All language subtitles for Free-CCNA-Wireless-Configuration-Day-58-CCNA-200-301-Complete-Course_en

This is a free, complete course for the CCNA.

If you like these videos, please subscribe\n

Also, please like and leave a comment, and\n

In this video we will look at wireless LAN\nconfiguration.

In the past three videos we covered a lot\n

Finally we’ll get hands-on and see how to\n

We will cover exam topics 2.7, 2.8, and 2.9.

2.9 in particular tells us what we need to\n

In addition, we will cover exam topic 5.10\n

using WPA2 PSK, pre-shared key, using the\nGUI.

Note that both topics 2.9 and 5.10 mention\n

Up to this point in the course we have only\n

You can configure wireless LANs via the CLI\n

GUI, and that’s what Cisco expects you to\nknow for the exam.

First I’ll give an introduction to the network\n

Then I’ll cover the necessary switch configurations,\n

Then I’ll show the basic wireless LAN controller\n

and do the configurations you need to know\nfor the CCNA.

Then I’ll show how to configure the WLC’s\n

Finally I’ll take a look at some additional\nfeatures on the WLC.

There’s a lot to explore in the WLC and\n

just point out a few features you might want\nto be aware of.

As always, watch until the end of the video\n

ExSim, the best practice exams for the CCNA.

For the first time in this course, I will\n

You can’t make a wireless lab with virtual\ndevices alone.

With that said, a partially virtual lab is\npossible.

I could have, for example, used a virtual\n

to get this hardware second hand for a cheap\n

Fortunately, you don’t have to purchase\n

Packet Tracer does offer some basic WLC and\nAP functionality.

It’s limited, but it’s good enough to\n

Anyway, in this topology I have one switch,\n

By the way, I haven’t connected any power\n

Can you guess how they are receiving power\n

The answer is PoE of course, power over ethernet.

A single ethernet cable is used to both pass\n

You can see here on the switch that its interfaces\n

Actually, the WLC itself also has two PoE\n

So, an AP could be directly connected to the\n

Note that the WLC connects to the switch via\n

You might remember from my EtherChannel video\n

But in the context of wireless LAN controllers,\n

And also note that WLCs only support static\n

So, when we configure the switch’s interfaces\n

1 MODE ON, not MODE ACTIVE or MORE DESIRABLE.

You don’t have to connect the WLC to the\n

to provide additional throughput and redundancy.

I will use three VLANs, three subnets, in\nthis network.

VLAN10 is the management VLAN, its subnet\n

VLAN 100 will be called ‘Internal’, its\n

And VLAN 200 will be called ‘Guest’.

Note that only VLAN 100 and VLAN 200 will\n

VLAN 10 will just be used for connecting to\n

APs, and managing them for example via their\n

VLAN100 will be mapped to an SSID, Internal,\n

It will be mapped to an SSID called Guest\n

Devices will be able to associate with that\nSSID too.

Now, in this video I won’t be doing any\n

in a real deployment you could limit the Guest\n

associated with the Internal SSID could access\n

The switch will have an SVI in each VLAN,\n

And the WLC will have an IP address in each\n

The APs will need an IP address in the management\n

but they will get their IP addresses via DHCP.

The WLC could be the server, but I’ll configure\n

I want to remind you that, since we’re using\n

interfaces connecting to the APs are access\nports.

Only the WLC needs to connect via a trunk\n

However the APs will form CAPWAP tunnels to\nthe WLC.

So, let’s say this client associated with\n

its default gateway, which is SW1’s VLAN\n100 SVI.

The traffic passes through the CAPWAP tunnel\nto the WLC.

On the WLC, the Internal WLAN is mapped to\n

SW1 then sends it back via the same path.

What if the client associated with the Internal\n

It will send the traffic to its default gateway,\n

SW1 routes it to VLAN 200 and sends it to\n

client via the CAPWAP tunnel and the AP.

So, that’s just a quick review of how traffic\n

So, let’s finally start our configurations,\nfirst SW1.

All of these configurations will be review\n

Here’s the first half of the configurations.

First I created the three VLANs, 10, 100,\n

Then I configured fastethernet 0/6, 7, and\n

F0/7 and 8 connect to the APs, so why do you\n

It’s because I will later connect my PC\n

A device’s CLI, command line interface,\n

to over the network using Telnet or SSH.

However, the GUI, graphical user interface,\n

You must connect over the network, using HTTP\nor HTTPS.

I’ll show you how to do that when I move\n

Anyway, I then configured SW1’s F0/1 and\n

Remember that WLCs only support static LAG,\nno PAgP or LACP.

So, you must use the command CHANNEL-GROUP\n

And finally I configured the port-channel\n

And here’s the second half of the configurations.

I configured an SVI for each VLAN.

These will be used as the default gateway\nfor their subnets.

I then configured a DHCP pool for each VLAN,\n

command and specified SW1’s SVI IP addresses\n

The VLAN10 DHCP pool will be used by the APs\n

Note that the VLAN10 pool has an additional\n

DHCP option 43 can be used to tell the APs\n

So, when the APs get an IP address from SW1,\n

192.168.1.100’, and the APs will then try\n

Although in this case it’s actually not\nnecessary.

The APs and WLC are in the same subnet, the\n

CAPWAP discovery messages to check if there\n

The WLC will hear those broadcast messages,\n

But just be aware that DHCP option 43 might\n

that it won’t be able to hear the broadcast\n

Remember that one for the exam, DHCP option\n43.

The VLAN 100 and VLAN 200 pools will be used\n

SW1 will assign IP addresses to them using\nDHCP.

Okay, the final command I used on the switch\nis NTP MASTER.

This will make it an NTP server, and I’ll\n

Okay, that’s all of the configuration needed\non SW1.

Now let’s finally configure the WLC.

I can’t connect to its GUI yet.

First I need to connect to its console port\n

When the WLC first boots up you will be greeted\n

So, you don’t actually need to know any\n

setup, the wizard will walk you through it.

First, it asks me if I would like to terminate\nautoinstall.

Autoinstall can be used to automatically download\n

I won’t do that, so I press enter to skip\nit.

Note that the value in the square brackets,\n

You don’t have to type yes, if you just\n

Then I entered the system name, the host name,\n

that I will use later to log in to the device.

It then asks me if I want to enable link aggregation,\nLAG.

Notice that there are two options in square\n

However, NO is in upper case letters, so it\nis the default.

If I just hit enter, the device will assume\n

However in this case I will be using a LAG\n

Then I enter some values for the management\ninterface.

Note that this isn’t a physical interface,\na physical port.

It is a virtual interface in the WLC.

I gave it an IP of 192.168.1.100, a /24 netmask,\n

default gateway, gave it a VLAN ID of 10,\n

Let’s continue with the WLC’s basic setup.

This is still part of the configuration wizard,\n

inputting commands in the CLI.

These three options at the top are a bit beyond\n

The virtual gateway IP is an IP address used\n

wireless clients such as when relaying DHCP\nrequests.

The multicast IP address is used when forwarding\n

Note that I selected an IP address in the\n

And the mobility/RF group name is used when\n

I doubt you’ll be asked about these on the\nCCNA exam.

Next in the setup it asks us to configure\n

I’ll show you how to do this in the GUI\n

I use the SSID internal, and then I accept\n

about DHCP bridging mode, leaving it disabled.

For wireless clients’ DHCP requests to reach\n

If DHCP bridging mode is enabled, the WLC\n

It will appear as if they are communicating\n

But that’s not necessary here, so I’ll\nleave it disabled.

I also accept the default for the next setting,\n

This means that clients are allowed to use\n

And finally I choose not to configure a RADIUS\n

The default WLAN security policy requires\na RADIUS server.

We will change the WLAN security policy to\n

Next I have to enter a country code, or a\n

This is actually very important and was a\n

Because I live in Japan, I originally entered\n

Look at the model name of this AP here.

Specifically, this E in the model name.

This E indicates the regulatory domain of\n

If the regulatory domain of the country specified\n

regulatory domain of the AP, the AP won’t\n

You can check the regulatory domain of each\ncountry here.

In Canada or the US, for example, -A is used\n

I configured a country in Europe on my WLC.

I doubt that you have to know this for the\n

lab with second-hand devices, you should be\n

Okay, here’s the final section of the initial\nWLC setup.

I choose to enable 802.11b, a, and g, as well\n

select which channels to use and how much\ntransmit power to use.

This is much better than doing everything\nmanually.

I then configure some NTP settings so my WLC\n

Finally I save the settings, and the device\nresets.

That’s all for the WLC initial setup.

So, now that the WLC’s initial setup is\n

So, instead of connecting my PC to the WLC’s\n

Remember, I configured SW1’s F0/6 interface\n

Now I will be able to use HTTP or HTTPS to\n

So, I enter WLC1’s IP address, 192.168.1.100,\nin a web browser.

However I get a warning that my connection\nis not private.

The error is certificate authority invalid.

This just means my PC doesn’t trust the\ncertificate on my WLC.

Next I clicked on advanced here.

And now I get the option to proceed to 192.168.1.100.

If your browser gives you a warning like this\n

but I know that I’m just connecting to WLC1\n

And here is the login screen for the Cisco\nWLC.

So, I click on the login button.

And then I enter the admin username and password\n

And here is the dashboard for the WLC.

Let me point out a few things.

Notice that it shows which interfaces are\n

Those two green interfaces are forming a LAG\n

Here there is a summary of some information\n

IP, system name, up time, temperature, CPU\n

And here is a summary of the access points\n

Note that both of my APs have already joined.

Okay, now let’s actually do some configurations\non the WLC.

First, I’ll go to the CONTROLLER tab up\ntop here.

From the controller tab, I clicked on interfaces,\n

Note that these are not physical ports, but\n

In most contexts we can use the terms port\n

However, in the context of WLCs, port means\n

Before configuring the interfaces, let me\n

Again, WLC ports are the physical interfaces\n

And interfaces are the logical interfaces\n

WLCs have a few different kinds of ports,\nlet me introduce them.

The service port is a dedicated management\n

That means keeping management traffic totally\n

My WLC doesn’t have a dedicated service\n

same physical ports as the regular data traffic.

Note that the service port must connect to\n

Also this port can be used to connect to the\n

recovery, and other system management tasks\nlike that.

Next are distribution system ports.

These are the standard network interfaces\n

that’s the 802.11 term for the wired network.

And these are the interfaces that are used\n

Note that these ports usually connect to switch\n

ports are used they can form a LAG, as I did\nin my network.

Then there is the console port, which can\n

And there might also be a redundancy port,\n

to form a high availability, HA, pair.

This means you have redundant WLCs, so if\n

My WLC is a bit old, so it just has an RJ45\n

These aren’t ports but it has a reset button\n

To show you the other kinds of ports, let’s\n

So, here is a pair of WLCs, let’s go through\n

Number 1 is the service port.

Again, this can be used for out-of-band management,\n

separate from the data traffic.

Number 2 is an RJ45 console port, and number\n

Then there is another USB port.

This isn’t a network port, it’s just a\n

the WLC, for example a new OS version to update\nthe software.

Next, number five is a distribution system\n

And then four more distribution system ports,\n

Number 7 isn’t a port, it’s a reset button\n

too indicating the status of the device, those\n

And finally number 9 is the redundancy port.

You could connect these two WLCs by their\n

Okay, those are the different kinds of physical\nWLC ports.

WLCs have a few different kinds of interfaces,\ntoo.

The management interface is used for so-called\n

used to manage devices such as Telnet or SSH\n

to the GUI, RADIUS authentication traffic,\n

Remember that, to connect to the GUI of the\n

CAPWAP tunnels between the APs and WLC are\n

Next there also might be a redundancy management\ninterface.

When two WLCs are connected by their redundancy\n

To manage the active WLC you can connect to\n

standby WLC you can use the redundancy management\ninterface.

Next there is the virtual interface.

Remember I had to configure this IP address\n

It’s used when communicating with wireless\n

web authentication if necessary, etc.

Next there is a service port interface.

If the WLC’s service port is used, this\n

management instead of the regular management\ninterface.

And finally there are dynamic interfaces,\n

For example, traffic from the internal wireless\n

the WLC’s Internal dynamic interface.

So, let’s go back to the GUI and configure\n

Here’s the interfaces menu again.

I’ll click New to create a new interface.

First I’ll make the interface for the Internal\n

I am then brought to this screen where I can\nenter more details.

The VLAN ID was already set to 100 from the\n

netmask, gateway, and DHCP server address.

That’s all I need to enter here, so I clicked\non Apply.

By the way, feel free to pause the video at\n

different settings available in any of these\nmenus.

So, now the dynamic interface called ‘internal’\n

I will map this interface to the Internal\n

That is the guest interface, so I click on\nNew again.

and then at this screen I specify a name of\n

will be used for the guest WLAN and VLAN.

Again at this screen I enter the IP information\n

netmask, gateway, and DHCP server address,\n

Okay, now the WLC has all of the interfaces\nit needs.

Finally let’s go to configuring some WLANs.

To do that, just click on the WLAN tab here\n

Note that one WLAN, Internal, already exists.

That is because I made it during the initial\nsetup in the CLI.

However, I still have to make some changes\nto this one.

For example, look at the security policies\ncolumn on the right.

It is configured to use 802.1X authentication,\n

But for the CCNA we have to configure Pre-shared\n

So, if I click on the WLAN ID, the number\n

The profile name is Internal, it’s a WLAN,\n

As I said before I’ll have to change that,\n

Currently the Internal WLAN is mapped to the\n

That’s not correct, we should map it to\n

I selected the Internal interface here.

Now it’s time to go to the security tab\n

First up, notice what’s called the ‘layer\n2 security’ setting.

This is where we can select things like WEP,\n

Currently it’s WPA+WPA2, which is what we\n

For your reference, here are the layer 2 security\n

Note that the newer WPA3 isn’t supported.

But that’s fine, we’re supposed to use\nWPA2 for the CCNA.

Next, look down here at authentication key\nmanagement.

This is what we want to change, it should\nbe PSK.

So, I scrolled down a bit, de-selected 802.1X,\n

Notice that the PSK can then be specified\n

HEX means hexadecimal, the same number system\n

ASCII means American Standard Code for Information\nInterchange.

Basically, it means you can enter your password\n

So, I selected ASCII, entered a short password,\n

message, stating that the PSK in ASCII format\n

This is to make sure the password is secure,\nnot easy to crack.

So this time I entered a longer password,\n

We won’t configure any ‘Layer 3’ security\n

the Layer 3 tab and you can see that my WLC\n

If I select web policy, various options appear,\n

Web authentication means that, after wireless\n

a web page, they will have to enter a username\n

Web passthrough is similar, but no username\n

Instead a warning or statement is displayed\n

In either of these examples, the Layer 2 authentication\n

This is common for public WiFi for example\nat a cafe.

Note that the conditional and splash page\n

require 802.1X layer 2 authentication.

Anyway, as I said before we won’t configure\n

There is also a AAA servers tab, but since\n

no need to set up anything like a RADIUS server.

So, let’s go to the QoS tab now.

The only thing you need to be aware of here\n

Here are the options available.

This is how you can control what quality of\n

Platinum should be used for voice, for example\nWiFi IP phones.

Gold should be used for video traffic.

Silver is the default, and bronze is given\n

Anyway, in this case I’ll just leave it\n

these four QoS settings, platinum, gold, silver,\nand bronze.

Okay, finally we’ll take a look at the advanced\ntab.

In this tab there are lots of different settings.

For example, you could configure a maximum\n

Currently it is 0, meaning there is no maximum.

Okay, I’ll scroll down to see other settings.

Here are some additional settings, for example\n

But I won’t touch these advanced settings,\n

Okay, the Internal WLAN is done.

Next I’ll click on Go here to create a new\nWLAN, the guest WLAN.

Okay, since we’re creating a new WLAN this\n

The profile name is used to identify this\n

make it the same as the SSID, as I did in\nthis case.

Note that the profile name and SSID don’t\n

Then there is the ID, a unique number that\nidentifies the WLAN.

The Internal WLAN was 1, so I’ll make this\none 2.

So, I’ll click on apply to move forward.

Okay, now we’re at that same page.

Since we already went through all of the settings\n

There are two things we should change on this\ngeneral tab.

The Internal WLAN was already enabled, but\n

And secondly, we should change the interface\n

Okay, I changed the settings.

Now, the only other change we have to make\n

I’ve already shown you how to do that, so\n

Okay, now we have two WLANs, the internal\n

So, let’s return to the monitoring dashboard\n

I scrolled down a bit, and you can see that\n

On my iPhone you can see that the guest and\n

Okay, now you can see that there are 3 clients\n

To see a list of them, you can click clients,\n

It shows their IP Addresses, which AP they\n

Okay, we’ve looked at a lot in this video,\n

look at a couple more things.

Let’s go to the wireless tab here.

The first thing we’re shown is a list of\n

You can see their IP addresses, model numbers,\n

Let’s click on an AP name and check the\nsettings.

Again, here you can see a lot of information\n

You should know what this is.

These are the operational modes I covered\nin earlier videos.

Local, flexconnect, monitor, rogue detector,\netc.

This is where you can configure the AP’s\n

Okay, next let’s look at the management\ntab.

First, you can see a summary of the management\nsettings.

For example, SNMPv1 is disabled, but v2 and\nv3 are enabled.

HTTP and HTTPS connections are enabled.

Telnet connections are disabled.

To prove this I tried to Telnet from my PC\n

Telnet is not a secure protocol, so it’s\n

SSH is enabled, and management via wireless\nis disabled.

This means that a wireless client won’t\n

Only a device connected to the wired network\ncan.

Let’s change that setting by clicking on\n

You can change that setting by checking this\n

If this is enabled, a wireless client, for\n

to connect to the WLC and make configuration\nchanges.

Anyway, let’s look at one last thing, here\non the security tab.

So, I clicked on the security tab and then\n

Let’s configure an ACL to limit the management\n

There are no ACLs at the moment, so I’ll\n

First I named the ACL MANAGEMENT_ACL, and\n

Then I clicked apply to move forward.

Okay, now the ACL has been created, but as\n

So, I’ll click here to add a new rule and\n

This is where you specify things like the\n

protocol, DSCP marking, direction, etc.

So, I specified a sequence number, source\n

I followed that process again to make two\n

Don’t worry about the exact contents of\n

So, now that the ACL is made let’s apply\n

To do so, click here, CPU access control lists.

To apply the ACL, check enable CPU ACL here\n

So, CPU ACLs are used to limit access to the\nCPU of the WLC.

This limits which devices will be able to\n

retrieve SNMP information from the WLC, etc.

This doesn’t affect traffic passing through\n

Okay, there are so many more things I could\n

quite long and we’ve covered what we need\nto for the CCNA.

To practice for the CCNA you can just use\n

But if you’re interested in really exploring\n

get some second-hand hardware for cheap like\n

But again, that’s not necessary for CCNA\nstudies.

Before moving on to the quiz, let’s review\n

First I introduced the network topology we\n

Then I showed the configurations I did on\n

Then I showed the basic WLC setup which is\n

Then I showed how to configure WLC interfaces.

Remember the difference between physical ports\n

Up to now I’ve always used the terms port\n

about WLCs you should be specific.

I then showed how to configure WLANs on a\nWLC.

We configured the Internal WLAN and the Guest\nWLAN.

And finally we looked at some additional features,\n

management traffic to the WLC.

Make sure to watch until the end of the video\n

ExSim for CCNA, the best practice exams for\nthe CCNA.

Okay, let’s go to quiz question 1.

Which WLC port can be used to form an HA pair\nwith another WLC?

Pause the video now to select the best answer.

Okay, the answer is redundancy port.

The redundancy port in this image is number\n9.

It can be used to connect the two WLCs together\n

One WLC will be active and the other will\n

Which WLC interface type maps a WLAN to a\nVLAN?

Pause the video now to select the best answer.

Okay, the answer is A, dynamic interface.

Dynamic interfaces are used to send traffic\n

In this video, for example, we created two\n

used them to map the Internal and Guest WLANs\n

Which of the following is a type of Layer\n3 authentication?

Pause the video now to select the best answer.

The answer is D, web authentication.

Web authentication can be configured under\n

It requires users to authenticate with a username\n

Which WLC QoS setting should be used for video\ntraffic?

Pause the video now to select the best answer.

Okay, the answer is B, gold.

Here are those QoS options again.

Silver, best effort, is the default, but Gold\n

Which WLC port type can form a LAG to pass\n

Pause the video now to select the best answer.

Okay, the answer is B, distribution system\nport.

These ports are the standard network ports\n

Okay, that’s all for the quiz.

Now let’s take a look at a bonus question\n