Growing a WLAN beyond a class C network (WLC2504, AP2700), AP groups?

Question

We're about to grow our network by expanding to a new office a few floor up putting us at a size no longer fit for a class C network (> 255 devices). For obvious reasons I don't want to increase the network's size beyond that either.
The equipment used is a 1 x WLC 2504 and 15 x AP2700. It's set up to run the APs in local mode for now and in terms of wireless traffic that should still work fine.
Since the offices are about 100 meters apart and require users to travel even further to get to from one to the other roaming between them is not really important and associating to an AP in the wrong office is unlikely given the distance. There is a fiber connection between the two offices.
What I do need is for users to be able to authenticate with the same credentials and for the same SSID to be used in both locations. I'm thinking this is best solved by giving each office it's own IP-range and AP Groups but maybe there are other alternatives?
Also I haven't managed to successfully get AP Groups to work. I have created a new interface on the controller with a different VLAN, DHCP server, etc. Then I added a WLAN to an AP Group but changed the interface to the newly created (different from the one set up in the WLAN). However when I associate to an AP in that AP group I still end up on the same VLAN as on the APs in the default-group.
Is changing of VLAN mapping only available for FlexConnect APs?
There is also a prerequisite in the documentation (linked below) that "the required access control list (ACL) must be defined on the router that serves the VLAN or subnet"? I haven't really understood what type of ACL this would be? The network as such is set up in an ASA firewall and has internet access, dhcp and so forth set.
http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-6/configuration-guide/b_cg76/b_cg76_chapter_01011100.html
I believe one solution would be to just create two WLANs with different profile name and VLAN but otherwise similar and assign them to different AP groups? This would also assume I stop using the default AP group and keep APs in two other AP groups since all WLANs exist in the default group.
Any help or guidance is appreciated.

Answer 1

(Cisco Controller) >show wlan apgroups
Total Number of AP Groups........................ 1
Site Name........................................ default-group
Site Description................................. <none>
NAS-identifier................................... Cisco_xx:yy:zz
AP Operating Class............................... Not-configured
RF Profile
2.4 GHz band..................................... <none>
5 GHz band....................................... <none>
WLAN ID Interface Network Admission Control Radio Policy
1 employeenet Disabled None
2 management Disabled None
3 guestnet Disabled None
16 guestnet Disabled None
--More-- or (q)uit
*AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
AP Name Slots AP Model Ethernet MAC Location Port Country Priority
AP_Hangout 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
AP_N 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
AP_Investor 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
AP_Extra 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
AP_NW 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
AP_Boardroom 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
AP_Investor 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
AP_NE 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
AP_Reception 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
AP25_NW 2 AIR-CAP2702I-E-K9 f4:0f:1b:xx:yy:zz 8th floor 1 SE 1
AP25_Hangout 2 AIR-CAP2702I-E-K9 f4:0f:1b:xx:yy:zz 8th floor 1 SE 1
AP_Event 2 AIR-CAP3602I-E-K9 c0:67:af:xx:yy:zz default location 1 SE 1
Site Name........................................ employeenet_2
Site Description................................. 8th floor AP group
Venue Group Code................................. Unspecified
--More-- or (q)uit
Venue Type Code.................................. Unspecified
NAS-identifier................................... Cisco_xx:yy:zz
AP Operating Class............................... Not-configured
RF Profile
2.4 GHz band..................................... <none>
5 GHz band....................................... <none>
WLAN ID Interface Network Admission Control Radio Policy
1 employeenet_2 Disabled None
16 guestnet Disabled None
*AP3600 with 802.11ac Module will only advertise first 8 WLANs on 5GHz radios.
AP Name Slots AP Model Ethernet MAC Location Port Country Priority
AP25_undefined 2 AIR-CAP2702I-E-K9 f4:0f:1b:xx.yy:zz 8th floor 1 SE 1
--More-- or (q)uit
(Cisco Controller) >
We're changing the APs out from the 3600 ones to the 2700 although all are not changed yet. Also I only moved one AP to the AP Group I'm trying to get working for the testing.
(Cisco Controller) >show wlan 1
WLAN Identifier.................................. 1
Profile Name..................................... Employeenet
Network Name (SSID).............................. <company name>
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Client Profiling Status
Radius Profiling ............................ Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Local Profiling ............................. Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Maximum number of Clients per AP Radio........... 200
--More-- or (q)uit
Number of Active Clients......................... 9
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 1800 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 12 hours
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... Cisco_xx:yy:zz
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ employeenet
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
mDNS Status...................................... Enabled
mDNS Profile Name................................ default-mdns-profile
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Quality of Service............................... Silver
Per-SSID Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0
--More-- or (q)uit
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-Client Rate Limits........................... Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
--More-- or (q)uit
Radius Servers
Authentication................................ Global Servers
Accounting.................................... Global Servers
Interim Update............................. Disabled
Framed IPv6 Acct AVP ...................... Prefix
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Security
802.11 Authentication:........................ Open System
FT Support.................................... Disabled
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Enabled
WPA (SSN IE)............................... Disabled
WPA2 (RSN IE).............................. Enabled
TKIP Cipher............................. Disabled
AES Cipher.............................. Enabled
Auth Key Management
802.1x.................................. Disabled
PSK..................................... Enabled
CCKM.................................... Disabled
--More-- or (q)uit
FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Disabled
PMF-1X(802.11w)......................... Disabled
PMF-PSK(802.11w)........................ Disabled
FT Reassociation Timeout................... 20
FT Over-The-DS mode........................ Enabled
GTK Randomization.......................... Disabled
SKC Cache Support.......................... Disabled
CCKM TSF Tolerance......................... 1000
WAPI.......................................... Disabled
Wi-Fi Direct policy configured................ Disabled
EAP-Passthrough............................... Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web-Passthrough............................... Disabled
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
Auto Anchor................................... Disabled
FlexConnect Local Switching................... Disabled
flexconnect Central Dhcp Flag................. Disabled
flexconnect nat-pat Flag...................... Disabled
flexconnect Dns Override Flag................. Disabled
flexconnect PPPoE pass-through................ Disabled
--More-- or (q)uit
flexconnect local-switching IP-source-guar.... Disabled
FlexConnect Vlan based Central Switching ..... Disabled
FlexConnect Local Authentication.............. Disabled
FlexConnect Learn IP Address.................. Enabled
Client MFP.................................... Optional
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60
Eap-params.................................... Disabled
AVC Visibilty.................................... Disabled
AVC Profile Name................................. None
Flow Monitor Name................................ None
Split Tunnel (Printers).......................... Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Disabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
Band Select...................................... Disabled
--More-- or (q)uit
Load Balancing................................... Disabled
Multicast Buffer................................. Disabled
Mobility Anchor List
WLAN ID IP Address Status
802.11u........................................ Disabled
MSAP Services.................................. Disabled
Local Policy
Priority Policy Name
(Cisco Controller) >
WLAN ID 2 and 3 are disabled.
Thanks for looking into this.