SSIDs, AP Management, and WLAN Configuration

A hotel wants three wireless networks: staff (secure, corporate VLAN), guests (open with captive portal, isolated), and IoT (devices like door locks and thermostats, restricted). All from one set of APs. The WLC is a Cisco 9800-L.

Three SSIDs, three WLANs, three VLANs. That's the standard enterprise wireless design — separate networks for different trust levels, all sharing the same physical infrastructure. The WLC maps each SSID to a VLAN and applies the appropriate security per SSID.

#SSID-to-VLAN Mapping#link

The WLC's `dynamic` interfaces are the glue. Each dynamic interface represents a VLAN and has an IP address in that VLAN's subnet. When you create a WLAN, you assign it to a dynamic interface — that's how the SSID ends up bridging clients into the right VLAN.

#Designing the Three SSIDs#link

#Guest Network Design#link

Guest networks deserve special attention. The default is not enough — guests should be isolated from corporate resources, rate-limited, and often subject to a captive portal for terms-of-service acceptance. Configuration checklist:

• ▪Dedicated VLAN with internet-only routing
• ▪ACL preventing access to internal RFC 1918 ranges (10.0.0.0/8, etc.)
• ▪Client isolation on the WLAN — guests can't see each other
• ▪Captive portal for acceptable-use acceptance (if required)
• ▪Rate limiting to prevent abuse of bandwidth
• ▪DNS filtering for malicious sites (optional but recommended)

#Configuring WLANs on a WLC#link

In the Cisco 9800 GUI: Configuration → Wireless → WLANs → Add. Fill in the profile name, SSID, and WLAN ID, then set the policy profile mapping to the dynamic interface and the security (WPA2/3, PSK or 802.1X). The WLC pushes this to all joined APs immediately.

#Check Your Understanding#link

#Common Mistakes#link

• ▪Creating a new SSID for every business need — consolidate first
• ▪Forgetting client isolation on guest networks
• ▪Using the same PSK for staff and IoT — one key for all defeats segmentation
• ▪Not configuring ACLs on the guest VLAN — guests reach internal resources
• ▪Broadcasting hidden SSIDs — it doesn't improve security and complicates client association