1.0 Overview

This document provides a comprehensive technical guide for migrating Cisco Access Points (APs) from a Mobility Express (ME) environment to a new Catalyst 9800 Series Wireless LAN Controller (WLC). The core objective is to ensure a seamless and structured transition with minimal service disruption. This process involves significant architectural differences between the two platforms, most notably the shift from the ME’s simplified configuration to the Catalyst 9800’s powerful new Tag-based configuration model on IOS-XE.

2.0 Technical Problem Analysis

The primary technical challenge is redirecting APs currently managed by a Mobility Express Master AP to a newly deployed, centralized Catalyst 9800 WLC. The initial approach focuses on “priming” the APs with the IP address of the new controller. While this is a critical step, it represents only one component of a successful migration. A robust solution must account for pre-migration planning, comprehensive 9800 controller configuration, licensing, and post-migration validation.

3.0 Comprehensive Migration Solution

This solution is structured in four distinct phases to ensure a controlled and predictable migration.

Phase 1: Pre-Migration Planning and Catalyst 9800 Staging

This preparatory phase is the most critical for success. Before any APs are moved, the Catalyst 9800 WLC must be fully staged and validated to replicate and enhance the services provided by the Mobility Express environment.

1. Configuration Audit: Document the complete configuration of the existing Mobility Express network, including all SSIDs, security settings (WPA2/WPA3-PSK, 802.1X RADIUS server details), VLAN mappings, ACLs, and RF parameters.
2. Licensing and Compatibility:
   • Ensure the Catalyst 9800 WLC is licensed correctly with DNA Essentials or Advantage licensing. This is a mandatory prerequisite, as the 9800 licensing model differs from the license-free ME model.
   • Verify that all AP models in the ME network are supported by the target IOS-XE software version running on the Catalyst 9800.
3. Catalyst 9800 Configuration: Implement the new configuration model to mirror the ME services. This involves:
   • Interfaces: Configure all necessary VLANs as trunked ports on the 9800’s switch-facing interface and create the corresponding Switched Virtual Interfaces (SVIs).
   • WLAN Profiles: Create a WLAN Profile for each SSID, defining the SSID name, security type (PSK, 802.1X), and other layer 2 parameters.
   • Policy Profiles: Create Policy Profiles to link WLAN Profiles to specific VLANs and define session timeouts, Quality of Service (QoS), and other L3+ policies.
   • Site, Policy, and RF Tags: This is the core of the 9800 architecture.
     • Create Policy Tags that map specific WLAN Profiles to Policy Profiles. This defines which SSIDs are broadcast and what policies are applied.
     • Create Site Tags to define AP-specific parameters, such as the primary and secondary 9800 WLCs for join priority.
     • Create RF Tags to assign custom RF Profiles for fine-tuning radio behavior (RRM, CleanAir, power levels).
   • AAA Configuration: Configure all necessary RADIUS or other authentication servers for 802.1X-enabled WLANs.
   • Global Configuration: Ensure fundamental settings like NTP, DNS, and system logging are correctly configured on the 9800.

Phase 2: Access Point Migration Strategy

With the 9800 fully staged, the next step is to prepare the APs for the move.

1. AP Image Pre-download (Recommended Best Practice): To minimize downtime during the cutover, instruct the APs to pre-download the required IOS-XE image from the 9800 WLC while they are still active on the ME controller. This is done from the ME controller CLI:
   config ap image predownload
2. AP Priming: The most direct method to redirect APs is to statically configure the new 9800 WLC’s IP address on each AP. This is executed from the ME controller CLI:
   config ap primary-base <WLC_Name> <9800_WLC_IP_Address>
   Note: Other discovery mechanisms like DHCP Option 43 or DNS resolution of CISCO-CAPWAP-CONTROLLER.localdomain can also be used but priming provides the most deterministic control.

Phase 3: Execution and Cutover

This phase should be conducted during a scheduled maintenance window.

1. Reboot Access Points: After priming the APs, initiate a reboot from the ME controller. This can be done for all APs simultaneously or in a phased approach for larger environments.
2. AP Join Process: Upon reboot, the APs will use the primed IP address to discover and initiate a CAPWAP tunnel with the Catalyst 9800 WLC. If a new software image is required (and was not pre-downloaded), the AP will download it, reboot again, and then rejoin.
3. Tag Assignment: Once joined, the APs must be assigned the correct Tags (Policy, Site, RF) created in Phase 1. This can be done manually per AP or by creating Filter rules on the 9800 to automatically assign tags based on criteria like AP name or location. Once the tags are applied, the APs will begin broadcasting the configured SSIDs.

Phase 4: Post-Migration Validation

1. Verify AP Status: On the Catalyst 9800 WLC CLI, use the following commands to confirm that all APs have joined successfully:
   show ap summary
show ap tag summary
2. Verify Service Status: Confirm that all WLANs are broadcasting and operational:
   show wlan summary
3. Client Connectivity Testing: Perform end-to-end testing by connecting wireless clients to each migrated SSID. Verify they receive the correct IP address from the expected VLAN and can access network resources as intended. Monitor client status with:
   show wireless client summary

By following these structured phases, the migration from Mobility Express to a Catalyst 9800 platform can be executed efficiently, ensuring configuration parity and operational readiness.