Cisco Catalyst 9800-40 Wireless Controller
Cisco IOS XE based and integrate the RF excellence of Cisco Aironet access points
Cisco Catalyst 9800-40 Wireless Controller:
Built from the ground-up for the Intent-based networking and Cisco DNA, Cisco Catalyst 9800 Series Wireless Controllers are Cisco IOS® XE based and integrate the RF excellence of Cisco Aironet® access points creating the best-in-class wireless experience for your evolving and growing organization. The Cisco Catalyst 9800 Series Wireless Controllers are built on an open and programmable architecture with built-in security, streaming telemetry and rich analytics.
The Cisco Catalyst 9800 Series Wireless Controllers are built on the three pillars of network excellence- always on, secure, and deployed anywhere-which strengthen the network by providing the best wireless experience without compromise, while saving time and money.
The Cisco Catalyst 9800-40 is a fixed wireless controller with seamless software updates for midsize and large enterprises. It is feature rich and enterprise ready to power your business-critical operations and transform end-customer experiences:
- High availability and seamless software updates, enabled by hot and cold patching, keep your clients and services always on during planned and unplanned events.
- Secure air, devices, and users with the Cisco Catalyst 9800-40. Wireless infrastructure becomes the strongest first line of defense with Cisco Encrypted Traffic Analytics (ETA) and Software-Defined Access (SD-Access). The controller comes with built-in security: Secure Boot, runtime defenses, image signing, integrity verification, and hardware authenticity.
- Built on a modular operating system, the 9800-40 features open and programmable APIs that enable automation of day-0 to day-N network operations. Model-driven streaming telemetry provides deep insights into the health of your network and clients.
- Cisco User Defined Network, a feature available in Cisco DNA Center, allows IT to give end users control of their very own wireless network partition on a shared network. End users can then remotely and securely deploy their devices on this network. Perfect for university dormitories or extended hospital stays, Cisco User Defined Network grants both device security and control, allowing each user to choose who can connect to their network.
- The Wi-Fi 6 readiness dashboard is a new dashboard in the Assurance menu of Cisco DNA Center. It will look through the inventory of all devices on the network and verify device, software, and client compatibility with the new Wi-Fi 6 standard. After upgrading, advanced wireless analytics will indicate performance and capacity gains as a result of the Wi-Fi 6 deployment. This is an incredible tool that will help your team define where and how the wireless network should be upgraded. It will also give you insights into the access point distribution by protocol (802.11 ac/n/abg), wireless airtime efficiency by protocol, and granular performance metrics.
- With Cisco In Service Software Upgrade (ISSU), network downtime during a software update or upgrade is a thing of the past. ISSU is a complete image upgrade and update while the network is still running. The software image-or patch-is pushed onto the wireless controller while traffic forwarding continues uninterrupted. All access point and client sessions are retained during the upgrade process. With just a click, your network automatically upgrades to the newest software.
Key Features:
| Metric | Value |
|---|---|
| Maximum number of access points | Up to 2000 |
| Maximum number of clients | 32,000 |
| Maximum throughput | Up to 40 Gbps |
| Maximum WLANs | 4096 |
| Maximum VLANs | 4096 |
| Max Site Tags | 2000 |
| Max Flex APs per Site | 100 |
| Max Policy Tags | 2000 |
| Max RF Tags | 2000 |
| Max RF Profiles | 4000 |
| Max Policy Profiles | 1000 |
| Max Flex Profiles | 2000 |
| Interfaces | 4x 10 GE/1 GE SFP+/SFP |
| Power supply | AC power with optional redundant AC power |
| Maximum power consumption | 381W |
| Deployment modes | Centralized, Cisco FlexConnect, and Fabric Wireless (SD-Access) |
| Form factor | 1RU |
| License | Smart License enabled |
| Operating system | Cisco IOS XE |
| Management | Cisco DNA Center, Cisco Prime Infrastructure, integrated WebUI, and third party (open standards APIs) |
| Interoperability | AireOS-based controllers |
| Policy engine | Cisco Identity Services Engine (ISE) |
| Location platform | Cisco Connected Mobile Experiences (CMX), Cisco DNA Spaces |
| Access points | Aironet 802.11ac Wave 1 and Wave 2 access points, Cisco Catalyst 9100 802.11ax access points |
Always on
Seamless software updates enable faster resolution of critical issues, introduction of new access points with zero downtime, and flexible software upgrades. Stateful switchover (SSO) with 1:1 active standby and N+1 redundancy keeps your network, services, and clients always on, even in unplanned events.
Secure
Secure air, devices, and users with the Cisco Catalyst 9800-40 Wireless Controller. Wireless infrastructure becomes the strongest first line of defense with ETA and SD-Access. The controller comes with built-in security: Secure Boot, runtime defenses, image signing, integrity verification, and hardware authenticity. Cisco Advanced Wireless Intrusion Prevention System (aWIPS) is a complete wireless security solution that uses the Cisco Unified Access® infrastructure to detect, locate, mitigate, and contain wired and wireless rogues and threats.
Open and programmable
The controller is built on the Cisco IOS XE operating system, which offers a rich set of open standards-based programmable APIs and model-driven telemetry that provide an easy way to automate day-0 to day-N network operations.
Physical dimensions:
| Dimension | Value |
|---|---|
| Width | 17.3 inches (43.94 cm) |
| Depth | 19.5 inches (49.53 cm) |
| Height | 1.72 inches (4.37 cm) |
| Weight | 22.8 lb (10.34 kg) |
Ports and their purposes:
| Port | Purpose |
|---|---|
| 1x RJ-45 console port | Console port for out-of-band management |
| 1x USB 3.0 console port | Console port for out-of-band management |
| 2x USB 3.0 ports | USB 3.0 ports for plugging in external memory |
| 1x RJ-45 management port | Management port used for out-of-band management. Also known as service port |
| 1x RJ-45 redundancy port | Redundancy port used for SSO |
| 1x SFP Gigabit Ethernet redundancy port | Redundancy port used for SSO
|
| 4x 10 GE/1 GE SFP+ or SFP ports | Ports used for sending and receiving traffic between access points and controller, northbound traffic, in-band management traffic, and wireless client traffic. Must be connected to the switch |
Front Panel LEDs
| LED | Color | Function |
|---|---|---|
| Power | Green | Green if all power rails are within spec |
| System status | Green | On: IOS has boot complete |
| Blinking: IOS boot in progress | ||
| Amber | On: IOS has boot complete | |
| Blinking: Secure boot failure | ||
| Off: ROMMON boot | ||
| High Availability | Green | On: HA active |
| Blinking: HA standby hot | ||
| Amber | Slow blink: Booted with HA standby cold | |
| Fast blink: HA maintenance | ||
| Alarm | Green | On: ROMMON boot complete |
| Blinking: System upgrade in progress | ||
| Amber | On: ROMMON boot and SYSTEM bootup | |
| Blinking: Temperature err and secure boot failure | ||
| USB console | Green | When LED is lit, USB Console is enabled (RJ-45 console is disabled) |
| SSD activity | Green | Indicates active use of the hard disk SSD memory devices in the unit |
| Network link | Green | Solid green indicates link |
| Flashing green indicates activity |
Rear Panel LEDs
| Green LED | Amber LED | Power Supply Status |
|---|---|---|
| Off | Off | No AC power to all power supplies |
| Off | On | Power supply failure (includes over voltage, over current, over temperature, and fan failure) |
| Off | 1 Hz blinking | Power supply warning events in which the power supply continues to operate (high temperature, high power, and slow fan) |
| 1 Hz blinking | Off | AC present, 12VSB on (power supply off) |
| On | Off | Power supply on and OK |
Power
The 9800-40 controller supports an optional redundant AC power supply.
The AC input ranges are as follows:
- Worldwide ranging AC input range (90 to 264 VAC)
The Power Entry Modules (PEMs) provide redundant power to the system, and the 9800-40 can operate continuously with only a single PEM installed. The PEMs are hot-swappable, and replacement of a single PEM can be made without power interruption to the system. All external connections to the PEMs are made from the rear panel of the chassis, and they are removed or inserted from the rear. The main power switch for the unit is located directly next to the PEMs on the rear of the chassis.
Benefits:
Cisco IOS XE opens a completely new paradigm in network configuration, operation, and monitoring through network automation. Cisco's automation solution is open, standards-based, and extensible across the entire lifecycle of a network device. The various mechanisms that bring about network automation are outlined below, based on a device lifecycle.
- Automated device provisioning: This is the ability to automate the process of upgrading software images and installing configuration files on Cisco access points when they are being deployed in the network for the first time. Cisco provides turnkey solutions such as Plug and Play (PnP) that enable an effortless and automated deployment.
- API-driven configuration: Modern wireless controllers such as the Cisco Catalyst 9800-40 Wireless Controller support a wide range of automation features and provide robust open APIs over Network Configuration Protocol (NETCONF) using YANG data models for external tools, both off-the-shelf and custom built, to automatically provision network resources.
- Granular visibility: Model-driven telemetry provides a mechanism to stream data from a wireless controller to a destination. The data to be streamed is driven through subscription to a data set in a YANG model. The subscribed data set is streamed out to the destination at configured intervals. Additionally, Cisco IOS XE enables the push model, which provides near-real-time monitoring of the network, leading to quick detection and rectification of failures.
- Seamless software upgrades and patching: To enhance OS resilience, Cisco IOS XE supports patching, which provides fixes for critical bugs and security vulnerabilities between regular maintenance releases. This support allows customers to add patches without having to wait for the next maintenance release.
Always on
- High availability: Stateful switchover with a 1:1 active standby and N+1 redundancy keeps your network, services, and clients always on, even in unplanned events.
- Software Maintenance Upgrades (SMUs) withhot and cold patching: Patching allows for a patch to be installed as a bug fix without bringing down the entire network and eliminates the need to requalify an entire software image.The SMU is a package that can be installed on a system to provide a patch fix or security resolution to a released image. SMUs allow you to address the network issue quickly while reducing the time and scope of the testing required. The Cisco IOS XE platform internally validates the SMU compatibility and does not allow you to install incompatible SMUs. All SMUs are integrated into the subsequent Cisco IOS XE Software maintenance releases.
- Intelligent rolling access point upgrades and seamless multisite upgrades: The Cisco Catalyst 9800-40 Wireless Controller comes equipped with intelligent rolling access point upgrades to simplify network operations. Multisite upgrades can now be done in stages, and access points can be upgraded intelligently without restarting the entire network.
- Standby monitoring of Cisco Catalyst 9800 Wireless Controllers in high-availability mode enables monitoring the health of the system on a standby controller in a high-availability pair using programmatic interfaces (NETCONF/YANG, RESTCONF) and CLIs without going through the active controller. For more details refer to the technical documentation.
- In-Service Software Upgrade (ISSU): ISSU is a complete image upgrade/update with zero downtime while the network is still on. The software image or a patch is pushed onto the wireless controller while traffic forwarding continues uninterrupted. All access point and client sessions are retained during the upgrade process.
Security
- Encrypted Traffic Analytics (ETA): ETA is a unique capability for identifying malware in encrypted traffic coming from the access layer. Since more and more traffic is being encrypted, the visibility this feature provides related to threat detection is critical for keeping your network secure at different layers.
- Trustworthy systems: Cisco Trust Anchor Technologies provide a highly secure foundation for Cisco products. With the Cisco Catalyst 9800-40, these trustworthy systems help assure hardware and software authenticity for supply chain trust and strong mitigation against man-in-the-middle attacks on software and firmware. Trust Anchor capabilities include:
- Image signing: Cryptographically signed images provide assurance that the firmware, BIOS, and other software are authentic and unmodified. As the system boots, its software signatures are checked for integrity.
- Secure Boot: Cisco Secure Boot technology anchors the boot sequence chain of trust to immutable hardware, mitigating threats against a system's foundational state and the software that is to be loaded, regardless of a user's privilege level. It provides layered protection against the persistence of illicitly modified firmware.
- Cisco Trust Anchor module: A tamper-resistant, strong cryptographic, single-chip solution uniquely identifies the product so that its origin can be confirmed to Cisco, providing assurance that the product is genuine.
- Cisco Wireless Intrusion Prevention System (WIPS): WIPS offers advanced network security to detect, locate, mitigate, and contain any intrusion or threat on your wireless network. It can monitor and detect wireless network anomalies, unauthorised access, and RF attacks. A new, dedicated classification engine for rogues and aWIPS is built on Cisco DNA Center. A fully integrated stack for the WIPS solution includes Cisco DNA Center, a Cisco Catalyst 9800 controller, Wave 2, and Cisco Catalyst 9100 Access Point. This new architecture provides improved detection and security, simplicity, and ease of use, and reduced false positive alarms.
Flexible NetFlow
- Flexible NetFlow (FNF): Cisco IOSFNF is the next generation in flow visibility technology, allowing optimization of the network infrastructure, reducing operating costs, and improving capacity planning and security incident detection with increased flexibility and scalability.
Application Visibility and Control
- Next-Generation Network Based Application Recognition (NBAR2): NBAR2 enables advanced application classification techniques, with up to 1400 predefined and well-known application signatures and up to 150 encrypted applications on the Cisco Catalyst 9800-40. Some of the most popular applications included are Skype, Office 365, Microsoft Lync, Cisco Webex®, and Facebook. Many others are already predefined and easy to configure. NBAR2 provides the network administrator with an important tool to identify, control, and monitor end-user application usage while helping ensure a quality user experience and securing the network from malicious attacks. It uses FNF to report application performance and activities within the network to any supported NetFlow collector, such as Cisco Prime, Stealthwatch®, or any compliant third-party tool.
Quality of Service
- Superior Quality of Service (QoS): QoS technologies are tools and techniques for managing network resources and are considered the key enabling technologies for the transparent convergence of voice, video, and data networks. QoS on the Cisco Catalyst 9800-40 consists of classification of traffic based on packet data as well as application recognition and traffic control actions such as drop, marking and policing. A modular QoS command-line framework provides consistent platform-independent and flexible configuration behavior. The 9800-40 also supports policies at two levels of target: BSSID as well as client. Policy assignment can be granular down to the client level.
Smart operation
- Bluetooth ready: The Cisco Catalyst 9800-40 has hardware support to connect a Bluetooth dongle to the controller, enabling you to use this wireless interface as a management port. This port functions as an IP management interface and can be used for configuration and troubleshooting using WebUI or the Command-Line Interface (CLI), and to transfer images and configurations.
- WebUI: WebUI is an embedded GUI-based device-management tool that provides the ability to provision the device, simplify device deployment and manageability, and enhance the user experience. WebUI comes with the default image. There is no need to enable anything or install any license on the device. You can use WebUI to build a day-0 and day-1 configuration and from then on monitor and troubleshoot the device without having to know how to use the CLI.
Specifications:
| Item | Specification |
|---|---|
| Wireless standards | IEEE 802.11a, 802.11b, 802.11g, 802.11d, WMM/802.11e, 802.11h, 802.11n, 802.11k, 802.11r, 802.11u, 802.11w, 802.11ac Wave1 and Wave2, 802.11ax |
| Wired, switching, and routing standards | IEEE 802.3 10BASE-T, IEEE 802.3u 100BASE-TX, 1000BASE-T. 1000BASE-SX, 1000-BASE-LH, IEEE 802.1Q VLAN taggin, 802.1AX Link Aggregation |
| Data standards |
|
| Security standards |
|
| Encryption standards |
|
| Authentication, Authorization, and Accounting (AAA) standards |
|
| Management standards |
|
| Management interfaces |
|
| Hard Disk Drives (HDD) |
|
| Environmental conditions supported |
|
| Regulatory compliance |
|
Licensing:
No licenses are required to boot up a Cisco Catalyst 9800 Series Wireless Controller. However, in order to connect any access points to the controller, Cisco DNA software subscriptions are required. To be entitled to connecting to a 9800 Series controller, each access point requires a Cisco DNA subscription license.
Determining license requirements for access points connecting to Cisco Catalyst 9800 Series Wireless Controllers
The access points connecting to the Cisco Catalyst 9800 Series have new and simplified software subscription packages.
They can support three tiers of Cisco DNA software: Cisco DNA Essentials, Cisco DNA Advantage and Cisco DNA Premier.
Cisco DNA software subscriptions provide Cisco innovations on the access point. They also include perpetual Network Essentials and Network Advantage licensing options, which cover wireless fundamentals such as 802.1X authentication, QoS and PnP; telemetry and visibility; and single sign-on, as well as security controls.
Cisco DNA subscription software has to be purchased for a 3-, 5-, or 7-year subscription term. Upon expiry of the subscription, the Cisco DNA features will expire, whereas the Network Essentials and Network Advantage features will remain.
Two modes of licensing are available:
- Cisco Smart Licensing is a flexible licensing model that provides you with an easier, faster, and more convenient way to purchase and manage software across the Cisco portfolio and across your organization. And it's secure- you control what users can access. With Smart Licensing you get:
- Easy Activation: Smart licensing establishes a pool of software licenses that can be used across the entire organization-no more PAKs (Product Activation Keys).
- Unified Management: My Cisco Entitlements (MCE) provides a complete view into all of your Cisco Products and services in an easy-to-use portal, so you always know what you have and what you are using.
- License Flexibility: Your software is not node-locked to your hardware, so you can easily use and tranfer licenses as needed. To use Smart Licensing, you must first set up a Smart Account on Cisco Software Central (software.cisco.com). For more detailed overview on Cisco Licensing, go to cisco.com/go/licensingguide
- Specific License Reservation (SLR) is a feature used in highly secure networks. It provides a method for customers to deploy a software license on a device (product instance) without communicating usage information to Cisco. There is no communication with Cisco or a satellite. The licenses are reserved for every controller. It is node-based licensing.
Four levels of license are supported on the Cisco Catalyst 9800 Series Wireless Controllers. The controllers can be configured to function at any one of the four levels.
- Cisco DNA Essentials: At this level the Cisco DNA Essentials feature set will be supported.
- Cisco DNA Advantage: At this level the Cisco DNA Advantage feature set will be supported.
- NE: At this level the Network Essentials feature set will be supported. This is available with Cisco DNA Essentials.
- NA: At this level the Network Advantage feature set will be supported. This is available with Cisco DNA Advantage.
Cisco DNA Premier is a bundle with ISE licenses and Cisco DNA Spaces Advantage. It is inclusive of Cisco DNA Advantage, so at this level the Cisco DNA Advantage feature set will be supported. For customers who purchase Cisco DNA Essentials, Network Essentials will be supported and will continue to function even after term expiration. And for customers who purchase Cisco DNA Advantage or Cisco DNA Premier, Network Advantage will be supported and will continue to function even after term expiration.
Initial bootup of the controller will be at the Cisco DNA Advantage level.
Managing licenses with Smart Accounts
Creating Smart Accounts by using the Cisco Smart Software Manager (SSM) enables you to order devices and licensing packages and also manage your software licenses from a centralized website. You can set up the Smart Account to receive daily email alerts and to be notified of expiring add-on licenses that you want to renew. A Smart Account is mandatory for the Cisco Catalyst 9800 Series.
Documentation:
Download the Cisco Catalyst 9800-40 Wireless Controller Datasheet (PDF).
Pricing Notes:
- All Prices are Inclusive of GST
- Pricing and product availability subject to change without notice.