> For the complete documentation index, see [llms.txt](https://docs.thousandeyes.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.thousandeyes.com/product-documentation/global-vantage-points/endpoint-agents/installing/cisco-devices/wireless-active-testing.md).

# Configuring Wireless Active Testing with ThousandEyes

This document explains how to set up Wireless Active Testing on the ThousandEyes platform.

## Introduction to Wireless Active Testing

Wireless Active Testing (WAT) helps you proactively detect Wi-Fi issues and adds the ability of pre-connection testing that tests the Wi-Fi onboarding process. It integrates the Cisco Catalyst 9800 Wireless LAN Controller with the ThousandEyes platform to deliver end-to-end network and application testing. Wireless Active Testing (WAT) helps you troubleshoot Wi-Fi network inconsistencies by using the Catalyst Access Point CW9172H with the ThousandEyes Endpoint Agent as an Active Testing Access Point. This enables early detection and resolution of wireless performance issues.

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-bc8539da1bd153a8f5adfe3eca9a0fca0ba9ce13%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-1.png?alt=media)

## Prerequisites

* Cisco Wireless CW9172H Access Point
* IOS-XE 17.18.2 software version of higher
* Connectivity to ThousandEyes platform (cloud). For details, see [Installing the Endpoint Agent on Windows](https://docs.thousandeyes.com/product-documentation/global-vantage-points/endpoint-agents/installing/windows/install-the-endpoint-agent-on-windows#network-connections) or [Installing the Endpoint Agent on macOS](https://docs.thousandeyes.com/product-documentation/global-vantage-points/endpoint-agents/installing/macos/install-the-endpoint-agent-on-macos#network-connections).

### Relevant Acronyms and Terminology

* WAT: Wireless Active Testing​
* SSID: Service Set Identifier (name)​
* BSSID: Basic Service Set Identifier—the MAC address of the wireless access point radio (BSS) that serves the association. In the ThousandEyes UI this is the same value used for filtering and tables labeled **BSSID** under wireless views.
* AP: Access Point
* Active Testing Access Point: A Catalyst access point running Endpoint Agent and performing Wireless Active Testing.

## Getting Started

The configuration of Wireless Active Testing with ThousandEyes consists of two stages:

* **Stage 1 - Active Testing Access Point Onboarding** : This involves performing the necessary configuration on the Wireless LAN Controller (WLC) to onboard the Access Point and deploy the ThousandEyes Endpoint Agent.
* **Stage 2 - SSID and Test Configuration** : This involves configuring the SSID and setting up the test parameters on the ThousandEyes platform to enable Wireless Active Testing.

### Stage 1 - Active Testing Access Point Onboarding

To set up this stage of Wireless Active Testing (WAT), see the detailed instructions [here](https://www.cisco.com/content/en/us/td/docs/wireless/controller/9800/17-18/config-guide/b_wl_17_18_cg/m_thousandeyes-integration-enhancements.html).

### Stage 2 - SSID and Test Configuration

#### Validating Agent Registration

1. After you finish configuring the WLC, the Endpoint Agents running on the Catalyst Access Points appear in the ThousandEyes portal. It may take about 5 to 10 minutes for the Endpoint Agent to register on the ThousandEyes platform after you install it on the WLC.
2. On the ThousandEyes platform, go to **Endpoint Experience > Agent Settings**. In **Agent Settings**, select **Add Filter**. In the **Platform** filter, choose **Cisco Wireless**. This displays only the Endpoint Agents installed on wireless access points.

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-f85a6d052b83026b2f4c80fbe0e7f64270a734f0%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-2a.png?alt=media)

#### SSID Configuration

1. After you confirm that the Endpoint Agents are installed on the access points and registered with the ThousandEyes platform, configure the SSIDs. The Endpoint Agent uses these SSIDs to connect to and cycle between access points broadcasting the selected SSID. To set up an SSID, go to **SSID Configurations** tab in **Agent Settings** and select **Create SSID Configuration**.

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-665ee55e2750e565711c08aa98c3a9cfb7af129d%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-3.png?alt=media)

2. The SSID Configuration section contains the following fields:

* **Configuration Name** – A name for the configuration.
* **SSID** - A list of available SSIDs that will be imported into ThousandEyes when the Active Testing Access Point is onboarded. In this dropdown menu, you can select the preferred SSID for this configuration. Alternatively, you are not limited to these suggestions and may manually configure any arbitrary SSID.
* **Band** – Specifies the wireless band.
* **Max Number of APs** – Specifies the maximum number of BSSIDs that the Active Testing Access Point will test during one round.

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-b9d677b2f4dd5402a2e8edbe5744c232778e3100%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-4.png?alt=media)

* **Credential Type** – Specifies the authentication configuration. Active Testing Access Points must authenticate to connect to SSIDs. To set the authentication method, select **Credential Type** in **SSID Configuration**. The available options are:
  * **Password** - If you select **Password**, you must provide the PSK (Pre-Shared Key) used for this SSID.
  * **Username/Password** - If you select **Username/Password**, select one of the supported EAP methods: PEAP, LEAP, or EAP-FAST, and provide the corresponding username and password.
  * **Certificate** - Select one of the LSC (Locally Significant Certificate), Manual, or SCEP options.
    * If you select the LSC (Locally Significant Certificate) option, three additional settings are available:
      * **EAP Outer Identity** - Optional. Defaults to **anonymous** if you do not specify a value.
      * **Verify Server Certificate** - Enabled by default. When enabled, the agent validates the RADIUS server certificate. When disabled, it does not.
      * **Trusted Server CA Certificate** - Optional. If different CAs issue the AP or WLC certificate and the RADIUS server certificate, provide the CA certificate that issued the RADIUS server certificate. If the same CA issued both certificates and the client device already trusts it, you do not need to provide a CA certificate.
    * If you select the Manual option, five additional settings are available:
      * **Client Bundle (PKCS #12)** - Upload a single PKCS#12 file (**.p12** or **.pfx**) that contains the client certificate chain and private key.
      * **Private Key Password** - Optional. The password used to unlock the private key in the Client Bundle. Leave this field empty if the PKCS#12 file has no password.
      * **EAP Outer Identity** - Optional. Defaults to **anonymous** if you do not specify a value.
      * **Verify Server Certificate** - Enabled by default. When enabled, the agent validates the RADIUS server certificate. When disabled, it does not.
      * **Trusted Server CA Certificate** - Optional. When different certificate authorities (CAs) issue infrastructure certificates (such as AP or WLC certificates) and RADIUS server certificates, the client must trust the CA that issued the RADIUS certificate to authenticate securely. If multiple CAs are in use, provide the CA certificate that signs the RADIUS server certificate. If the same CA signs both the AP or WLC certificate and the RADIUS server certificate, and the client device already trusts that CA, you do not need to provide this certificate.
    * If you select the SCEP option, enter the required SCEP settings and any additional certificate details required by your organization's certificate authority (CA). SCEP support requires Cisco IOS XE Release 26.2.1 or later. It automatically enrolls and renews client certificates for EAP-TLS SSIDs. For details, see Cisco's [Wireless Active Testing SCEP support](https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/26-1/configuration-guide/wl-26-1-cg/wireless-active-testing-scep-support/wat-scep-support.html) guide.
      * **Server URL** - The URL of the SCEP enrollment endpoint.
      * **Common Name** - The Common Name (CN) to include in the certificate signing request (CSR). This field supports variables, as shown in the following examples.

        | **Configuration Field**       | **Example Value in CSR**   |
        | ----------------------------- | -------------------------- |
        | `{{eth_mac_colon}}`           | `8c:88:81:5a:7a:30`        |
        | `WAT-AP-{{radio_mac_none}}`   | `WAT-AP-20cc.27c2.3180`    |
        | `SENSOR_{{client_mac_colon}}` | `SENSOR_20-cc-27-c2-31-92` |
        | `{{hostname}} SN:${SN}`       | `M-9172H SN:DSM28400038`   |
        | `TE AP {{sn}}`                | `TE AP DSM28400038`        |
      * **Subject Alternative Name(s)** - Additional identities to include in the CSR's Subject Alternative Name (SAN) extension. This field supports variables, as shown in the following examples.

        | **Configuration Field**             | **Example Value in CSR**            |
        | ----------------------------------- | ----------------------------------- |
        | `DNS.1 = {{hostname}}`              | `DNS.1 = M-9172H`                   |
        | `URI.1 = urn:serial:{{sn}}`         | `URI.1 = urn:serial:DSM28400038`    |
        | `URI.2 = urn:mac:{{eth_mac_colon}}` | `URI.2 = urn:mac:8c:88:81:5a:7a:30` |
      * **Challenge Password** - The SCEP challenge password, if your SCEP server requires one.
      * **Server Certificate Fingerprint** - The fingerprint used to verify the CA certificate retrieved from the SCEP server.
      * **State** - The state or province to include in the certificate subject.
      * **Country Code** - The country code to include in the certificate subject.
      * **Locality** - The city or locality to include in the certificate subject.
      * **Organization** - The organization name to include in the certificate subject.
      * **Organization Unit** - The department or organizational unit to include in the certificate subject.
      * **Email Address** - The email address to include in the certificate subject.
      * **Automatic re-enrollment** - When enabled, the Wireless Certificate Platform renews the client certificate before it expires. When disabled, the platform does not automatically renew the certificate.
      * **Verify server certificate** - When enabled, the agent validates the RADIUS server certificate during EAP-TLS authentication. This setting applies to the RADIUS server certificate. It is separate from **Server Certificate Fingerprint**, which is used during SCEP enrollment.
      * **Trusted Server CA Certificate** - Optionally upload a **.pem** CA certificate to validate the RADIUS server certificate. If the access point does not already trust the CA that issued the RADIUS certificate, provide that CA certificate.
  * **Open (no authentication)** - No authentication is required when this option is selected.

#### Wireless Active Testing Configuration

Once the SSIDs imported from the WLC have been configured on the ThousandEyes platform you can set up Wireless Active Testing. In this section, you’ll create a Wireless Active Testing configuration and associate the configured SSIDs with the Active Testing Access Point.

1. Go to Endpoint Experience > Test Settings, choose **Wireless Active Testing**, and then select **Add Configuration**.

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-af5976d8c6592eac9bcf02af36414c510cddcd64%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-5a.png?alt=media)

2. The **Wireless Active Testing** section consists of three sub-sections:
   * Select SSIDs - provide a name for your Wireless Sensor Configuration and select up to three SSIDs for Wireless Active Testing.
   * Select Agents - select the Endpoint Agents you want to associate with these SSIDs for testing. There are three options for selecting which Endpoint Agents will use the previously selected SSIDs for testing:
     * All Agents – All Endpoint Agents
     * Specific Agents – Only selected Endpoint Agents
     * Agent Labels — Only Endpoint Agents associated with a specific label. Note that SSID-based labels cannot be used within Wireless Sensor Configuration.
   * Review and Create

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-a0eec57785fbf5cffab5585c6f426e04d20162e5%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-6a.png?alt=media)

3. Enter the relevant information in each of the above sub-sections and proceed by clicking **Next**. In the final sub-section, review the configuration, and if everything looks correct, click **Create**. After you complete the configuration, the Active Testing Access Point connects to the configured SSIDs and begins collecting wireless metrics.

It may take up to 20 minutes for the data to appear on the ThousandEyes platform.

### Synthetic Tests Configuration

In addition to wireless monitoring, Wireless Active Testing with the ThousandEyes Endpoint Agent lets you set up synthetic tests for critical business applications. The configuration process is the same as for other Endpoint Agents. For detailed instructions and best practices, see [Monitoring an Application using Synthetic Tests](https://docs.thousandeyes.com/product-documentation/end-user-monitoring/test-settings/synthetic-tests).

## Leveraging Wireless Active Test Data in ThousandEyes

This section covers Wireless Active Testing (WAT) data in the ThousandEyes platform. It explains how to interpret and use the test data generated by WAT.

For more information about viewing Endpoint Agent data, see [Viewing Data](https://docs.thousandeyes.com/product-documentation/end-user-monitoring/viewing-data#local-networks-view).

### Dashboards

Dashboards make it easy to monitor and visualize large volumes of test data, and help you quickly identify and resolve issues.

To help you track test results efficiently and reduce the need for external assistance, we offer Dashboard Templates. These templates promote consistency and support best practices for managing multiple account organizations.

For more information about dashboards, see the following articles:

* [Using Dashboard Templates](https://docs.thousandeyes.com/product-documentation/dashboards/dashboard-templates)
* [Customizing your Dashboard](https://docs.thousandeyes.com/product-documentation/dashboards/customizing-your-dashboard)
* [Troubleshooting with Dashboard Drill-Down](https://docs.thousandeyes.com/product-documentation/dashboards/troubleshooting-with-drill-down)
* [Additional Data Collected by Mobile Endpoint Agent](https://docs.thousandeyes.com/product-documentation/global-vantage-points/endpoint-agents/data-collected-by-endpoint-agent#additional-data-collected-by-mobile-endpoint-agent)

### Endpoint Agent Views

The view provides the ability to search for an agent and view its performance, associated application performance, and infrastructure performance in a single page.

To utilize the Agent View:

1. Navigate to **Endpoint Experience > Agent Views** in the ThousandEyes platform.
2. Use the Search section to enter and select the specific Endpoint Agent you want to examine.

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-737e7cea53580465d8dbdfedc7816091dace482e%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-7a.png?alt=media)

3. In the **Metrics** section, select **Connection**, and select **RSSI** from the dropdown correpsonding to Connection.
4. You can now see the visual representation of the SSIDs tested during the selected time frame along with their corresponding RSSI values.
5. In the **Segment Visualization** section, on the **Connection** tab, you can view wireless data such as SSID, BSSID, channel, PHY mode, connection score, Wi-Fi signal quality, RSSI, and link speed.

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-ebcb670e7bce04c2a0dc8e00e7e96ab77bb71f32%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-8.png?alt=media)

6. For viewing the detailed entries for events, you can refer to the **Logs** tab in the **Logs and Metrics** section.

You can refer the [Agent Views](https://docs.thousandeyes.com/product-documentation/end-user-monitoring/viewing-data/agent-views) documentation to learn more about analyzing and troubleshooting.

### Local Network Views

The Local Networks view shows wireless data aggregated from multiple endpoint agents, unlike the Single Agent view, which displays data for individual agents. To access this view, go to **Endpoint Experience > Views**, and then select **Local Networks** and **Wireless**.

In this view, the Endpoint table lists all endpoint agents active during the selected time frame, along with relevant wireless metrics.

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-7e9785743a4e148ff88a562b68a769da9b4431f1%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-9.png?alt=media)

The **BSSID Table** provides the same view from the BSSID perspective.

![](https://1112912342-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M4QARF6s57qxMrOHDTZ%2Fuploads%2Fgit-blob-7bc92dd1fb234a1c6b6ec04e40a8be48c3aa5b20%2Fproduct-documentation_global-vantage-points_endpoint-agents_wireless-active-testing-10.png?alt=media)

### Features Not Supported

WAT does not support the following Endpoint Agent features and configurations:

* Real User and Dynamic tests
* Browser extension
* Throughput rate
* Retransmission rate
* Channel Swap Events
* SSIDs that use captive portals