Campus lan and Wireless lan solution Design Guide

Preferred redundancy for controller HA SSO pair 
Figure 36. 
Spreading the ports from the active and standby WLCs across both switches within the Cisco StackWise Virtual 
pair is the recommended design. This design minimizes the traffic that crosses the virtual switch link between 
the Cisco Catalyst switches in the Cisco StackWise Virtual pair during normal (non-failure) operation, because 
both the active and standby WLCs have ports connected to both switches. This design also avoids a switchover 
from the active WLC to the standby WLC in the event of a switch failure within the pair. However, in the event 
of a switch failure within the pair, the number of ports connected to the active WLC is reduced by half. You 
choose a switching platform with appropriate resources to support ARP and MAC address table entries from the 
wireless controller for the deployed environment. 
Note: 
Catalyst 9800 wireless controllers support PagP and LACP as of IOS XE 17.1 and higher. 

---

© 2020 Cisco and/or its affiliates. All rights reserved. 
Page 49 of 76
Preferred redundancy - Single Cisco Catalyst 9800 controller connected to redundant single logical 
switch 
If you are only connecting a single Cisco Catalyst 9800 controller to the wired LAN, such as for an N+1 
controller deployment, connect the single controller physical ports spread across redundant Cisco Catalyst 
switches in a Cisco StackWise Virtual pair, switch stack, or separate line cards in a highly redundant modular 
chassis. 
 
Preferred redundancy for single controller 
Figure 37. 
The trunk configuration and switching platform choices from the previous design also apply here. 
Wireless controller patches using software maintenance updates (SMUs) 
An SMU is a software package that can be installed on a wireless controller to provide a patch fix for bugs or 
security resolution to an already released image. Cisco Catalyst 9800 Series controllers support two types of 
SMUs - hot patching and cold patching. 
A hot patch does not need a system reload - meaning that clients and APs will not be affected when applying 
the hot patch. When the wireless controller is part of an HA SSO pair, the SMU activation applies to both the 
active and standby controllers.
A cold patch does require a system reload. However, in an HA SSO pair, the system will first install the SMU on 
the standby controller and reload it. Once the standby finishes reloading the active controller will reload. When 
this happens, a switchover occurs, and the standby controller becomes the new active controller. The new 
active controller takes over all AP and client sessions. Then, the new standby controller (previously the active 
controller) is updated. Throughout this update, AP and client sessions remain up.