Courseiva
WirelessGlobal Config

wireless profile policy [name]

Creates or modifies a wireless policy profile, which defines client access policies (e.g., VLAN, QoS, ACLs) for a WLAN on a Cisco wireless LAN controller.

Definition: wireless profile policy [name] is a Cisco IOS global config command. Creates or modifies a wireless policy profile, which defines client access policies (e.g., VLAN, QoS, ACLs) for a WLAN on a Cisco wireless LAN controller.

Overview

The `wireless profile policy [name]` command is used in Cisco IOS-XE global configuration mode to create or modify a wireless policy profile. A policy profile defines client-specific policies such as VLAN assignment, Quality of Service (QoS), Access Control Lists (ACLs), and other client access parameters for a WLAN on a Cisco wireless LAN controller (WLC) integrated into a switch or router (e.g., Catalyst 9800 series). This command is critical for CCNA and CCNP candidates because it bridges the gap between wireless connectivity and network security/QoS enforcement. Without a policy profile, clients connecting to a WLAN would have no defined VLAN, no traffic filtering, and no QoS treatment, leading to security risks and poor performance.

The networking concept behind policy profiles is the separation of RF (radio frequency) configuration from client policy. In Cisco wireless architectures, a WLAN profile defines SSID and security settings, while a policy profile defines what happens to client traffic after association. This decoupling allows the same SSID to be used across multiple policy profiles (e.g., different VLANs for different user groups) or multiple SSIDs to share the same policy profile. You would reach for this command when you need to assign clients to a specific VLAN, apply an ACL to filter traffic, set QoS markings (e.g., for voice or video), or enable features like Fast Roaming or Client Exclusion. Alternatives include using the WLC GUI, but the CLI is essential for automation and exam scenarios.

In the broader configuration workflow, you typically create a WLAN profile first, then a policy profile, and finally a tag (e.g., policy tag) to map the WLAN to the policy profile. The command is executed in global config mode, and changes take effect immediately (no reload required). The running config is updated, and you must save to startup config to persist. Privilege level 15 is required. Important IOS behavior: the command creates a sub-configuration mode where you can set various parameters; exiting with `exit` returns to global config. If the policy profile name already exists, you enter its sub-mode to modify it. If it does not exist, it is created. The command is available in IOS-XE 16.x and later (Catalyst 9800).

Syntax·Global Config
wireless profile policy [name]

When to Use This Command

  • Assigning a specific VLAN to a WLAN for client traffic segmentation
  • Applying QoS policies (e.g., Platinum, Gold) to a WLAN for voice/video traffic
  • Configuring AAA override to allow RADIUS-assigned VLANs per user
  • Enabling multicast or broadcast filtering on a WLAN

Parameters

ParameterSyntaxDescription
nameWORD (1-64 characters)Specifies the name of the policy profile. The name must be unique within the WLC. Common mistake: using spaces or special characters; use alphanumeric and hyphens/underscores only. If the name already exists, the command enters sub-mode to modify that profile.

Command Examples

Create a basic policy profile with VLAN and QoS

wireless profile policy guest-policy vlan guest-vlan service-policy input platinum-up service-policy output platinum-down no shutdown
wireless profile policy guest-policy
 vlan guest-vlan
 service-policy input platinum-up
 service-policy output platinum-down
 no shutdown
 end

Creates a policy profile named 'guest-policy', assigns VLAN 'guest-vlan', applies Platinum QoS policies for upstream and downstream traffic, and enables the profile with 'no shutdown'.

Configure AAA override and ACL in a policy profile

wireless profile policy employee-policy vlan employee-vlan aaa-override ip access-group employee-acl in no shutdown
wireless profile policy employee-policy
 vlan employee-vlan
 aaa-override
 ip access-group employee-acl in
 no shutdown
 end

Creates 'employee-policy' with VLAN 'employee-vlan', enables AAA override to allow RADIUS-assigned VLANs, and applies an IPv4 ACL 'employee-acl' for inbound traffic.

Understanding the Output

The output shows the configuration commands entered under the wireless policy profile. Each line represents a setting: 'vlan' specifies the VLAN for client traffic; 'service-policy' applies QoS policies; 'aaa-override' allows RADIUS to override VLAN/ACL; 'ip access-group' applies an ACL; 'no shutdown' activates the profile. Verify that all desired policies are present and that the profile is not in 'shutdown' state.

Missing 'no shutdown' means the profile is disabled.

Configuration Scenarios

Create a policy profile for corporate users with VLAN 100 and QoS

A company wants to provide wireless access for employees on a dedicated VLAN 100 with voice QoS marking for VoIP traffic. The policy profile will be applied to the corporate SSID.

Topology

Switch (VLAN 100) --- WLC (Catalyst 9800) --- AP --- Clients

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Create the policy profile: wireless profile policy corporate-policy
  3. 3.Step 3: Set VLAN: vlan 100
  4. 4.Step 4: Enable QoS: service-policy input platinum-up (assuming a policy map named platinum-up exists)
  5. 5.Step 5: Set client VLAN assignment: vlan 100
  6. 6.Step 6: Exit policy profile: end
Configuration
! Full IOS config block
configure terminal
wireless profile policy corporate-policy
 vlan 100
 service-policy input platinum-up
 end

Verify: show wireless profile policy detailed corporate-policy | include VLAN Expected output: VLAN : 100

Watch out: If the VLAN is not created on the switch, clients will not get an IP address. Ensure the VLAN exists and is allowed on trunk ports to the WLC.

Apply an ACL to a guest wireless policy profile

A hotel wants to provide guest Wi-Fi with internet-only access, blocking internal network resources. An ACL named GUEST-ACL is created to permit only HTTP/HTTPS and DNS.

Topology

WLC (Catalyst 9800) --- AP --- Guest Clients; WLC connected to firewall for internet

Steps

  1. 1.Step 1: Create ACL globally: ip access-list extended GUEST-ACL
  2. 2.Step 2: Permit DNS: permit udp any any eq 53
  3. 3.Step 3: Permit HTTP/HTTPS: permit tcp any any eq 80; permit tcp any any eq 443
  4. 4.Step 4: Deny all other: deny ip any any
  5. 5.Step 5: Exit ACL: exit
  6. 6.Step 6: Create policy profile: wireless profile policy guest-policy
  7. 7.Step 7: Set VLAN: vlan 200
  8. 8.Step 8: Apply ACL: ipv4 access-list GUEST-ACL in
  9. 9.Step 9: Exit: end
Configuration
! Full IOS config block
configure terminal
ip access-list extended GUEST-ACL
 permit udp any any eq 53
 permit tcp any any eq 80
 permit tcp any any eq 443
 deny ip any any
 exit
wireless profile policy guest-policy
 vlan 200
 ipv4 access-list GUEST-ACL in
 end

Verify: show wireless profile policy detailed guest-policy | include Access-list Expected output: IPv4 Access-list in : GUEST-ACL

Watch out: ACL is applied in the inbound direction (from client to network). Ensure the ACL does not accidentally block DHCP (UDP 67/68) or clients may not get an IP. Add permit udp any any eq 67 and eq 68 if needed.

Troubleshooting with This Command

When troubleshooting wireless client issues, the `show wireless profile policy [name]` command is essential to verify that the policy profile is correctly configured. Healthy output should show the expected VLAN, ACLs, QoS policies, and other parameters like client exclusion or fast roaming. Problem indicators include: VLAN set to 0 (meaning no VLAN assigned), missing ACLs, or incorrect QoS policy names. Common symptoms this command helps diagnose include: clients not getting IP addresses (check VLAN), clients unable to reach certain destinations (check ACL), or poor voice/video quality (check QoS).

A step-by-step diagnostic flow: 1) Identify the policy profile name from the WLAN configuration: `show wlan name <SSID> | include Policy`. 2) Display the policy profile: `show wireless profile policy <name>`. 3) Verify VLAN is set to a valid VLAN ID (not 0). 4) If ACL is applied, check the ACL rules with `show access-lists <acl-name>`. 5) If QoS is applied, verify the policy map exists: `show policy-map <name>`. 6) Check client association: `show wireless client summary` and then `show wireless client mac <mac> detail` to see which policy profile is applied to that client. 7) If clients are not getting IPs, check DHCP relay or VLAN interface configuration on the switch.

Correlate with other commands: `show wlan summary` to see WLAN-to-policy mapping; `show wireless tag policy all` to see policy tags; `debug wireless client mac <mac>` for real-time client state machine. Common mistake: forgetting to apply the policy profile to a policy tag. Use `show wireless tag policy <tag-name>` to verify the mapping. If the policy profile is not referenced by any tag, it will not be used.

CCNA Exam Tips

1.

Remember that policy profiles are applied to WLANs via 'wlan [name]' and 'policy profile [name]' under the WLAN configuration.

2.

AAA override requires both the policy profile and the WLAN to have 'aaa-override' enabled.

3.

QoS service-policy names (platinum-up, etc.) are predefined; you cannot create custom ones on the WLC.

4.

The 'no shutdown' command is required to enable the policy profile; otherwise it remains administratively down.

Common Mistakes

Forgetting to issue 'no shutdown' after creating the profile, leaving it disabled.

Applying an ACL that does not exist, causing the profile to fail to apply to the WLAN.

Misconfiguring VLAN name (must match a VLAN interface on the WLC) or using a VLAN ID instead of name.

wireless profile policy [name] vs wlan [profile-name] [wlan-id] [ssid]

Both 'wireless profile policy' and 'wlan' commands create configuration profiles on a Cisco wireless LAN controller, but they operate at different layers. The policy profile defines per-client access policies (VLAN, QoS, ACLs), while the WLAN profile binds an SSID to a WLAN ID and references a policy profile. They are commonly confused because both involve 'profiles' in the wireless configuration hierarchy.

Aspectwireless profile policy [name]wlan [profile-name] [wlan-id] [ssid]
ScopeDefines client-level policies (VLAN, QoS, ACLs, session timeout)Defines WLAN-level parameters (SSID, WLAN ID, security, broadcast SSID)
Configuration modeGlobal config, then 'wireless profile policy <name>'Global config, then 'wlan <name> <wlan-id> <ssid>'
PersistencePersists in running config, saved to startup via 'write memory'Persists in running config, saved to startup via 'write memory'
PrecedenceMust exist before being referenced by a WLAN profileCan exist independently but requires a policy profile to be functional
Typical useApplying specific QoS, VLAN, or ACL to clients in a WLANCreating a new WLAN with a specific SSID and security settings

Use wireless profile policy [name] when you need to define client access policies (e.g., VLAN assignment, QoS marking) that will be applied to clients connecting through a WLAN.

Use wlan [profile-name] [wlan-id] [ssid] when you need to create or modify a WLAN configuration, associating an SSID with a WLAN ID and setting parameters like security and broadcast settings.

Platform Notes

In IOS-XE (Catalyst 9800), the command syntax is `wireless profile policy [name]` in global config mode. The sub-mode commands include `vlan`, `service-policy`, `ipv4 access-list`, `ipv6 access-list`, `client exclusion`, `fast-roaming`, etc. In earlier IOS versions (e.g., 12.x or 15.x) that run on standalone APs or older WLCs (like 5508), the equivalent command is `config wlan policy-profile` on the WLC CLI, but the syntax is different. For IOS-XE 16.x and later, the command is consistent.

There is no direct NX-OS equivalent because NX-OS is used on data center switches, not wireless controllers. However, on Cisco Catalyst 9800-CL (cloud) or embedded wireless on switches, the same command applies. For ASA, there is no equivalent; ASA handles firewall policies, not wireless profiles.

In IOS-XR, this command does not exist as IOS-XR is used on routers, not wireless controllers. Always ensure the device supports wireless controller functionality (e.g., Catalyst 9800, 3850 with wireless, or 9300 with wireless).

Related Commands

show wireless client summary

Displays a summary of all wireless clients currently associated with the controller, including their MAC addresses, IP addresses, SSIDs, and connection status, used for quick client monitoring and troubleshooting.

wlan [profile-name] [wlan-id] [ssid]

Creates or modifies a WLAN profile on a Cisco wireless LAN controller, associating it with a WLAN ID and SSID for wireless client access.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions