Cisco Blogs

Always-On Mobile Experience with Wi-Fi

August 16, 2012 - 19 Comments

Importance of High Availability:  If you are reading this blog, you likely own 2-5 Wi-Fi-capable devices: laptops, mobile phones, or tablets. From employees to students, from doctors to guests, the common theme is that everyone now uses wireless as a preferred mode of access.

It is easy to understand why hospitals find Wi-Fi mission-critical to support all the devices and systems behind their complex procedures. Consider the retail distribution environment:  A few moments of network downtime during Christmas could leave a shipping company unable to track packages and ultimately unable to deliver them on time. This momentary inefficiency incurs both immediate penalties as well as future losses for the firm. For schools administering exams via wireless tablets, downtime is painfully disruptive. In an outdoor environment, network downtime for a few minutes could mean losing with employees in a mine. Downtime is aggravating even in the case of my two year old, who watches the “Elmo Song” and other Sesame Street music videos on the iPad—a pause of just a few seconds will have her fussing.

The Problem: Today, in most environments where High Availability is important, the access point is configured with primary and secondary controllers. In the event of the primary controller failing, the access point is disconnected for anywhere between 10-100 seconds before rolling over to the secondary controller. This roll-over time, dependent upon the scale of APs (and clients) managed,  is caused by the CAPWAP tunnels that connect the access point to controller having to be torn down from the primary controller and re-established with the secondary controller. Additionally, the client needs to re-authenticate with the AP, which in turn needs to validate credentials with the radius server. All this results in a 10-100 second failover time from the primary to secondary controller.

The Solution: A sub-second (yes, that’s less than one second) fail-over that maintains SSID connection. The latest 7.3 release (read as August-2012 – not some futuristic date) enables a second controller to be configured in “Hot Standby” mode to a designated primary controller.

The redundancy ports of these two controller appliances are connected with an Ethernet cable. In case of WiSM2, you can have a redundant blade in the same or across chassis with VSS. This connection is used to exchange the configurations, the CAPWAP states of APs, and regular keep-alives. This is how a sub-second failover can be achieved for hundreds of access points to the standby controller in case of a hardware failure or network loss for the primary Controller. This means that there is NO SSID Outage because of Access Points Stateful Switch Over (AP-SSO) from primary to the standby controller.

In addition, the standby controller also syncs the Pairwise Master Key (PMK) key cache from the active primary controller, so when the client re-associates to the access point, there is no need for the controller to re-authenticate with the RADIUS server, resulting in downtime of only a handful of seconds.

What is even better is that access point licenses on the primary controller are copied over to the standby controller. This means customers only need to purchase a low priced standby controller without purchasing duplicate licenses for managing APs!

Worry not — HealthCare, Education, Retail, Financial or any other customer segment leveraging wireless to offer increased productivity, better services, or mission-critical communication. With Cisco’s latest High Availability (HA) for the Wireless Network – you can be rest assured and always-on.

 Here is a video that demonstrates the benefits of High Availability:

In an effort to keep conversations fresh, Cisco Blogs closes comments after 60 days. Please visit the Cisco Blogs hub page for the latest content.


  1. Hi Can the HA box have AP licences installed on it. Can't think of a use case for it but just wondering. Also can the HA box be used as an Anchor WLC. I am thinking of having the standby HA installed in DMZ and use it for both Anchor and standby. Regards

    • Hi Reza, Thank you for the questions. If you have an existing controller e.g. 5508 with 50 base licenses and 100 adder, you can convert it to HA today. If you choose to migrate it back to being a primary controller, the licenses will be remembered and reverted back on the box. The HA SKU cannot be used as an anchor. You can however have the HA SKU be a standby to the anchor to increase resiliency. Best Regards, Jeevan

  2. Hi jeevan , Thanks for the info .. Just tell me one thing, wot will happen if redundancy port failed in any of the controller which means whether the key cache will sync only after the fail-over or it sync at regular interval

    • If RP fails, there won't be any more config or client key cache sync between the active and standby controller. Also, since RP fails the standalone controller will go into maintenance mode where it won't communicate with any other controller on the network. BTW good news to all, the 7.3 code is already posted :) HA PIDs will be order able in the next few weeks

  3. Hi Jeevan, Do you know when the 7.3.X will be released?

  4. I won't even pretend that I understood any of that! But knowing the effort you put into everything, I'm sure its great. Well done!

  5. Awesome feature. This is exactly what we need as Wireless is Misson Critical for us. Could you help me understand how licensing will work for this feature. Do I have to buy redundant licenses? I have 100 AP's in my environment, I would need: - 2x Controllers - 1x 100 AP license or 2x 100 AP license Can I buy the following: - 2x Controllers - 1x 100 AP license + 1x 12 AP license (as this is the smallest license offering)

    • Thanks. In your environment you will need to buy a Controller with 100 AP licenses(AIR-CT5508-100-K9) and the Standby SKU(AIR-CT5508-HA-K9). No redundant licenses needed on the -HA Controller. This standby -HA controller scales all the way to 500 APs. Namely in the future if you add licenses on the primary to scale up; you dont need to purchase anything extra on the standby. Before you ask, we should make this orderable within a few weeks.

      • This is AWESOME, I like this scheme, way more cost effective than Aruba (Redundant licensing needed). Thank you for making this simple.

      • Jeevan, Thanks for the info - this HA pricing feature is long awaited. Glad to see it's here. You mentioned being able to order in a few weeks - do you NTE pricing for the Standby controller (AIR-CT5508-HA-K9)?

        • Sorry JW, We do not post pricing information in advance of the release. My request is to reach out to your local Cisco representative on the pricing of the Standby Controller. Regards, Jeevan

  6. Hi Awesome feature Especially when even the licenses becomes redundant Might just be what makes some customers go fully redundant instead of semi- or in worst case not at all. A few questions comes to mind tho Customers who already have full redundancy and wants to upgrade to v7.3 to reduce downtime in case of one wlc failing. Lets say they have two wlc 5508 redundant for 500 aps. If they upgrade they will have 500 licenses they dont "need". Is their any conversion to be made in terms of licenses or is it a different kind of license all together to be able to run the AP-SSO feature? Is this a feature reserved for the 5508 wlc and WiSM2 or will it work on the smaller scale wlc aswell?

    • Hi, Firstly thank you. On your two questions: 1. If a customer has a Controller with 500 redundant licenses already; my recommendation would be to simply use that Controller as a primary in some other location when they expand. It is only possible to transfer 'adder' licenses as the following link describes: 2. This feature will be supported on 5508, WiSM2 and Flex7500 in 7.3. i.e. Not on the WLC2500 or ISR G2 Best Regards, Jeevan

  7. Good feature, Pitty it can't be run over a LAN/WAN.

    • Hi Paul, Thanks for your comment. Over a WAN, the latency may not be good enough to sync all the information between the two Controllers. Also the reconvergence time for an AP to join the standby Controller may not be small enough to achieve instant failover. Over a Campus LAN (L2 connected with low latency) it may work but it is not fully tested/supported. We should have more details in the next few weeks leading upto FCS. Best regards, Jeevan

  8. Is this achievable across a L3 boundary or does the hot-standy wlc need to be within the same broadcast domain?

    • Hi Shahid, Thanks for your comment. Over a WAN, the latency may not be good enough to sync all the information between the two Controllers. Also the reconvergence time for an AP to join the standby Controller may not be small enough to achieve instant failover. Over a Campus LAN (L2 connected with low latency) it may work but it is not fully tested/supported. We should have more details in the next few weeks leading upto FCS. Best regards, Jeevan

      • Hi Jeevan Is this achievable/supported across a L3 boundary / Campus LAN?

        • In 7.3 release with 5508, Flex7500 and 8500 the two controllers need to be physically adjacent to each other and the redundancy ports connected with ethernet cable. The two WiSM2 blades can be in the same chassis or another chassis with VSS technology.