Cisco 1941W Wireless Configuration Example

The Cisco 1941W router has wireless onboard but this isn’t just any ordinary “wireless” interface. It’s a complete access point that has to be configured separately from the router.  The router and (virtual) access point are connected to each other by using a virtual gigabit interface. Let me give you a picture to help you visualize how this works internally:

Cisco 1941W Internal Wifi Topology

All the interfaces are above are not real but virtual interfaces on the router. Let me explain each interface to you:

  • The router has a Wlan-AP0 interface which is only used to access the console of the access point.
  • The access point has a dot11Radio 0 interface which is the radio for the 2.4GHz frequency.
  • The access point also has a dot11Radio 1 interface which is the radio for the 5GHz frequency.
  • The access point has a Gi0/0 interface which is connected to the Wlan-Gi0/0 on the router.
  • The Wlan-Gi0/0 on the router and the Gi 0/0 interface on the access point are layer 2 interfaces (switchport) that we can use as a trunk.
  • The Vlan1 interface on the router is a routed port where you can configure an IP address. It’s connected to the Wlan-Gi0/0 interface so that’s why you see the dashed line.
  • The BVI1 interface on the access point is similar to the Vlan1 interface of the router. It’s connected to the Gi0/0 interface.

The logic behind these interfaces is that each SSID that you configure for the wireless network will be assigned to a single VLAN. The virtual Gigabit link between the access point and router can be configured as a trunk so that all (wireless) traffic can be isolated in VLANs.

Each VLAN will need an IP address that can be used as the default gateway for its wireless clients, that’s why we need to create VLAN interfaces on the router.

In the next part of this lesson i’ll give you a configuration example where we will create a wireless network and two VLANs:

  • One VLAN for wireless users.
  • One VLAN for management traffic.

Just like a router or switch we can connect to the virtual access point through SSH for remote management. Also, if you are using WPA-2 enterprise the access point will communicate with an external radius server. We need to make sure that management traffic doesn’t get mixed up with wireless traffic so that’s why we need to create at least two VLANs. Our network will look like this:

Cisco 1941W Two VLANs

Let me explain this picture:

  • On the router we will configure IP address on the Vlan 1 interface and on the access point we have on its BVI1 interface. This will be used for management traffic.
  • The Vlan10 interface on the router will have IP address, this will be the default gateway for the wireless users.

Let’s take a look at the configuration!

First we will configure a DHCP pool for the wireless users:

Router(config)#ip dhcp pool VLAN10-WIFI

The IP address on the Vlan10 interface will be the default gateway and we’ll use Google DNS (

Next step is to make sure the Wlan-Gi0/0 interface is operational:

Router(config)#interface Wlan-GigabitEthernet0/0
Router(config-if)#no shutdown

Now we will configure the Wlan-Ap0 interface so that we can access the console of the access point:

Router(config)#interface wlan-ap 0
The wlan-ap 0 interface is used for managing the embedded AP.
Please use the "service-module wlan-ap 0 session" command to console into the embedded AP

Router(config-if)#ip address

Pick whatever IP address you want, just make sure it’s not already in use on your network. The router only uses this IP address internally for the console connection. Let’s configure the trunk on the router:

Router(config)#interface wlan-gigabitEthernet 0/0
Router(config-if)#switchport mode trunk

Let’s configure the Vlan1 interface for management traffic:

Router(config)#interface vlan 1
Router(config-if)#ip address

And don’t forget the VLAN for our wireless users:

Router(config)#vlan 10
Router(config-vlan)#name WIFI
Router(config)#interface vlan 10
Router(config-if)#ip address

The router is now ready, let’s move over to the access point:

Router#service-module wlan-ap 0 session
Trying, 2067 ... Open


You are now connected to the access point, in case you have to enter a username/password, This is usually cisco/cisco. Let’s erase the default config so we can start with a clean one:

ap#erase startup-config
Erasing the nvram filesystem will remove all configuration files! Continue? [confirm]
Erase of nvram: complete

And reload it…


Once the access point is reloaded we’ll login again, the default password for enable is normally ‘Cisco’:

Password: Cisco

Our next move is to configure the gigabit interface of the access point. We will use the BVI interfaces to tell the interface to which VLANs it belongs:

Ap(config-if)#interface gigabitEthernet 0
Ap(config-subif)#bridge-group 1
Ap(config-if)#interface gigabitEthernet 0.10
Ap(config-subif)#encapsulation dot1Q 10
Ap(config-subif)#bridge-group 10

Bridge-group 1 is for VLAN 1 and will be untagged, bridge-group 10 will use a sub-interface and should be tagged as VLAN 10.

Now we’ll configure the BVI interface for management traffic:

Ap(config)#bridge irb
Ap(config)#interface BVI 1
Ap(config-if)#ip address

We don’t need a BVI interface for VLAN 10 because the wireless users only require an IP address on the router as a default gateway. The routing/switching configuration is now complete, let’s work on the wireless part.

First we will create a simple wireless network that uses a pre-shared key for WPA:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You’ve Ever Spent on Your Cisco Career!
  • Full Access to our 739 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

545 Sign Ups in the last 30 days

100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!


Forum Replies

  1. Hi Rob,

    If you want to seperate home and guest users, you need to use VLANs and different subnets. I don’t have the 1941W with me here but the configuration for two VLANs should look like this, I used VLAN70 and VLAN80:

    dot11 ssid VLAN80
    authentication open
    vlan 70
    dot11 ssid VLAN80
    authentication open
    vlan 80

    These are the SSIDs for VLAN70 and VLAN80. Now we need to apply both of them to the radio that you want to use:

    interface dot11radio0
    ssid VLAN70
    ssid VLAN80

    the “mbssid” command tells the access point to use mult

    ... Continue reading in our forum

  2. I am confused, where do I apply the IP NAT Inside command for my wireless network?

  3. I’d love to see your config when you get a chance to post it. I suppose I am having trouble getting my head around the need for VLANS. I understand that VLANs separate the broadcast traffic into sub-domains and therefore isolate traffic as routers do not forward broadcast frames.

    My understanding so far is:

    1. The bridge-groups in the radio sub-interfaces tie these interfaces to the BVIs that are created.

    2. So then the “encapsulation dot1Q xx native” command in the sub-interface then ties the SSIDs (which have the vlan command) to the respective sub-interface an

    ... Continue reading in our forum

  4. Hi Matt,

    Take a look at my 1941 example:

    Does your 2851 work the same? Do you have to use the console on the router to switch to the AP? The AP is integrated in the router but in reality, these are two separate devices that are connected with an internal gigabit link.

    In my 1941, the router uses the wlan-GI0/0 and the AP uses its Gi0/0 interface. This is a L2 interface…it’s the same thing as connecting a router to a switch.

    We use VLANs so that you can separate traffic. In your exam

    ... Continue reading in our forum

  5. Hi Rene, I hope you had a great holiday. I have managed to get a wireless setup on my Cisco 2851 with an HWIC-AP that works that doesn’t use BVIs, bridge-groups and actual VLANS. I am able to access the internet from any of the three SSIDs I have configured. I have not configured any actual VLANs on it, a sh vlan-switch command only shows the five default ones. The Dot11Radio0/3/0 and its subinterfaces are L3 ethernet types with a native VLAN assigned to each. The dot11 ssids are then placed into a VLAN which binds them to the respective L3 interfaces. As shown

    ... Continue reading in our forum

43 more replies! Ask a question or join the discussion by visiting our Community Forum