How to Convert CW9800H1 and CW9800L WLC to Campus Gateway Operation

Last updated
Save as PDF

Introduction

The purpose of this document is to describe the requirements and steps needed to assist a customer who wants to convert their spare or decommissioned CW9800H1 or CW9800L operating in WLC mode to Campus Gateway Mode. The steps outlined are the pre-conversion steps outlined serve as a guide for you to follow prior to completing conversion. Review these steps and complete. Once completed open a case with Meraki Support and they will guide you through the rest of the conversion process.

Prerequisites

Console cable connection to device
Dashboard organization access with inventory permissions

Network requirements

TFTP/FTP server for image transfer
Port channel configuration between WLC and switch
Management VLAN connectivity

Firmware requirements

Wireless Controller Image:

CW9800H1
- IOS XE 17.15.5 - https://software.cisco.com/download/.../IOSXE-17.15.5
CW9800L
- IOS XE 17.18.3 - https://software.cisco.com/download/.../IOSXE-17.18.3

Step-by-step instructions

On Device pre-conversion steps

Step 1: Ensure the WLC is running the correct software version. If not, download and install the correct WLC version. See the Firmware Requirements section.

# show version

Step 2: Physically connect a console cable to RJ45 console port of the WLC. This will be needed to execute the steps that follow.

CW9800H1 Front Panel – Blue RJ45 Port is console port	CW9800L Front Panel - #3 is the Console Port / Blue RJ45 Port

Step 3: Ensure to back up all of the device configurations externally as these will get overridden once converted to Campus Gateway operation.

Converting to Campus Gateway operation will override the existing WLC configuration on the device.

CLI Commands to execute:

wr mem
copy startup-config <external destination>

Example to TFTP Server

copy startup-config tftp://10.14.99.30/WLC_backup.cfg

Step 4: Disconnect all the APs from the WLC which will be convert. It is recommended to move the APs to another WLC to maintain wireless connectivity for users during the conversion. Use the below command to verify there are no APs connected to the WLC.

CLI Commands to execute:

# show ap summary

Step 5: If the WLC is deployed in HA SSO, please disable any existing HA SSO configuration.

CLI Commands to execute:

Check SSO status:

#show chassis rmi

Disable SSO:

config t
no redun-management interface vlan <> chassis ...

Reload the WLC:

reload

Step 6: Once the WLC comes back up:

Ensure that all Access Points (APs) are removed
SSO is disjoined
No external entities (such as Catalyst Center, Cisco Spaces, etc.) are connected to the WLC

Step 7: Verify the configuration register is set to 0x2102. If it is not, change to 0x2102 and reload the device for the change to take effect

CLI Commands to execute:

conf t
config-register 0x2102
end
wr
Reload

Step 8: Factory reset the WLC.

CLI Commands to execute:

factory-reset all

Screenshot:

Step 9: Retrieve the Cloud ID for the WLC. This can be obtained from the output of the following command on the WLC. For example, Q5DB-HJ2Z-GU27 represents the Cloud ID.

WLC# show crypto pki trustpoints status | include cn
     cn=IOS-Self-Signed-Certificate-2245825410
     cn=IOS-Self-Signed-Certificate-2245825410
     cn=Cisco Licensing Root CA,o=Cisco
     o=Cisco,cn=High Assurance SUDI CA
     cn=Q5DB-HJ2Z-GU27,ou=ACT-2 Lite SUDI,o=Cisco,serialNumber=PID:CW9800H1 SN:FLX2642053V
     cn=Cisco Root CA 2099,o=Cisco
     cn=Cisco Manufacturing CA III,o=Cisco
     serialNumber=PID:CW9800H1 SN:FLX2642053V,cn=SWSUDI
     cn=Cisco Basic Assurance Root CA 2099,o=Cisco
     cn=Cisco Manufacturing CA SHA2,o=Cisco
     cn=SHA2,serialNumber=PID:CW9800H1 SN:FLX2642053V
     cn=Cisco Root CA M2,o=Cisco

In this output, the value labeled as “cn=Q5DB-HJ2Z-GU27” (under the SUDI certificate entry) corresponds to the Cloud ID.

Dashboard steps

Step 1: Inventory Management

a. Non-Cloud Monitored WLC: For the WLCs which are not added to Dashboard for use with Cloud Monitoring for Wireless, claim the WLC only to inventory of the Organization.

1. Navigate Organization > Configure > Inventory

2. Click + Claim Devices and enter the Cloud ID of the WLC. Please do not add the WLC to any network on the shard.

If claimed into a network follow steps in next section for Cloud Monitored devices.

b. Cloud Monitored WLC: For a Cloud Monitored WLC, please remove the device from the Network that it was added to in order to bring it back to the Organization Inventory.

Step 3: Open a support case on Dashboard to initiate the conversion process. Please provide the Cloud ID for the WLC to be converted.

On Device Conversion Steps

After a factory reset, verify that the WLC is running version 17.15.5 using the show version command. After the Support Case updates that the conversion can proceed, follow these steps:

Step 1: Confirm that the uplink interfaces are operational by checking

show ip interface brief

Example Output for a CW9800H1:

interface TwentyFiveGigE0/1/0
 switchport mode trunk
 channel-group 1 mode active
interface TwentyFiveGigE0/1/1
 switchport mode trunk
 channel-group 1 mode active
interface Port-channel1
 switchport mode trunk

Step 2: Validate that the uplink switch has the appropriate port channel configurations on the ports connected to the WLC. The ports should be configured in LACP mode active in trunk mode.

Note: The port channel configurations should be correct prior to completing the conversion to Campus Gateway operation as when operating as a CG, all the device ports come up in a single port channel by default.

Example:

interface TwentyFiveGigE0/1/0
 switchport mode trunk
 channel-group 1 mode active
interface TwentyFiveGigE0/1/1
 switchport mode trunk
 channel-group 1 mode active
interface Port-channel1
 switchport mode trunk

Step 3: Transfer the CG IOS XE image the WLC.

CLI Commands to execute:

copy tftp|ftp://<server>/<image-path>/<image-name> bootflash:

Screenshot:

Step 4: Configure the SELinux mode from Enforcing to Permissive.

CLI Commands to execute:

conf t
service internal
exit
set platform software selinux permissive

To verify SELinux mode:

# show platform software selinux

Screenshot:

Step 5: Change the config-register to 0x0 from default 0x2102 and set the boot system variable to bootflash:packages.conf

CLI Commands to execute:

config t
config-register 0x0
boot system flash bootflash:packages.conf
end
wr

To verify the modified config-register and boot system variable:

show version
show boot

Screenshot:

Step 6: Install the downloaded Campus Gateway image file. It is recommended to use the One Shot Image Upgrade.

CLI Commands to execute:

install add file bootflash:<image-name> activate commit prompt-level none

Note: The device will boot into ROMMON mode after install since the config-register was set to 0x0.

Step 7: For Campus Gateway operation, the USB port will be disabled. Enter the following commands to disable the USB port.

CLI Commands to execute:

set
USB_DISABLE=1
confreg 0X2102
set

Validate default variables are set such as:

BOOT=bootflash:packages.conf
USB_DISABLE=1

Boot the device:

sync
reset

The device will reset and boot with the CG Image.

Screenshot:

Step 8: Validate that the device is running the Campus Gateway image and the ROMMON variables were set. The default credentials are:

Username: admin
Password: Cloud ID of the Device

CLI Commands to execute:

show romvar → Verify USB_Disable=1
show install summary → Confirm the image file is in Committed state
show boot → Verify config-register is set to 0x2102
show boot → Verify packages.conf [E(11] [TS(12]

Screenshot:

Step 10: To ensure the device is ready to be onboarded to Dashboard, perform Level 3 reset for Day 0 configuration.

CLI Command to execute:

test platform software mcg reset

Screenshot:

Verification

Search Organization > Inventory, and select the Campus Gateway. Click Add to Network and go through the onboarding flow. Refer to the Onboarding flow section of the Campus Gateway deployment guide.