Secure Data Wipe

This feature allows you to securely erase files from the file system of the Cisco Access Points.

For more information, see the chapter Secure Data Wipe.

Mesh feature and Mesh + Flex feature is supported in Cisco Catalyst 9124AXE outdoor Access Points.

For more information, see the chapter Mesh Access Points.

Mesh feature and Mesh + Flex feature is supported in Cisco Catalyst 9124AXI/D outdoor Access Points.

For more information, see the chapter Mesh Access Points.

Support for SGT Inline Tagging Over Port-Channel Uplink

SGT inline tagging over port-channel uplink is supported in Cisco IOS XE Amsterdam 17.3.5a for Cisco Catalyst 9800-L Wireless Controller, Cisco Catalyst 9800-40 Wireless Controller, and Cisco Catalyst 9800-80 Wireless Controller.

For more information, see the Cisco TrustSec chapter.

Cisco Catalyst 9124AXE Access Point

Cisco Catalyst 9124AXE Access Point is supported from this release.

The supported regulatory domains are A, B, E, and Z.

Cisco Catalyst 9124 Access Points

• Cisco Catalyst 9124AXD Access Points

• Cisco Catalyst 9124AXI Access Points

Overlapping Client IP Address in Flex Deployment

This feature offers overlapping IP address across various flex sites and provides all the functionalities that are supported in flex deployments.

For more information, see the Overlapping Client IP Address in Flex Deployment chapter.

Plug and Play Support for Cisco DNA Center Provisioning

From this release, the controller supports PnP feature, which allows for automated provisioning on DNA Center (DNAC 2.1.2.x release and above).

Smart Software Manager On-Prem (SSM On-Prem) Support for Smart Licensing Using Policy

SSM On-Prem is an asset manager, which works in conjunction with CSSM. It enables you to administer products and licenses on your premises instead of having to directly connect to CSSM.

Here, a product instance is connected to SSM On-Prem, and SSM On-Prem becomes the single point of interface with CSSM. The product instance can be configured to push the required information to SSM On-Prem. Alternatively, SSM On-Prem can be set-up to pull the required information from a product instance at a configurable frequency. After usage information is available in SSM On-Prem, you must synchronize the same with CSSM, to ensure that the product instance count, license count and license usage information is the same on both, CSSM and SSM On‐Prem. Offline and online options are available for synchronization between CSSM and SSM On‐Prem.

Minimum Required SSM On-Prem Version: Version 8, Release 202102

Minimum Required Cisco IOS XE Version: Cisco IOS XE Amsterdam 17.3.3

For more information, see the Smart Licensing Using Policy chapter and the Command Reference guide.

From this release onwards, the controller supports deployment of both Cisco DNA Spaces IoT Services and Network Assurance on Cisco DNA Center. However, IoT Services and Intelligent Capture (iCAP) port configuration are still mutually exclusive.

For more information, see IoT Services Management chapter.

AP Authorization Using Serial Number

From this release onwards, serial number authorization is applicable to all the access points. When serial-number authorization is enabled, the controller uses the top-assembly serial number for the authorization of the AP.

For more information, see Authorizing Access Points section in Converting Autonomous Access Points to Lightweight Mode chapter.

OEAP Personal SSID Support

From this release onwards, the Cisco OfficeExtend Access Point (OEAP) supports personal SSID. This enables a local home client to use the same OEAP for local networking and internet connectivity.

For more information, see OEAP Personal SSID section in FlexConnect chapter.

Smart Licensing Using Policy

An enhanced version of Smart Licensing, with the overarching objective of providing a licensing solution that does not interrupt the operations of your network, rather, one that enables a compliance relationship to account for the hardware and software licenses you purchase and use.

With this licensing model, you do not have to complete any licensing-specific operations, such as registering or generating keys before you start using the software and the licenses that are tied to it. Only export-controlled and enforced licenses require Cisco authorization before use. License usage is recorded on your device with timestamps and the required workflows can be completed at a later date.

Multiple options are available for license usage reporting – this depends on the topology you implement. You can use the Cisco Smart Licensing Utility (CSLU) Windows application, or report usage information directly to CSSM. A provision for offline reporting for air-gapped networks, where you download usage information and upload to CSSM, is also available.

Starting with this release, Smart Licensing Using Policy is automatically enabled on the device. This is also the case when you upgrade to this release. By default, your Smart Account and Virtual Account in CSSM is enabled for Smart Licensing Using Policy.

For more information, see the Smart Licensing Using Policy chapter.

Cisco DNA Center Support for Smart Licensing Using Policy

Cisco DNA Center supports Smart Licensing Using Policy functionality starting with Cisco DNA Center Release 2.2.2. The corresponding minimum required Cisco IOS XE Release for this platform is Cisco IOS XE Amsterdam 17.3.2a.

Implement the “Connected to CSSM Through a Controller” topology to have Cisco DNA Center manage a product instance. When you do, the product instance records license usage, but it is the Cisco DNA Center that initiates communication with the product instance to retrieve and report usage to Cisco Smart Software Manager (CSSM), and returns the acknowledgement (RUM ACK).

In order to meet reporting requirements, Cisco DNA Center provides ad hoc or on-demand reporting, as well as scheduled reporting options.

For more information, see the Smart Licensing Using Policy chapter.

Access Point Audit Configuration

In this release, AP Audit Configuration feature helps to detect wireless service synchronization issues between the controller and AP. Two methods are implemented to support the AP audit configuration.

The following commands were introduced:

• ap audit-report

• show ap audit-report summary

• show ap audit-report detail

For more information, see the AP Audit Configuration chapter.

Access Point Image Download Time Enhancement

This feature adds support to multiple sliding windows for control packets going from controller to AP.

The following commands were introduced:

• capwap window size

• show capwap client rcb

For more information, see the AP Image Download Time Enhancement chapter.

Access Point Support Bundle

You can now retrieve the support bundle information of an AP and export it to the controller or an external server. The AP support bundle contains core files, crash files, show run-configuration, configuration commands, msglog, and traplog.

Until Cisco IOS XE 17.2.1 Release, you had to login to the AP console to retrieve the AP support-bundle information.

The following commands were introduced:

• ap name export support-bundle mode

• show ap support-bundle summary

For more information about Access Point Support Bundle, see AP Support Bundle chapter.

Application Visibility and Control support

From this release onwards, AVC is supported on Cisco Industrial Wireless 3702 Access Point.

BLE Management in the Controller

From this release onwards, you can enable the BLE radio configuration globally, manually configure gRPC token on the controller, and manually enable gRPC in the AP profile.

The following commands were introduced:

• ap dot15 shutdown

• ap cisco-dna token

• cisco-dna grpc

• show ap ble summary

• show ap name ble detail

• show ap grpc summary

• show ap name grpc detail

For more information about BLE management in the controller, see BLE Management in the Controller chapter.

Cisco DNA Center Assurance Wi-Fi 6 ²

The Cisco DNA Center Assurance Wi-Fi 6 dashboard provides a visual representation of the wireless network.

In this release, commands to troubleshoot this network is introduced.

• statistics traffic-distribution

• show wireless stats ap name traffic-distribution slot packet-count signal

• show wireless stats ap name traffic-distribution slot airtime access-category

• show wireless stats ap name traffic-distribution slot airtime traffic-type

• show wireless stats ap name traffic-distribution slot latency access-category

For more information, see Cisco DNA Center Assurance Wi-Fi 6 Dashboard chapter.

Client Roaming Across Policy Profile

The controller allows seamless roaming between same WLAN associated with different policy profile.

For more information, see

The following command was introduced:

• wireless client vlan-persistant

Support for Spectrum Intelligence in Cisco Catalyst 9115 AP

From this release, Spectrum Intelligence feature is supported on Cisco Catalyst 9115 Access Points.

• show cleanair interferers

• show cleanair status

• debug cleanair major

• debug cleanair event

• debug cleanair raw 10

For more information, see Spectrum Intelligence chapter.

Embedded Wireless on Cisco Catalyst 9000 Series Switches for Single Secure Site Deployment (Non-SDA)

The Cisco Integrated Wireless on Cisco Catalyst 9000 Series Switches is the next-generation Wi-Fi solution, combining the most advanced features of the Cisco Catalyst 9800 Series Wireless controller with the Catalyst 9000 series switches, creating a best-in-class wireless experience that provides enterprise-class resiliency, security, and IT simplicity for single site deployments.

For more information, see Embedded Wireless on Cisco Catalyst 9000 Series Switches for Single Secure Site Deployment (Non-SDA) chapter.

Enable/Disable IW3702 Heaters

Cisco Industrial Wireless 3702 Access Point has two heaters that are enabled by default and will start to work when the environment temperature is under -20°C. If you determine that the environment temperature where the AP is deployed will never be under -20°C, you can turn off the heaters, which allows the APs to request less power from the device when the AP is powered by PoE+.

To display the AP temperature, status, and the heater operational status you can use the following command.

• show ap name temperature

Enhanced Certificate Management Through GUI

The Public Key Infrastructure (PKI) Management page now displays the following tabs:

Trustpoints tab: Used to add, create or enroll a new trustpoint. This also displays the current Trustpoints configured on the controller and other details of the trustpoint. You can also see if the trustpoint is in use for any of the features.

CA Server tab: Used to enable or disable the Certificate Authority (CA) server functionality on the controller. The CA server functionality should be enabled for the controller to generate a Self-Signed Certificate (SSC).

Key Pair Generation tab: Used to generate key pairs.

Certificate Management tab: Used to generate and manage certificates, and perform all certificate related operations, on the controller.

For more information about certificate management, see Certificate Management chapter.

Enhanced Mesh Convergence

Mesh convergence allows MAPs to reestablish connection with the controller, when it loses backhaul connection with the current parent.

Ethernet Daisy Chain on Cisco Industrial Wireless 3702

The Cisco Industrial Wireless 3702 Access Points have the capability to daisy chain APs when they function as MAPs. The daisy chained MAPs can either operate the APs as a serial backhaul, allowing different channels for uplink and downlink access, thus improving backhaul bandwidth, or extend universal access.

The following command was introduced:

• ssid broadcast persistent

External Modules

External module enables traffic to flow in and out from the Cisco Aironet Developer Platform module, when an AP is in both local and flex connect mode.

In this release, the following command was introduced:

• remote-lan rlan-profile policy rlan-policy ext-module

For more information on configuring external modules, see RLAN External Module chapter.

Flexible Antenna Port Configuration for Cisco Industrial Wireless 3702

The presence of multiple antennas on the transmitters and the receivers of APs results in better performance and reliability of the APs.

The following commands were introduced:

• ap name antenna-band-mode

• show ap general config

For more details, see Cisco Flexible Antenna Port chapter.

gNMI Configuration Persistence

The gNMI Configuration Persistence feature ensures that all successful configuration changes made through gNMI SET persists in the configuration after a device restart.

Hotspot 2.0 Updates

The Hotspot 2.0 R3 has added options such as new ANQP elements, Terms & Conditions, and integration of OSEN security and WPA2 security on the same SSID:

The following commands were introduced:

• advice-charge

• eap-method

• inner-auth-eap

• inner-auth-non-eap

• nai-realm

• plan

• terms-conditions

• tunneled-eap-credential

• url

• vlan-name

• vlan-id

• vlan encryption osen

For more information on the Hotspot 2.0 feature enhancements, see Hotspot 2.0 chapter.

HTTP and HTTPS Requests for Web Authentication

From Cisco IOS XE Amsterdam 17.3.1 onwards, to control the HTTP and HTTPS requests sent to the web authentication module, new commands that are listed below are introduced under the global parameter map parameters.

The following commands were introduced:

• secure-webauth-disable

• webauth-http-enable

For more information, see Configuring HTTP and HTTPS Requests for Web Authentication section.

IoT Module Management in the Controller

The IoT Module Management solution uses the USB interface on the Cisco Catalyst 9105AXI, 9105AXW, 9115AX, 9117AX, 9120AX, and 9130AX series Access Points, to connect to the IoT connector. These APs host the third party application software components, that act as containers. Cisco DNAC helps in the provisioning, deployment, and in controlling the container applications on the APs. The controller and the APs are managed by Cisco DNAC. You can connect the USB modules to the APs, then login to the controller and run the commands to enable the USB and Cisco IOx application to the APs associated in the AP profile group.

The following commands were introduced:

• ap dot15 shutdown

• ap cisco-dna token

• cisco-dna grpc

• show ap ble summary

• show ap name ble detail

• show ap grpc summary

• show ap name grpc detail

For more information, see IoT Module Management in the Controller chapter.

Mesh - 2.4 GHz Mesh Backhaul

In certain countries, you might prefer to use 2.4 GHz radio frequencies to achieve much larger mesh or bridge distances.

For more information, see Mesh Access Points chapter.

Mesh Off Channel Background Scanning

This release supports off channel background scanning for Mesh APs.

For more information, see Mesh Access Points chapter.

Multicast Filtering

In this release, the Multicast Filtering feature is supported on Layer 3 for IPv6. When you enable this feature, the APs will stop forwarding multicast packets to the clients.

For more information, see the Multicast Filtering chapter.

Address Resolution Protocol (ARP) and Neighbor Discovery (ND) Proxy

Neighbor Discovery (ND) Proxy is the ability of the controller to respond to the Neighbor Solicitation packet destined to the wireless clients.

The following commands were introduced:

• ipv4 arp-proxy

• ipv6 nd proxy

For more information, see the IPv6 Client IP Address Learning chapter.

OFDMA in Cisco Catalyst 9130 APs

Both Uplink and Downlink Orthogonal frequency-division multiple access (UL OFDMA and DL OFDMA) features are supported in Cisco Catalyst 9130 APs in this release.

• Currently limited to support eight users in a DL OFDMA or UL OFDMA transmission.

• In this release, 37 users are supported in the 80-MHz and 160-MHz bandwidths.

Retain Client for 10 seconds after delete

The controller retains client session for 10 seconds instead of immediately deleting for few clients. This feature is applicable for run state clients, if any client status shows as controller IPLEARN or Authenticating, that client entry will be removed from the controller and only run state clients will be moved to idle state. This is supported on central authentication with local and flex mode enabled.

You must execute the following commands to view the clients in idle state.

• show wireless stats client detail

• show wireless client summary

Rogue Containment and AP Impersonation Detection based on AP Authentication

In Cisco IOS XE Amsterdam 17.3.1 Release, a rogue device that is enabled with 802.11w Protected Management Frames (PMF) is not contained. Instead, the rogue device is marked as Contained Pending and a wireless service assurance (WSA) alarm is raised to inform about the event. As the device containment is not performed, AP resources are not consumed unnecessarily.

The AP Authentication feature allows you to detect AP impersonation. When you enable this feature, the controller creates an AP domain secret and shares it with other APs in the same network. This allows the APs to authenticate each other.

Also, this is enhanced using two other methods:

• Checking channel of the rogue in the DS Parameter set and matching it with Managed APs channels.

• Using Infrastrucure MFP to check the message integrity check.

The following command was introduced:

• show wireless wps rogue ap detailed

For more information, see Managing Rogue Devices chapter.

Standby Monitoring

Standby Monitoring feature allows to monitor the Health of the Standby controller directly from the Standby, without going through the Active controller.

The following commands are introduced:

• show processes cpu

• show environment summary

For more information, see the High Availability chapter.

Support for Cisco Catalyst 9105 Series APs

Support is added for Cisco Catalyst 9105I and 9105W APs in this release.

Support for Configuring SR-IOV for KVM and VMware ESXi Environments

Starting with this release, SR-IOV can be configured on KVM and ESXi environments.

For more information on configuring SR-IOV for KVM and ESXi, see the following sections:

• Installing the Controller in KVM Environment

• Installing Controller in VMware Environment

Cisco User Defined Network (UDN) Mobile Application

The Cisco User Defined Network (UDN) mobile application helps create a user defined network and restrict access to devices unless they are invited to share the network.

For more information, see User Guide for Cisco User Defined Network Mobile Application.

Support for Configuring High Throughput Templates on Cisco Catalyst 9800-CL Cloud Wireless Controller

From 17.3 release onwards, high throughput templates can be configured on the Cisco Catalyst 9800-CL Cloud Wireless Controller private cloud instances. With this enhancement, the throughput can be raised from 2 Gbps to 5 Gbps.

For information on the supported templates and hardware requirements, see Supported Templates and Hardware Requirements.

Syslog Support for Client State Change

The Syslog Support for Client State Change feature enables you to track the client details such as IP addresses, AP names, and so on.

The following commands was introduced:

• wireless client syslog-detailed

Support for Direct-Sequence (DS) Parameter Set

The managed APs will now have additional information about the DS Parameter Set of the detected Rogue AP, in the Rogue AP reports. If an impersonation attack is detected, the controller checks if the reported DS channel matches with one of the recent channels used by the managed APs. If a match is not found, a DS channel attack alarm is raised through the wireless service assurance (WSA) impersonation alarm.

Tri-Radio (Dynamic)

Support for Dual Radio role is added to the Tri-Radio feature. This feature enables FRA to dynamically choose between dual radio and tri-radio mode and determine the radio role as client-serving or monitor for the individual radios.

For more information, see Cisco Access Points with Tri-Radio chapter.

Uplink MU-MIMO in Cisco Catalyst 9130 APs

Uplink Multi-user multiple-input and multiple-output (UL MU MIMO) feature is supported in Cisco Catalyst 9130 APs in this release.

• Conceptually similar to Downlink MU-MIMO, which is already supported in Cisco Catalyst 9130 APs.

• Allows multiple clients to send traffic simultaneously, thus saving air time.

• Controller by AP through triggers sent to clients.

• Supported in 20-MHz, 40-MHz, and 80-MHz bandwidths, but not supported in the 160-MHz bandwidth.

• Supported only in the 5-GHz band.

• Currently limited to support three users. When more than three users are connected, UL MU-MIMO scheduling does not occur, and the AP falls back to single-user (SU) transmission.

User Defined Network

A user defined network (UDN) is a solution that is aimed at providing secure and remote on-boarding of devices in shared service environments like dormitory rooms, resident halls, class rooms and auditoriums.

For more information, see the User Defined Network chapter.

WIPS: Advanced Security Enhancements

The following WIPS alarms were included in this release:

• Denial-Of-Service Attack: Request-To-Send Flood

• Denial-Of-Service Attack: Clear-To-Send Flood

Dark Mode option

You can enable Dark Mode in the GUI. Dark Mode (screen with light text in a dark background) is best suited for reducing eye strain, especially in low-light conditions. Screen glare and flickering is also reduced.

Click the Preferences icon (the gear icon) > Dark Mode option

Download AP support bundle from the GUI

Configuration > Wireless > Access Points > Edit AP

Enhanced Certificate Management Through the GUI

Configuration > Security > PKI Management

Embedded Wireless on Cisco Catalyst 9000 Series Switches for Single Secure Site Deployment (Non-SDA)

Configuration > Embedded Wireless Setup

Open Roaming

Configuration > Wireless > Hotspot/OpenRoaming

Software Upgrade page enhancement

Administration > Software Management > Software Upgrade

Tracking of appliance temperature in the System Information dashlet

Cisco Catalyst 9800 Wireless Controller GUI Dashboard

Tri-Radio (Dynamic)

• Configuration > Radio Configurations > Network

• Configuration >Wireless > Access Points

Minimum number of vCPUs

(Hyperthreading is not supported)

4

6

10

7

9

13

Minimum CPU Allocation (MHz)

4,000

6,000

10, 000

4000

6000

10,000

Minimum Memory (GB)

8

16

32

8

16

32

Required Storage (GB)

16

16

16

16

16

16

Virtual NICs (vNIC)

(*) 3rd NIC for High Availability

2/(3)*

2/(3)*

2/(3)*

2/(3)*

2/(3)*

2/(3)*