wlan [profile-name] [wlan-id] [ssid]
Creates or modifies a WLAN profile on a Cisco wireless LAN controller, associating it with a WLAN ID and SSID for wireless client access.
Definition: wlan [profile-name] [wlan-id] [ssid] is a Cisco IOS global config command. Creates or modifies a WLAN profile on a Cisco wireless LAN controller, associating it with a WLAN ID and SSID for wireless client access.
Overview
The `wlan` command in global configuration mode on a Cisco wireless LAN controller (WLC) creates or modifies a WLAN profile, which is the fundamental construct for providing wireless client access. A WLAN profile bundles together all the parameters that define a wireless network: the SSID (service set identifier) that clients see, the WLAN ID (a unique numeric identifier), security settings, QoS policies, VLAN assignments, and advanced features like FlexConnect or multicast. This command is the starting point for any wireless deployment; without it, no SSID is broadcast, and clients cannot associate.
The concept behind a WLAN profile is that it abstracts the physical radio interfaces (which are managed separately via AP groups or RF profiles) and allows the network engineer to define logical wireless networks that can be mapped to different VLANs or security domains. For example, a guest WLAN might use a different SSID, be placed on a separate VLAN, and enforce open authentication with a captive portal, while a corporate WLAN uses WPA2-Enterprise with 802.1X. The `wlan` command is used when you need to create a new WLAN or modify an existing one.
Alternatives include using the WLC web GUI or the older `config wlan` CLI, but the `wlan` command is the modern, streamlined approach in IOS-XE based controllers (e.g., 9800 series). In the broader workflow, after creating the WLAN profile, you typically configure security (e.g., `security wpa`), assign it to an AP group or policy profile, and then verify with `show wlan summary`. Important IOS behavior: the command takes effect immediately and is written to the running configuration; changes are saved with `write memory`.
The privilege level required is 15 (privileged EXEC) to enter global config mode. The command is buffered in the sense that the WLC will validate parameters and reject invalid combinations (e.g., trying to assign a WLAN ID that already exists). The running config will show the WLAN profile with all its subcommands.
For CCNA and CCNP candidates, mastering this command is essential because it is the foundation for all wireless configuration tasks, from small office setups to large enterprise deployments with hundreds of APs.
wlan [profile-name] [wlan-id] [ssid]When to Use This Command
- Configuring a new guest wireless network with open authentication for a retail store.
- Setting up a secure corporate WLAN with WPA2-PSK for employee access.
- Modifying an existing WLAN to change the SSID or enable broadcast SSID.
- Creating multiple WLAN profiles for different VLANs or security policies on the same controller.
Parameters
| Parameter | Syntax | Description |
|---|---|---|
| profile-name | WORD (1-32 characters) | A descriptive name for the WLAN profile, such as 'Corporate' or 'Guest'. This name is used to reference the profile in other commands. It must be unique and can contain letters, numbers, hyphens, and underscores. Common mistake: using spaces or special characters that are not allowed. |
| wlan-id | <1-512> | A unique numeric identifier for the WLAN. The range is 1 to 512 on most platforms. This ID is used internally and must not conflict with existing WLAN IDs. Common mistake: trying to use an ID that is already assigned, which will cause the command to fail. |
| ssid | WORD (1-32 characters) | The SSID (network name) that will be broadcast to wireless clients. It can be up to 32 characters and is case-sensitive. The SSID can be hidden later with the `broadcast-ssid disable` command. Common mistake: using an SSID that is already in use by another WLAN profile (though multiple profiles can share the same SSID if configured carefully). |
Command Examples
Create a new WLAN with WPA2-PSK security
wlan GuestNet 1 Guest_SSIDWLAN Profile Name: GuestNet WLAN ID: 1 SSID: Guest_SSID Status: Enabled Broadcast SSID: Enabled Security: WPA2-PSK PSK: (configured)
The output shows the WLAN profile name 'GuestNet' with ID 1 and SSID 'Guest_SSID'. Status is enabled, broadcast SSID is on, and security is set to WPA2-PSK with a pre-shared key configured.
Modify an existing WLAN to disable SSID broadcast
wlan CorpNet 2 Corporate_SSIDWLAN Profile Name: CorpNet WLAN ID: 2 SSID: Corporate_SSID Status: Enabled Broadcast SSID: Disabled Security: WPA2-Enterprise
The output indicates the WLAN 'CorpNet' is configured with ID 2, SSID 'Corporate_SSID', broadcast SSID disabled (hidden network), and WPA2-Enterprise security for 802.1X authentication.
Understanding the Output
The output from the 'wlan' command displays the WLAN profile configuration. Key fields include: 'WLAN Profile Name' (user-defined identifier), 'WLAN ID' (numeric identifier 1-16), 'SSID' (the network name broadcast to clients), 'Status' (Enabled/Disabled), 'Broadcast SSID' (Enabled means visible, Disabled means hidden), and 'Security' (e.g., WPA2-PSK, WPA2-Enterprise). In a real network, ensure the WLAN ID is unique and the SSID matches organizational naming conventions.
A disabled status or incorrect security can prevent client connectivity. Watch for mismatched security settings between the controller and client expectations.
Configuration Scenarios
Create a basic open WLAN for guest access
A company wants to provide internet-only access to visitors without authentication. They need a separate SSID 'Guest' on VLAN 100, with no encryption.
Topology
WLC (Gig0/1)---Trunk to Switch---VLAN 100 (Guest subnet 192.168.100.0/24)Steps
- 1.Step 1: Enter global configuration mode: configure terminal
- 2.Step 2: Create the WLAN profile: wlan Guest 10 Guest
- 3.Step 3: (Optional) Configure security to open: no security wpa
- 4.Step 4: Set the VLAN: vlan 100
- 5.Step 5: Enable the WLAN: no shutdown
- 6.Step 6: Exit and save: end; write memory
! Create WLAN profile wlan Guest 10 Guest no security wpa vlan 100 no shutdown end
Verify: Use 'show wlan summary' to see the WLAN with ID 10, SSID Guest, status Enabled. Use 'show wlan id 10' for detailed parameters.
Watch out: If the WLAN is not enabled with 'no shutdown', it will not broadcast. Also, ensure the VLAN exists on the switch and the trunk allows it.
Configure a secure corporate WLAN with WPA2-Enterprise and 802.1X
An enterprise needs a secure wireless network for employees using Active Directory authentication. The SSID 'Corp' should use WPA2 with AES encryption and 802.1X.
Topology
WLC---RADIUS Server (192.168.1.10)---AD DomainSteps
- 1.Step 1: Enter global configuration: configure terminal
- 2.Step 2: Create the WLAN: wlan Corporate 20 Corp
- 3.Step 3: Configure security: security wpa wpa2 aes; security wpa akm dot1x
- 4.Step 4: Point to RADIUS server: radius server <name> address ipv4 192.168.1.10 auth-port 1812 acct-port 1813; key <key>
- 5.Step 5: Enable the WLAN: no shutdown
- 6.Step 6: Exit and save.
! Create secure corporate WLAN wlan Corporate 20 Corp security wpa wpa2 aes security wpa akm dot1x radius server Corp-RADIUS address ipv4 192.168.1.10 auth-port 1812 acct-port 1813 key MySecretKey exit no shutdown end
Verify: Use 'show wlan id 20' to verify security settings. Use 'show radius server statistics' to confirm RADIUS communication.
Watch out: The RADIUS server must be configured globally before referencing it in the WLAN. Also, ensure the WLC has network reachability to the RADIUS server.
Troubleshooting with This Command
When troubleshooting wireless client connectivity, the `wlan` command itself is not a troubleshooting tool, but the WLAN profile it creates is central to diagnostics. Healthy output from `show wlan summary` shows the WLAN as 'Enabled' with the correct SSID, security, and VLAN. Problem indicators include 'Disabled' status (often due to 'shutdown' command), missing SSID (if profile not created), or incorrect security settings causing client association failures.
Key fields to examine in `show wlan id <id>` include 'WLAN Status' (should be Enabled), 'Broadcast SSID' (if disabled, clients must manually enter SSID), 'Security' (must match client capabilities), and 'VLAN' (must be allowed on trunk). Common symptoms: clients can see the SSID but cannot associate – check if WLAN is shutdown or if security mismatch (e.g., client uses WPA but WLAN expects WPA2). If clients associate but get no IP, verify VLAN assignment and DHCP relay.
Step-by-step diagnostic flow: 1) `show wlan summary` to confirm WLAN exists and is enabled. 2) `show wlan id <id>` to inspect security and VLAN. 3) `show client summary` to see if clients are associating. 4) If no clients, check AP join status with `show ap summary`. 5) If clients associate but no connectivity, check DHCP with `show dhcp statistics`. Correlate with `debug client <mac>` to see authentication and association messages. Also, `show ap config general` can reveal if AP is on correct flexconnect group.
The `wlan` command's output is static configuration; dynamic issues require other show commands.
CCNA Exam Tips
CCNA exam tip: The 'wlan' command is used in global config mode on a WLC; remember that WLAN IDs must be unique and range from 1 to 16.
CCNA exam tip: Know that disabling broadcast SSID does not secure the network; it only hides the SSID from beacon frames.
CCNA exam tip: The exam may test that WLAN profiles are applied to specific interfaces or VLANs using the 'wlan' command followed by interface configuration.
CCNA exam tip: Be aware that the 'wlan' command creates the profile, but additional commands like 'security wpa psk' are needed to set the passphrase.
Common Mistakes
Mistake 1: Using the same WLAN ID for multiple profiles, causing configuration conflicts.
Mistake 2: Forgetting to enable the WLAN after creation, leaving it in 'Disabled' state and clients unable to connect.
Mistake 3: Misconfiguring the SSID with spaces or special characters that are not supported by some clients.
wlan [profile-name] [wlan-id] [ssid] vs show wlan summary
The `wlan` command in global config mode creates or modifies a WLAN profile, while `show wlan summary` in privileged exec mode displays configured WLANs. They are often paired for troubleshooting and configuration tasks, as one is used to change settings and the other to verify them.
| Aspect | wlan [profile-name] [wlan-id] [ssid] | show wlan summary |
|---|---|---|
| Scope | Configuration change | Display only |
| Configuration mode | Global config | Privileged exec |
| Persistence | Alters running-config | Reads running-config |
| Typical use | Create or modify a WLAN | List all WLANs with details |
| Impact on network | Immediate if applied | None |
Use `wlan [profile-name] [wlan-id] [ssid]` when you need to create a new WLAN or modify an existing one, such as when adding a new SSID for a guest network.
Use `show wlan summary` when you need to quickly verify the configured WLANs, their IDs, SSIDs, and status before or after making changes.
Platform Notes
On IOS-XE based controllers (Cisco 9800 series), the `wlan` command syntax is identical to the traditional AireOS WLC. However, IOS-XE introduces additional subcommands like `no security wpa` and `vlan` that are similar. The output of `show wlan summary` may differ slightly in formatting but contains the same key fields.
For NX-OS (Cisco Nexus switches with wireless capabilities), there is no direct equivalent; wireless is handled by separate controllers. On ASA firewalls, wireless is not natively supported; instead, they rely on external WLCs. In IOS versions, the `wlan` command was introduced in later 15.x trains for WLCs; earlier versions used `config wlan` in config mode.
IOS-XR does not support WLAN profiles as it is a routing platform. On Catalyst 9800, the command is fully supported and is the primary method for WLAN configuration. Note that on some platforms, the WLAN ID range may be limited to 1-512, but on 9800 it can go up to 4096.
Always check the specific platform documentation.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions