected Management Frames (PMF), calculate 802.11e Enhanced Distributed Channel Access (EDCA) contention parameters, map Differentiated Services Code Points (DSCP) to 802.11e User Priority (UP), and deploy Call Admission Control (CAC) and client steering to protect real-time voice and video.

---

1. Catalyst 9800 WLAN Profile Construction & Access Parameters

Under the Cisco IOS-XE modular wireless architecture, configuration is separated into distinct, reusable profiles bound together using Tags. The WLAN Profile (wireless wlan <profile-name> <wlan-id> <ssid-name>) defines the Layer 2 RF attributes advertised by an Access Point over the air:

+-------------------------------------------------------------------------------------------------+
|                               CATALYST 9800 WLAN PROFILE ATTRIBUTES                             |
|                                                                                                 |
|  +---------------------------+  +---------------------------+  +-----------------------------+  |
|  |      SSID DEFINITION      |  |       RADIO POLICIES      |  |        CLIENT LIMITS        |  |
|  | - SSID Broadcast Name     |  | - All (2.4, 5, 6 GHz)     |  | - Per-WLAN Max Associations |  |
|  | - Broadcast SSID in Beacon|  | - dot11a (5 GHz Only)     |  | - Per-Radio Max Associations|  |
|  | - WLAN ID (1-4096)        |  | - dot11-6ghz (6 GHz Only) |  | - Prevents AP Memory Exhaust|  |
|  +---------------------------+  +---------------------------+  +-----------------------------+  |
|                                                                                                 |
|  +-------------------------------------------------------------------------------------------+  |
|  |                      802.11w PROTECTED MANAGEMENT FRAMES (PMF)                            |  |
|  | - Disabled: Management frames unencrypted (Legacy WPA2-Personal/Enterprise)               |  |
|  | - Optional: PMF advertised in RSN IE; supports both PMF and non-PMF clients               |  |
|  | - Mandatory: Required for WPA3 SAE / WPA3-Enterprise; non-PMF associations rejected       |  |
|  +-------------------------------------------------------------------------------------------+  |
+-------------------------------------------------------------------------------------------------+

Core WLAN Parameters & Operational Tuning

1. SSID Broadcast Suppression (no broadcast-ssid):

   • By default, the AP includes the SSID string in cleartext inside its periodic 802.11 Beacon frames (transmitted approximately every 102.4 ms / 100 Time Units).
   • Disabling broadcast SSID (no broadcast-ssid) instructs the AP to set the SSID Information Element (IE) field in beacons to null (0 bytes length). Clients cannot passively discover the network.
   • Architectural Pitfall: Suppressing SSIDs does not enhance security. The SSID is transmitted in cleartext during legitimate client Probe Requests, Association Requests, and Reassociation frames. Furthermore, hidden SSIDs force client operating systems to constantly transmit active probe requests across all channels searching for the hidden network, dramatically accelerating client battery drain and creating unnecessary RF airtime congestion.

2. Radio Policy Selection: Allows administrators to restrict which physical AP transceiver radios broadcast the WLAN:

   • all: Broadcasts across 2.4 GHz, 5 GHz, and 6 GHz (Wi-Fi 6E/7) radios.
   • dot11a: Restricts the SSID exclusively to the 5 GHz band (U-NII-1 through U-NII-8).
   • dot11b: Restricts the SSID exclusively to the 2.4 GHz ISM band. Commonly isolated for legacy IoT devices, barcode scanners, and medical telemetry.
   • dot11-6ghz: Restricts the SSID exclusively to the 6 GHz spectrum.
   • dot11a-dot11-6ghz: Broadcasts across both 5 GHz and 6 GHz bands while disabling 2.4 GHz transmission entirely, eliminating legacy 2.4 GHz co-channel interference in dense enterprise environments.

3. IEEE 802.11w Protected Management Frames (PMF):

   • Historically, standard 802.11 management frames (Deauthentication, Disassociation, Channel Switch Announcements, Action frames) were transmitted in cleartext without cryptographic integrity. Attackers could trivially spoof an AP's BSSID and transmit spoofed deauthentication frames to disconnect clients instantly (Denial of Service).
   • IEEE 802.11w (PMF) encrypts unicast management frames using AES-CCMP or AES-GCMP and appends a BIP (Broadcast Integrity Protocol) cryptographic Message Integrity Check (MIC) using AES-128-CMAC (or GMAC-256) to broadcast/multicast management frames.
   • PMF Operational Modes:
     • disabled: Management frames are transmitted unencrypted.
     • optional: The AP advertises PMF capability in its 802.11 RSN Information Element (RSN IE). Clients that support 802.11w negotiate protected management frames, while legacy non-PMF clients are permitted to connect without protection.
     • mandatory: The AP strictly mandates 802.11w. Clients lacking PMF support are rejected during 802.11 association. Note: Mandatory PMF is a non-negotiable prerequisite for WPA3-Personal (SAE) and WPA3-Enterprise.

4. Client Association Limits: To prevent an AP located in a dense lecture hall, dining commons, or auditorium from exhausting its CPU or memory tables, administrators configure client association thresholds:

   • Per-WLAN Client Limit: Caps the total number of simultaneous client associations permitted across that specific SSID.
   • Per-Radio Client Limit: Prevents an individual 2.4 GHz, 5 GHz, or 6 GHz radio transceiver chip from exceeding its hardware MAC address table capacity.

---

2. 802.11e / WMM Enhanced Distributed Channel Access (EDCA) Deep Dive

In legacy 802.11b/g/a networks utilizing the Distributed Coordination Function (DCF), the wireless medium was governed strictly by Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA). Every frame contended for the channel under identical mathematical rules. A background cloud backup had the exact same statistical probability of gaining channel access as an emergency VoIP call.

802.11e Enhanced Distributed Channel Access (EDCA)

The IEEE 802.11e amendment—commercially branded by the Wi-Fi Alliance as Wi-Fi Multimedia (WMM)—replaces DCF with Enhanced Distributed Channel Access (EDCA). EDCA introduces prioritized channel contention by creating four distinct Access Categories (AC) within the MAC layer of both the AP and the client station:

+-------------------------------------------------------------------------------------------------+
|                            802.11e EDCA ACCESS CATEGORY ARCHITECTURE                            |
|                                                                                                 |
|  [ AC_VO: Voice ]       --> AIFSN = 2  --> CWmin = 3,  CWmax = 7   --> TXOP = 1.504/3.264 ms   |
|  [ AC_VI: Video ]       --> AIFSN = 2  --> CWmin = 7,  CWmax = 15  --> TXOP = 3.008/6.016 ms   |
|  [ AC_BE: Best Effort ] --> AIFSN = 3  --> CWmin = 15, CWmax = 1023 --> TXOP = 0 (Single Frame)|
|  [ AC_BK: Background ]  --> AIFSN = 7  --> CWmin = 15, CWmax = 1023 --> TXOP = 0 (Single Frame)|
+-------------------------------------------------------------------------------------------------+

EDCA establishes deterministic channel prioritization through three mathematical parameters tuned per Access Category:

1. Arbitration Inter-Frame Space (AIFS / AIFSN):

   • Under DCF, every station waited a fixed DCF Inter-Frame Space (DIFS) before decrementing backoff counters.
   • In EDCA, DIFS is replaced by AIFS, calculated as: $\text{AIFS}[AC] = \text{SIFS} + (\text{AIFSN}[AC] \times \text{SlotTime})$
   • High-priority traffic queues have smaller Arbitration Inter-Frame Space Numbers (AIFSN). Voice (AC_VO) and Video (AC_VI) use $\text{AIFSN} = 2$. Best Effort (AC_BE) uses $\text{AIFSN} = 3$, and Background (AC_BK) uses $\text{AIFSN} = 7$.
   • Because Voice and Video wait significantly less time after channel activity ceases, their contention engines begin decrementing backoff slots before Best Effort or Background engines can start.

2. Contention Window (CWmin and CWmax):

   • When a station senses the RF medium is busy, it draws a random backoff integer uniformly distributed in the range $[0, CW]$.
   • Real-time traffic uses dramatically smaller contention windows:
     • AC_VO (Voice): $CW_{min} = 3$, $CW_{max} = 7$
     • AC_VI (Video): $CW_{min} = 7$, $CW_{max} = 15$
     • AC_BE (Best Effort): $CW_{min} = 15$, $CW_{max} = 1023$
     • AC_BK (Background): $CW_{min} = 15$, $CW_{max} = 1023$
   • A voice queue draws a random backoff integer between 0 and 3. A best-effort data packet draws a backoff integer between 0 and 15. If a collision occurs, AC_VO doubles its window to a maximum of only 7, whereas AC_BE doubles exponentially up to 1023 slots.

3. Transmission Opportunity (TXOP):

   • Under standard DCF, a station that wins contention is permitted to transmit only a single 802.11 frame before relinquishing the channel ($TXOP = 0$).
   • When an AC_VO or AC_VI queue wins contention, it is granted a TXOP duration (e.g., 1.504 ms or 3.264 ms for voice; 3.008 ms or 6.016 ms for video).
   • During this TXOP window, the station transmits a concatenated burst of multiple data frames separated only by Short Inter-Frame Spaces (SIFS), without re-contending for the shared medium. This dramatically minimizes latency, jitter, and MAC overhead for streaming media.

Detailed EDCA Parameters Reference Matrix

Note on UP 0 vs UP 3: In 802.11e, User Priority 0 is designated as Normal Best Effort, while UP 3 is Excellent Effort. Both map to Access Category AC_BE. Background traffic uses UP 1 (Background) and UP 2 (Spare), both mapping to AC_BK.

---

3. Cisco QoS Profiles & UP-to-DSCP Mapping Architecture

Cisco organizes wireless Quality of Service into four standardized QoS Profiles. When configuring a WLAN Policy Profile, the administrator binds a QoS profile that establishes the maximum allowable priority ceiling for that SSID:

+-------------------------------------------------------------------------------------------------+
|                                    CISCO QOS PROFILES                                           |
|                                                                                                 |
|  +------------------------+  +------------------------+  +-----------------------------------+  |
|  |    PLATINUM (VOICE)    |  |      GOLD (VIDEO)      |  |        SILVER (BEST EFFORT)       |  |
|  | - User Priority: 6 & 7 |  | - User Priority: 4 & 5 |  | - User Priority: 0 & 3            |  |
|  | - DSCP: 46 (EF)        |  | - DSCP: 34 (AF41)      |  | - DSCP: 0 (CS0 / Best Effort)     |  |
|  | - Voice WLANs (VoIP)   |  | - Video Conferencing   |  | - Standard Enterprise Data WLANs  |  |
|  +------------------------+  +------------------------+  +-----------------------------------+  |
|                                                                                                 |
|  +-------------------------------------------------------------------------------------------+  |
|  |                                    BRONZE (BACKGROUND)                                    |  |
|  | - User Priority: 1 & 2  |  DSCP: 10 (AF11)  |  Guest Internet, Bulk Transfers, IoT        |  |
|  +-------------------------------------------------------------------------------------------+  |
+-------------------------------------------------------------------------------------------------+

The QoS Profile Ceiling Concept

A QoS profile configured on a WLAN Policy Profile acts as a hard policy ceiling:

• If a corporate WLAN is assigned the Platinum profile, client traffic can flow across all four priority tiers: Voice (UP 6/7), Video (UP 4/5), Best Effort (UP 0/3), and Background (UP 1/2). Each packet retains its requested marking.
• If a guest or public Wi-Fi network is configured with the Silver (Best Effort) profile, and an untrusted or misconfigured guest endpoint transmits packets marked with DSCP 46 (EF) or 802.11e UP 6, the AP and WLC demote and clamp the packets to Silver priority (UP 0 / DSCP 0). This prevents guest endpoints from monopolizing voice queues or starving enterprise mission-critical traffic.

Downstream and Upstream QoS Translation Mechanics

Because 802.11 Wi-Fi frames use a 3-bit User Priority (UP) field (values 0-7) located in the 802.11 QoS Control header, while wired IP networks use a 6-bit Differentiated Services Code Point (DSCP) field (values 0-63) in the IPv4/IPv6 header, the controller and AP execute continuous bidirectional translation:

[ WIRED NETWORK ] === DSCP 46 (EF) ===> [ CATALYST 9800 WLC ]
                                                 |
                                                 v Encapsulates into CAPWAP Data (UDP 5247)
                                                   Outer IP Header tagged with DSCP 46
                                                 |
                                                 v
[ ACCESS POINT ] <=== CAPWAP Tunnel (DSCP 46) ===+
       |
       v Decapsulates CAPWAP; maps DSCP 46 -> 802.11e UP 6
       v Places frame in AC_VO hardware queue; transmits using Voice EDCA
       |
       v Over the Air (UP 6)
[ WIRELESS CLIENT ]

1. Downstream Translation (Wired Core $\rightarrow$ WLC $\rightarrow$ AP $\rightarrow$ Client):
   • A Cisco Unified Communications Manager (CUCM) server or VoIP gateway transmits a voice packet marked with DSCP 46 (Expedited Forwarding [EF]) to the Catalyst 9800 WLC.
   • The WLC inspects the inner IP header DSCP, validates that the destination WLAN permits Platinum QoS, and maps DSCP 46 to 802.11e UP 6.
   • CAPWAP Outer Header Preservation: Crucially, the WLC copies DSCP 46 into the outer IP header of the CAPWAP Data packet (UDP 5247). This ensures that intermediate campus routers and switches prioritize the CAPWAP tunnel packet across the wired underlay.
   • The AP receives the CAPWAP packet, decapsulates the payload, places the frame into its hardware AC_VO transmit queue, sets UP 6 in the 802.11 QoS Control header, and transmits it over the air using Voice EDCA parameters.
2. Upstream Translation (Client $\rightarrow$ AP $\rightarrow$ WLC $\rightarrow$ Wired Core):
   • A Wi-Fi smartphone transmits an 802.11 frame tagged with UP 6 in the QoS Control header.
   • The AP verifies the WLAN QoS profile ceiling. If permitted, the AP translates UP 6 to DSCP 46, encapsulates the frame into CAPWAP Data, and tags the outer CAPWAP IP packet with DSCP 46 toward the controller.
   • The controller decapsulates the packet and forwards the 802.3 Ethernet frame onto the campus core switch with DSCP 46 intact.

Comprehensive QoS Profiles & Protocol Mappings Reference

---

4. Advanced RF Client Management & Admission Control

Enterprise-grade wireless requires active management of client connection behavior and rigorous protection of voice capacity against RF over-subscription.

Band Select (2.4 GHz vs. 5 GHz Steering)

Many client operating systems default to associating with the 2.4 GHz band because 2.4 GHz signals propagate further and penetrate walls more effectively, presenting a superficially higher Received Signal Strength Indicator (RSSI). However, the 2.4 GHz band offers only three non-overlapping channels (1, 6, 11) and suffers severe co-channel interference.

• Band Select can delay selected 2.4 GHz probe responses to encourage dual-band clients to associate on 5 GHz. It is an association aid, not a forced roam mechanism, and 6 GHz discovery/selection uses different client and protocol behavior.
• Mechanics: When an unassociated client transmits Probe Requests across multiple bands:
  1. The AP detects probe requests on both 2.4 GHz and 5 GHz from the same client MAC address.
  2. The AP deliberately suppresses or delays its 2.4 GHz Probe Responses (e.g., ignoring the first 2-3 probe requests on 2.4 GHz).
  3. Simultaneously, the AP responds immediately to probe requests on the 5 GHz (and 6 GHz) band.
  4. The client's operating system discovers 5 GHz first and initiates association on the 5 GHz radio.
  5. If the client is truly a 2.4 GHz-only device, it continues probing 2.4 GHz; after the suppression cycle expires, the AP responds normally on 2.4 GHz so the client is never stranded.

Client Steering & 802.11v BSS Transition Management (BSTM)

Traditional Wi-Fi clients are notoriously "sticky"—they associate to an AP upon entering a building and refuse to roam to a closer AP even when their signal drops to -82 dBm, degrading their own throughput and consuming excessive channel airtime.

• 802.11v BSS Transition Management (BSTM):
  • The Catalyst 9800 continuously monitors client RSSI, SNR, and AP channel utilization.
  • When a client's signal degrades below an optimal threshold, or when an AP becomes overloaded, the AP transmits an 802.11v BSS Transition Management Request Action frame to the client.
  • The frame includes a prioritized candidate list of superior neighbor BSSIDs, along with channel numbers and preference ratings.
  • Compliant clients evaluate the candidate list and execute an orderly, fast roam to the recommended target AP without dropping active TCP or voice sessions.

Call Admission Control (CAC) & WMM TSPEC Signaling

In VoIP environments, if too many simultaneous voice calls are admitted onto a single AP radio, the aggregate voice traffic will exceed available airtime, causing packet drops, jitter, and audio breakup across all active calls.

• Call Admission Control (CAC) prevents voice over-subscription by enforcing strict capacity limits:
  • A WMM-compliant VoIP handset issues a Traffic Stream Specification (TSPEC) admission request via an 802.11 ADDTS (Add Traffic Stream) Action frame prior to initiating or answering a call. The TSPEC packet specifies required data rates, packet sizes, and maximum allowable delay.
  • The AP evaluates current channel utilization: if existing voice calls occupy less than the configured CAC voice bandwidth limit (e.g., 75% of total RF airtime), the AP returns an ADDTS Response with Status Code 0 (Admission Accepted).
  • If the call would exceed the threshold, the AP rejects the TSPEC with Status Code 1 (Admission Refused). The handset displays a "Network Busy" message or automatically rolls over to cellular voice, protecting existing active calls from audio degradation.

---

5. End-to-End Catalyst 9800 Configuration & Verification CLI

The following configuration demonstrates creating an enterprise voice/video WLAN profile on the Cisco Catalyst 9800, enforcing 802.11w PMF, configuring Platinum QoS, enabling WMM and Call Admission Control (CAC), and verifying status:

! =========================================================================
! STEP 1: CONFIGURE WLAN PROFILE FOR ENTERPRISE VOICE
! =========================================================================
C9800-01# configure terminal
wireless wlan Corp-Voice 10 Corp-Voice-SSID
 ! Restrict radio policy to 5 GHz and 6 GHz (eliminate 2.4 GHz interference)
 radio-policy dot11a-dot11-6ghz
 ! Cap associations to 50 clients per AP radio on this SSID
 client limit 50
 ! Enforce 802.11w Protected Management Frames (Mandatory for WPA3)
 security pmf mandatory
 ! Enable WPA2/WPA3 Enterprise 802.1X Key Management
 security wpa akm dot1x
 security wpa akm dot1x-sha256
 broadcast-ssid
 no shutdown
exit

! =========================================================================
! STEP 2: CONFIGURE POLICY PROFILE WITH PLATINUM QOS AND CAC
! =========================================================================
wireless profile policy Corp-Voice-Policy
 vlan Voice-VLAN
 ! Assign Platinum QoS Profile (Maps to AC_VO, UP 6, DSCP 46 EF)
 qos-profile platinum
 ! Enable Wi-Fi Multimedia (WMM)
 wmm
 ! Enable Call Admission Control (CAC) for Voice Streams
 call-admission-control voice
  admission-control-mandatory
  max-bandwidth 75
  roam-bandwidth 10
 exit
 no shutdown
exit

! =========================================================================
! STEP 3: BIND WLAN AND POLICY PROFILE VIA POLICY TAG
! =========================================================================
wireless tag policy Campus-Policy-Tag
 wlan Corp-Voice policy Corp-Voice-Policy
exit

! =========================================================================
! STEP 4: VERIFICATION COMMANDS
! =========================================================================
! Verify WLAN Profile operational state, PMF, and radio policy
C9800-01# show wireless wlan name Corp-Voice
! Verify: Radio Policy = 802.11a/6GHz, PMF = Mandatory, Status = Enabled

! Verify Policy Profile QoS and CAC parameters
C9800-01# show wireless profile policy detailed Corp-Voice-Policy
! Verify: QoS Profile = platinum, WMM = Enabled, CAC Voice = Enabled

! Verify active client QoS and DSCP translation
C9800-01# show wireless client mac-address aaaa.bbbb.cccc detail | include QoS
! Expected Output: QoS Profile : Platinum | Current User Priority : 6