Configuring Policy Profile Features

Configuring AAA Override

SUMMARY STEPS

  1. configure terminal
  2. wireless profile policy profile-policy
  3. aaa-override
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile policy profile-policy

Example:

Device(config)# wireless profile policy test-wgb

Configures WLAN policy profile and enters the wireless policy configuration mode.

Step 3

aaa-override

Example:

Device(config-wireless-policy)# aaa-override

Configures AAA policy override.

Note

 

If VLAN is not pushed from the RADIUS server, the VLAN Override feature can be disabled from the RADIUS server.

Step 4

end

Example:

Device(config-wireless-policy)# end

Returns to privileged EXEC mode.

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring Override VLAN for Central Switching

SUMMARY STEPS

  1. configure terminal
  2. vlan vlan-id
  3. name vlan-name
  4. end

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

vlan vlan-id

Example:

Device(config)# vlan 20

Defines VLANs that can be pushed from the RADIUS server.

Note

 

The valid VLAN ID ranges from 1 to 4094.

Step 3

name vlan-name

Example:

Device(config-vlan)# name vlan_ascii

(Optional) Changes the default name of the VLAN.

Step 4

end

Example:

Device(config-vlan)# end

Returns to privileged EXEC mode.

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring Override VLAN for Local Switching

SUMMARY STEPS

  1. configure terminal
  2. wireless profile flex flex_profile_name
  3. vlan-name vlan_name
  4. vlan-id vlan_id
  5. end

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile flex flex_profile_name

Example:

Device(config)# wireless profile flex rr-xyz-flex-profile

Configures a Flex profile.

Step 3

vlan-name vlan_name

Example:

Device(config-wireless-flex-profile)# vlan-name vlan_123

Defines VLANs that can be pushed from the RADIUS server.

Step 4

vlan-id vlan_id

Example:

Device(config-wireless-flex-profile-vlan)# vlan-id 23

Configures VLAN ID.

The valid VLAN ID ranges from 1 to 4096.

Step 5

end

Example:

Device(config-wireless-flex-profile-vlan)# end

Returns to privileged EXEC mode.

Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Verifying VLAN Override on Layer 3 Web Authentication

To display the VLAN override after L3 authentication, use the following command:

Device# show wireless client mac <mac> detail
[…]
        Vlan Override after L3 Auth: True

To display the statistics about client, use the following command:

Device# show wireless stats client detail
[…]
      Total L3 VLAN Override vlan change received      : 1
      Total L3 VLAN Override disassociations sent      : 1
      Total L3 VLAN Override re-associations received  : 1
      Total L3 VLAN Override successful VLAN change    : 1
      […]
      L3 VLAN Override connection timeout                             : 0

Configuring DHCP for WLANS (CLI)

Configuring DHCP Scopes (CLI)

SUMMARY STEPS

  1. configure terminal
  2. ip dhcp pool pool-name
  3. network network-name mask-address
  4. dns-server hostname
  5. end

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

ip dhcp pool pool-name

Example:

(config)#ip dhcp pool test-pool

Configures the DHCP pool address.

Step 3

network network-name mask-address

Example:

(dhcp-config)#network 209.165.200.224 255.255.255.0

Specifies the network number in dotted-decimal notation and the mask address.

Step 4

dns-server hostname

Example:

(dhcp-config)#dns-server example.com

Specifies the DNS name server. You can specify an IP address or a hostname.

Step 5

end

Example:

Device(config)# end

Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

Configuring the Internal DHCP Server Under Client VLAN SVI (CLI)

Before you begin

  • For wireless clients, only two DHCP servers are supported.

  • To use the internal DHCP server for both wireless and wired client VLAN, an IP address must be configured under the client VLAN SVI.

  • For wireless clients, the IP address of the internal DHCP server must be different from the address of the wireless client VLAN SVI (in the DHCP helper address configuration).

  • For wireless clients, the internal DHCP server can be configured under the client VLAN SVI or under the wireless policy profile.

SUMMARY STEPS

  1. configure terminal
  2. interface loopback interface-number
  3. ip address ip-address
  4. exit
  5. interface vlan vlan-id
  6. ip address ip-address
  7. ip helper-address ip-address
  8. no mop enabled
  9. no mop sysid
  10. exit
  11. ip dhcp excluded-address ip-address
  12. ip dhcp excluded-address ip-address
  13. ip dhcp pool pool-name
  14. network network-name mask-address
  15. default-router ip-address
  16. exit
  17. wireless profile policy profile-policy
  18. central association
  19. central dhcp
  20. central switching
  21. description policy-proile-name
  22. vlan vlan-name
  23. no shutdown

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

interface loopback interface-number

Example:

Device(config)# interface Loopback0

Creates a loopback interface and enters interface configuration mode.

Step 3

ip address ip-address

Example:

Device(config-if)# ip address 10.10.10.1 255.255.255.255

Configures the IP address for the interface.

Step 4

exit

Example:

Device(config-if)# exit

Exits interface configuration mode.

Step 5

interface vlan vlan-id

Example:

Device(config)# interface vlan 32

Configures the VLAN ID.

Step 6

ip address ip-address

Example:

Device(config-if)# ip address 192.168.32.100 255.255.255.0

Configures the IP address for the interface.

Step 7

ip helper-address ip-address

Example:

Device(config-if)# ip helper-address 10.10.10.1

Configures the destination address for UDP broadcasts.

Note

 

If the IP address used in the ip helper-address command is an internal address of the controller an internal DHCP server is used. Otherwise, the external DHCP server is used.

Step 8

no mop enabled

Example:

Device(config-if)# no mop enabled

Disables the Maintenance Operation Protocol (MOP) for an interface.

Step 9

no mop sysid

Example:

Device(config-if)# no mop sysid

Disables the task of sending MOP periodic system ID messages.

Step 10

exit

Example:

Device(config-if)# exit

Exits interface configuration mode.

Step 11

ip dhcp excluded-address ip-address

Example:

Device(config)# ip dhcp excluded-address 192.168.32.1

Specifies the IP address that the DHCP server should not assign to DHCP clients.

Step 12

ip dhcp excluded-address ip-address

Example:

Device(config)# ip dhcp excluded-address 192.168.32.100

Specifies the IP addresses that the DHCP server should not assign to DHCP clients.

Step 13

ip dhcp pool pool-name

Example:

Device(config)# ip dhcp pool pool-vlan32

Configures the DHCP pool address.

Step 14

network network-name mask-address

Example:

Device(dhcp-config)# network 192.168.32.0 255.255.255.0

Specifies the network number in dotted-decimal notation, along with the mask address.

Step 15

default-router ip-address

Example:

Device(dhcp-config)# default-router 192.168.32.1

Specifies the IP address of the default router for a DHCP client.

Step 16

exit

Example:

Device(dhcp-config)# exit

Exits DHCP configuration mode.

Step 17

wireless profile policy profile-policy

Example:

Device(config)# wireless profile policy default-policy-profile

Configures the WLAN policy profile and enters wireless policy configuration mode.

Step 18

central association

Example:

Device(config-wireless-policy)# central association

Configures central association for locally switched clients.

Step 19

central dhcp

Example:

Device(config-wireless-policy)# central dhcp

Configures the central DHCP for locally switched clients.

Step 20

central switching

Example:

Device(config-wireless-policy)# central switching

Configures WLAN for central switching.

Step 21

description policy-proile-name

Example:

Device(config-wireless-policy)# description "default policy profile"

Adds a description for the policy profile

Step 22

vlan vlan-name

Example:

Device(config-wireless-policy)# vlan 32

Assigns the profile policy to the VLAN.

Step 23

no shutdown

Example:

Device(config-wireless-policy)# no shutdown

Enables the wireless profile policy.

Configuring the Internal DHCP Server Under a Wireless Policy Profile

SUMMARY STEPS

  1. configure terminal
  2. interface loopback interface-number
  3. ip address ip-address
  4. exit
  5. interface vlan vlan-id
  6. ip address ip-address
  7. no mop enabled
  8. no mop sysid
  9. exit
  10. ip dhcp excluded-address ip-address
  11. ip dhcp pool pool-name
  12. network network-name mask-address
  13. default-router ip-address
  14. exit
  15. wireless profile policy profile-policy
  16. central association
  17. central switching
  18. description policy-proile-name
  19. ipv4 dhcp opt82
  20. ipv4 dhcp opt82 ascii
  21. ipv4 dhcp opt82 format vlan_id
  22. ipv4 dhcp opt82 rid vlan_id
  23. ipv4 dhcp server ip-address
  24. vlan vlan-name
  25. no shutdown

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

interface loopback interface-number

Example:

Device(config)# interface Loopback0

Creates a loopback interface and enters interface configuration mode.

Step 3

ip address ip-address

Example:

Device(config-if)# ip address 10.10.10.1 255.255.255.255

Configures the IP address for the interface.

Step 4

exit

Example:

Device(config-if)# exit

Exits interface configuration mode.

Step 5

interface vlan vlan-id

Example:

Device(config)# interface vlan 32

Configures the VLAN ID.

Step 6

ip address ip-address

Example:

Device(config-if)# ip address 192.168.32.100 255.255.255.0

Configures the IP address for the interface.

Step 7

no mop enabled

Example:

Device(config-if)# no mop enabled

Disables the Maintenance Operation Protocol (MOP) for an interface.

Step 8

no mop sysid

Example:

Device(config-if)# no mop sysid

Disables the task of sending MOP periodic system ID messages.

Step 9

exit

Example:

Device(config-if)# exit

Exits interface configuration mode.

Step 10

ip dhcp excluded-address ip-address

Example:

Device(config)# ip dhcp excluded-address 192.168.32.100

Specifies the IP address that the DHCP server should not assign to DHCP clients.

Step 11

ip dhcp pool pool-name

Example:

Device(config)# ip dhcp pool pool-vlan32

Configures the DHCP pool address.

Step 12

network network-name mask-address

Example:

Device(dhcp-config)# network 192.168.32.0 255.255.255.0

Specifies the network number in dotted-decimal notation along with the mask address.

Step 13

default-router ip-address

Example:

Device(dhcp-config)# default-router 192.168.32.1

Specifies the IP address of the default router for a DHCP client.

Step 14

exit

Example:

Device(dhcp-config)# exit

Exits DHCP configuration mode.

Step 15

wireless profile policy profile-policy

Example:

Device(config)# wireless profile policy default-policy-profile

Configures a WLAN policy profile and enters wireless policy configuration mode.

Step 16

central association

Example:

Device(config-wireless-policy)# central association

Configures central association for locally switched clients.

Step 17

central switching

Example:

Device(config-wireless-policy)# central switching

Configures local switching.

Step 18

description policy-proile-name

Example:

Device(config-wireless-policy)# description "default policy profile"

Adds a description for the policy profile.

Step 19

ipv4 dhcp opt82

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82

Enables DHCP Option 82 for the wireless clients.

Step 20

ipv4 dhcp opt82 ascii

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82 ascii

Enables ASCII on DHCP Option 82.

Step 21

ipv4 dhcp opt82 format vlan_id

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82 format vlan32

Enables VLAN ID.

Step 22

ipv4 dhcp opt82 rid vlan_id

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82 rid

Supports the addition of Cisco 2-byte Remote ID (RID) for DHCP Option 82.

Step 23

ipv4 dhcp server ip-address

Example:

Device(config-wireless-policy)#  ipv4 dhcp server 10.10.10.1

Configures the WLAN's IPv4 DHCP server.

Step 24

vlan vlan-name

Example:

Device(config-wireless-policy)# vlan 32

Assigns the profile policy to the VLAN.

Step 25

no shutdown

Example:

Device(config-wireless-policy)# no shutdown

Enables the wireless profile policy.

Configuring the Internal DHCP Server Globally (CLI)

SUMMARY STEPS

  1. configure terminal
  2. interface loopback interface-num
  3. ip address ip-address
  4. exit
  5. interface vlanvlan-id
  6. ip address ip-address
  7. no mop enabled
  8. no mop sysid
  9. exit
  10. ip dhcp-server ip-address
  11. ip dhcp excluded-address ip-address
  12. ip dhcp pool pool-name
  13. network network-name mask-address
  14. default-router ip-address
  15. exit
  16. wireless profile policy profile-policy
  17. central association
  18. central dhcp
  19. central switching
  20. description policy-proile-name
  21. vlan vlan-name
  22. no shutdown

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

interface loopback interface-num

Example:

Device(config)# interface Loopback0

Creates a loopback interface and enters interface configuration mode.

Step 3

ip address ip-address

Example:

Device(config-if)# ip address 10.10.10.1 255.255.255.255

Configures the IP address for the interface.

Step 4

exit

Example:

Device(config-if)# exit

Exits interface configuration mode.

Step 5

interface vlanvlan-id

Example:

Device(config)# interface vlan 32

Configures the VLAN ID.

Step 6

ip address ip-address

Example:

Device(config-if)# ip address 192.168.32.100 255.255.255.0

Configures the IP address for the interface.

Step 7

no mop enabled

Example:

Device(config-if)# no mop enabled

Disables the Maintenance Operation Protocol (MOP) for an interface.

Step 8

no mop sysid

Example:

Device(config-if)# no mop sysid

Disables the task of sending the MOP periodic system ID messages.

Step 9

exit

Example:

Device(config-if)# exit

Exits the interface configuration mode.

Step 10

ip dhcp-server ip-address

Example:

Device(config)# ip dhcp-server 10.10.10.1

Specifies the target DHCP server parameters.

Step 11

ip dhcp excluded-address ip-address

Example:

Device(config)# ip dhcp excluded-address 192.168.32.100

Specifies the IP address that the DHCP server should not assign to DHCP clients.

Step 12

ip dhcp pool pool-name

Example:

Device(config)# ip dhcp pool pool-vlan32

Configures the DHCP pool address.

Step 13

network network-name mask-address

Example:

Device(dhcp-config)# network 192.168.32.0 255.255.255.0

Specifies the network number in dotted-decimal notation along with the mask address.

Step 14

default-router ip-address

Example:

Device(dhcp-config)# default-router 192.168.32.1

Specifies the IP address of the default router for a DHCP client.

Step 15

exit

Example:

Device(dhcp-config)# exit

Exits DHCP configuration mode.

Step 16

wireless profile policy profile-policy

Example:

Device(config)# wireless profile policy default-policy-profile

Configures a WLAN policy profile and enters wireless policy configuration mode.

Step 17

central association

Example:

Device(config-wireless-policy)# central association

Configures central association for locally switched clients.

Step 18

central dhcp

Example:

Device(config-wireless-policy)# central dhcp

Configures central DHCP for locally switched clients.

Step 19

central switching

Example:

Device(config-wireless-policy)# central switching

Configures local switching.

Step 20

description policy-proile-name

Example:

Device(config-wireless-policy)# description "default policy profile"

Adds a description for the policy profile.

Step 21

vlan vlan-name

Example:

Device(config-wireless-policy)# vlan 32

Assigns the profile policy to the VLAN.

Step 22

no shutdown

Example:

Device(config-wireless-policy)# no shutdown

Enables the profile policy.

Verifying Internal DHCP Configuration

To verify client binding, use the following command:

Device# show ip dhcp binding 

Bindings from all pools not associated with VRF:
IP address      Client-ID/              Lease expiration        Type       State      Interface
                Hardware address/
                User name
192.168.32.3    0130.b49e.491a.53       Mar 23 2018 06:42 PM    Automatic  Active     Loopback0

To verify the DHCP relay statistics for a wireless client, use the following command:

Device# show wireless dhcp relay statistics 

DHCP Relay Statistics
---------------------

DHCP Server IP :   10.10.10.1

Message              Count
--------------------------
DHCPDISCOVER      :  1
BOOTP FORWARD     :  137
BOOTP REPLY       :  0
DHCPOFFER         :  0
DHCPREQUEST       :  54
DHCPACK           :  0
DHCPNAK           :  0
DHCPDECLINE       :  0
DHCPRELEASE       :  0
DHCPINFORM        :  82

Tx/Rx Time :
------------
LastTxTime : 18:42:18
LastRxTime : 00:00:00

Drop Counter :
-------------
TxDropCount : 0

To verify the DHCP packet punt statistics in CPP, use the following command:

Device# show platform hardware chassis active qfp feature wireless punt statistics 

CPP Wireless Punt stats:

                                 App Tag     Packet Count
                                 -------     ------------
         CAPWAP_PKT_TYPE_DOT11_PROBE_REQ            14442
              CAPWAP_PKT_TYPE_DOT11_MGMT               50
              CAPWAP_PKT_TYPE_DOT11_IAPP             9447
              CAPWAP_PKT_TYPE_DOT11_RFID                0
               CAPWAP_PKT_TYPE_DOT11_RRM                0
             CAPWAP_PKT_TYPE_DOT11_DOT1X                0
        CAPWAP_PKT_TYPE_CAPWAP_KEEPALIVE             2191
      CAPWAP_PKT_TYPE_MOBILITY_KEEPALIVE                0
            CAPWAP_PKT_TYPE_CAPWAP_CNTRL             7034
             CAPWAP_PKT_TYPE_CAPWAP_DATA                0
          CAPWAP_PKT_TYPE_MOBILITY_CNTRL                0
                         WLS_SMD_WEBAUTH                0
                       SISF_PKT_TYPE_ARP             5292
                      SISF_PKT_TYPE_DHCP              140
                     SISF_PKT_TYPE_DHCP6             1213
                   SISF_PKT_TYPE_IPV6_ND              350
                SISF_PKT_TYPE_DATA_GLEAN               44
             SISF_PKT_TYPE_DATA_GLEAN_V6               51
                SISF_PKT_TYPE_DHCP_RELAY              122
         CAPWAP_PKT_TYPE_CAPWAP_RESERVED                0

Configuring FlexConnect DHCP-Required (CLI)

Perform the procedure given below to configure FlexConnect DHCP-Required through the CLI:

SUMMARY STEPS

  1. configure terminal
  2. wireless profile policy profile-policy
  3. ipv4 dhcp required
  4. no shutdown

DETAILED STEPS

  Command or Action Purpose

Step 1

configure terminal

Example:

Device#configure terminal

Enters global configuration mode.

Step 2

wireless profile policy profile-policy

Example:

Device#wireless profile policy rr-xyz-policy-1

Configures WLAN policy profile and enters the wireless policy configuration mode.

Step 3

ipv4 dhcp required

Example:

Device(config-wireless-policy)#ipv4 dhcp required

Enables the FlexConnect DHCP-Required feature.

Step 4

no shutdown

Example:

Device(config-wireless-policy)#no shutdown

Saves the configuration.

Verifying FlexConnect DHCP-Required

  • To verify the IP address learnt for a client on an IP DHCP-Required policy-enabled WLAN, use the show wireless client summary command:


    Note

    The controller or AP does not learn the IP address through other means such as ARP or data gleaning, when IPv4 DHCP-Required is enabled. 

    Device# show wireless client summary 
Number of Clients: 1
MAC Address         AP Name           Type  ID  State         Protocol     Method     Role
-------------------------------------------------------------------------------------------------------------------------
1cXX.bXXX.59XX      APXXXX.7XXX.4XXX  WLAN  3   IP Learn      11ac         Dot1x      Local

  • This example shows that the client IP is in the Run state, indicating that the client has received the IP address from DHCP: 

    Device# show wireless client summary 
Number of Clients: 1
MAC Address       AP Name             Type       ID       State        Protocol       Method      Role
-------------------------------------------------------------------------------------------------------------------------
5XXX.37XX.c3XX    APXXXX.4XXX.4XXX    WLAN        3        Run         11n(5)         None        Local

Configuring DHCP for WLANs (GUI)

Configuring DHCP Scopes (GUI)

Procedure

Step 1

Choose Administration > DHCP Pools.

Step 2

In the Pools section, click Add to add a new DHCP pool.

The Create DHCP Pool dialog box is displayed.

Step 3

In the DHCP Pool Name field, enter a name for the new DHCP pool.

Step 4

From the IP Type drop-down list, choose the IP address type.

Step 5

In the Network field, enter the network served by this DHCP scope. This IP address is used by the management interface with netmask applied, as configured in the Interfaces window.

Step 6

In the Subnet Mask field, enter the subnet mask assigned to all the wireless clients.

Step 7

In the Starting ip field, enter the starting IP address.

Step 8

In the Ending ip field, enter the trailing IP address.

Step 9

In the Reserved Only field, enable or disable it.

Step 10

From the Lease drop-down list, choose the lease type as either User Defined or Never Expires. If you choose User Defined, you can enter the amount of time that an IP address is granted to a client.

Step 11

To perform advanced configuration for DHCP scope, click Advanced.

Step 12

Check the Enable DNS Proxy check box to enable DNS proxy.

Step 13

In the Default Router(s) field, enter the IP address of the optional router or routers that connect to the device and click the + icon to add them to the list. Each router must include a DHCP forwarding agent that enables a single device to serve the clients of multiple devices.

Step 14

In the DNS Server(s) field, enter the IP address of the optional DNS server or servers and click the + icon to add them to the list. Each DNS server must be able to update a client’s DNS entry to match the IP address assigned by the DHCP scope.

Step 15

In the NetBios Name Server(s) field, enter the IP address of the optional Microsoft NetBIOS name server or servers, such as Microsoft Windows Internet Naming Service (WINS) server, and click the + icon to add them to the list.

Step 16

In the Domain field, enter the optional domain name of the DHCP scope for use with one or more DNS servers.

Step 17

To add DHCP options, click Add in the DHCP Options List section. DHCP provides an internal framework for passing configuration parameters and other control information, such as DHCP options, to the clients on your network. DHCP options carry parameters as tagged data stored within protocol messages exchanged between the DHCP server and its clients.

Step 18

Enter the DHCP option that you want to add.

Step 19

Click Save & Apply to Device.

Configuring the Internal DHCP Server Under Client VLAN SVI (GUI)

Procedure

Step 1

Choose Configuration > Layer2 > VLAN > SVI.

Step 2

Click an SVI.

Step 3

Click the Advanced tab.

Step 4

Under DHCP Relay settings, enter the IPV4 Helper Address.

Step 5

Click Update & Apply to Device.

Configuring the Internal DHCP Server Under a Wireless Policy Profile (GUI)

Procedure

Step 1

Choose Configuration > Tags & Profiles > Policy.

Step 2

Click a policy name.

Step 3

Click the Advanced tab.

Step 4

Under DHCP settings, check or uncheck the IPv4 DHCP Required check box and enter the DHCP Server IP Address.

Step 5

Click Update & Apply to Device.

Configuring the Internal DHCP Server Globally (GUI)

Procedure

Step 1

Choose Administration > DHCP Pools > Pools.

Step 2

Click Add.

The Create DHCP Pool window is displayed.

Step 3

Enter the DHCP Pool Name, Network, Starting ip, and Ending ip.

Step 4

From the IP Type, Subnet Mask, and Lease drop-down lists, choose a value.

Step 5

Click the Reserved Only toggle button.

Step 6

Click Apply to Device.

Configuring FlexConnect DHCP-Required (GUI)

Perform the steps given below to configure the FlexConnect DHCP-Required feature through the GUI:

Procedure

Step 1

Choose Configuration > Tags & Profiles > Policy.

Step 2

On the Policy window, click the name of the corresponding Policy Profile.

The Edit Policy Profile window is displayed.

Step 3

Click the Advanced tab.

Step 4

In the DHCP section, check the IPv4 DHCP Required check box to enable the feature.

Step 5

Click Update & Apply to Device.