N+1 High Availability Configuration on Cisco 2504WLC

Yesterday I implemented N+1 HA configuration on my lab with Cisco 2504 WLC. Earlier tried to find a guide especially for 2504 Controller but didn’t get on Cisco web. That’s the reason I thought to create a post about this, may be it will be helpful for others.

Few Remembering points:

  • The N+1 HA setup provides redundancy for controllers across separate data centers with low cost of deployment.
  • These WLCs are independent of each other and do not share configuration or IP addresses on any of their interfaces. Each WLC needs to be managed separately, can run a different hardware and a different software version, and can be deployed in different datacenters across the WAN link.
  • We must configure and manage both WLC separately.
  • When a primary WLC resumes operation, the APs fall back from the backup WLC to the primary WLC automatically if the AP fallback option is enabled.

For more info: N+1 HA Deployment Guide

N+1 HA Configuration via GUI:

Step1: Configure both WLC’s and just make sure the hostname and IP address used for management and the dynamic interfaces are different.

Step2: Go to Primary Controller GUI and navigate to Wireless > Access Points > Global Configuration, then configure the backup controller on the primary to point to the secondary controller.


Step3: Configure High Availability to input Primary and Backup controller IP Address at Wireless AP.

Go to Wireless > Access Point > All APs, select specific AP and then Click on High Availability tab.

Enter the primary WLC, secondary WLC IP and name here. Make sure that the WLC name we entered on the AP high availability tab is correct and is case sensitive.

Step4: Configure Mobility Group on both Primary and Secondary Controllers.

Go to Primary WLC GUI then navigate to Controller > Mobility Management > Mobility Groups and then click on new, enter the details of secondary controller.


Same on secondary WLC:

Go to Secondary WLC GUI then navigate to Controller > Mobility Management > Mobility Groups and then click on new, enter the details of Primary controller.


Step5: Enable Secondary Unit

Via GUI:

Go to Secondary Controller GUI and navigate to Controller then enable the AP Fallback (Enable on both WLC) & HA SKU secondary unit from drop down option.

Via CLI:

Execute the config redundancy unit secondary command to obtain support for Max AP count licenses on a given hardware.

(WLC2) >config redundancy unit ?
 primary        Redundancy unit type is primary
 secondary      Redundancy unit type is secondary
 (WLC2) >config redundancy unit secondary

Make sure:

  1. After this entire configuration we must save the config by Save configuration via GUI or save config from CLI on Both WLCs .
  2. Reboot Secondary WLC to take effect of (config redundancy unit secondary) this command.(According to my test, if you will not reboot this WLC after applying this command AP failover will not happen)


(WLC1) >show redundancy summary
 Type of the Unit = Primary
 (WLC1) >
(WLC2) >show redundancy  summary
 Type of the Unit = Secondary
 (WLC2) >

144 thoughts on “N+1 High Availability Configuration on Cisco 2504WLC

      1. Thanks,

        I have also found that and got confirmation from CISCO that it does not support WLC 2504.


  1. Step3: Configure High Availability to input Primary and Backup controller IP Address at Wireless AP.

    Go to Wireless > Access Point > All APs, select specific AP and then Click on High Availability tab.

    ^ This step, can you confirm if this only needs to be actioned on the Primary unit? Or should this be done on the secondary unit aswell? Thanks

  2. I have 2 2504 WLC with 25 AP as base license, If I have to convert one WLC to HA-SKU mode for failover, what will happen to 25 AP licenses, will it get scraped or I can use it in the primary WLC

    1. You can/can’t use the AP license from 2nd controller: better to contact CIsco TAC and (possibly)rehost these license and upload to primary WLC to make the total 50.

  3. Thanks for this post. Question I have, do you need to configure all of the WLAN’s/etc on the secondary controller? How much configuration needs to be in place on that secondary controller for the failover to work?

    1. If you are using 2504 WLCs then you need to configure both WLCs separately with same configuration except IP address and name of WLC. For failover, you need to add both WLCs in each other mobility list and also add WLC ip/Hostnamen in global config of both WLCs.

  4. Also wondering how you verify this configuration is working. Should you see the other controller connected in the mobility group? Mine shows the other controller in the group as “Control and Data path Down”? Should you see AP’s populate on the secondary controller? Can’t find much on doing this with the 2504 controllers. Thanks

      1. I did, and I can run the ping command from each of the WLC’s and it’s successful. Not sure what else I need to do?

  5. Thanks for all of your help.
    I found the problem, the “default group” was identified differently between the controllers. You have to make sure the “default mobility domain name” is the same on both units. You can set this on the general tab of the controller menu.

  6. Hi, I have Primary WLC (2504) with 10 AP license ( data_encryption & base-ap-count ) and Secondary WLC is only having (data_encryption) there is NO base-ap-count license on the secondary. How does the Failover works?.
    I am not sure how does the HA license really looks and Do we need to HA license in both WLC?

    1. Did you configure the secondary wlc as HA wlc by using the command “config redundancy unit secondary”(for it you need 7.6 or higher wlc version). If yes then seconadyr wlc will supoort max 75 AP .

      Example: If primary WLC is down then all your AP will join to 2nd WLC (for 90 days). After 90 days you will get alarm or log messgaes to activate your primary WLC. So withen 90 days you must make your primayr work.


  7. Hi, I have 2 WLC 2504 (AIR-CT2504-K9). One with Max AP count license for 25 APs and the other for 12 APs. I need to make the other one as secondary WLC. The 25 AP license WLC is the Primary one. Will the licenses get synchronized after configuring HA on both WLCs?

    1. Hi,

      No sync will take betwene two WLC as they dont have any Redundent port connection.

      I would recommand to transfer the license (Only adder is possible )form secondary to primary then you can force secondary to act as HA WLC by using the command” config redundancy unit secondary”(for this you must be running 7.6 or higer WLC SW version)


      1. If I need to add the same license on the secondary unit, do I need to buy the adder license? Could you please guide which license is required since I need to configure this unit in HA.

      2. Secondary WLC dont need any license if you have 7.6 or higher version. Just convert it to HA (by using the command “config redundancy unit secondary”) then it will support max 75 AP.


  8. i have 2 WLCs 2504 . One has got 30 Licenses and the other has just evaluation license for 90 days for 75 APs .And there is no HA configured.All APs have primary and secondary controllers ip address and name added to them. Will the 30 APs from primary WLC associate with secondary with the temporary license when primary wlc fails Or Do i need to first have Mobiltiy configured with HA secondary on secondary wlc configured and then the 30 APs will be supportec for 90 days ?

    If i don’t go for HA i.e N+1 should purchasing 30 APs for secondary WLC be better option even though it would be costly and will the APs switch to secondary WLC during failover test.

    Also will configuring just The mobility without HA-SKU – Secondary , possible for Both units to work as HA.

    And Finally is there any Url that expalin in details about the licensing for theWLCs as its quiet confusing.

    1. You just need license on Primary WLC, meand you dont need license on secondary WLC. if primary goes dwon then secondary wlc will take over the functionality for next 90 days. In thes e90 days you nee dto repaire the primary and make sure that is up and running again.


  9. Hi there.
    I have one question, must implementation I used SSO as HA method, but, what happen when I need to use N+1 and the WLC are geographically separate. For example, in my remote site I have network for my users with vlan 10, but in my data center where ir my backup WLC I don’t have that addressing or vlan?


    1. N+1 HA will work if you set the faiover / Mobility group configured properly. If you have diff vlans in diff datacenters then AP will use that as per your config on wlc for specific location.

  10. Hello,
    The first many thank you wrote the greate document!
    I have two 5204 WLC, the primary has 50 AP license and the backup has 25 AP license, the second WLC version is 8.5 and the primary WLC version is 8.3, and the second WLC just configuration managment IP and not configuration others.
    Now my questions are:
    1). Is it possible to configuration HA between these WLCs? because of there are software and license are differents.

    2). I am not configure the second WLC, do I need export the primary WLC configuration and import to the second WLC?

    Thanks a lot.

    1. 1. If you are using 2504 wlc then it will only support HA N+1 means no AP SSO and Client SSO. My recommendation is to keep the same software on both WLCs else every time AP will roam from WLC1 to WLC2 then all APs need to download new software from wlcs.

      2. no you need to configure the 2nd wlc same as wlc1.

      Another Info: Starting with 7.6, we can convert 2504 WLC to an HA SKU and vice versa. It does not need to have a minimum AP licenses. In that case you can use the one controller from the bundle to convert it in HA, under “Standby Controller Licensing”.
      First you can trafer 25 license from secondary to Primary and then convert secondary to to standby which will support 75 AP .

  11. Hi,

    I configure 2 2504 wlc as HA mode..

    In primary WlC I configured with some ap groups, flex connect groups and ssid’ s also

    Let me know about secondary wlc configuration
    1) I have to configure ssid with same interface IP address as in primary WlC or different IP address.
    2)what about ap groups and flex connect groups


    1. HI,

      1. You need to configure the SSID with diff. interface ip address then primary.
      2. Configure same AP/flex group name on secondary as in Primary.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s