Configuration and Implementation
Configuration is a dependency chain
AWCC items reward engineers who configure in the correct order. A typical sequence: verify management reachability and time sync, build AAA and certificate trust, create security profiles, create SSIDs bound to VLANs, define RF profiles (channels, power, data rates), attach everything to an AP group, then push and verify.
Rules that decide items
- A VLAN must exist on every trunk and access port in the path before an SSID can pass traffic.
- RF profiles are per band; a 5 GHz channel plan should not be applied to 2.4 GHz radios.
- Disabling the lowest legacy rates shrinks the cell and discourages sticky clients; keep at least one basic rate for management frames.
- Band steering and load balancing are steering hints, not guarantees - clients can ignore them.
- WMM/QoS marking must be consistent end to end; tagging on the SSID but stripping at the uplink silently breaks voice.
Worked example
Design a corporate SSID and a guest SSID. Corporate: WPA3-Enterprise, RADIUS-assigned dynamic VLAN, PMF capable, 802.11r enabled only after confirming client support. Guest: open or OWE with captive portal, client isolation, and a DMZ anchor. Order matters - if AAA is unreachable, the corporate SSID fails at association and no amount of RF tuning helps, so validate RADIUS first, then SSID, then VLAN, then RF.
Traps that cost marks
Tuning RF before validating AAA; enabling fast transition on a WLAN whose clients lack support; putting the guest SSID on the management VLAN; forgetting the native VLAN mismatch between AP port and controller; changing power on every AP at once and losing the baseline.
Verification habit
After each push, confirm the AP is online, the SSID is beaconing, a client completes the 4-way handshake, and DHCP is answered - four checks that localize almost any configuration fault.