Cisco Catalyst 9136I Series User manual

1
Cisco Systems, Inc. www.cisco.com
GETTING STARTED GUIDE
Cisco Catalyst 9136I Series Access Points
First Published: October 12, 2021

2
Cisco Catalyst 9136I Series Access Points
1About this Guide
2About the Cisco Catalyst 9136I Series Wireless Access Point
3Safety Instructions
4Unpacking
5AP Views, Ports, and Connectors
6Preparing the AP for Installation
7Installation Overview
8Performing a Pre-Installation Configuration
9Mounting the Access Point
10 Powering the Access Point
11 Configuring and Deploying the Access Point
12 Checking the Access Point LEDs
13 Miscellaneous Usage and Configuration Guidelines
14 FAQs
15 Related Documentation
16 Declarations of Conformity and Regulatory Information
Communications, Services, and Additional Information
Cisco Bug Search Tool

3
Cisco Catalyst 9136I Series Access Points
1 About this Guide
This guide provides instructions on how to install your Cisco Catalyst 9136I series access point and provides links to
resources that can help you configure it. This guide also provides mounting instructions and troubleshooting information.
Note that the C9136I series access point is referred to as the access point or the AP in this document.
2 About the Cisco Catalyst 9136I Series Wireless Access Point
The Cisco Catalyst 9136I series wireless access point is a tri-band (2.4-GHz, 5-GHz, 6-GHz), enterprise 802.11ax (Wi-Fi
6) AP. The AP has one model which has integrated antennas, and are designed to use 2.4 GHz, the 5 GHz and the 6 GHz
bands. This AP series supports a greater overall High Density Experience (HDX), which provides a more predictable
performance for advanced applications such as 4K or 8K videos, high-density and high-definition collaboration
applications, all-wireless offices, and Internet-of-Things (IoT). The AP supports full interoperability with leading
802.11ax and 802.11ac clients, along with a mixed deployment with other APs and controllers. These APs provide
integrated security, resiliency and operational flexibility as well as increased network intelligence.
A full listing of the AP's features and specifications are provided in the Cisco Catalyst 9136I Series Access Point Data
Sheet, at the following URL:
https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9100ax-access-points/nb-06-cat-9130-ser-ap
-ds-cte-en.html
Cisco Catalyst 9136I Series Wireless Access Point Features
The C9136I series AP is a wireless controller-based product, and supports:
Five radios: a 6-GHz radio, a dual-band 5 GHz (8x8) flexible radio with 2.4 GHz, and a 4x4 5 GHz, a single-band 5 GHz radio,
and an Omni IoT radio. The BLE, Zigbee, Thread, and other multi-protocol 802.15.4 devices use the Omni IoT radio
Four 2.4-GHz and 5-GHz dual-band, four 5-GHz single-band, four 6-GHz single bands, and one 2.4-GHz IoT integrated
antennas on the C9136I-xmodels.
Note The ‘x’ in the model numbers represents the regulatory domain. For information on supported regulatory
domains, see the“AP Model Numbers and Regulatory Domains” section on page 4.
Integrated internal antennas that are omni directional in azimuth, for 2.4-GHz, 5-GHz bands, and 6-GHz bands.
Multiuser Multiple-Input Multiple-Output (MU-MIMO) technology for uplink and downlink.
Orthogonal Frequency Division Multiple Access (OFDMA)-based scheduling for both uplink and downlink.
Multigigabit Ethernet (mGig)
The following hardware external interfaces:
—2x100/1000/2500/5000 Multigigabit Ethernet (RJ-45)
—RS-232 Console Interface through RJ-45
—Recovery push button (enables partial or full system configuration recovery)
—USB 2.0 Port
—One multi-color LED.

4
Cisco Catalyst 9136I Series Access Points
Integrated Bluetooth Low Energy (BLE) radio to enable IoT use cases such as location tracking and wayfinding.
Intelligent Capture probes the network and provides Cisco DNA Center with deep analysis.
Spatial Reuse (also known as Basic Service Set (BSS) coloring) which allows APs and their clients to differentiate
between BSSs, thus permitting more simultaneous transmissions.
New power savings mode called Target Wake Time (TWT) which allows the client to stay asleep and wake up only
at pre-scheduled (target) times to exchange data with the AP. This provides significant energy savings for
battery-operated devices.
Cisco Digital Network Architecture (DNA) support enables Cisco DNA Spaces, Apple FastLane and Cisco Identity
Services Engine.
Optimized AP Roaming for ensuring that client devices associate with the AP in their coverage range that offers the
fastest data rate available.
Cisco CleanAir technology enhanced with 160MHz channel support. CleanAir delivers proactive, high-speed
spectrum intelligence across 20-, 40-, and 80-, and 160-MHz-wide channels to combat performance problems
arising from wireless interference.
The AP supports lightweight deployments (using Cisco Wireless Controllers). The AP also supports the following
operating modes:
Local—This is the default mode for the Cisco AP. In this mode, the AP serves clients.
In local mode, the AP creates two CAPWAP tunnels to the Cisco WLC, one for management and the other for data
traffic. This is known as central switching because the data traffic is switched (bridged) from the AP to the controller
where it is then routed.
FlexConnect—In FlexConnect mode (previously known as HREAP), the data traffic is switched locally and is not sent
to the controller. In this mode, the Cisco AP behaves like an autonomous AP, but is managed by the Cisco WLC. Here,
the AP continues to function even if connection to the controller is lost.
Monitor—In the monitor mode, specified Cisco APs can exclude themselves from handling data traffic between
clients and the infrastructure. These APs act as dedicated sensors for location based services (LBS), rogue AP
detection, and intrusion detection (IDS).
When APs are in monitor mode, they actively monitor the airwaves and typically do not serve clients.
Sniffer—In the wireless sniffer mode, the AP starts sniffing the air on a given channel. It captures and forwards all the
packets from the clients on that channel to a remote machine that runs Airopeek or Wireshark (packet analyzers for
IEEE 802.11 wireless LANs). This includes information on the time stamp, signal strength, packet size, etc.
Note In the sniffer mode, the server to which the data is sent should be on the same VLAN as the wireless
controller management VLAN otherwise an error will be displayed.
AP Model Numbers and Regulatory Domains
You need to verify whether the AP model you have is approved for use in your country. To verify approval and to identify
the regulatory domain that corresponds to a particular country, visit http://www.cisco.com/go/aironet/compliance. Not
all regulatory domains have been approved. As and when they are approved, this compliance list will be updated.
AP Type Model Number Details
Access Point for indoor
environments, with internal
antennas
C9136I-xTri-band, controller-based 802.11ax

5
Cisco Catalyst 9136I Series Access Points
Antennas and Radios
The C9136I series access point configurations are:
C9136I-x
Internal Antennas
The C9136I models (C9136I-x) have four internal dual-band antennas with a dedicated 2.4 GHz radio and a 5 GHz radio,
four internal single-band antennas with a dedicated 5 GHz radio, four internal single-band antennas with a dedicated
6-GHz radio, one internal single-band antenna with a dedicated 2.4 GHz IOT radio, and one dual-band antenna with a
dedicated 2.4-GHz radio and a 5-GHz AUX radio and two tri-band antenna with a dedicated 2.4-GHz, 5-GHz and 6-GHz
Aux radio.
Operating Frequency and Maximum Output Power
3 Safety Instructions
Translated versions of the following safety warnings are provided in the translated safety warnings document that is
shipped with your access point. The translated warnings are also in the Translated Safety Warnings for Cisco Catalyst
Access Points, which is available on Cisco.com.
Warning This unit is intended for installation in restricted access areas. A restricted access area can be
accessed by skilled, instructed or qualified personnel. Statement 1017
Warning IMPORTANT SAFETY INSTRUCTIONS
This warning symbol means danger. You are in a situation that could cause bodily injury. Before you
work on any equipment, be aware of the hazards involved with electrical circuitry and be familiar with
standard practices for preventing accidents. Use the statement number provided at the end of each
warning to locate its translation in the translated safety warnings that accompanied this device.
SAVE THESE INSTRUCTIONS Statement 1071
Warning Read the installationinstructions before using, installing or connecting the system to the power source.
Statement 1004
Radio Frequency Bands Maximum Power level(dBm)
Wi-Fi 2400-2483.5 MHz 20
5150-5350 MHz 23
5470-5725 MHz 30
5925-6425 MHz 23
Bluetooth 2.4 GHz 20

6
Cisco Catalyst 9136I Series Access Points
Warning This product relies on the building’s installation for short-circuit (overcurrent) protection. Ensure that
the protective device is rated not greater than 20A. Statement 1005
Warning Installation of the equipment must comply with local and national electrical codes. Statement 1074
Warning In order to comply with FCC radio frequency (RF) exposure limits, antennas should be located at a
minimum of 12 inches (30 cm) or more from the body of all persons. Statement 332
Warning Ultimate disposal of this product should be handled according to all national laws and regulations.
Statement 1040
Warning This equipment is suitable for use in environment air spaces (plenums) in accordance with Section
300.22 (C) of the National Electrical Code, and Sections 2-128, 12-010(3) and 12-100 of the Canadian
Electrical Code, Part 1, CSA C22.2. External power supply, power adapter and/or power injector, if
provided, are not suitable for installation in air spaces. Statement 440
Warning Class I Equipment. This equipment must be earthed. The power plug must be connected to a properly
wired earth ground socket outlet. An improperly wired socket outlet could place hazardous voltages on
accessible metal parts.
4 Unpacking
To unpack the access point, follow these steps:
Step 1 Unpack and remove the access point and the accessory kit from the shipping box.
Step 2 Return any packing material to the shipping container and save it for future use.
Step 3 Verify that you have received the items listed below. If any item is missing or damaged, contact your Cisco
representative or reseller for instructions.
—The access point
—(Optional) Mounting bracket (AIR-AP-BRACKET-1= (default) or AIR-AP-BRACKET-2=, only if selected when
you order the access point)
—Adjustable ceiling-rail clip (AIR-AP-T-RAIL-R or AIR-AP-T-RAIL-F) (selected when you order the access point)
The following accessories can be ordered separately from Cisco:

7
Cisco Catalyst 9136I Series Access Points
•AIR-AP-BRACKET-1= for low profile installations
•AIR-AP-BRACKET-2= for electrical or network boxes, above ceiling mounts
•Mid-span power injector AIR-PWRINJ7= when PoE is not available
5 AP Views, Ports, and Connectors
Figure 1 Face of the 9136AXI Model
1Status LED 3USB 2.0 port
2Location of the ports and connectors on the head of the
AP.

8
Cisco Catalyst 9136I Series Access Points
Figure 2 Ports and Connectors on the Head of the C9136I Model
1Kensington lock slot 55GbE port 1
2Security hasp for padlocking AP to mounting bracket 65GbE port 0
3
Mode button
For information on how to use the Mode button, see “Using
the Mode Button” section.
7USB 2.0 port
4RJ-45 console port

9
Cisco Catalyst 9136I Series Access Points
dC9136I (Internal Antenna) Radiation Patterns
The AP is undergoing tests. The image placeholders will get replaced with the actual images after obtaining the results.

10
Cisco Catalyst 9136I Series Access Points
6 Preparing the AP for Installation
Before you mount and deploy your access point, we recommend that you perform a site survey (or use the site planning
tool) to determine the best location to install your access point.
You should have the following information about your wireless network available:
Access point locations.
Access point mounting options: below a suspended ceiling, on a flat horizontal surface, or on a desk top.
Note You can mount the access point above a suspended ceiling but you must purchase additional mounting
hardware: See “Mounting the Access Point” section on page 13 for additional information.
Access point power options: Use Cisco power injector—Cisco Power Injector AIR-PWRINJ7= or UL approved Listed
Power Adapter—802.3at (PoE+) 802.3af, or Cisco Universal PoE (Cisco UPOE).
Note Use an UL listed power adapter with rated output 42.5-57 Vdc, min. 1.11A, Tma is 50 degree C minimum,
Altitude is 3048m minimum.
Note The UL approved Listed Power Adapter must meet the following minimum specifications: Rated output of
42.5-57 Vdc, min. 1.11A, Tma is 50°C minimum, Altitude is 3048m minimum.
Note If 802.3af is used, both the 2.4 GHz and 5 GHz radios will be reduced to 1x1 and Ethernet will be
downgraded to 1 GbE. The USB port will also be off.
Operating temperature:
—C9136I: 32°—122°F (0°—50°C)
Note When installing the C9136I in an environment where the ambient temperature is in the range of
104°—122°F (>40°—50°C), the access point configuration will change from 8x8 to 4x4 on the 5 GHz
radios and the uplink Ethernet will downgrade to 1GbE. However, the USB port will remain enabled.
Cisco recommends that you make a site map showing access point locations so that you can record the device MAC
addresses from each location and return them to the person who is planning or managing your wireless network.
7 Installation Overview
Installing the access point involves these operations:
Step 1 Performing a Pre-Installation Configuration, page 11 (optional)
Step 2 Preparing the AP for Installation, page 10
Step 3 Mounting the Access Point, page 13
Step 4 Powering the Access Point, page 15

11
Cisco Catalyst 9136I Series Access Points
8 Performing a Pre-Installation Configuration
The following procedures ensure that your access point installation and initial operation go as expected. This procedure
is optional.
Note Performing a pre-installation configuration is an optional procedure. If your network controller is properly
configured, you can install your access point in its final location and connect it to the network from there.
See the “Deploying the Access Point on the Wireless Network” section on page 16 for details.
The pre-installation configuration setup is illustrated in Figure 3.
Figure 3 Pre-Installation Configuration Setup
To perform pre-installation configuration, perform the following steps:
Step 1 Make sure that the Cisco Wireless Controller DS port is connected to the network. Use the procedure for CLI
or web-browser interface as described in the appropriate Cisco Wireless Controller guide.
a. Make sure that access points have Layer 3 connectivity to the Cisco Wireless Controller Management and
AP-Manager Interface.
b. Configure the switch to which your access point is to attach. See the Cisco Wireless Controller Configuration
Guide for the release you are using, for additional information.
c. Set the Cisco Wireless Controller as the master so that new access points always join with it.

12
Cisco Catalyst 9136I Series Access Points
d. Make sure DHCP is enabled on the network. The access point must receive its IP address through DHCP.
Note An 802.11ax Cisco AP will be assigned an IP address from the DHCP server only if a default router
(gateway) is configured on the DHCP server (enabling the AP to receive its gateway IP address) and the
gateway ARP is resolved.
e. CAPWAP UDP ports must not be blocked in the network.
f. The access point must be able to find the IP address of the controller. This can be accomplished usingDHCP,
DNS, or IP subnet broadcast. This guide describes the DHCP method to convey the controller IP address. For
other methods, refer to the product documentation. See also the “Configuring DHCP Option 43” section on
page 19 for more information.
Note The access point requires a gigabit Ethernet (GbE) link to prevent the Ethernet port from becoming a
bottleneck for traffic because wireless traffic speeds exceed transmit speeds of a 10/100 Ethernet port.
Step 2 For C9136I, proceed to Step 3. For C9136IE, connect the antennas to the AP before powering the AP up.
Enabling the AP radios without connecting the antennas can result in damage to the AP.
Step 3 Apply power to the access point. See , page 14.
a. As the access point attempts to connect to the controller, the LED cycles through a green, red, and off
sequence, which can take up to 5 minutes.
Note If the access point remains in this mode for more than five minutes, the access point is unable to find the
Master Cisco Wireless Controller. Check theconnection between the access point and the Cisco Wireless
Controller and be sure that they are on the same subnet.
b. If the access point shuts down, check the power source.
c. After the access point finds the Cisco Wireless Controller, it attempts to download the new operating system
code if the access point code version differs from the Cisco Wireless Controller code version. While this is
happening, the Status LED blinks blue.
d. If the operating system download is successful, the access point reboots.
Step 4 Configure the access point if required. Use the controller CLI, controller GUI, or Cisco Prime Infrastructure
to customize the access-point-specific 802.11ax network settings.
Step 5 If the pre-installation configuration is successful, the Status LED is green indicating normal operation.
Disconnect the access point and mount it at the location at which you intend to deploy it on the wireless
network.
Step 6 If your AP does not indicate normal operation, turn it off and repeat the pre-installation configuration.
Note When you are installing a Layer 3 access point on a different subnet than the Cisco Wireless
Controller, be sure that a DHCP server is reachable from the subnet on which you will be installing
the access point, and that the subnet has a route back to the Cisco Wireless Controller. Also be sure
that the route back to the Cisco Wireless Controller has destination UDP ports 5246 and 5247 open
for CAPWAP communications. Ensure that the route back to the primary, secondary, and tertiary
controller allows IP packet fragments. Finally, be sure that if address translation is used, that the
access point and the Cisco Wireless Controller have a static 1-to-1 NAT to an outside address. (Port
Address Translation is not supported.)

13
Cisco Catalyst 9136I Series Access Points
9 Mounting the Access Point
Cisco Catalyst 9136I series access points can be mounted in several configurations – on a suspended ceiling, on a hard
ceiling or wall, on an electrical or network box, and above a suspended ceiling.
For access point mounting instructions, go to the following URL:
http://www.cisco.com/c/en/us/td/docs/wireless/access_point/mounting/guide/apmount.html
The standard mounting hardware supported by the AP is listed in Table 1.
When mounting the AP in areas where there is a possibility of the AP being knocked off the mounting bracket, use the
lock hasp on the back of the AP (see Figure 4) to lock it to the bracket.
Table 1 Brackets and Clips for Mounting the AP
Part Number Description
Brackets123
1. Mount the AP using no less than four screw holes on a bracket.
2. AIR-AP-BRACKET-3 is not compatible for use with Cisco Catalyst 9136I series access points.
3. You can also use “in-tile” mounting options available from third parties. For more information, visit the
access point data sheet available on Cisco.com at
https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9100ax-access-points/nb-06-cat-
9130-ser-ap-ds-cte-en.html.
AIR-AP-BRACKET-1 Low-profile bracket—Used for ceiling mount
installations
(This is the default option.)
AIR-AP-BRACKET-2 Universal bracket—Used for wall or electrical box
installations.
Clips AIR-AP-T-RAIL-R Ceiling Grid Clip (Recessed mounting)
(This is the default option)
AIR-AP-T-RAIL-F Ceiling Grid Clip (Flush mounting)
AIR-CHNL-ADAPTER Optional adapter for channel-rail ceiling grid profile.

14
Cisco Catalyst 9136I Series Access Points
Figure 4 Locking the AP to the Bracket
1Position of the hasps for the locks on the back of the AP

15
Cisco Catalyst 9136I Series Access Points
10 Powering the Access Point
Caution Ensure that the AP is powered using a UL-compliant PoE power source. You must connect the unit only
to PoE network without routing to the outside plant.
The AP can be powered only through Power-over-Ethernet (PoE) using the following:
802.3at (PoE+): Any 802.3at (30.0 W) compliant switch port or Cisco Power Injector AIR-PWRINJ7=
802.3af: Any 802.3af (15.4 W) compliant switch port
Note If 802.3af is used, both the 2.4 GHz and 5 GHz radios will be reduced to 1x1 and Ethernet will be
downgraded to 1 GbE. The USB port will also be off.
802.3bt: Any 802.3bt compliant switch port
Cisco Universal PoE (Cisco UPOE)
Caution Use the recommended AC power adapter from the Cisco accessories list with the device to reduce safety
issues.
11 Configuring and Deploying the Access Point
This section describes how to connect the access point to a controller. Because the configuration process takes place
on the controller, see the Cisco Wireless Controller Configuration Guide for additional information.
The Controller Discovery Process
Note • The controller must be running release IOS-XE 17.x to support C9136AXI. For more information, visit
the access point data sheet available on Cisco.com at
https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9100ax-access-points/guide-c07-742311.
html
•Youcannotedit or queryanyaccess point usingthecontroller CLI ifthenameofthe access point contains
a space.
•Make sure that the controller is set to the current time. If the controller is set to a time that has already
occurred, the access point might not join the controller because its certificate may not be valid for that
time.
Access points must be discovered by a controller before they can become an active part of the network. The access
point supports these controller discovery processes:
Locally stored controller IP address discovery—If the access point was previously joined to a controller, the IP
addresses of the primary, secondary, and tertiary controllers are stored in the access point non-volatile memory. This
process of storing controller IP addresses on an access point for later deployment is called priming the access point.
For more information about priming, see the “Performing a Pre-Installation Configuration” section on page 11.

16
Cisco Catalyst 9136I Series Access Points
DHCP server discovery—This feature uses DHCP option 43 to provide controller IP addresses to the access points.
Cisco switches support a DHCP server option that is typically used for this capability. For more information about
DHCP option 43, see the “Configuring DHCP Option 43” section on page 19.
DNS discovery—The access point can discover controllers through your domain name server (DNS). For the access
point to do so, you must configure your DNS to return controller IP addresses in response to
CISCO-CAPWAP-CONTROLLER.localdomain, where localdomain is the access point domain name. Configuring the
CISCO-CAPWAP-CONTROLLER provides backwards compatibility in an existing customer deployment. When an
access point receives an IP address and DNS information from a DHCP server, it contacts the DNS to resolve
CISCO-CAPWAP-CONTROLLER.localdomain. When the DNS sends a list of controller IP addresses, the access
point sends discovery requests to the controllers.
Deploying the Access Point on the Wireless Network
After you have mounted the access point, follow these steps to deploy it on the wireless network:
Step 1 Connect and power up the access point.
Step 2 Observe the access point LED (for LED status descriptions, see “Checking the Access Point LEDs” section on
page 16.
a. When you power up the access point, it begins a power-up sequence that you can verify by observing the
access point LED. If the power-up sequence is successful, the discovery and join process begins. During this
process, the LED blinks sequentially green, red, and off. When the access point has joined a controller, the
LED is green if no clients are associated or blue if one or more clients are associated.
b. If the LED is not on, the access point is most likely not receiving power.
c. If the LED blinks sequentially for more than 5 minutes, the access point is unable to find its primary,
secondary, and tertiary Cisco Wireless Controller. Check the connection between the access point and the
Cisco Wireless Controller, and be sure the access point and the Cisco Wireless Controller are either on the
same subnet or that the access point has a route back to its primary, secondary, and tertiary Cisco Wireless
Controller. Also, if the access point is not on the same subnet as the Cisco Wireless Controller, be sure that
there is a properly configured DHCP server on the same subnet as the access point. See the “Configuring
DHCP Option 43” section on page 19 for additional information.
Step 3 Reconfigure the Cisco Wireless Controller so that it is not the master.
Note A master Cisco Wireless Controller should be used only for configuring access points and not in a
working network.
12 Checking the Access Point LEDs
The location of the access point status LED is shown in Figure 1.
Note Regarding LED status colors, it is expected that there will be small variations in color intensity and hue from
unit to unit. This is within the normal range of the LED manufacturer’s specifications and is not a defect.
However, the intensity of the LED can be changed through the controller.

17
Cisco Catalyst 9136I Series Access Points
The access point status LED indicates various conditions and are described in Table 2.
13 Miscellaneous Usage and Configuration Guidelines
Using the Mode Button
Using the Mode button (see Figure 2) you can:
Reset the AP to the default factory-shipped configuration.
Clear the AP internal storage, including all configuration files.
To use the mode button, press, and keep pressed, the mode button on the access point during the AP boot cycle. Wait
until the AP console shows a seconds counter. Once the counter indicates the number of seconds the mode button is
pressed, the AP status LED changes to blinking red. Then:
To reset the AP to the default factory-shipped configuration, keep the mode button pressed for less than 20
seconds. The AP configuration files are cleared.
This resets all configuration settings to factory defaults, including passwords, WEP keys, the IP address, and the
SSID.
To clear the AP internal storage, including all configuration files, keep the mode button pressed for more than 20
seconds, but less than 60 seconds.
Note If the mode button is pressed for more than 30 seconds but less than 60 seconds, the FIPS mode flag is
also cleared during the full factory reset of the AP. The FIPS flag when set disables console access.
The AP status LED changes from Blue to Red, and all the files in the AP storage directory are cleared.
If you keep the mode button pressed for more than 60 seconds, the mode button is assumed faulty and no changes are
made.
Table 2 LED Status Indications
Message Type LED State Message Meaning
Association status Green Normal operating condition, but no
wireless client associated
Blue Normal operating condition, at least one
wireless client association
Boot loader status Green Executing boot loader
Boot loader error Blinking Green Boot loader signing verification failure
Operating status Blinking Blue Software upgrade in progress
Alternating between Green and
Red
Discovery/join process in progress
Access point operating
system errors
Cycling through
Red-Off-Green-Off-Blue-Off
General warning; insufficient inline power

18
Cisco Catalyst 9136I Series Access Points
Troubleshooting the Access Point to Cisco Controller Join Process
Note As specified in the Cisco Wireless Solutions Software Compatibility Matrix, ensure that your controller is
running controller software release 8.9.111.0 or IOS-XE 16.12.1 or later to support C9136I or 8.10.105.0
or IOS-XE 16.12.2 or later to support C9136IE.
Access points can fail to join a controller for many reasons: a RADIUS authorization is pending; self-signed certificates
are not enabled on the controller; the access point and the controller regulatory domains don’t match, and so on.
Controller software enables you to configure the access points to send all CAPWAP-related errors to a syslog server.
You do not need to enable any debug commands on the controller because all of the CAPWAP error messages can be
viewed from the syslog server itself.
The state of the access point is not maintained on the controller until it receives a CAPWAP join request from the access
point. Therefore, it can be difficult to determine why the CAPWAP discovery request from a certain access point was
rejected. In order to troubleshoot such joining problems without enabling CAPWAP debug commands on the controller,
the controller collects information for all access points that send a discovery message to it and maintains information for
any access points that have successfully joined it.
The controller collects all join-related information for each access point that sends a CAPWAP discovery request to the
controller. Collection begins with the first discovery message received from the access point and ends with the last
configuration payload sent from the controller to the access point.
When the controller is maintaining join-related information for the maximum number of access points, it does not collect
information for any more access points.
An access point sends all syslog messages to IP address 255.255.255.255 by default.
You can also configure a DHCP server to return a syslog server IP address to the access point using option 7 on the
server. The access point then starts sending all syslog messages to this IP address.
When the access point joins a controller for the first time, the controller sends the global syslog server IP address (the
default is 255.255.255.255) to the access point. After that, the access point sends all syslog messages to this IP address
until it is overridden by one of the following scenarios:
The access point is still connected to the same controller, and the global syslog server IP address configuration on
the controller has been changed using the config ap syslog host global syslog_server_IP_address command. In
this case, the controller sends the new global syslog server IP address to the access point.
The access point is still connected to the same controller, and a specific syslog server IP address has been
configured for the access point on the controller using the config ap syslog host specific Cisco_AP
syslog_server_IP_address command. In this case, the controller sends the new specific syslog server IP address
to the access point.
The access point is disconnected from the controller and joins another controller. In this case, the new controller
sends its global syslog server IP address to the access point.
Whenever a new syslog server IP address overrides the existing syslog server IP address, the old address is erased
from persistent storage, and the new address is stored in its place. The access point also starts sending all syslog
messages to the new IP address provided the access point can reach the syslog server IP address.
You can configure the syslog server for access points and view the access point join information only from the controller
CLI.
Important Information for Controller-based Deployments
Keep these guidelines in mind when you use C9136I series access point:

19
Cisco Catalyst 9136I Series Access Points
The access point can only communicate with Cisco wireless controllers.
The access point does not support Wireless Domain Services (WDS) and cannot communicate with WDS devices.
However, the controller provides functionality equivalent to WDS when the access point joins it.
CAPWAP does not support Layer 2. The access point must get an IP address and discover the controller using Layer
3, DHCP, DNS, or IP subnet broadcast.
The access point console port is enabled for monitoring and debug purposes. All configuration commands are
disabled when the access point is connected to a controller.
Configuring DHCP Option 43
You can use DHCP Option 43 to provide a list of controller IP addresses to the access points, enabling them to find and
join a controller.
The following is a DHCP Option 43 configuration example on a Windows 2003 Enterprise DHCP server for use with Cisco
Catalyst lightweight access points. For other DHCP server implementations, consult product documentation for
configuring DHCP Option 43. In Option 43, you should use the IP address of the controller management interface.
Note DHCP Option 43 is limited to one access point type per DHCP pool. You must configure a separate DHCP
pool for each access point type.
The C9136I series access point uses the type-length-value (TLV) format for DHCP Option 43. DHCP servers must be
programmed to return the option based on the access point DHCP Vendor Class Identifier (VCI) string (DHCP Option 43).
The VCI string for the C9136I series access point is:
Cisco AP C9136I
The format of the TLV block is listed below:
Type—0xf1 (decimal 241)
Length—Number of controller IP addresses * 4
Value—IP addresses of the WLC management interfaces listed sequentially in hex
To configure DHCP Option 43 in the embedded Cisco IOS DHCP server, follow these steps:
Step 1 Enter configuration mode at the Cisco IOS CLI.
Step 2 Create the DHCP pool, including the necessary parameters such as default router and name server. A DHCP
scope example is as follows:
ip dhcp pool <pool name>
network <IP Network> <Netmask>
default-router <Default router>
dns-server <DNS Server>
Where:
<pool name> is the name of the DHCP pool, such as AP9136I
<IP Network> is the network IP address where the controller resides, such as 10.0.15.1
<Netmask> is the subnet mask, such as 255.255.255.0
<Default router> is the IP address of the default router, such as 10.0.0.1
<DNS Server> is the IP address of the DNS server, such as 10.0.10.2
Step 3 Add the option 43 line using the following syntax:

20
Cisco Catalyst 9136I Series Access Points
option 43 hex <hex string>
The hex string is assembled by concatenating the TLV values shown below:
Type + Length + Value
For example, suppose that there are two controllers with management interface IP addresses, 10.126.126.2 and
10.127.127.2. The type is f1(hex). The length is 2 * 4 = 8 = 08 (hex). The IP addresses translate to 0a7e7e02 and
0a7f7f02. Assembling the string then yields f1080a7e7e020a7f7f02. The resulting Cisco IOS command added to the
DHCP scope is option 43 hex f1080a7e7e020a7f7f02.
14 FAQs
What is 802.11ax?
The IEEE 802.11ax standard, also known as the High-Efficiency Wireless (HEW) or Wi-Fi 6, builds off of the 802.11ac
and delivers a better experience in typical environments, and a more predictable performance for advanced applications
such as 4K or 8K video, high-density high-definition collaboration applications, all-wireless offices and
Internet-of-Things (IoT). 802.11ax is designed to use both 2.4Ghz and the 5GHz bands, unlike prior standards.
What is Wi-Fi 6E?
The IEEE 802.11ax standard, also known as High-Efficiency Wireless (HEW) or Wi-Fi 6, builds on 802.11ac. It delivers a
better experience in typical environments with more predictable performance for advanced applications such as 4K or
8K video, high-density, high-definition collaboration apps, all-wireless offices, and IoT. Wi-Fi 6E is Wi-Fi 6, “Extended”
into the 6 GHz band.
What is Cisco Multigigabit Ethernet?
Cisco Multigigabit Ethernet (mGig) is a unique Cisco innovation also available in the Cisco Catalyst 9136I series access
point. With the increasing popularity of 802.11ax and new wireless applications, wireless devices now require more
network bandwidth. Hence, there is a need for a technology that supports speeds higher than 1 Gbps on all cabling
infrastructure. Cisco Multigigabit technology allows you to achieve bandwidth speeds from 1 to 10 Gbps over traditional
Cat 5e cabling or newer. The C9136I AP supports up to 5 Gbps using mGig.
For more information see the following Cisco Multigigabit FAQ document:
http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/catalyst-multigigabit-switching/multigiga
bit-ethernet-technology.pdf