N+1 High Availability Configuration on Cisco 2504WLC

Yesterday I implemented N+1 HA configuration on my lab with Cisco 2504 WLC. Earlier tried to find a guide especially for 2504 Controller but didn’t get on Cisco web. That’s the reason I thought to create a post about this, may be it will be helpful for others.

Few Remembering points:

  • The N+1 HA setup provides redundancy for controllers across separate data centers with low cost of deployment.
  • These WLCs are independent of each other and do not share configuration or IP addresses on any of their interfaces. Each WLC needs to be managed separately, can run a different hardware and a different software version, and can be deployed in different datacenters across the WAN link.
  • We must configure and manage both WLC separately.
  • When a primary WLC resumes operation, the APs fall back from the backup WLC to the primary WLC automatically if the AP fallback option is enabled.

For more info: N+1 HA Deployment Guide

N+1 HA Configuration via GUI:

Step1: Configure both WLC’s and just make sure the hostname and IP address used for management and the dynamic interfaces are different.

Step2: Go to Primary Controller GUI and navigate to Wireless > Access Points > Global Configuration, then configure the backup controller on the primary to point to the secondary controller.


Step3: Configure High Availability to input Primary and Backup controller IP Address at Wireless AP.

Go to Wireless > Access Point > All APs, select specific AP and then Click on High Availability tab.

Enter the primary WLC, secondary WLC IP and name here. Make sure that the WLC name we entered on the AP high availability tab is correct and is case sensitive.

Step4: Configure Mobility Group on both Primary and Secondary Controllers.

Go to Primary WLC GUI then navigate to Controller > Mobility Management > Mobility Groups and then click on new, enter the details of secondary controller.


Same on secondary WLC:

Go to Secondary WLC GUI then navigate to Controller > Mobility Management > Mobility Groups and then click on new, enter the details of Primary controller.


Step5: Enable Secondary Unit

Via GUI:

Go to Secondary Controller GUI and navigate to Controller then enable the AP Fallback (Enable on both WLC) & HA SKU secondary unit from drop down option.

Via CLI:

Execute the config redundancy unit secondary command to obtain support for Max AP count licenses on a given hardware.

(WLC2) >config redundancy unit ?
 primary        Redundancy unit type is primary
 secondary      Redundancy unit type is secondary
 (WLC2) >config redundancy unit secondary

Make sure:

  1. After this entire configuration we must save the config by Save configuration via GUI or save config from CLI on Both WLCs .
  2. Reboot Secondary WLC to take effect of (config redundancy unit secondary) this command.(According to my test, if you will not reboot this WLC after applying this command AP failover will not happen)


(WLC1) >show redundancy summary
 Type of the Unit = Primary
 (WLC1) >
(WLC2) >show redundancy  summary
 Type of the Unit = Secondary
 (WLC2) >

144 thoughts on “N+1 High Availability Configuration on Cisco 2504WLC

  1. very helpful – yes nothing online about the 2504 – all documents on cisco’s site are for the 5500. wasted an hour trying to follow the document and use the steps on the 2504… youre the man – good luck in the lab!

    CCIE 19366

  2. Just a question on the licensing component of the HA.
    When I view Licenses on the HA controller, there is a base-ap-count licence that says it’s evaluation with a time of 12 weeks & 6 days. What happens when the time expires?

    1. Hi Tony ,
      The licence issues start once an AP associates to the controller, after 90 days it start sending syslogand snmp traps regarding license.

      12 week and 6 day = 90 days and it will be like this always.

      Once Your primary WLC is down all AP will connect to HA WLC (secondary ) then you can check the Management > Software Activation > License Usuage.


  3. Hi,

    Just a question, which software version and FUS are you running on both 2504’s?


  4. hi,
    during the ap failover from primary to secondary 2504-HA WLC, clients(Laptops) need to re authenticate to the respective ssid, but during fall back to the primary WLC they need not, can you explain why..

    thanks and regards,

    1. Hi Dibin,
      In both case (AP Failover & AP Fallback) client will disconnect for few seconds and connect again.Means it is not transparent for clients in this case.

      2504 only supports N+1 HA not AP SSO & Client SSO.


  5. Sandeep thanks for the reply, but my question was not about client and ap sso, i know 2504 doesn’t support this. In my case during failover the clients get de-authenticated which is normal but during fallback they do not. Is there any explanation regarding this.

    thanks and regards,

    1. No, I am still not agree with you. While AP fallback of AP is not transparent to the clients.Means they have to re associate just like in AP failover.

  6. ya i totally agree with you, but this scenario is right now happening at one of my client location, i know it doesn’t make much sense theoretically, that is y i raised this question here.! i cant find any explanation myself, other than some excuses i cooked up to get out of the loop..:D..anyways thanks for ur time..:)

  7. Could you share documentation about protocols which is used for communication between primary and secondary controllers? How do they synchronize configuration files? I want install one secondary controller for two my standalone controllers with different configuration files.

    1. Hi Kron,
      1. In N+1 they don’t synchronize the configuration.
      2. Each of the controllers in the N+1 HA model needs to be upgraded or downgraded independently.
      3. These WLCs are independent of each other and do not share configuration or IP addresses on any of their interfaces. Each WLC needs to be managed separately, can run a different hardware and a different software version, and can be deployed in different datacenters across the WAN link.
      4. The overall goal for the addition of N+1 HA with HA-SKU is to reduce the total cost for geographically separate HA deployments across the WAN link.
      5. It this mode you can just think that they are 2 independent WLCs.(Just like earlier we used to have two WLC, each with AP licenses).


      1. Hi Guys,

        Just to inform you i also build an N+1 config based on 3 WLC 2504 Primary nodes and 1 WLC 2504 Stanby SKU node.

        At this moment i’m running code 7.6.130 which is more stable then the 7.6.120.

        Also I have chosen to use Cisco Prime Infra 2.x LifeCycle management. With this platform you can add controllers to the same config group and use templates on this group. This give you the options to keep the configs in sync, because you don’t configure WLANs / Security on the controller itself but in a template.

  8. Thanks for this article. I wasted a bunch of time trying to figure out how to do HA N+1 with the 2504’s but I only came up with articles on the 5500 series that weren’t relevant. This really helped. Thanks!

  9. Great post on HA for 2504. One question I would have that’s not completely clear to me is the requirements to have the APs join without upgrading and eventually re-starting after failover. Basically it should be same software and config but what if i.e. the second controller is on a different location which uses different VLANs? Are there any problems on that? I currently have no hardware to check for myself.

    1. Hi Patrick,
      If both WLC have same software then AP will not upgrade SW but it will only take the configuration from 2nd WLC.(But in this kind of HA client will disconnect and then connect again).

      There is no problem if your other WLC have at other location, as you know AP sends discoveries to all controllers in the mobility group.Once primary WLC is down then it will search for other and if its software version is not same as primary then it will upgrade its version and reset.

      At there should be a way configured for AP to discover other WLCs.


      1. Hi Sandeep,
        THanks for the clarification. I already suspected it this was this way but only knew from the old 4402 and was not sure if Cisco added some more stability and enhancements on the 2504/5508 beside the AP SSO and Client SSO on the 5508 when using the redundancy link.

  10. Hello Sandeep. I really want to congratulate for your effort and altruism for sharing this information to the world. This stuff is needed even for a CCNA who is in charge of deploying customer’s networks.

    I just have one question related to Patrick’s question: what if for security reasons a customer wants to install the WLC 2504 in a different place and, of course, a different network? How do I deal with the different Vlans, as every single WLC needs to be configured separately? Do I have to create the same SSIDs and Vlans just like the primary WLC? This is the only thing I’m still confused, as Vlans are local.

    Thank you very much and once again my gratitude and congrats.

    1. Hi Fabian,
      Thank you very much.
      Regarding WLCs in different location :
      Fot 5508 WLC: Normally It is required for us to have direct physical connectivity between the two WLCs via the redundancy port(5508WLC) and also they should have management IP in same subnet. The distance between the two WLCs must not go beyond 100 metres.

      for 2504 WLC (Only support N+1 HA): You can have backup WLC at remote location. In your case you can have different vlan at both side(WLAN name can be same).
      I am assuming that both side AP can reach/discover both WLC.

      But if primary WLC is down then All AP at main location will connect to Backup WLC and will get ip in different vlan. (and this we dont want). So its better to use Sepearte WLC at each location or you can connect remote AP via flexconnect at main location.

      I hope it clarify your issue!


      1. It’s correct. Sorry for bother you again: the backup WLC (N+1) is just going to be in case of damage of the first one, but the customer also wants to keep the backup WLC in a remote office. What will happen then is that in case of failure, AP clients are going to take different IP addresses? Thank you

      2. No problem, I am happy to share my thoughts.
        If you have connectivity between both networks or in other words if HQ AP can find the remote WLC then yes they will get the ip from different VLAN(as defined on remote WLC).
        ***Frankly speaking I never seen this type of scenario 🙂
        I feel its better to use Flex-connect in this case.


      3. Hi Fabian, Sandeep,
        Just one more thought on this, I might be wrong though:
        If I move my APs manually to the secondary WLC, change their mode to flexconnect and enable local switching on the SSID, add the vlans to the interface list of the secondary WLC that are needed for the other location, create an AP group to match the SSIDs and the other VLANs to the APs from the primary location, could that work? I hope my goal is clear on this: Once the primary WLC fails, the APs should failover to the secondary. As per the secondary controller config, the APs reboot to change to flexconnect mode and are assigned the AP group with the alternative VLAN but in local mode.
        Could that work?

  11. Exactly. They don’t want a new IP address but also they’re should not be in flex connect. So the best scenario would be if both WLCs are in the same subnet, wouldn’t it?

  12. Just a quick question we have 2 controllers CON1 and CON2. To be cost effective we would like to use the N+1 scenario so that if CON1 goes down the AP’s will go to the HA controller and we would like the same thing to happen for CON2. Will this work with the N+1 model? Also, for the AP’s would you configure them to have their respective Primary Controller configured CON1 or CON2 and the HA as the backup?

    I have read quite a bit of cisco’s documentation but it seems to be a little confusing depending on the different type of code and what it can support(we are currently on7.6.130). I feel this scenario should work for us, but wanted you get your thoughts.

    1. Hi, yes it will work. Make sure you assign the backup WLC as HA controller to each AP(yes u are right , primary will be CON1 or CON2 and secondary or backup will be HA WLC).
      I will recommend you use same version of code on all WLC.


  13. Hi. ,
    Actually. I have a doubt can we deploy .,
    Two 2504. Wlc. In. same. Datacenter & ip subnet. If it canbe done how to configure. This. Set up


    1. Hi Arjun,
      Do you want to deploy 2 X 2504 wlc in same data center with same IP or different IP ?
      With Same IP is not a good idea and it will meshup.
      With different IP it will work perfectly.


  14. Do we require any license
    Do we require same license count on each controller
    1st controller 5 License and 2nd Controller 25 will it work if total AP are 5

    1. Hi Sudhir,
      Yes it will if you have enough AP license on both.
      It will also work if you have wlc1 with 5 AP license and WLC2 with HA-SKU license.


      1. Hello,

        I would translate it to part numbers if you never mind, Does your last info mean , If I bought 25 AP Licenses ( AIR-CT2504-25-K9) , and bought one unit (AIR-CT2504-HA-K9) for HA SKU setup, will not be effective till I buy more 25 licenses adder licences LIC-CT2504-25

      2. No…
        If you have one unit (AIR-CT2504-25-K9) and one unit (AIR-CT2504-HA-K9) for HA SKU setup then its enough. You don’t need to buy any adder licences.


      3. If I remember correctly, this is a requirement for the 5508 chassis to be used as HA part. So if you bought two 5508-25, you could not convert one of these to be a HA controller for active/standby HA. For me this logic is only explainable via the pricing of the units to prevent customers buying the cheaper 5508-25 over the 5508-HA for the same purpose.
        If you bought two 5508-50 then there is no restriction. Please correct me if I got that one wrong.

      4. You must need to have minimum 50 AP license to Converter a normal 5508 (with AP License) to HA SKU.
        I am agree with you regarding the price of HA model.


  15. Is this statement true ?
    “A WLC IP address only needs to be configured when the backup WLC is in a different mobility group.”

      1. thanks, so both 2504 WLC will work in Act-Act to achieve AP load balancing as well as backup for each other.
        in the event of failure of one WLC, only the users of this WLC will be affected other WLC users wont be affected?

  16. hi,

    sorry my bad english..

    I misunderstood ha-sku in 2504 ..
    Is it necessary to configure the secondary controller? Not databases are synchronized? config are not synchronized?

    1. Hi, it mean if you use Mac Filtering you must think about insert MAC in both controllers…
      Salut, par contre si tu utilises le filtrage MAC tu dois bien penser à les entrer dans les 2 contrôleurs, j’ai eu le souci lol. Bon courage

  17. hi,

    , But in my IOS version 7.6 has an option to enable SSO ?? it’s a cisco 2504ha-sku..

    what’s the difference??

  18. Hi – thanks for the guide. I have a Air-CT2504-K9 and a Air-Ct2504-HA-K9. i have setup the 2 box up, and did your guide. But when i poweroff my WLC01, it takes i minut before the WLC02 find the AP, and the box start to download software to the AP, and the reboot the ap. And i 5 minut, everythink Work on the WLC02. – Can you help :o)

      1. 1.)
        hmm do you think that i the problem..

        Can I copy the firmware from one WLC01 ti WLC02 in anywhy ?

        Manufacturer’s Name………………………… Cisco Systems Inc.
        Product Name………………………………. Cisco Controller
        Product Version…………………………….
        Bootloader Version…………………………. 1.0.20
        Field Recovery Image Version…………………
        Firmware Version…………………………… PIC 20.0

        Manufacturer’s Name………………………… Cisco Systems Inc.
        Product Name………………………………. Cisco Controller
        Product Version…………………………….
        Bootloader Version…………………………. 1.0.20
        Field Recovery Image Version…………………
        Firmware Version…………………………… PIC 20.0

        Yes, its lige this right, – the fist line i default
        CONTROLLER -> Mobility Management -> Mobility Groups – >

        e0:89:9d:42:99:00 none
        e0:89:9d:43:23:60 none L-I-E

        e0:89:9d:43:23:60 none
        e0:89:9d:42:99:00 none L-I-E


      2. You must keep the same version on both controllers otherwise whenever Cisco AP will move from WLC1 to another then they will download new image from WLC.

  19. Hello All, I used this guide to setup a 2504HA, mirrored the configs, verified redundancy states of each and it looks good, but it’s not working. Licence on the secondary says EULA not accepted, but this is not adjustable, since it’s a cisco installed HA only licence… thoughts? Also, a couple of the WLAN numbers are diff on the secondary, would that affect anything?

  20. Hello All,

    Thanks for sharing your experience.

    i have two wlc (AIR-CT2504-15-K9) & ( AIR-CT2504-HA-K9 ). my questions are:

    1) Since there is no redundancy port like in 5500, how should i connect both controllers to each other for HA. ?

    2) Do i need to configure both controllers with same configuration ?

    3) Both controllers will be in same DC, does above configuration applies to my scenario ?

    please need your help.

    Thank you

    1. Hi Azuz,
      I am glad that my post helped.
      1. You don’t need to connect 2504 WLCs physically.
      2.yes you should configure both WLC in same way but with different host name and IP address for interfaces.
      3.yes my post exactly match your requirements.


      1. First of all Thanks RSCCIEW for replying.

        -Since the controllers wont be connected physically .. i should connect them to some switch (ex. core switch) and the ip address of each interface (uplink to core ) should be from the management vlan that i have for all devices.

        am i correct ?

        Thank you..

      2. Hi,
        Yes you need to connect both WLSs to core switch. I was telling regarding Dynamic/management interface of each WLC must have a unique IP address.
        Link from WLC to core should be configured as trunk port and allowed only required VLANs.


    2. Just deployed 2504HA with help from the postings here. Took a few weeks to work the kinks out, but now I have a much greater understanding of WLCs. If you can make it work correctly on 2504s, larger controllers with redundancy ports will be easy. Thanks for all the info!

  21. Good day RSCCIEW,

    I have 2 questions

    – WLC has image version then can it run HA ?
    – I have Primary WLC (AIR-CT2504-25-K9) 15 license and AIR-CT2504-HA-K9 and 15 APs. In the case Primary WLC goes down, APs will connect to Secondary WLC then license for Secondary WLC will be set 90 days, after 3 days Primary WLC come back, APs will connect to Primary WLC and reset Secondary WLC license from 87 to 90days. Am I correct ?

    Thank you very much.

  22. Hello Mr.Cciew, i want to ask .. I already used your guide to config n+1 in 2504, and ap already registered in secondary wlc, the led ap is green and the light is still , but i dont see any ssid for broadcast from the ap, from your experience what the issue and are we need to config same wlan ssid in 2nd wlc?

    Thanks for your help

  23. So, if i config in wlc primary ssid “test” i must config in secondary same ssid?

    But what if the ssid “test ” is in different vlan? And with different network segment..


  24. After following your instructions I performed a test and disconnected the primary WLC: the APs joined the secondary controller right away and clients migrated seamlessly. However, although I connected the primary WLC back online the APs never join it back, staying joined to the secondary.
    I can see “Primary Discovery Request” as well as “Primary Discovery Response” capwap events on the primary, but APs stays on the secondary.
    Both WLCs are running the same software version.

    1. Hi,
      Ensure that AP fallback option is enabled on Primary WLC.
      If you want to have completely control o APs regarding WLC failover than you can configure AP with primary/secondary WLC IP&Name.
      Wireless>All APs> select the AP , then click on High Availability tab and enter Primary/ secondary WLC ip and name.


      1. Got it, a typo in the WLC. It is very important the primary WLC name is spelled correctly for the APs to join again the primary WLC. A typo in the secondary name did not prevent the APs to join the secondary, though. TKS

  25. Is there any way to connect 2 controller via direct connection, as I understand there is no specific HA port include in 2504 but my office just need backup controller inside our network. In that case I can connect them via switch port but still curious to know what if I can connect them directly via one of the mgmt port. As you said this two controller can work together regardless of software version or configuration, is that mean 2nd controller copy config and stay as standby? I want to know how long it will take when primary controller is down and AP fall to another controller. All the configuration are already have on 2nd controller? I’m not so clear that part. If the firmware version is different it will take more time i guess.


    1. Hi Akkt,
      No you can not connect two 2504 WLC physically. The only way to configure two WLC identical ( except mgmt and dynamic interface IP).
      If you have same software version on both WLC then it will take 2-4 minutes max otherwise it may take ~5-10 min.

  26. Hey Hello,

    I have a scenario,

    let say we have 2 5508 controller working as HA AP-SSO . but for some reason their HA pair disconnect.we have upgraded our primary controller
    from 7.6 to

    Currently Primary controller running code & secondary controller running code 7.6.

    Now i want to pair them again as HA AP SSO,so is it possible to controller running different code?

    If not then what can be done to make this happen.

    Kindly reply

  27. Hey Hello,

    I have a scenario,

    let say we have 2 5508 controller working as HA AP-SSO . but for some reason their HA pair disconnect.we have upgraded our primary controller
    from 7.6 to

    Currently Primary controller running code and secondary controller running code 7.6.

    Now i want to pair them in HA AP SSO again, So is it possible HA if controller running different code?

    If not then what can be done to make this happen.

    Kindly Reply

    1. You must have the same version of code for SSO. With different versions of code, N+1 is your only option. Even for N+1 you should have the same code to speed up failover.

  28. Hi,
    If i have two primary controllers and want to have one backup controller for both. Then what will be configuration on backup controller under Mobility Group? Do i need to create two separate Mobility Groups ( with two primary controller MAC and IP?)


      1. Hi,
        What changes do i need to make for my setup (reference to your steps). Step 4 in this post?


      2. Hi,
        1. First define which is your primary WLC.
        Then add both others controller IP /Mac and mobility group of primary WLC.
        2. On both (secondary / tertiary) WLC add the IP/ MAC of the primary WLC in mobility group.


  29. Great info….Thanks

    In the N+1 configuration what is the failover time you have experienced?

    If configured for Flex Connect do the AP’s still join the backup controller immediately or only when they are required to talk to the controller?

    1. Thanks, it was around 2-3 minutes if you have SW version on both WLC.
      Backup scenario is same in both case(either its local mode or flex-connect)


  30. i have two WLC, both have license of 25 AP, and i have 50 AP in total. They work active-active. If a WLC fails, the other can manage 50 AP? I have configured mobility group.

  31. Hi,
    First of all I really want to congratulate for your effort
    For the N+1 HA setup for the both WLC have the same configuration, so i can take backup the primary wlc config and restore to secondary wlc and make the necessary changes to the interfaces. As per you the configuration is not sync between wlc, so if i make any changes in config on primary wlc i need to do the same on seconday wlc also.

  32. Hi
    First of all I really want to congratulate for your effort
    In N+1 HA setup configuration not sych between wlc so i can take backup from primary wlc and download on secondary wlc and make necessary changes to interfaces. If i make any changes in primary wlc the same changes have to make in secondary wlc also.

  33. Hi,

    Thank you for your great effort.

    May you please support me on this request.

    I have 2×2504 to deploy in a branch. customer wants one SSID for corporate users but different VLANs (one per floor). and one SSID for Guest (one VLAN for the whole branch building).

    if a failover occur from wlc1 to wlc2, corporate users and guest users should still using the same VLANs as mentioned above(as with the wlc1).

    is it doable?


    1. Hi, if you have one AP group per floor, you can assign an interface for each of these AP group’s SSID. If you do this similarly on the HA the client would be able to re-use that given IP address in case of WLC failover. HTH

  34. Hi,

    thank you for you answer,

    but shall I configure both WLCs as you did here, and then configure the same SSIDs and VLANs related to corporate users and guest users on both WLCs?? the standby WLC will not be doing anything unless the first wlc fails and the APs start registering with the second wlc.

    appreciate your valuable support.


    Haitham Jneid

  35. Hi,

    We have implemented a 2504 controller at the customer’s HQ location out of its 3 locations. The two locations are connected via MPLS to the HQ.

    We have implemented AD authentication using Flexconnect on the APs and are facing challenges on Web authentication where the customer wants a editable page which we get while login to the internet.

    Is this possible in an N+1 scenario?


  36. Hi,

    Regarding WLC2504, I have 2 of them connected to the same distribution switch and configured as HA N+1, since each one of them should be managed independently, I need the same WLAN (VLAN 100 subnet to be used on both of them.

    is this possible?

    so in case a failover occurs, users will still get IPs from the same subnet(VLAN 100 subnet on the secondary unit.

    please advise, need to know if it will work or there will be a conflict..


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s