Build a Secure Enterprise Wireless Network

Configure a Cisco WLC to manage lightweight APs with WPA2-Enterprise auth.

Introduction

30 Second Summary

Every time you connect to WiFi at a company office, a hidden system is checking your identity, assigning you to the right network, and blocking access to areas you shouldn't reach. That decision happens in milliseconds across multiple devices working together.

In this project, you will build that entire enterprise wireless system from scratch in Cisco Packet Tracer. You'll configure a Wireless LAN Controller to manage access points, set up RADIUS authentication for individual user logins, and isolate guest traffic on a separate VLAN.

What You'll Build

You'll demonstrate a fully operational wireless network where corporate employees log in with personal credentials verified by a RADIUS server, while guests connect on a completely isolated network segment with no way to reach corporate resources.

By the end of this project, you'll have:

  • A Cisco 3504 WLC centrally managing two lightweight access points that auto-discover and register via CAPWAP without any manual AP configuration.
  • A corporate WLAN where each employee authenticates with their own username and password, verified by a RADIUS server using 802.1X (WPA2-Enterprise).
  • A guest WLAN on a completely isolated VLAN where visitors connect with a simple shared passphrase using WPA2-PSK, unable to reach corporate resources.
  • A wired backbone with proper VLAN segmentation, trunk ports, and router-on-a-stick inter-VLAN routing delivering end-to-end connectivity verified by pinging across network segments.
  • Secret Mission: Diagnose and fix a lightweight AP that refuses to join the WLC due to a switchport misconfiguration.

Are there any prerequisites?

You need Cisco Packet Tracer installed on your machine (free via a Cisco NetAcad account). You should also have basic familiarity with IP addressing and navigating Packet Tracer's interface.

No physical hardware, cloud accounts, or paid software is required. Everything in this project runs inside the Packet Tracer simulation.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters. You're going to construct a complete enterprise wireless network from scratch, and understanding the end goal will help every configuration decision click into place.

Set Up the Physical Topology

Every enterprise wireless network starts with a physical foundation. Before you configure a single IP address or create a WLAN, you need the right devices in place and properly cabled together.

In this step, you will place all nine devices onto the Cisco Packet Tracer canvas, connect them with copper cables, and prepare two laptops for wireless connectivity. By the end, you will have the complete physical backbone that the rest of this project builds on.

In this step, get ready to:
  • Place all network infrastructure and end devices on the Packet Tracer canvas.
  • Cable devices together and verify green link lights on every connection.
  • Swap the wired NICs on both laptops to wireless modules so they can connect to your future WLANs.
Place the network infrastructure devices

Your enterprise network needs three core infrastructure devices: a router for inter-VLAN routing, a switch to connect everything on the wired side, and a Wireless LAN Controller to centrally manage your access points.

  • In the bottom-left panel of Packet Tracer, click the Network Devices category (the icon showing a router and switch).
  • Click the Routers subcategory in the row below.
  • Find the ISR 4331 model, click it, then click anywhere on the workspace to place it.
  • Click the Switches subcategory.
  • Find the 2960 model, click it, then click the workspace to place it to the right of your router.
  • Click the Wireless Devices subcategory.
  • Find the 3504 WLC model, click it, then click the workspace to place it below your switch.
  • While still in Wireless Devices, find the 3702i lightweight AP model. Click it and place two of them on the workspace, spaced apart below the WLC. These are your lightweight APs (LAP-1 and LAP-2).

What is a Wireless LAN Controller?

A WLC is a centralized device that manages multiple lightweight access points from a single interface. Instead of configuring each AP individually, you create WLANs once on the controller and it pushes settings to every AP automatically.

The APs discover the WLC using the CAPWAP protocol and register themselves without manual intervention. This is the standard architecture in enterprise wireless deployments and a core topic on the CCNA exam.

You should see five devices on your canvas: the router, switch, WLC, and two lightweight APs.

Place the end devices

Your network also needs end devices: a server for RADIUS authentication, an admin workstation for managing the WLC, and two laptops that will connect wirelessly.

  • In the bottom-left panel, click the End Devices category.
  • Click the End Devices subcategory (the default subcategory showing PCs, laptops, and servers).
  • Find Server-PT, click it, and place it on the workspace near your router. This will be your RADIUS server.
  • Find PC-PT, click it, and place it on the workspace near your switch. This will be your Admin PC.
  • Find Laptop-PT, click it, and place two laptops on the workspace spaced apart from the APs. These are Laptop-1 and Laptop-2, your future wireless clients.

Your canvas should now have nine devices total: Router, Switch, WLC, LAP-1, LAP-2, Server, Admin PC, Laptop-1, and Laptop-2.

Label your devices for clarity
  • Click the Router to open its configuration window.
  • Click the Config tab and type Router in the Display Name field.
  • Close the window and repeat for each device, naming them: Switch, WLC, LAP-1, LAP-2, RADIUS-Server, Admin-PC, Laptop-1, Laptop-2.

Arrange devices logically

Position the router at the top, the switch in the center, the WLC and APs below the switch, end devices (server, PC) to the sides, and laptops near the APs. A clean layout makes troubleshooting much easier in later steps.

Cable the topology

With all devices placed, you need to connect them with copper straight-through cables. Each cable creates the physical link that carries data between devices.

  • In the bottom-left panel, click the Connections category (the lightning bolt icon).
  • Click Copper Straight-Through (the solid black line icon).
  • Click the Router, select port GigabitEthernet0/0/0, then click the Switch and select port GigabitEthernet0/1.
  • Click the WLC, select port 1, then click the Switch and select port GigabitEthernet0/2.
  • Click LAP-1, select its Ethernet port, then click the Switch and select port FastEthernet0/1.
  • Click LAP-2, select its Ethernet port, then click the Switch and select port FastEthernet0/2.
  • Click the Admin PC, select port FastEthernet0, then click the Switch and select port FastEthernet0/10.
  • Click the RADIUS Server, select port FastEthernet0, then click the Router and select port GigabitEthernet0/0/1.

Wait a few seconds for all link lights to turn green. Green lights indicate a valid Layer 1 connection between devices.

Seeing orange or red link lights?

Orange triangles mean the port is still initializing. Wait 30-60 seconds for the switch to finish its spanning-tree calculation. If a light stays red, double-check that you used a Copper Straight-Through cable (not a crossover) and that you selected the correct port on each device.

If you connected to the wrong port, click the cable to delete it and re-create the connection with the correct ports. Help me fix my cable connections in Packet Tracer

Swap the laptop NICs to wireless modules

By default, laptops in Packet Tracer come with a wired Ethernet module (PT-LAPTOP-NM-1CFE). You need to replace this with a WPC300N wireless module so the laptops can connect to your future WLANs over Wi-Fi.

  • Click Laptop-1 to open its configuration window.
  • Click the Physical tab.
  • Click the power button on the side of the laptop to power it off (the green light turns off).
  • Drag the PT-LAPTOP-NM-1CFE module from the laptop to the MODULES pane on the left to remove it.
  • Drag the WPC300N module from the MODULES pane on the left to the empty module slot on the laptop.
  • Click the power button again to power the laptop back on.
  • Close the Laptop-1 window.

Now repeat the same process for Laptop-2.

  • Click Laptop-2 to open its configuration window.
  • Click the Physical tab.
  • Power off Laptop-2 by clicking the power button.
  • Drag PT-LAPTOP-NM-1CFE from the laptop to the MODULES pane.
  • Drag WPC300N from the MODULES pane to the empty slot on the laptop.
  • Power the laptop back on and close the window.

Why replace the NIC?

Lightweight APs broadcast wireless signals, but your laptops can only hear them with a wireless adapter installed. The WPC300N module simulates a real 802.11n wireless card. Without it, the laptops have no way to associate with any SSID.

Module won't install?

Make sure you powered off the laptop first. Packet Tracer does not allow hardware changes while the device is powered on. If the WPC300N snaps back to the modules list, check that you removed the existing PT-LAPTOP-NM-1CFE module first. Only one NIC can occupy the slot at a time.

Help me install the wireless module on my Packet Tracer laptop

Verify your completed topology

Before you run this check, take a moment to predict: what should you see on every cable connection if everything is wired correctly?

  • Look at every cable on the canvas. Confirm that all six connections show green triangles on both ends.
  • Click Laptop-1, then click the Desktop tab, and confirm you see a PC Wireless option. This proves the wireless module is installed correctly.
  • Repeat the Desktop tab check on Laptop-2 to confirm PC Wireless appears there as well.

All six cables should display green link lights, and both laptops should show the PC Wireless option in their Desktop tab. This confirms your physical topology is complete and ready for configuration.

✔️ All green lights and PC Wireless visible

Your physical topology is complete. All devices are connected and both laptops are wireless-ready.

ⓧ Some link lights are still orange or missing

Orange lights usually mean the switch is still calculating spanning tree. Wait 60 seconds in Realtime mode. If lights remain orange after a full minute, check that you used the correct cable type (Copper Straight-Through) and the correct ports listed above. Delete and re-create any incorrect cables.

If a laptop does not show PC Wireless in the Desktop tab, open the Physical tab and verify the WPC300N module is in the slot. If you see PT-LAPTOP-NM-1CFE still installed, you need to remove it and install the wireless module.

Your physical foundation is in place. Every device is connected, powered on, and the laptops are wireless-ready. Next up, you will configure the wired infrastructure with VLANs, trunk ports, and DHCP pools that allow your WLC and APs to communicate.

Configure the Wired Infrastructure

Your physical topology is ready with all cables showing green link lights. Now you need the wired backbone that the wireless network will ride on top of.

Without VLANs separating traffic, trunk ports carrying tagged frames between devices, and DHCP handing out addresses, the WLC cannot communicate with APs and wireless clients cannot get online. In this step, you'll build that wired foundation using VLAN segmentation, router-on-a-stick inter-VLAN routing, and DHCP pools.

In this step, get ready to:
  • Configure VLANs and port assignments on the switch.
  • Set up router subinterfaces for inter-VLAN routing.
  • Create DHCP pools and assign static IPs to end devices.
Configure the switch with VLANs and port assignments

The switch needs three VLANs to keep traffic separated: one for corporate wireless clients, one for guest wireless clients, and one for management traffic (including communication between the WLC and APs).

  • Click the Switch in your topology to open it, then click the CLI tab.
  • Create the three VLANs by entering these commands:
enable
configure terminal
vlan 10
name Corporate-Wireless
vlan 20
name Guest-Wireless
vlan 100
name Management
exit

What do these commands do?

  • enable enters privileged EXEC mode so you can make configuration changes.
  • configure terminal enters global configuration mode.
  • Each vlan command creates a VLAN with an ID number, and name gives it a human-readable label. VLAN 10 is for corporate wireless, VLAN 20 for guest wireless, and VLAN 100 for management.
  • Verify the VLANs exist by running this command:
show vlan brief

You should see VLAN 10 (Corporate-Wireless), VLAN 20 (Guest-Wireless), and VLAN 100 (Management) listed as active in the output table.

VLANs not appearing?

  • Make sure you typed exit after the last VLAN name command to return to global configuration mode.
  • Run show vlan brief from privileged EXEC mode (after typing end), not from config mode.
  • help me troubleshoot why my VLANs are not showing up on my Catalyst 2960 switch in Packet Tracer

Now assign each port to its correct role. Trunk ports carry traffic for multiple VLANs (tagged with VLAN IDs), while access ports belong to a single VLAN (untagged).

  • Configure the trunk and access ports by entering these commands (you should still be in global config mode after running configure terminal):
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,100
interface GigabitEthernet0/2
switchport mode trunk
switchport trunk allowed vlan 10,20,100
interface FastEthernet0/1
switchport mode access
switchport access vlan 100
interface FastEthernet0/2
switchport mode access
switchport access vlan 100
interface FastEthernet0/10
switchport mode access
switchport access vlan 100
end

What do these port assignments do?

G0/1 (to router) and G0/2 (to WLC) become trunk ports that carry tagged frames for VLANs 10, 20, and 100. This lets the router route between VLANs and the WLC manage traffic on each VLAN.

Fa0/1 and Fa0/2 (to the lightweight APs) and Fa0/10 (to the Admin PC) become access ports on VLAN 100. The APs need to be on the management VLAN so they can discover the WLC.

  • Verify the trunk is active by running:
show interfaces trunk

You should see G0/1 and G0/2 listed as trunking ports with VLANs 10, 20, and 100 in the allowed list.

No output from show interfaces trunk?

In Packet Tracer, trunk ports only appear in this output when the physical link on both ends is up. If you see no output, verify that the Router and WLC are powered on and their link lights are green.

help me figure out why show interfaces trunk shows no output on my 2960 switch in Packet Tracer

✔️ Awesome, I've got everything!

Great. Make sure you see all three VLANs and both trunk ports confirmed before moving on.

ⓧ I'd like to double check the full config

Here is the complete switch configuration you should have entered:

enable
configure terminal
vlan 10
name Corporate-Wireless
vlan 20
name Guest-Wireless
vlan 100
name Management
exit
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk allowed vlan 10,20,100
interface GigabitEthernet0/2
switchport mode trunk
switchport trunk allowed vlan 10,20,100
interface FastEthernet0/1
switchport mode access
switchport access vlan 100
interface FastEthernet0/2
switchport mode access
switchport access vlan 100
interface FastEthernet0/10
switchport mode access
switchport access vlan 100
end
Configure the router for inter-VLAN routing

The switch can separate traffic into VLANs, but devices on different VLANs cannot talk to each other without a router. Router-on-a-stick uses subinterfaces on a single physical port to route between VLANs.

  • Click the Router in your topology to open it, then click the CLI tab.
  • Create the subinterfaces and the server network interface by entering these commands:
enable
configure terminal
interface GigabitEthernet0/0/0
no shutdown
interface GigabitEthernet0/0/0.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0
interface GigabitEthernet0/0/0.20
encapsulation dot1Q 20
ip address 192.168.20.1 255.255.255.0
interface GigabitEthernet0/0/0.100
encapsulation dot1Q 100
ip address 192.168.100.1 255.255.255.0
interface GigabitEthernet0/0/1
ip address 10.10.200.1 255.255.255.0
no shutdown
end

What do these subinterfaces do?

Each subinterface (like G0/0/0.10) handles traffic for one VLAN. The encapsulation dot1Q 10 command tells the router that frames tagged with VLAN 10 belong to this subinterface.

The IP address on each subinterface becomes the default gateway for devices on that VLAN. G0/0/1 connects directly to the RADIUS server on its own subnet (10.10.200.0/24).

  • Verify all interfaces are up by running:
show ip interface brief

You should see G0/0/0, G0/0/0.10, G0/0/0.20, G0/0/0.100, and G0/0/1 all listed with their IP addresses and a status of "up".

Interfaces showing as down?

  • Make sure you included no shutdown on the physical interface G0/0/0 (not just the subinterfaces). The subinterfaces inherit the physical interface status.
  • Confirm G0/0/1 also has no shutdown. Without it, the server network stays unreachable.
  • help me fix my router subinterfaces that are showing as down in Packet Tracer
Configure DHCP pools and static IP addresses

Wireless clients and lightweight APs need IP addresses automatically assigned by DHCP. The management pool is especially important because it includes DHCP option 150, which tells the APs the IP address of the WLC so they can register automatically via CAPWAP.

  • Still on the Router CLI, create the three DHCP pools by entering these commands:
configure terminal
ip dhcp excluded-address 192.168.100.1 192.168.100.10
ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool MGMT
network 192.168.100.0 255.255.255.0
default-router 192.168.100.1
option 150 ip 192.168.100.254
ip dhcp pool CORP-WIFI
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
ip dhcp pool GUEST-WIFI
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
end

What does option 150 do?

The option 150 ip 192.168.100.254 line in the MGMT pool tells lightweight APs "your controller lives at 192.168.100.254." When an AP powers on and gets a DHCP lease from this pool, it reads option 150 and automatically sends a CAPWAP join request to that address.

The excluded addresses (.1 through .10 in each pool) prevent the router from handing out addresses reserved for infrastructure devices like gateways and the WLC.

  • Verify the pools exist by running:
show ip dhcp pool

You should see MGMT, CORP-WIFI, and GUEST-WIFI listed with their network ranges.

DHCP pools not showing?

  • Make sure you typed end to exit configuration mode before running the show command.
  • Confirm each pool has a network statement. A pool without a network is incomplete and won't display addresses.
  • help me troubleshoot my DHCP pool configuration on the ISR 4331 router in Packet Tracer

✔️ Awesome, I've got everything!

Great. Confirm the router shows all subinterfaces up and all three DHCP pools present before continuing.

ⓧ I'd like to double check the full router config

You entered two chunks of commands on the router. Scroll up and confirm:

  • The subinterfaces chunk: G0/0/0 with no shutdown, G0/0/0.10 (dot1Q 10, 192.168.10.1), G0/0/0.20 (dot1Q 20, 192.168.20.1), G0/0/0.100 (dot1Q 100, 192.168.100.1), and G0/0/1 (10.10.200.1, no shutdown).
  • The DHCP chunk: three excluded-address ranges (.1-.10), MGMT pool with option 150, CORP-WIFI pool, and GUEST-WIFI pool.

Now assign static IPs to the two end devices that need fixed addresses.

  • Click the RADIUS Server in your topology.
  • Go to the Desktop tab, then click IP Configuration.
  • Set the IPv4 Address to 10.10.200.10, Subnet Mask to 255.255.255.0, and Default Gateway to 10.10.200.1.
  • Close the Server window.
  • Click the Admin PC in your topology.
  • Go to the Desktop tab, then click IP Configuration.
  • Set the IPv4 Address to 192.168.100.200, Subnet Mask to 255.255.255.0, and Default Gateway to 192.168.100.1.

Time to verify end-to-end connectivity. Before you test, think about what you expect to happen.

What path does a ping take?

A ping from the Admin PC (192.168.100.200, VLAN 100) to the RADIUS server (10.10.200.10) must travel: PC to switch (access port VLAN 100), switch to router (trunk, tagged VLAN 100), router subinterface G0/0/0.100 receives it, router routes to G0/0/1 (10.10.200.0/24 network), then out to the server.

Before you run the ping, do you think the Admin PC will successfully reach the RADIUS server at 10.10.200.10? What about the router at 192.168.100.1?

  • On the Admin PC, go to the Desktop tab and click Command Prompt.
  • Test connectivity to the router by running:
ping 192.168.100.1
  • Test connectivity to the RADIUS server by running:
ping 10.10.200.10

Both pings should return replies. The first one or two packets may time out while ARP resolves. If you see replies from both addresses, your wired infrastructure is working end-to-end.

Ping to 192.168.100.1 failing?

  • Verify Fa0/10 is set to access VLAN 100 on the switch. Run show vlan brief and confirm Fa0/10 appears under VLAN 100.
  • Confirm the router subinterface G0/0/0.100 has encapsulation dot1Q 100 and the correct IP. Run show ip interface brief on the router.
  • Check that G0/1 on the switch is configured as a trunk with VLAN 100 in the allowed list.
  • help me fix my ping from the Admin PC to the router at 192.168.100.1

Ping to 10.10.200.10 failing?

  • If the router ping (192.168.100.1) works but the server ping fails, the issue is between the router and server.
  • Verify the server's gateway is set to 10.10.200.1 (the router's G0/0/1 interface).
  • Confirm G0/0/1 on the router has no shutdown and shows as up.
  • help me troubleshoot why my Admin PC cannot reach the RADIUS server across VLANs

Your wired backbone is fully operational. VLANs are isolating traffic, the router is forwarding between networks, and DHCP is ready to hand out addresses. Next up, you'll bring the WLC online and watch the APs discover it automatically.

Set Up the WLC and Verify AP Registration

Your wired backbone is fully operational. VLANs are segmented, trunks are carrying tagged traffic, and DHCP pools are handing out addresses. Now it is time to bring the wireless architecture to life.

In this step, you access the Wireless LAN Controller GUI and watch something impressive happen automatically. Your lightweight APs discover the WLC through DHCP option 150 and register themselves over CAPWAP without you touching them individually.

In this step, get ready to:
  • Access the WLC GUI and complete initial setup with admin credentials.
  • Verify both lightweight APs have auto-registered via CAPWAP.
  • Create VLAN interfaces on the WLC for corporate and guest wireless traffic.
Access the WLC GUI and complete initial setup

The WLC has a web-based management interface. In Packet Tracer, the initial connection must use HTTP. After initial setup completes, the controller only serves its GUI over HTTPS.

  • Click the Admin PC device on the canvas.
  • Go to the Desktop tab.
  • Click Web Browser.
  • In the URL bar, type http://192.168.100.254 and press Go.

The WLC initial setup wizard appears. This is where you create your admin account and confirm the controller's settings.

  • Set the admin username to admin.
  • Set the admin password to Cisco123.
  • Complete the remaining setup wizard prompts, accepting defaults where possible.
  • Confirm and apply the settings. The WLC processes the configuration.

Why HTTP first, then HTTPS?

In Packet Tracer, the WLC requires an unsecure HTTP connection for the very first setup. After initial configuration, it switches to HTTPS exclusively. If you try HTTP after setup, the WLC resets the connection without redirecting you.

Now reconnect using HTTPS to access the full management dashboard.

  • In the Admin PC's web browser URL bar, type https://192.168.100.254 and press Go.
  • Enter username admin and password Cisco123.
  • Click Login.

You should see the WLC management dashboard. This confirms your Admin PC can reach the controller over the management VLAN.

Can't reach the WLC at 192.168.100.254?

Make sure you used http:// (not https://) for the initial setup. HTTPS only works after the first configuration is complete.

Verify the Admin PC has IP 192.168.100.200 with gateway 192.168.100.1. Both the PC and the WLC must be on VLAN 100 for communication to work.

Wait 30-60 seconds after powering on the WLC. It needs time to boot and obtain its management IP from the DHCP pool.

Help me troubleshoot why the Admin PC cannot reach the WLC in Packet Tracer.

Verify AP auto-discovery and registration

With the WLC online, your lightweight APs should have already discovered it. The APs received the WLC's IP address (192.168.100.254) from DHCP option 150 in the MGMT pool, then sent CAPWAP join requests automatically.

  • In the WLC GUI, click the Wireless tab (or Monitor tab, depending on your view).

Before you look at the results, predict: do you think both APs registered successfully, or might one have failed? Think about what each AP needs to join the controller.

  • Look for both LAP-1 and LAP-2 in the list of registered access points.
  • Confirm each AP has an IP address in the 192.168.100.x range.

Both APs should appear as registered. They obtained DHCP addresses from the MGMT pool and joined the WLC via CAPWAP tunnels. You now have centralized visibility of your wireless infrastructure without having configured each AP individually.

How did the APs find the WLC automatically?

When each AP powered on, it sent a DHCP request on VLAN 100 (its access port VLAN). The router's MGMT pool replied with an IP address and included option 150, which tells the AP the WLC's address.

The AP then sent a CAPWAP join request to 192.168.100.254. The WLC accepted the request and now manages that AP's configuration, firmware, and radio settings centrally. This is exactly how enterprise deployments scale to hundreds of APs.

APs not showing as registered?

Give the APs 60-90 seconds after the WLC comes online. CAPWAP registration is not instant in Packet Tracer.

Verify that switch ports Fa0/1 and Fa0/2 are configured as access ports on VLAN 100. The APs send untagged CAPWAP traffic that must land on the management VLAN.

Check that the DHCP pool MGMT on the router includes option 150 ip 192.168.100.254. Without this, APs have no way to discover the WLC address.

Help me figure out why my APs are not registering with the WLC in Packet Tracer.

Create VLAN interfaces on the WLC for wireless traffic

The WLC needs dedicated interfaces mapped to each wireless VLAN. These interfaces tell the controller which VLAN to put traffic on when it comes from a specific WLAN.

  • In the WLC GUI, navigate to Controller > Interfaces.
  • Click New to create a new interface.
  • Enter interface name Corp-WLAN and VLAN ID 10.
  • Click Apply.
  • On the interface configuration page, enter IP Address 192.168.10.254, Netmask 255.255.255.0, Gateway 192.168.10.1, and Primary DHCP Server 192.168.10.1.
  • Click Apply to save the Corp-WLAN interface.

The Corp-WLAN interface is now active. Repeat the process for the guest network.

  • Click New again to create a second interface.
  • Enter interface name Guest-WLAN and VLAN ID 20.
  • Click Apply.
  • Enter IP Address 192.168.20.254, Netmask 255.255.255.0, Gateway 192.168.20.1, and Primary DHCP Server 192.168.20.1.
  • Click Apply to save the Guest-WLAN interface.

What do these interfaces do?

Each WLC interface maps wireless traffic to a specific VLAN on your wired backbone. When you create a WLAN in the next step, you assign it to one of these interfaces. Corporate wireless clients land on VLAN 10 and guest clients land on VLAN 20.

The DHCP Server field tells the WLC where to relay client DHCP requests. Since your router handles DHCP for both pools (CORP-WIFI and GUEST-WIFI), you point each interface to the router's subinterface IP on that VLAN.

  • Navigate back to Controller > Interfaces and confirm you see three interfaces listed: management, Corp-WLAN, and Guest-WLAN.

You should see all three interfaces with their correct VLAN IDs and IP addresses. Your WLC is now fully prepared to host wireless networks on separate VLANs.

Interface not appearing after applying?

Double check that the VLAN ID matches exactly: 10 for Corp-WLAN and 20 for Guest-WLAN. A mismatch means traffic will land on the wrong VLAN.

Make sure you clicked Apply after entering the IP details. If you navigate away before applying, the interface is created with a name but has no IP configuration.

Help me troubleshoot WLC interface creation issues.

✔️ Awesome, I've got everything!

Great. Confirm you have saved all settings and can see both APs registered plus both interfaces listed.

ⓧ I'd like to double check the full configuration

Here is what your WLC should have at this point:

  • Management IP: 192.168.100.254 (accessible via HTTPS from Admin PC).
  • Admin credentials: username admin, password Cisco123.
  • LAP-1 and LAP-2 registered under the Wireless tab with IPs in the 192.168.100.x range.
  • Corp-WLAN interface: VLAN 10, IP 192.168.10.254, mask 255.255.255.0, gateway 192.168.10.1, DHCP server 192.168.10.1.
  • Guest-WLAN interface: VLAN 20, IP 192.168.20.254, mask 255.255.255.0, gateway 192.168.20.1, DHCP server 192.168.20.1.

Your WLC is set up, both APs are centrally managed, and the VLAN interfaces are ready to carry wireless traffic. Next up, you will create your first WLAN and connect a wireless client to prove end-to-end connectivity.

Create a Corporate WLAN with WPA2-PSK

Your WLC is live with both APs registered and VLAN interfaces ready to carry traffic. Now it is time to create the actual wireless network that employees will connect to.

Before tackling enterprise authentication, you need a working WLAN to prove the end-to-end wireless path functions. WPA2-PSK is the quickest way to get a client connected through the WLC. Everyone shares a single passphrase to join the network.

In this step, get ready to:
  • Create a Corporate WLAN on the WLC with SSID Corp-WiFi, bound to the VLAN 10 interface.
  • Secure the WLAN with WPA2-PSK using AES encryption.
  • Connect Laptop-1 wirelessly and verify end-to-end connectivity across VLANs.
Create the Corporate WLAN on the WLC

A WLAN profile on the WLC defines everything about a wireless network: its name (the SSID that clients see), which VLAN carries its traffic, and how clients authenticate. Once created, the WLC pushes this profile to every registered AP automatically.

  • In the WLC GUI, click WLANs in the top menu bar.
  • Locate the dropdown box in the upper-right corner that says Create New.
  • Click Go to create a new WLAN.
  • Enter Corporate in the Profile Name field.
  • Enter Corp-WiFi in the SSID field.
  • Set the ID to 1.
  • Click Apply.

The WLC opens the WLAN edit screen with several tabs across the top. You need to configure the General tab and the Advanced tab before moving on to security.

  • On the General tab, click the Interface/Interface Group dropdown.
  • Select Corp-WLAN from the list. This is the VLAN 10 interface you created in the previous step.
  • Click the Advanced tab.
  • Scroll down to the FlexConnect section.
  • Enable FlexConnect Local Switching.
  • Enable FlexConnect Local Auth.
  • Click Apply.

What is FlexConnect?

FlexConnect allows lightweight APs to switch traffic locally at the access point instead of tunnelling everything back through the WLC. In Packet Tracer lab environments, enabling Local Switching and Local Auth ensures that wireless client traffic is forwarded properly on the local VLAN.

Set WPA2-PSK security on the WLAN

The WLAN exists but currently has no security. Anyone could connect without credentials. You need to add WPA2 encryption with a pre-shared key so that only people who know the passphrase can join.

  • In the same WLAN edit screen, click the Security tab.
  • Under the Layer 2 tab, select WPA+WPA2 from the Layer 2 Security dropdown. This reveals the WPA parameters section.
  • Under WPA+WPA2 Parameters, check the box next to WPA2 Policy.
  • Confirm that AES is selected as the encryption type.
  • Under Authentication Key Management, select PSK.
  • Enter CorpSecure2024 as the passphrase.
  • Click Apply.

What does WPA2-PSK actually mean?

WPA2-PSK (also called WPA2-Personal) means every device that connects shares the same passphrase. The passphrase is used to derive encryption keys that protect data over the air.

AES is the encryption algorithm. It replaced the older, weaker TKIP standard. Together, WPA2 + AES is the minimum acceptable security for any modern wireless network.

Navigate back to the WLANs list by clicking Back. You should see your Corporate WLAN listed with SSID Corp-WiFi and ID 1.

Don't see the WLAN listed?

Make sure you clicked Apply after creating the WLAN and again after configuring FlexConnect settings. If you skipped either Apply, the changes were not saved.

help me troubleshoot why my WLAN is not appearing in the WLC WLANs list after I configured it

Connect Laptop-1 to the Corporate WLAN

The WLAN is configured and your APs are now broadcasting the Corp-WiFi SSID. Time to connect a wireless client and prove the entire path works: laptop connects to the AP, the AP forwards traffic on VLAN 10, the router hands out a DHCP address, and inter-VLAN routing reaches the server network.

  • Click on Laptop-1 in your Packet Tracer topology.
  • Click the Desktop tab.
  • Open PC Wireless.
  • Go to the Profiles tab.
  • Click New to create a new wireless profile.
  • Name the profile Corporate.
  • Under Available Wireless Networks, select Corp-WiFi.
  • Choose WPA2-Personal for the security type.
  • Enter the passphrase CorpSecure2024.
  • Click Connect.

After a brief delay, you should see a wireless association indicator (a dotted wave line) appear between Laptop-1 and one of the APs in the topology view.

Before you verify the IP address, predict: what IP range should Laptop-1 receive? Think about which VLAN interface you bound the WLAN to and which DHCP pool serves that network.

  • Close the PC Wireless app.
  • On Laptop-1's Desktop tab, open Command Prompt.
  • Verify your IP address by typing:
ipconfig

You should see an IP address in the 192.168.10.x range. This confirms the laptop connected to the Corp-WiFi SSID, its traffic was placed on VLAN 10, and the router's CORP-WIFI DHCP pool served an address.

  • Test end-to-end connectivity across VLANs by pinging the RADIUS server:
ping 10.10.200.10

You should see successful replies. This proves that traffic flows from your wireless client, through the AP, across VLAN 10, through the router's inter-VLAN routing, and out to the server network on 10.10.200.0/24.

Not getting an IP or ping fails?

  • If Laptop-1 shows no IP address, make sure the passphrase matches exactly. The WLC passphrase is CorpSecure2024 (case-sensitive). A mismatch prevents association.
  • If the IP address is 0.0.0.0 or in the wrong range, try toggling the IP configuration between Static and DHCP on the laptop's Config tab to force a DHCP renewal.
  • If ping to 10.10.200.10 fails but you have a valid IP, confirm FlexConnect Local Switching is enabled on the WLAN. Without it, traffic may not forward properly in Packet Tracer.

help me troubleshoot why my wireless laptop cannot get an IP address or ping the server through the WLC

Why does this matter for the CCNA exam?

You just proved an end-to-end wireless path: DHCP assignment on a specific VLAN, inter-VLAN routing through a router-on-a-stick configuration, and a ping that crosses network boundaries. This is exactly the type of verification the CCNA 200-301 tests under exam topics 1.6 (wireless architectures) and 2.4 (inter-VLAN routing).

The security problem you just created

Your WLAN works, but it has a fundamental flaw for enterprise use. Every single user shares the same passphrase: CorpSecure2024. If any one person shares it or it leaks, every device on the network is compromised.

Worse, you cannot revoke access for a single user. The only fix is to change the passphrase for everyone. In a company with 500 employees, that means reconfiguring 500 devices. This is the exact problem that WPA2-Enterprise with RADIUS solves in the next step.

Your wireless infrastructure is alive. A client can connect, get an address, and reach services across the network. Next up, you will replace this shared passphrase with individual user credentials backed by a RADIUS server, giving you the ability to grant and revoke access per person.

Upgrade to WPA2-Enterprise with RADIUS Authentication

Your corporate WLAN is live and Laptop-1 can reach the server across VLANs. But think about the passphrase CorpSecure2024 you just used. Every single employee who connects to this network shares that same key.

If one person leaks the passphrase, your entire network is compromised. You cannot revoke a single person's access without changing the key for everyone. WPA2-Enterprise solves this by giving each user individual credentials verified against a RADIUS server. In this step, you will set up that authentication infrastructure and prove it works.

In this step, get ready to:
  • Configure the RADIUS server with user accounts and a WLC client entry.
  • Register the RADIUS server on the WLC and switch the corporate WLAN from PSK to 802.1X.
  • Reconnect Laptop-1 using individual enterprise credentials and verify end-to-end connectivity.
Configure the RADIUS server with user accounts

The RADIUS server is the central authority that decides who can access the corporate wireless network. You need to tell it two things: which device is allowed to send authentication requests (the WLC), and which user accounts are valid.

  • Click the RADIUS Server device in your Packet Tracer topology to open its configuration window.
  • Click the Services tab at the top.
  • Select AAA from the list of services on the left.
  • Click the On radio button to enable the AAA service.

Now add the WLC as an authorized client. This tells the RADIUS server to accept authentication requests from that specific IP address.

  • Under the Network Configuration section, enter the following values:
  • Set Client Name to WLC-1.
  • Set Client IP to 192.168.100.254.
  • Set Secret to RadiusKey123.
  • Click Add to save the client entry.

What is a shared secret?

The shared secret is a password that both the WLC and the RADIUS server know. It encrypts the communication between them so that user credentials are never sent in plaintext across the network. Both sides must have the exact same secret or authentication silently fails.

Next, create the user accounts that employees will use to authenticate.

  • Scroll down to the User Setup section.
  • Enter user1 in the Username field.
  • Enter User1Pass in the Password field.
  • Click Add.
  • Enter user2 in the Username field.
  • Enter User2Pass in the Password field.
  • Click Add.

You should now see both user accounts listed in the user table and the WLC-1 client entry visible in the network configuration table. The AAA service indicator should show as On.

Why individual accounts matter

Each employee gets their own username and password. If someone leaves the company, you disable their account. Everyone else keeps connecting without interruption. Compare this to PSK, where you would need to change the passphrase on every single device.

Don't see the AAA section?

Make sure you clicked the Server device (not the router or switch). The AAA service only appears under Services on a server device in Packet Tracer.

If the service list is empty, close the device window and re-open it. Packet Tracer occasionally needs a moment to load services after the device powers on.

Help me troubleshoot the AAA service on my RADIUS server in Packet Tracer.

Register the RADIUS server on the WLC and switch to 802.1X

The RADIUS server is ready to authenticate users. Now you need to tell the WLC where to send authentication requests, and then reconfigure the corporate WLAN to require 802.1X instead of the shared passphrase.

  • Switch back to the Admin PC's web browser where you have the WLC GUI open at https://192.168.100.254.
  • Navigate to Security in the top menu bar.
  • In the left sidebar, expand RADIUS and click Authentication.
  • Click New.
  • Enter 10.10.200.10 in the Server IP Address field.
  • Enter RadiusKey123 in the Shared Secret field.
  • Enter RadiusKey123 again in the Confirm Shared Secret field.
  • Click Apply.

You should see the RADIUS server appear in the authentication server list with IP 10.10.200.10. This confirms the WLC now knows where to forward login requests.

Now reconfigure the corporate WLAN to use this RADIUS server instead of the shared passphrase.

  • Navigate to WLANs in the top menu bar.
  • Click on WLAN ID 1 (the Corporate profile) to open its settings.
  • Click the Security tab.
  • Under Layer 2, confirm WPA+WPA2 is still selected.
  • Under Authentication Key Management, change the selection from PSK to 802.1X.
  • Click the AAA Servers tab.
  • In the Server 1 dropdown, select the RADIUS server you just added (10.10.200.10).
  • Click Apply.

What just happened to your WLAN?

By switching from PSK to 802.1X, the WLC now requires every connecting client to provide a username and password. The WLC forwards those credentials to the RADIUS server at 10.10.200.10 for verification. If the RADIUS server confirms the credentials, the client is allowed on the network.

The old passphrase CorpSecure2024 is now useless. Anyone who tries to connect with it will be rejected because the WLAN no longer accepts PSK authentication.

Don't see the RADIUS server in the Server 1 dropdown?

Go back to Security > RADIUS > Authentication and confirm the server entry is listed. If it is missing, re-add it with the exact IP and shared secret. The dropdown only populates after the RADIUS server has been successfully added and applied.

Help me connect my WLC to the RADIUS server.

Reconnect Laptop-1 with enterprise credentials

The WLAN now requires individual credentials. Laptop-1 is still holding its old PSK profile, which will no longer work. You need to delete that profile and create a new one using WPA2-Enterprise authentication.

  • Click Laptop-1 in your topology to open its configuration window.
  • Click the Desktop tab.
  • Open PC Wireless.
  • Go to the Profiles tab.
  • Select the old Corporate profile.
  • Click Delete to remove it.

Now create a new profile that uses enterprise authentication.

  • Click New to create a new wireless profile.
  • Name the profile Corp-Enterprise.
  • Under Available Wireless Networks, select Corp-WiFi.
  • Choose WPA2-Enterprise for the security type.
  • Enter user1 as the username.
  • Enter User1Pass as the password.
  • Click Connect.

Before you check the result, what do you expect to happen? Will the laptop connect successfully, or will authentication fail?

After a brief delay, the laptop authenticates through the RADIUS server. The WLC forwards the credentials to 10.10.200.10, the server verifies them against its user database, and sends back an Access-Accept message.

  • Close the PC Wireless app.
  • Open Command Prompt from the Desktop tab.
  • Type ipconfig and press Enter.

You should see an IP address in the 192.168.10.x range. This confirms the laptop received a DHCP address from the CORP-WIFI pool after successfully authenticating via RADIUS.

  • Type ping 10.10.200.10 and press Enter to test end-to-end connectivity to the RADIUS server.

You should see successful replies from 10.10.200.10. This proves the full authentication chain is working: Laptop-1 presented credentials to the WLC, the WLC forwarded them to the RADIUS server, the server approved the request, and now the laptop has full network access across VLANs.

Why this approach instead of WPA2-PSK?

With PSK, every device shares one passphrase. If an employee leaves or a key leaks, you must change the passphrase on every device in the organization. WPA2-Enterprise with RADIUS lets you disable one user account and everyone else keeps working. This is why every corporate wireless network in production uses 802.1X.

Laptop not connecting or getting an IP?

Double-check that the username is exactly user1 and password is User1Pass (case-sensitive). The RADIUS server rejects mismatched credentials silently.

Verify the shared secret matches on both sides. The WLC has RadiusKey123 and the RADIUS server client entry must also have RadiusKey123. A mismatch means the WLC cannot decrypt the RADIUS response.

If the laptop shows no IP after connecting, confirm the WLC can reach the RADIUS server. From the Admin PC, ping 10.10.200.10 to verify network connectivity.

Help me troubleshoot my WPA2-Enterprise connection in Packet Tracer.

Your corporate network now authenticates users individually. No more shared passphrase that one disgruntled employee can leak to the world. Next up, you will tackle the Secret Mission and troubleshoot a rogue AP that refuses to join the controller.

Secret mission

Diagnose and Fix a Rogue AP That Cannot Join the WLC

A new lightweight AP has been added to the network, but it refuses to register with the WLC. The link light is green, the AP powers on, yet it never appears in the controller. Can you diagnose the switchport misconfiguration causing the failure and bring the AP online?

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely within Cisco Packet Tracer, so there are no cloud resources, subscriptions, or ongoing costs to worry about. Your entire network exists inside a single .pkt file on your local machine.

Resources you created:

  • Cisco Packet Tracer topology file (.pkt) containing all devices, cabling, and configurations.

Keep everything running

No action needed. Choose this if you want to revisit the topology later to add more features like ACLs, additional WLANs, or more VLANs.

  • Save your topology by pressing Ctrl+S (Windows) or Cmd+S (macOS) in Packet Tracer.
  • Choose a location you can find easily, like your Desktop or a dedicated lab folder.
  • You can reopen the file anytime to continue building on your enterprise wireless network.

Pause - I'll come back to this later

Since everything lives inside a single file, pausing is the same as saving. There are no background processes or running services to stop.

  • Save your topology file by pressing Ctrl+S (Windows) or Cmd+S (macOS).
  • Close Cisco Packet Tracer. Your network state is preserved in the .pkt file.
  • When you return, double-click the .pkt file to reopen your topology exactly where you left off.

Delete - I don't want to use this again

Remove the project file from your machine entirely. This cannot be undone.

  • Close Cisco Packet Tracer if it is still open.
  • Navigate to the folder where you saved your .pkt file.
  • Delete the .pkt file. On macOS, drag it to the Trash and empty the Trash. On Windows, right-click and select Delete, then empty the Recycle Bin.
  • Cisco Packet Tracer itself stays installed on your machine for future labs. There is no need to uninstall it.

Nice Work!

Nice Work!

You just built a complete enterprise wireless network from scratch. A Cisco 3504 WLC is now centrally managing three lightweight access points, corporate users authenticate with individual credentials through a RADIUS server, and the entire architecture runs on properly segmented VLANs.

You've learned how to:

  • Build a centralized wireless network with a WLC managing multiple lightweight APs discovered automatically via DHCP option 150 and registered over CAPWAP.
  • Configure VLAN segmentation with trunk ports and router-on-a-stick inter-VLAN routing to isolate corporate and guest wireless traffic on separate network segments.
  • Implement WPA2-Enterprise authentication with a RADIUS server, upgrading from a shared passphrase to individual user credentials verified via 802.1X.
  • Secret Mission: Diagnosed and fixed a switchport misconfiguration preventing AP registration, the most common WLC troubleshooting scenario in production networks.

Ready to quiz yourself?