TechKnowSurge

Cisco CCNA 2.7 Cisco CCNA 2.6 Cisco CCNA 2.8 Cisco CCNA 2.9 Cisco CCNA 5.8 Cisco CCNA 5.3

VideoNetworkFree

DEMO: WLC Management

Wireless LAN Controller (WLC) management covers three interface types—dynamic, management, and virtual—along with access controls for web, SSH, Telnet, and local versus RADIUS-based administrator authentication.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Wireless LAN Controller (WLC) management requires a clear understanding of the three logical interface types available on the platform. Dynamic interfaces are user-facing VLAN interfaces, representing segments such as operations and sales networks that carry end-user traffic. The management interface is the controller's primary IP address, used for administrative access via SSH or Telnet, CAPWAP communication with wireless access points, and outbound connections to AAA infrastructure such as RADIUS servers. The virtual interface operates in the background, supporting mobility management, DHCP relay, and embedded Layer 3 security without direct administrator interaction under normal operations. Administrative access to the WLC is configurable across several channels. Web-based management can be restricted to HTTPS only by disabling plain HTTP, and CLI access via Telnet or SSH carries a default session timeout of five minutes. Local management accounts can be created directly on the controller, and these coexist with accounts authenticated through an external RADIUS or TACACS server. The priority order for administrator authentication is defined under the Security tab and determines whether the controller attempts local or external authentication first. A notable behavior applies when local authentication is set as the secondary option: if the primary RADIUS server is reachable but does not recognize the user, access is denied; the controller falls back to local credentials only when the external server is completely unreachable.

What you'll learn

Identify the three interface types on a Cisco Wireless LAN Controller — dynamic, management, and virtual — and describe the role of each
Configure management access settings on a Cisco WLC, including HTTP/HTTPS access, Telnet/SSH options, local management users, and authentication priority order for RADIUS and local accounts

What's covered

WLC Management

Interface Types
- Dynamic Interfaces
  - Associated with VLANs
  - User network segments
- Management Interface
  - Primary IP address
  - CAPWAP access point setup
  - AAA/RADIUS communication
- Virtual Interface
  - Mobility and DHCP relay
  - Layer 3 security
Management Access Methods
- Web Interface (HTTP/HTTPS)
  - Disable HTTP, allow HTTPS
- Telnet and SSH
  - 5-minute session timeout
- Serial Port Connection
Management User Accounts
- Local Management Users
  - Add or manage accounts
- RADIUS Server Auth
  - Supports remote users
- Authentication Priority Order
  - Local, RADIUS, TACACS
  - Local as fallback only

Aligned to

Cisco CCNA

2.7 Describe physical infrastructure connections of WLAN components

2.6 Describe Cisco Wireless Architectures and AP modes

2.8 Describe network device management access

2.9 Interpret the wireless LAN GUI configuration for client connectivity

5.8 Compare authentication, authorization, and accounting concepts

5.3 Configure and verify device access control using local passwords

Key terms

Wireless LAN Controller: A network device that provides centralized management of multiple lightweight wireless access points, handling functions such as client authentication, roaming, radio frequency management, and security policy enforcement. WLCs communicate with APs using CAPWAP and allow network-wide wireless configuration from a single management point.
Dynamic Interface: A WLC interface type that maps to a specific VLAN and carries user network traffic for that segment.
Virtual Interface: A WLC interface type that supports mobility management, DHCP relay, and Layer 3 security functions rather than carrying standard user data.
Virtual LAN: A logical grouping of network devices that behave as if they are on the same network regardless of physical location.
Secure Shell: A cryptographic network protocol that provides secure remote login and command execution over an unsecured network.
Authentication: The process of verifying the identity of a user, device, or system.
Remote Authentication Dial In User Service: A network protocol that provides centralized authentication, authorization, and accounting (AAA) for users and devices connecting to a network, commonly used with 802.1X and VPN deployments. RADIUS uses UDP and encrypts only the password field in its messages.

Topics

Wireless Lan Controller Wlc Management Cisco Wireless Network Interfaces Radius Authentication Ssh Telnet Networking

Transcript

There's a few more management aspects that we need to cover with our wireless LAN controller.

Interface Types

From a physical perspective we have four ports on our wireless LAN controller, but we've already taken a look at the interfaces, which shows us a little different view into this. I'm going to go to controllers and go to interfaces, and I see these interfaces here, I see the VLANs that they're associated with, and I see this interface type. According to this interface type there's two different types, dynamic and static, but there's really three different types according to Cisco. We do have this dynamic type that's right here, and we'll talk about that here in a second. We also have a management interface, and then we have a virtual interface.

First of all, let's talk about dynamic. Dynamic is one that we can associate with a VLAN. These are our VLAN interfaces; they call them dynamic interfaces on the wireless LAN controller. So the dynamic interfaces that we have here are the exact Ops and sales, and those are our user networks.

Then we have the virtual. Virtual is associated with supporting mobility management, DHCP relay, and some embedded layer 3 security. We're not going to get real in depth into it, just know that there's this virtual interface.

The Management Interface

Then we have the management interface. The management interface is the first interface that we set up as we went through the setup of this device. It does quite a few different things. That's the main interface that we're interacting with right now. In fact, you can see the address of it is 10.1.10.5, so up here in the controller it's 10.1.10.5. If I were to telnet or SSH into this device I would use that IP address.

When we set up the wireless access points to connect into this device, we use the IP address of 10.1.10.5, its management interface. So the process of that CAPWAP of setting up the wireless access points is using this management interface as well, and all the traffic is getting tunneled across to that IP address. And if this wireless LAN controller is using like a AAA server, like a RADIUS server or some other authentication server, or other services out there, they use this 10.1.10.5. So this management interface is really key to a lot of the interaction that happens between this wireless LAN controller and other devices. So just be aware of that, and there are three different types once again: dynamic, management and virtual.

Web, Telnet and SSH Access

I did mention telnet and SSH. What I can do is I can go under this management tab and I can see that there's some settings under here. One of them is this web interface. If I want to control, maybe I want to disable the HTTP access to this and only allow HTTPS, then I could come in here and disable this to only allow HTTPS access. I'm not going to commit this change though, not at least at this point in time.

Under telnet and SSH I could go under here, and in here I have some settings as well, where I can disable or enable to allow telnet. I do notice that the session timeout for telnet and SSH is five minutes, so after five minutes if I'm SSHed into this it should time out. So there are some different interfaces. I've also got the serial port if I want to change the serial port connection on this device.

Local Management Users

I also have local management users, and this right here shows the WLC admin account right here. So I'm able to add a new user to this to allow others to manage this device as well.

Now let's say I create a user named Andrew on here, but it's also connecting through RADIUS. It can actually use both RADIUS for me to manage this device, and it also could use this local management users, so I could use either one. So then that raises an interesting question: if I have Andrew on my RADIUS server and Andrew on the local server, which one will it use?

Authentication Priority Order

The answer to that is actually under the security tab. I can go to the security tab, and what I can do is I can look at this priority order and I select management users. So under the management users it shows me the order used for authentication, and it has local first and then RADIUS. I could actually change it too. You can see I can move these up and down, or I could include a TACACS+ server, so I can include these different servers, move them up and down.

Notice it says if the local is selected as a second priority, then the user will authenticate against local only if the priority is unreachable. So in other words, if I select the local as being the second, what it's going to do is it's going to try to authenticate with the RADIUS server. If it connects to the RADIUS server and that user is not there, then I'm not going to be able to log into this. But if that RADIUS server is down, then it will go to the local and authenticate with the local server.

There's obviously quite a bit more that we could cover with this management, but we hit the highlights of how to manage this wireless LAN controller.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →