Setting up a WLAN
Whether you use a WLC's GUI or an autonomous AP's CLI, the decisions are the same: the SSID, the security (WPA2/WPA3, Personal or Enterprise), the passphrase or RADIUS server, the band and channel, and which VLAN the clients go into. Below, a factory-new AP gets set up and LAP2, a Linux laptop, joins with nmcli and gets an address by DHCP:
In NetLab
▶ AP1 NetLab access point. Type help to see the commands. AP1> show wlan Radio : on SSID : (none) Security : WPA2-Personal Passphrase : NOT SET Band : 5 GHz Channel : 36 AP1> wlan ssid Staff AP1> wlan security wpa2 AP1> wlan passphrase Netlab-2027! AP1> radio band 5 Band set to 5 GHz, channel 36. AP1> radio channel 44 AP1> show wlan Radio : on SSID : Staff Security : WPA2-Personal Passphrase : set (12 characters) Band : 5 GHz Channel : 44 ▶ LAP2 student@LAP2:~$ nmcli device wifi list IN-USE SSID MODE CHAN RATE SIGNAL BARS SECURITY Staff Infra 44 540 Mbit/s 74 ▂▄▆_ WPA2 student@LAP2:~$ nmcli device wifi connect Staff password Netlab-2027! Device 'wlan0' successfully activated with 'Staff'. student@LAP2:~$ ip addr show wlan0 2: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000 link/ether 00:1a:7e:d5:f6:e4 brd ff:ff:ff:ff:ff:ff inet 192.168.30.10/24 brd 192.168.30.255 scope global dynamic wlan0 valid_lft 86399sec preferred_lft 86399sec inet6 fe80::21a:7eff:fed5:f6e4/64 scope link valid_lft forever preferred_lft forever student@LAP2:~$ ping -c 2 192.168.30.1 PING 192.168.30.1 (192.168.30.1) 56(84) bytes of data. 64 bytes from 192.168.30.1: icmp_seq=1 ttl=255 time=0.500 ms 64 bytes from 192.168.30.1: icmp_seq=2 ttl=255 time=0.640 ms --- 192.168.30.1 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1001ms rtt min/avg/max/mdev = 0.500/0.570/0.640/0.070 ms
When a client can't connect
| Check | Look at |
|---|---|
| Is the AP on? (power, radio) | show power inline on the switch; the AP's radio state |
| Does the client see the SSID? | netsh wlan show networks / nmcli device wifi list |
| Right passphrase / credentials? | The client's error: "The network security key isn't correct" |
| Does the client support the band and security? | An old 2.4 GHz-only laptop can't see a 5 GHz SSID; WPA2-only clients can't join WPA3 |
| Is the signal strong enough, and the channel clean? | Signal %, overlapping neighbours |
| Joined but no address? | DHCP: the AP's VLAN, the pool, the helper address |
Tip: Work from layer 1 up: power and radio, then association (SSID, security), then IP (DHCP, gateway).