Cisco Catalyst 9800-L Wireless Controller
Built from the ground up for intent-based networking

Key Features:

Feature	Description
Maximum number of access points	250, 500 (with Performance license)
Maximum number of clients	5000, 10,000 (with Performance license)
Maximum throughput	5 Gbps, 10 Gbps* (with Performance license)
Maximum WLANs	4096
Maximum VLANs	4096
Fixed uplinks	2x 10G/Multigigabit copper or 2x 10G/Multigigabit fiber
Power supply	110W, 12V DC, AC/DC adapter
Maximum power consumption	9800-L-C: 86.9W (with 4.5W USB load) 9800-L-F: 84.5W (assumes 2pc 2.5W SFP and with 4.5W USB load)
Deployment modes	Centralized, Cisco FlexConnect, and fabric
Form factor	1RU; half-width chassis allows side-by-side installation in standard 19-in. rack
License	Smart License enabled
Software	Cisco IOS XE
Management	Cisco DNA Center, Cisco Prime Infrastructure, and third party (open standards APIs)
Interoperability	AireOS-based controllers
Access points	Cisco Aironet 802.11ac Wave 1 and Wave 2 access points, Cisco Catalyst 9100 802.11ax access points

Always on

The Cisco Catalyst 9800-L provides seamless software updates for faster resolution of critical issues, the ability to introduce new access points with zero downtime, and flexible software upgrades. Stateful Switchover (SSO) with active standby and N+1 redundancy keeps your network, services, and clients always on, even in unplanned events.

Secure

Secure the air, devices, and users with the Cisco Catalyst 9800-L. Wireless infrastructure becomes the strongest first line of defense with Encrypted Traffic Analytics and SD-Access. The controller comes with built-in security: Secure Boot, runtime defenses, image signing, integrity verification, and hardware authenticity. Cisco Advanced Wireless Intrusion Prevention System (aWIPS) is a complete wireless security solution that uses the Cisco Unified Access® infrastructure to detect, locate, mitigate, and contain wired and wireless rogues and threats.

Open and programmable

The Cisco Catalyst 9800-L controller is built on the Cisco IOS XE operating system, which offers a rich set of open standards-based programmable APIs and model-driven telemetry that provide an easy way to automate day-0 to day-N network operations.

Physical dimensions:

Dimension	Value
Width	8.5 in. (21.59 cm)
Depth	9.06 in. (23.01 cm)
Height	1.58 in. (4.02 cm)
Weight	C9800-L-C: 3.95 lb. (1.79 kg) C9800-L-F: 4.01 lb. (1.82 kg)

Ports and their purposes:

Port	Purpose
1x RJ-45 console port	Console port for out-of-band management
1x Micro USB console port	Console port for out-of-band management
1x USB 3.0 port	USB 3.0 port for plugging in external memory
1x RJ-45 management port	Management port used for out-of-band management. Also known as the service port.
1x RJ-45 redundancy port	Redundancy port used for SSO
4x 2.5G/1G and 2x 10G copper ports	Ports used for sending and receiving traffic between access points and controller, northbound traffic, in-band management traffic, and wireless client traffic. Must be connected to the switch.
4x 2.5G/1G copper and 2x 10G SFP+ fiber ports	Ports used for sending and receiving traffic between access points and controller, northbound traffic, in-band management traffic, and wireless client traffic. Must be connected to the switch.

Front Panel LEDs

LED	Color	Function
Power	Green	Green if all power rails are within spec
System status	Green	On: IOS has boot complete
		Blinking: IOS boot in progress
	Red	On: IOS has boot complete
		Blinking: Secure boot failure
		Off: ROMMON boot
High Availability	Green	On: HA active
		Slow blink: HA standby hot
	Amber	Slow blink: Booted with HA standby cold
		Fast blink: HA maintenance
Alarm	Green	On: ROMMON boot complete
		Blinking: System upgrade in progress
	Amber	On: ROMMON boot and SYSTEM bootup
		Blinking: Temperature err and secure boot failure
Network link LED Indicator	Green	Solid green: Link
		Flashing green: Activity
		LED off: Link down

Power

The Cisco Catalyst 9800-L Wireless Controller is powered by a single output 12V DC, 110W 120/240V AC adapter (C9800-AC-110W) that is shipped by default.

Benefits:

Cisco IOS XE

The Cisco Catalyst 9800 Series opens a completely new paradigm in network configuration, operation, and monitoring through network automation. Cisco’s automation solution is open, standards based, and extensible across the entire lifecycle of a network device. The various mechanisms that bring about network automation are outlined below, based on the device lifecycle.

• Automated device provisioning: This is the ability to automate the process of upgrading software images and installing configuration files on Cisco Catalyst access points when they are being deployed in the network for the first time. Cisco provides turnkey solutions with Plug and Play (PnP) capabilities that enable an effortless and automated deployment.
• API-driven configuration: Modern wireless controllers such the Cisco Catalyst 9800 Series support a wide range of automation features and provide robust open APIs over NETCONF and RESTCONF using YANG data models for external tools, both off-the-shelf and custom built, to automatically provision network resources.
• Granular visibility: Model-driven telemetry provides a mechanism to stream data from a switch to a destination. The data to be streamed is driven through subscription to a data set in a YANG model. The subscribed data set is streamed out to the destination at configured intervals. Additionally, Cisco IOS XE enables the push model, which provides near-real-time monitoring of the network, leading to quick detection and rectification of failures.
• Seamless software upgrades and patching: To enhance OS resilience, Cisco IOS XE supports patching, which provides fixes for critical bugs and security vulnerabilities between regular maintenance releases. This support allows customers to add patches without having to wait for the next maintenance release.

Security

• Trustworthy systems: Cisco Trust Anchor Technologies provide a highly secure foundation for Cisco products. With the Cisco Catalyst 9800 Series, these trustworthy systems enable hardware and software authenticity assurance for supply chain trust and strong mitigation against man-in-the-middle attacks on software and firmware. Trust Anchor capabilities include:
• Image signing: Cryptographically signed images provide assurance that the firmware, BIOS, and other software are authentic and unmodified. As the system boots, its software signatures are checked for integrity.
• Secure Boot: Cisco Secure Boot technology anchors the boot sequence chain of trust to immutable hardware, mitigating threats against a system's foundational state and the software that is to be loaded, regardless of a user's privilege level. It provides layered protection against the persistence of illicitly modified firmware.
• Cisco Trust Anchor module: A tamper-resistant, strong cryptographic, single-chip solution provides hardware authenticity assurance to uniquely identify the product so that its origin can be confirmed to Cisco, providing assurance that the product is genuine.
• Cisco Wireless Intrusion Prevention System (WIPS): WIPS offers advanced network security to detect, locate, mitigate, and contain any intrusion or threat on your wireless network. It can monitor and detect wireless network anomalies, unauthorised access, and RF attacks. A new, dedicated classification engine for rogues and aWIPS is built on Cisco DNA Center. A fully integrated stack for the WIPS solution includes Cisco DNA Center, Cisco Catalyst 9800 controller, Wave 2, and Cisco Catalyst 9100 Access Point. This new architecture provides improved detection and security, simplicity, ease of use, and reduced false positive alarms.

Resiliency and high availability

• Stateful Switchover (SSO): Stateful Switchover with an active standby and N+1 redundancy keeps your network, services, and clients always on, even in unplanned events.
• Software Maintenance Upgrades (SMUs) and hot and cold patching: Patching allows for a patch to be installed as a bug fix without bringing down the entire network and avoiding the need to requalify an entire software image. The SMU is a package that can be installed on a system to provide a patch fix or security resolution to a released image. SMUs allow you to address the network issue quickly while reducing the time and scope of the testing required. The Cisco IOS XE platform internally validates the SMU compatibility and does not allow you to install incompatible SMUs. All SMUs are integrated into the subsequent Cisco IOS XE Software maintenance releases.
• Intelligent rolling access point upgrades and seamless multisite upgrades: The Cisco Catalyst 9800 Series comes with intelligent rolling access point upgrades to simplify network operations. Multisite upgrades can now be done in stages, and access points can be upgraded intelligently without restarting the entire network.
• Standby Monitoring of Cisco Catalyst 9800 Wireless Controllers in HA mode enables monitoring the health of the system on standby controller in an HA pair using programmatic interfaces (NETCONF/YANG, RESTCONF) and CLIs without going through the active controller.
• In-Service Software Upgrade (ISSU): ISSU is a complete image upgrade/update with zero downtime while the network is still on. The software image or a patch is pushed onto the wireless controller while traffic forwarding continues uninterrupted. All access point and client sessions are retained during the upgrade process.

Flexible NetFlow

• Flexible NetFlow (FNF): Cisco IOS Software FNF is the next generation in flow visibility technology, allowing optimization of the network infrastructure, reducing operating costs, and improving capacity planning and security incident detection with increased flexibility and scalability.

Application Visibility and Control

• Next-Generation Network Based Application Recognition (NBAR2): NBAR2 enables advanced application classification techniques, with up to 1400 predefined and well-known application signatures and up to 150 encrypted applications on the Cisco Catalyst 9800-40. Some of the most popular applications included are Skype, Office 365, Microsoft Lync, Cisco Webex®, and Facebook. Many others are already predefined and easy to configure. NBAR2 provides the network administrator with an important tool to identify, control, and monitor end-user application usage while helping ensure a quality user experience and securing the network from malicious attacks. It uses FNF to report application performance and activities within the network to any supported NetFlow collector, such as Cisco Prime, Stealthwatch®, or any compliant third-party tool.

Quality of Service

• Superior Quality of Service (QoS): QoS technologies are a set of tools and techniques for managing network resources and are considered the key enabling technologies for the transparent convergence of voice, video, and data networks. QoS on the Cisco Catalyst 9800 Series consists of classification and marking, policing and markdown, and scheduling, shaping, and queuing functions. A modular QoS command-line framework provides consistent platform-independent and flexible configuration behavior. The Cisco Catalyst 9800 Series also supports 2-level hierarchical or nested policies.

Smart operation

• Bluetooth ready: The Cisco Catalyst 9800-L has hardware support to connect a Bluetooth dongle to the controller, enabling you to use this wireless interface as a management port. This port functions as an IP management interface and can be used for configuration and troubleshooting using the WebUI or Command-Line Interface (CLI), and to transfer images and configurations.
• WebUI: WebUI is an embedded GUI-based device-management tool that enables provisioning of the device, simplifying device deployment and manageability and enhancing the user experience. WebUI comes with the default image. There is no need to enable anything or install any license on the device. You can use WebUI to build a day-1 configuration and from then on monitor and troubleshoot the device without having to know how to use the CLI.

Specifications:

Item	Specification
Wireless standards	IEEE 802.11a, 802.11b, 802.11g, 802.11d, WMM/802.11e, 802.11h, 802.11n, 802.11k, 802.11r, 802.11u, 802.11w, 802.11ac Wave1 and Wave2, 802.11ax
Wired, switching, and routing standards	IEEE 802.3 10BASE-T, IEEE 802.3u 100BASE-TX specification, 1000BASE-T, 1000BASE-SX, 1000-BASE-LH, IEEE 802.1Q VLAN tagging, IEEE 802.1AX Link Aggregation
Data standards	RFC 768 User Datagram Protocol (UDP) RFC 791 IP RFC 2460 IPv6 RFC 792 Internet Control Message Protocol (ICMP) RFC 793 TCP RFC 826 Address Resolution Protocol (ARP) RFC 1122 Requirements for Internet Hosts RFC 1519 Classless Interdomain Routing (CIDR) RFC 1542 Bootstrap Protocol (BOOTP) RFC 2131 Dynamic Host Configuration Protocol (DHCP) RFC 5415 Control and Provisioning of Wireless Access Points (CAPWAP) Protocol RFC 5416 CAPWAP Binding for 802.11
Security standards	Wi-Fi Protected Access (WPA) IEEE 802.11i (WPA2, RSN) RFC 1321 MD5 Message-Digest Algorithm RFC 1851 Encapsulating Security Payload (ESP) Triple DES (3DES) Transform RFC 2104 HMAC: Keyed-Hashing for Message Authentication RFC 2246 TLS Protocol Version 1.0 RFC 2401 Security Architecture for the Internet Protocol RFC 2403 HMAC-MD5-96 within ESP and AH RFC 2404 HMAC-SHA-1-96 within ESP and AH RFC 2405 ESP DES-CBC Cipher Algorithm with Explicit IV RFC 2407 Interpretation for Internet Security Association Key Management Protocol (ISAKMP) RFC 2408 ISAKMP RFC 2409 Internet Key Exchange (IKE) RFC 2451 ESP CBC-Mode Cipher Algorithms RFC 3280 Internet X.509 Public Key Infrastructure (PKI) Certificate and Certificate Revocation List (CRL) Profile RFC 4347 Datagram Transport Layer Security (DTLS) RFC 5246 TLS Protocol Version 1.2
Encryption standards	Static Wired Equivalent Privacy (WEP) RC4 40, 104 and 128 bits Advanced Encryption Standard (AES): Cipher Block Chaining (CBC), Counter with CBC-MAC (CCM), Counter with CBC Message Authentication Code Protocol (CCMP) Data Encryption Standard (DES): DES-CBC, 3DES Secure Sockets Layer (SSL) and Transport Layer Security (TLS): RC4 128-bit and RSA 1024- and 2048-bit DTLS: AES-CBC IPsec: DES-CBC, 3DES, AES-CBC 802.1AE MACsec encryption
Authentication, Authorization, and Accounting (AAA) standards	IEEE 802.1X RFC 2548 Microsoft Vendor-Specific RADIUS Attributes RFC 2716 Point-to-Point Protocol (PPP) Extensible Authentication Protocol (EAP)-TLS RFC 2865 RADIUS Authentication RFC 2866 RADIUS Accounting RFC 2867 RADIUS Tunnel Accounting RFC 2869 RADIUS Extensions RFC 3576 Dynamic Authorization Extensions to RADIUS RFC 5176 Dynamic Authorization Extensions to RADIUS RFC 3579 RADIUS Support for EAP RFC 3580 IEEE 802.1X RADIUS Guidelines RFC 3748 Extensible Authentication Protocol (EAP) Web-based authentication TACACS support for management users
Management standards	Simple Network Management Protocol (SNMP) v1, v2c, v3 RFC 854 Telnet RFC 1155 Management Information for TCP/IP-based Internets RFC 1156 MIB RFC 1157 SNMP RFC 1213 SNMP MIB II RFC 1350 Trivial File Transfer Protocol (TFTP) RFC 1643 Ethernet MIB RFC 2030 Simple Network Time Protocol (SNTP) RFC 2616 HTTP RFC 2665 Ethernet-Like Interface Types MIB RFC 2674 Definitions of Managed Objects for Bridges with Traffic Classes, Multicast Filtering, and Virtual Extensions RFC 2819 Remote Monitoring (RMON) MIB RFC 2863 Interfaces Group MIB RFC 3164 Syslog RFC 3414 User-Based Security Model (USM) for SNMPv3 RFC 3418 MIB for SNMP RFC 3636 Definitions of Managed Objects for IEEE 802.3 MAUs RFC 4741 Base NETCONF protocol RFC 4742 NETCONF over SSH RFC 6241 NETCONF RFC 6242 NETCONF over SSH RFC 5277 NETCONF event notifications RFC 5717 Partial Lock Remote Procedure Call RFC 6243 With-Defaults capability for NETCONF RFC 6020 YANG Cisco private MIBs
Management interfaces	Web-based: HTTP/HTTPS Command-line interface: Telnet, Secure Shell (SSH) Protocol, serial port Cisco Prime Infrastructure
Environmental conditions supported	Operating temperature: 32° to 104°F (0° to 40°C) Nonoperating temperature: -13° to 158°F (-25° to 70°C) Operating humidity: 5% to 95% noncondensing Nonoperating humidity: 0% to 95% noncondensing Operating altitude: Appliance operating: 0 to 3000 m (0 to 10,000 ft) Appliance nonoperating: 0 to 12,192 m (0 to 40,000 ft) Electrical input: AC input frequency range: 47 to 63 Hz AC input range: 90 to 264 VAC Maximum power: 9800-L-C max measured power = 86.9W (with 4.5W USB load) 9800-L-F max measured power = 84.5W (assumes 2pc 2.5W SFP and with 4.5W USB load) Maximum heat dissipation: 9800-L-C: 296.4 Btu/hr (with 4.5W USB load) 9800-L-F: 288.2 Btu/hr (assumes 2pc 2.5W SFP and with 4.5W USB load) Sound power level measure: Normal: 40 dBA at 25C Maximum: 42.9 dBA at 40C Power adapter: Input power: 100 to 240 VAC; 50/60 Hz
Regulatory compliance	Safety: UL/CSA 60950-1 IEC/EN 60950-1 AS/NZS 60950.1 CAN/CSA-C22.2 No. 60950-1 EMC - Emissions: FCC 47CFR15 AS/NZS CISPR 22 CISPR 22 EN55022/EN55032 (EMI-1) ICES-003 VCCI KN 32 (EMI-2) CNS-13438 EMC - Emissions: EN61000-3-2 Power Line Harmonics (EMI-3) EN61000-3-3 Voltage Changes, Fluctuations, and Flicker (EMI-3)

Licensing:

No licenses are required to boot up a Cisco Catalyst 9800 Series Wireless Controller. However, in order to connect any access points to the controller, Cisco DNA software subscriptions are required. To be able to connect to a Cisco Catalyst 9800 Series controller, each access point requires a Cisco DNA subscription license.

Determining license requirements for access points connecting to Cisco Catalyst 9800 Series Wireless Controllers

Access points connecting to the Cisco Catalyst 9800 Series have new and simplified software subscription packages.

They can support three tiers of Cisco DNA software: Cisco DNA Essentials, Cisco DNA Advantage, and Cisco DNA Premier.

Cisco DNA software subscriptions provide Cisco innovations on the access point. They also include perpetual Network Essentials and Network Advantage licensing options, which cover wireless fundamentals such as 802.1X authentication, QoS, and PnP; telemetry and visibility; and single sign-on, as well as security controls.

Cisco DNA subscription software has to be purchased for a 3-, 5-, or 7-year subscription term. Upon expiration of the subscription, the Cisco DNA features will expire, whereas the Network Essentials and Network Advantage features will remain.

Two modes of licensing are available:

• Cisco Smart Licensing is a flexible licensing model that provides you with an easier, faster, and more convenient way to purchase and manage software across the Cisco portfolio and across your organization. And it's secure- you control what users can access. With Smart Licensing you get:
  • Easy Activation: Smart licensing establishes a pool of software licenses that can be used across the entire organization-no more PAKs (Product Activation Keys).
  • Unified Management: My Cisco Entitlements (MCE) provides a complete view into all of your Cisco Products and services in an easy-to-use portal, so you always know what you have and what you are using.
  • License Flexibility: Your software is not node-locked to your hardware, so you can easily use and tranfer licenses as needed. To use Smart Licensing, you must first set up a Smart Account on Cisco Software Central (software.cisco.com). For more detailed overview on Cisco Licensing, go to cisco.com/go/licensingguide
• Specific License Reservation (SLR) is a feature used in highly secure networks. It provides a method for customers to deploy a software license on a device (product instance) without communicating usage information to Cisco. There is no communication with Cisco or a satellite. The licenses are reserved for every controller. It is node-based licensing.

Four levels of license are supported on the Cisco Catalyst 9800 Series Wireless Controllers. The controllers can be configured to function at any one of the four levels.

• Cisco DNA Essentials: At this level the Cisco DNA Essentials feature set will be supported.
• Cisco DNA Advantage: At this level the Cisco DNA Advantage feature set will be supported.
• NE: At this level the Network Essentials feature set will be supported. This is available with Cisco DNA Essentials.
• NA: At this level the Network Advantage feature set will be supported. This is available with Cisco DNA Advantage.

Cisco DNA Premier is a bundle with ISE licenses and Cisco DNA Spaces Advantage. It is inclusive of Cisco DNA Advantage, so at this level the Cisco DNA Advantage feature set will be supported. For customers who purchase Cisco DNA Essentials, Network Essentials will be supported and will continue to function even after term expiration. And for customers who purchase Cisco DNA Advantage or Cisco DNA Premier, Network Advantage will be supported and will continue to function even after term expiration.

Initial bootup of the controller will be at the Cisco DNA Advantage level.

The Cisco Catalyst 9800-L Wireless Controller has enhanced capability to increase performance through a Performance license. This Performance license allows customers to connect with 500 access points and 10,000 clients and gives a higher throughput.

Comparison of the 9800-L with and without the Performance license

Features	Catalyst 9800-L	Catalyst 9800-L with Performance License
APs supported	250	500
Clients supported	5,000	10,000
Throughput with IMIX	5 Gbps	5 Gbps
Throughput without IMIX	5 Gbps	10 Gbps

• Customer will have an option to select this Performance license while buying the 9800-L wireless controller or can order as spare.
• The Performance license is a perpetual license that is separate from the Cisco DNA license. They are also tracked by Smart Account.
• For High Availability deployments, Performance licenses must be brought on both controllers in the HA pair.

Managing licenses with Smart Accounts

Creating Smart Accounts by using the Cisco Smart Software Manager (SSM) enables you to order devices and licensing packages and also manage your software licenses from a centralized website. You can set up the Smart Account to receive daily email alerts and to be notified of expiring add-on licenses that you want to renew. A Smart Account is mandatory for Cisco Catalyst 9800 Series controllers

Documentation:

Download the Cisco Catalyst 9800-L Wireless Controller Datasheet (PDF).