Skip to main content

 

Cisco Meraki Documentation

How to Add Cisco 9800 Wireless Controllers and APs to Dashboard

  1. Last updated
  2. Save as PDF

Overview

This article explains how to onboard a Cisco Catalyst 9800 Wireless Controller and its access points to the Meraki dashboard for Cloud Monitoring, how to control which dashboard network new access points join, and how to remove the controller and its access points.

The onboarding process follows four stages:

  1. Prepare the wireless controller and the dashboard organization.
  2. Claim the wireless controller to the organization using its Cloud ID (Meraki serial number).
  3. Add the wireless controller to a dashboard network and supply credentials so the dashboard can provision the configuration it needs.
  4. Confirm the controller and its access points appear in dashboard.

When you add a wireless controller to a network, the dashboard first checks the controller configuration to confirm it can be provisioned. By default, every access point joined to the wireless controller at that moment is added to the same dashboard network as the wireless controller.

Prerequisites

Wireless controller requirements

Enable the Meraki Tunnel Service  on the wireless controller before you onboard it in dashboard.

The controller must also meet these requirements:

  • Provide a username and password with privilege 15 access when you add the wireless controller to a network. If the account does not have privilege 15, provide the wireless controller enable password as well.
  • Use AAA New-model for device access control. This mode allows the dashboard to securely access the wireless controller.
aaa new-model
  • Keep four unused consecutive VTY slots available. The dashboard provisions and secures these VTY lines so that only the dashboard uses them to reach the controller.
  • Support at least one SSH encryption algorithm that dashboard supports: aes128-gcm@openssh.com, aes256-gcm@openssh.com, aes128-ctr, aes192-ctr, or aes256-ctr.
  • Allow IPv6, because the dashboard uses IPv6 inside the Meraki Tunnel to reach the wireless controller.

Define a username and password on the switch before you start the AAA configuration. The aaa new-model command immediately applies local authentication to all lines and interfaces except the console line line con 0. Any Telnet or SSH session opened after you enable the command — including a session that times out and reconnects — must authenticate against the local database of the wireless controller.

Firmware requirements

  • Cisco 9800 Wireless LAN Controllers register with the Meraki dashboard from firmware version IOS XE 17.12.3, or 17.15.1 or later.
  • 9800-CL requires IOS XE 17.18.2 or later.

Dashboard requirements

  • If you do not have a dashboard account and organization, refer to Creating a Dashboard Account and Organization.
  • Claim 9800 wireless controllers from the new version of Organization > Inventory. Navigate to Organization > Inventory and select Try New Version in the upper right corner.

Screenshot of the inventory page in dashboard showing the 'Try new version' button

  • Select Try New Version in the top right corner of the Create network and Add devices pages before you use them.
  • Do not claim 9800 wireless controllers from the Per-device licensing organization inventory page. If your organization uses per-device licensing, claim and add controllers from one of these pages instead:
    • Organization > Create network for a new network. Select +Claim devices.
    • Network-wide > Add devices for an existing network. Select +Claim devices.

Screenshot of the Add devices page in dashboard showing the 'Try new version' button

Network design restrictions

Image depicting cloud managed and cloud monitored APs in the same network with a warning symbol

 Do not place Cloud-Managed access points in the same network as Cloud Monitored access points. Claim them to separate networks.
Image depicting cloud managed and monitored WLC in the same network with a warning symbol Do not place Cloud-Managed access points in the same network as Cisco 9800 Wireless Controllers.

Image showing that only APs from a single WLC can be added to a specific network

 Reserve a network for the access points of a single wireless controller. For example, do not add access points joined to wireless controller-A to a network already reserved for access points on wireless controller-B.

For detailed recommendations on how to organize your wireless controllers and access points in dashboard networks, refer to the  Cloud Monitoring for Wireless Design Guide.

Step-by-step instructions

Step 1: Find the Cloud ID

Claim the wireless controller with its Cloud ID (Meraki serial number). Retrieve the Cloud ID from either the Web UI or the CLI. For an HA-SSO unit, retrieve the Cloud IDs of both 9800 controllers in the pair.

Web UI

Navigate to Configuration > Services > Cloud Services > Meraki.

Standalone 9800:

Image showing the Configuration > Services > Cloud Services > Meraki page within the WLC

HA-SSO 9800:

Image showing the successful registration of HA 9800 WLC in the WLC GUI

CLI

Standalone 9800:

9800#show meraki
Chassis Num  PID           Serial Number  Cloud ID        Mac Address     Status      Mode
--------------------------------------------------------------------------------------------------
1            C9800-L-C-K9  FCL262201G3    Q2ZZ-LU6P-3RFF  0845.d11b.8340  Registered  C9K-C

HA-SSO 9800:

9800-HA#show meraki
Chassis Num  PID           Serial Number  Cloud ID        Mac Address     Status      Mode
------------------------------------------------------------------------------------------------------------
1            C9800-L-F-K9  FCL270501CM    Q2ZZ-2TQ8-CKHF  8c1e.806f.8bc0  Registered  C9K-C
2            C9800-L-F-K9  FCL270501Q0    Q2ZZ-J9N6-8BNK  8c1e.806f.87a0  Registered  C9K-C

Step 2: Claim the wireless controller to the organization

  1. Log in to dashboard and navigate to Organization > Configure > Inventory.

  2. Select + Claim devices.

    Screenshot of the inventory page in dashboard showing the claim devices button

  3. Enter the Cloud ID of the 9800 wireless controller. For HA-SSO, enter the Cloud ID of each 9800 in the pair.

  4. Select Claim Device.

    Screenshot of the page on dashboard where the serial number can be entered before claiming devices

The 9800 wireless controller now appears in your organization inventory.

Screenshot of the inventory page showing a 9800 WLC successfully added

If your organization uses per-device licensing, go to Network-wide > Configure > Add devices, select +Claim Devices, and complete the same fields.

Step 3: Add the wireless controller to a network

Add the claimed controller to an existing dashboard network, or create a network and add it in the same flow. Use either the Inventory page or the Create network page.

Network configuration does not apply to wireless controllers. However if this dashboard network also include Meraki Managed devices, choose the appropriate configuration option from the drop-down menu.

Add from the Inventory page

  1. On the Organization > Configure > Inventory page, select the check box next to the 9800 wireless controller. For HA-SSO, select the check box for each 9800 in the pair.

Screenshot of the inventory page showing how to add the WLC to a network

  1. Select Add to network.

    clipboard_ec7bdca0b5bc20198022b34bce0e8f129.png

  2. Choose the destination network:

    • For an existing network, select Existing network and choose the network name from the drop-down.

    • For a new network, select New network, name the network, choose the network configuration, and select Next.

  3. Enter the wireless controller username and password that the dashboard uses to provision the required configuration.

    clipboard_eca0d991599c9984db15bb5c923836a69.png

  4. Select the check box to acknowledge that the dashboard accesses the wireless controller to provision configuration, then select Next.

  5. Review the wireless controller network assignment, the access point network assignment policy, and the credentials. Select Confirm.

    clipboard_e130d75a2cc5c2dd5a94f35364811a104.png

  6. Select the network name to open the wireless controller's dashboard network.

    Screenshot of the inventory page showing the WLC in the inventory

Add from the Create network page

  1. On the Organization > Configure > Create network page, name the new network and choose the Combined hardware network type.

  2. Select the check box next to the 9800 wireless controller. For HA-SSO, enter the serial number of each 9800 in the pair.

  3. Select Create network.

    Screenshot showing the create network page for selecting a combined networkEnter the wireless controller username and password that the dashboard uses to provision the required configuration.

    Screenshot of the inventory page showing the selection of the WLC to create a network

  4. Select the check box to acknowledge that the dashboard accesses the wireless controller to provision configuration, then select Save.

Step 4: Change the access point network assignment

The access point assignment rule controls which dashboard network new access points join. The rule is per-wireless controller, and you change it from the wireless controller APs page.

  1. Go to the wireless controller APs page.

  2. Select the pencil edit icon next to the AP assignment option.

  3. Choose the assignment option and select Save.

    clipboard_e3b780a50d07ee2ea1206ba818fa104ee.png

To relocate access points that dashboard already onboarded, change the access point assignment first, then follow the guidelines for access points in Moving Devices between Networks.

Remove wireless controllers and access points from dashboard

Remove a wireless controller

Follow these steps to avoid problems later.

  1. Navigate to Wireless > Wireless LAN Controller > List.

  2. Confirm the wireless controller you want to remove is online (green).

  3. Select the wireless controller and select Remove.

    [IMAGE: Wireless LAN Controller list with a controller selected and Remove highlighted]

  4. Wait a couple of minutes.

  5. Log in to the WLC and run #show run | inc meraki to confirm the dashboard removed the Cloud Monitoring configuration. Confirm these lines are absent:

# username meraki-user privilege 15 secret…
# username meraki-tdluser secret 9…
  1. Stop communication between the device and the Meraki cloud. While the Meraki service runs and the device has network access to the Meraki cloud, the node continues to exchange keep-alive packets. Log in to the WLC and disable the service:
# config t
# no service meraki connect

Meraki offboard EEM script

When you remove the wireless controller from the dashboard network, the dashboard provisions and runs the following EEM (Embedded Event Manager) script to remove all dashboard-provisioned configurations from the wireless controller.

event manager applet MERAKI_OFFBOARD_CLEANUP authorization bypass
event timer watchdog time 5 maxrun 600
action 0001 cli command "enable"
action 0002 cli command "config terminal"
action 0003 syslog msg "start MERAKI_OFFBOARD_CLEANUP"
action 0060 cli command "no ip http authentication local"
action 0061 cli command "no ip http secure-server"
action 0062 cli command "no ip http access-class ipv6 MERAKI_MGMT_IPV6_IN"
action 0063 cli command "no ipv6 unicast-routing"
action 0064 cli command "no ipv6 access-list MERAKI_MGMT_IPV6_OUT"
action 0065 cli command "no ipv6 access-list MERAKI_MGMT_IPV6_IN"
action 0066 cli command "no ip access-list extended MERAKI_MGMT_IP_OUT"
action 0067 cli command "no ip access-list standard MERAKI_MGMT_IP_IN"
action 012E cli command "no yang-interfaces aaa authorization method-list MERAKI"
action 012F cli command "no netconf-yang"
action 0130 cli command "ip ssh pubkey-chain"
action 0131 cli command "no username meraki-user"
action 0132 cli command "exit"
action 0143 cli command "no ip ssh version 2"
action 0144 cli command "no ip ssh port 2222 rotary 55"
action 01F9 cli command "do-exec clear line vty 16" pattern ".*"
action 01FA cli command "y"
action 01FB cli command "do-exec clear line vty 17" pattern ".*"
action 01FC cli command "y"
action 01FD cli command "do-exec clear line vty 18" pattern ".*"
action 01FE cli command "y"
action 01FF cli command "do-exec clear line vty 19" pattern ".*"
action 0200 cli command "y"
action 0201 cli command "no line vty 16 19"
action 04C6 cli command "no aaa authentication login MERAKI local"
action 04C7 cli command "no aaa authorization exec MERAKI local"
action 04C8 cli command "no aaa authorization commands 1 MERAKI local"
action 04C9 cli command "no aaa authorization commands 15 MERAKI local"
action 04FB cli command "no username meraki-user" pattern ".*[confirm].*"
action 04FC cli command "y"
action 04FD cli command "no username meraki-tdluser" pattern ".*[confirm].*"
action 04FE cli command "y"
action 04E8 cli command "no event manager applet MERAKI_OFFBOARD_CLEANUP"
action 04E9 cli command "do-exec write memory"
action 04EA syslog msg "stop MERAKI_OFFBOARD_CLEANUP"
end

Remove Cloud Monitored access points

Removing a wireless controller from a network also removes every access point associated with that controller, online or offline, from its network automatically.

Remove offline access points manually only when you know an access point will never rejoin the wireless controller, such as when you physically remove access points from the network:

  1. Navigate to Wireless > Monitor > Access Points.
  2. Select the offline access points that you no longer want to operate in Cloud Monitoring.
  3. Select Remove.

Verification

Use these outcomes to confirm each stage succeeded:

  • Cloud ID retrieved: The show meraki output lists each chassis with a Cloud ID and a Registered status.
  • Controller claimed: The 9800 wireless controller appears in the list on the Organization > Configure > Inventory page.
  • Controller added to a network: The Inventory page updates to show the wireless controller assigned to the network. Access points do not appear in the inventory list immediately.
  • Controller removed: #show run | inc meraki on the WLC returns no Cloud Monitoring configuration lines, including username meraki-user and username meraki-tdluser.
  • Meraki service disabled: #show meraki connect shows the "meraki connect service" as disabled, which confirms the WLC no longer communicates with the Meraki cloud.

Troubleshooting

  • Access points do not appear after onboarding: Dashboard does not display access points in the inventory list immediately after you add the wireless controller to a network.
  • Access points show as offline: Access points that lose communication with the wireless controller appear as offline in dashboard.
  • Existing access points stay in their original network: Changing the AP network assignment rule does not move access points that dashboard already onboarded. The rule applies only to new access points that join the wireless controller. Access points moved before you change the assignment rule automatically return to their original network.
  • A removed online access point comes back: Removing an online access point associated with a Cloud Monitored wireless controller from a dashboard network causes dashboard to re-add that access point to its original network automatically.
  • The wireless controller is offline during removal: Follow the same removal steps, and expect to remove some configuration lines manually. For the full list of configuration lines that dashboard adds when a controller joins a network, refer to Cloud Monitoring for Wireless Dashboard Provisioned Configurations.
  • Locked out after enabling AAA: Authenticate with the local database of the wireless controller. Define a local username and password before you configure AAA to prevent the lockout.