Deny Wireless Client Session Establishment Using Calendar Profiles

Information About Denial of Wireless Client Session Establishment

Denial of client session establishment feature allows the controller to stop client session establishment based on a particular time. This helps control the network in efficient and controlled manner without any manual intervention.

In Cisco Catalyst 9800 Series Wireless Controller , you can deny the wireless client session based on the following recurrences:

  • Daily

  • Weekly

  • Monthly

The Calendar Profiles created are then mapped to the policy profile. By attaching the calendar profile to a policy profile, you will be able to create different recurrences for the policy profile using different policy tag.


Note

You need to create separate Calendar Profile for Daily, Weekly, and Monthly sub-categories.

The following is the workflow for denial of wireless client session establishment feature:

  • Create a calendar profile.

  • Apply the calendar profile to a policy profile.

Note

A maximum of 100 calendar profile configuration and 5 calendar profile association to policy profile is supported.

Points to Remember

If you boot up your controller, the denial of client session establishment feature kicks in after a minute from the system boot up.

If you change the system time after the calendar profile is associated to a policy profile, you can expect a maximum of 30 second delay to adapt to the new clock timings.


Note

You cannot use the no action deny-client command to disable action while associating the calendar profile to a policy profile.

If you want to disable the action command, you need to disassociate the calendar profile from the policy profile, and re-configure again.

Configuring Daily Calendar Profile

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile calendar-profile name name

Example:

Device(config)# wireless profile calendar-profile name daily_calendar_profile

Configures a calendar profile.

Here,

name refers to the name of the calendar profile.

Step 3

start start_time end end_time

Example:

Device(config-calendar-profile)# start 09:00:00 end 17:00:00

Configures start and end time for the calendar profile.

Here,

start_time is the start time for the calendar profile. You need to enter start time in HH:MM:SS format.

end_time is the end time for the calendar profile. You need to enter end time in HH:MM:SS format.

Step 4

recurrence daily

Example:

Device(config-calendar-profile)# recurrence daily

Configures daily recurrences for a calendar profile.

Step 5

end

Example:

Device(config-calendar-profile)# end

Returns to privileged EXEC mode.

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Note

 

When the calendar profile kicks in, the AP power profile rules (for example, radio state and USB device state) that are defined for the Ethernet speed are not applied and continue to be as per the fixed power profile.

Configuring Weekly Calendar Profile

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile calendar-profile name name

Example:

Device(config)# wireless profile calendar-profile name weekly_calendar_profile

Configures a calendar profile.

Here,

name refers to the name of the calendar profile.

Step 3

start start_time end end_time

Example:

Device(config-calendar-profile)# start 18:00:00 end 19:00:00

Configures start and end time for the calendar profile.

Here,

start_time is the start time for the calendar profile. You need to enter start time in HH:MM:SS format.

end_time is the end time for the calendar profile. You need to enter end time in HH:MM:SS format.

Step 4

recurrence weekly

Example:

Device(config-calendar-profile)# recurrence weekly

Configures weekly recurrences for the calendar profile.

Step 5

day {friday | monday | saturday | sunday | thursday | tuesday | wednesday}

Example:


Device(config-calendar-profile)# day friday
Device(config-calendar-profile)# day monday

Configure days when the weekly calendar needs to be active.

Note

 

You can configure multiple days using this command.

Step 6

end

Example:

Device(config-calendar-profile)# end

Returns to privileged EXEC mode.

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring Monthly Calendar Profile

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile calendar-profile name name

Example:

Device(config)# wireless profile calendar-profile name monthly_calendar_profile

Configures a calendar profile.

Here,

name refers to the name of the calendar profile.

Step 3

start start_time end end_time

Example:

Device(config-calendar-profile)# start 18:00:00 end 19:00:00

Configures start and end time for the calendar profile.

Here,

start_time is the start time for the calendar profile. You need to enter start time in HH:MM:SS format.

end_time is the end time for the calendar profile. You need to enter end time in HH:MM:SS format.

Step 4

recurrence monthly

Example:

Device(config-calendar-profile)# recurrence monthly

Configures monthly recurrences for the calendar profile.

Step 5

date value

Example:

Device(config-calendar-profile)# date 25

Configures a date for the calendar profile.

Note

 

If the requirement is to perform denial of service in certain timing, such as, 2,10, and 25 of every month, all three days need to be configured using the date command. There is no range for date. You need to configure the dates as per your requirement.

Step 6

end

Example:

Device(config-calendar-profile)# end

Returns to privileged EXEC mode.

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Mapping a Daily Calendar Profile to a Policy Profile

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile policy profile-name

Example:

Device(config)# wireless profile policy default-policy-profile

Creates policy profile for the WLAN.

The profile-name is the profile name of the policy profile.

Step 3

calender-profile name calendar-profile-name

Example:

Device(config-wireless-policy)# calender-profile name daily_calendar_profile

Maps a calendar profile to a policy profile.

The calendar-profile-name is the name of the calendar profile name created in .

Note

 

You need to disable Policy Profile before associating a calendar profile to a policy profile. The following needs to be done:

Device(config-wireless-policy)# shutdown

Step 4

action deny-client

Example:

Device(config-policy-profile-calender)# action deny-client

Configures deny client session establishment during calendar profile interval.

Note

 

Client associations are denied daily between timeslot 9:00:00 to 17:00:00. For start and end time details, see .

Step 5

end

Example:

Device(config-policy-profile-calender)# end

Returns to privileged EXEC mode.

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Mapping a Weekly Calendar Profile to a Policy Profile

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile policy profile-name

Example:

Device(config)# wireless profile policy default-policy-profile

Creates policy profile for the WLAN.

The profile-name is the profile name of the policy profile.

Step 3

calender-profile name calendar-profile-name

Example:

Device(config-wireless-policy)# calender-profile name weekly_calendar_profile

Maps a calender profile to a policy profile.

The calendar-profile-name is the name of the calendar profile name created in .

Note

 

You need to disable Policy Profile before associating a calendar profile to a policy profile. The following needs to be done:

Device(config-wireless-policy)# shutdown

Step 4

action deny-client

Example:

Device(config-policy-profile-calender)# action deny-client

Configures deny client session establishment during calendar profile interval.

Note

 

Client associations are denied daily between timeslot 9:00:00 to 17:00:00. For start and end time details, see .

On Monday and Tuesday, clients are denied between 17:30:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.

On 25th of every month, clients are denied between 18:00:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.

Step 5

end

Example:

Device(config-policy-profile-calender)# end

Returns to privileged EXEC mode.

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Mapping a Monthly Calendar Profile to a Policy Profile

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile policy profile-name

Example:

Device(config)# wireless profile policy default-policy-profile

Creates policy profile for the WLAN.

The profile-name is the profile name of the policy profile.

Step 3

calender-profile name calendar-profile-name

Example:

Device(config-wireless-policy)# calender-profile name monthly_calendar_profile

Maps a calender profile to a policy profile.

The calendar-profile-name is the name of the calendar profile name created in .

Step 4

action deny-client

Example:

Device(config-policy-profile-calender)# action deny-client

Configures deny client session establishment for the defined calendar profile interval.

Note

 

Every day client associations are denied between timeslot 9:00:00 to 17:00:00. For start and end time details, see .

On Monday and Tuesday, clients are denied between 17:30:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.

On 25th of every month, clients are denied between 18:00:00 and 19:00:00 besides regular time 9:00:00 to 17:00:00.

Step 5

end

Example:

Device(config-policy-profile-calender)# end

Returns to privileged EXEC mode.

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Verifying Calendar Profile Configuration

To view the summary of calendar profiles, use the following command:

Device# show wireless profile calendar-profile summary
Number of Calendar Profiles: 3

Profile-Name                       
---------------------------------
monthly_25_profile                 
weekly_mon_profile                 
daily_calendar_profile

To view the calendar profile details for a specific profile name, use the following command:

Device# show wireless profile calendar-profile detailed daily_calendar_profile
Calendar profiles                          : daily_calendar_profile
------------------------------------------------------------------
Recurrence                                : DAILY
Start Time                                : 09:00:00
End Time                                  : 17:00:00

Verifying Policy Profile Configuration

To view the detailed parameters for a specific policy profile, use the following command:

Device# show wireless profile policy detailed default-policy-profile
Tunnel Profile
  Profile Name                      : Not Configured
Calendar Profile
  Profile Name                      : monthly_25_profile
  Wlan Enable                       : Not Configured
  Client Block                      : Client Block Configured
  ----------------------------------------------------
  Profile Name                      : weekly_mon_profile
  Wlan Enable                       : Not Configured
  Client Block                      : Client Block Configured
  ----------------------------------------------------
  Profile Name                      : daily_calendar_profile
  Wlan Enable                       : Not Configured
  Client Block                      : Client Block Configured
  ----------------------------------------------------
Fabric Profile
  Profile Name                      : Not Configured

To view the configured calendar profile information under policy profile, use the following command:

Device# show wireless profile policy all
Tunnel Profile
Profile Name : Not Configured
Calendar Profile
Profile Name : daily_calendar_profile
Wlan Enable : Not Configured
Client Block : Client Block Configured
----------------------------------------------------
Profile Name : weekly_calendar_profile
Wlan Enable : Not Configured
Client Block : Client Block Configured
----------------------------------------------------
Fabric Profile
Profile Name : Not Configured

Note
The anchor priority is always displayed as local. Priorities can be assigned on the foreign controller.