Wireless LAN GUI configuration
Interpret the controller GUI for WLAN creation, security settings, QoS profiles and advanced options for client connectivity.
WLAN creation fields
On a Cisco WLC, a WLAN is the controller-side definition of an SSID: its name, the interface/VLAN it maps to, security, QoS and advanced behavior. The blueprint asks you to *interpret* the GUI for client connectivity — recognize which settings matter and what each does, not memorize click paths.
WLAN creation — the fields that matter
| Setting | What it controls | Typical value |
|---|---|---|
| WLAN ID / Profile name | Internal identifier and label | e.g. 1 / CORP-SECURE |
| SSID | The broadcast network name clients see | e.g. CorpNet |
| Status | Enabled or admin-disabled | Enabled |
| Interface/Interface group | VLAN the WLAN drops client traffic into | The VLAN interface for this user segment |
| Security (L2) | Auth/encryption scheme | WPA2-PSK or WPA2-802.1X |
| Security (L3) | Web auth / passthrough if used | None for internal WLANs |
| QoS profile | Traffic priority ceiling for the WLAN | Platinum (voice), Gold (video), Silver (best effort), Bronze (background) |
- WLAN
- SSID 'CORP', Interface 'vlan20-dyn', Security WPA2/AES+PSK, QoS Silver, Status enabled
- Enabled status + SSID set → the network is advertised.
- Interface mapping to vlan20-dyn → clients land in VLAN 20 — verify that VLAN exists on the WLC uplink.
- WPA2/AES with PSK → a compatible client-side pre-shared key is required.
- QoS Silver → ordinary data ceiling; a voice WLAN would need Platinum.
Every field has a connectivity consequence — read the profile as a checklist against the client symptoms.
QoS profiles and advanced settings
WLC QoS profiles
| Profile | Intended traffic |
|---|---|
| Platinum | Voice |
| Gold | Video |
| Silver | Best effort (default for general data) |
| Bronze | Background/scavenger |
Advanced WLAN settings commonly shown in the GUI: band select (steer dual-band clients toward 5 GHz), client load limits, session timeout, client exclusion after repeated auth failures, DHCP address assignment required (forces clients through DHCP), and Coverage Hole Detection / Aironet IE options. Recognize their purpose; exact defaults are controller-version dependent.
Interpreting settings for connectivity
GUI fields → common client symptoms
| Field to check | If wrong, clients see… |
|---|---|
| Status disabled | SSID invisible / association refused |
| Wrong interface/VLAN mapping | Associates but gets wrong or no IP |
| Security mismatch (e.g. 802.1X vs client PSK) | Authentication failure at join |
| DHCP required + client static IP | Client cannot pass traffic |
| QoS profile too low | Voice/video quality issues under load |
Common mistakes
- Treating the WLAN ID/Profile name as the SSID — the SSID is the broadcast name field.
- Creating the WLAN but leaving it disabled — the SSID never appears.
- Mapping the WLAN to a VLAN that isn't carried on the WLC uplink.
- Expecting the GUI profile alone to deliver DHCP — the VLAN-side relay must exist too.
Observation: Clients on the new WLAN receive addresses in the guest VLAN's scope.
- WLAN mapped to the wrong dynamic interface
- Trunk toward the WLC carries the wrong allowed VLANs
- DHCP helper on the wrong SVI
| Check | Indicates |
|---|---|
| WLAN → interface mapping in the GUI | Confirms the intended VLAN binding. |
| WLC uplink trunk allowed list | The intended VLAN must be present. |
| DHCP scope actually serving the VLAN | Verifies where leases originate. |
Correction: Rebind the WLAN to the correct interface and confirm the VLAN path.
New clients lease in the intended subnet and reach their gateway.
Sources
- Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
- Wi-Fi Alliance — Security — reviewed 2026-11-02
Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.