In short
A wireless LAN controller (WLC) manages many access points as one network. Choose a hardware controller (Cisco Catalyst 9800 or CW9800, HPE Mist Edge for tunnelling), the controller built into a FortiGate firewall, or a cloud portal. Cisco needs a licence per AP, not per controller. We size, quote and can install.
Shop network hardware
Add products and licences to your basket, then check out when you are ready.
What a wireless LAN controller does
Once a site has more than a few access points, configuring each one on its own stops working. A controller (or a cloud platform doing the same job) gives you:
- One configuration for every access point: networks (SSIDs), security, VLANs and guest access set once.
- Roaming between access points without dropping calls or sessions.
- Radio management: channel and power settings tuned automatically so neighbouring APs do not interfere.
- Monitoring: which devices are connected where, and what is going wrong when someone complains.
- Optionally, traffic tunnelling: some designs send wireless traffic back to the controller, which suits guest networks and larger campuses.
Three ways to run on-premises Wi-Fi
| Approach | Examples in this shop | Good for | What you license |
|---|---|---|---|
| Hardware wireless controller | Cisco Catalyst 9800-L, CW9800L, CW9800M, CW9800H1/H2 | Campuses and sites that want control on premises, from a few dozen to thousands of APs | Cisco: a licence per access point (DNA or Networking Subscription); none to boot the controller |
| Controller built into the firewall | Every FortiGate firewall, with FortiAP | Offices that already secure the internet edge with a FortiGate | Fortinet: "does not require any additional licensing"; FortiCare per AP optional |
| Cloud management | HPE Aruba Networking Central, HPE Mist, WatchGuard Cloud, FortiManagement Cloud | Multi-site businesses with little IT on each site | A per-AP cloud subscription |
HPE Mist adds an on-premises appliance for designs that tunnel traffic: HPE says "The Juniper Mist Edge is a standalone appliance that you can use to eliminate the need for legacy wireless controllers in campus deployments." The ME-X2-M supports up to 2,000 access points and the ME-X6 up to 5,000 (HPE hardware guides); both are on the HPE Mist access points page.
Compare, then add to your basket
Every product in our shop lists its order codes and licences, ready to add.
Cisco Catalyst 9800 and CW9800 controllers
Cisco's on-premises controllers scale from the CW9800L ("up to 500 Access Points (APs) and 10,000 clients") through the CW9800M (up to 3,000 APs and 32,000 clients) to the CW9800H1 and H2 (up to 6,000 APs and 64,000 clients). The Catalyst 9800-L remains on sale for smaller sites.
Cisco's licence rule is the one that surprises buyers: "No licenses are required to boot up a CW9800 wireless controller. However, to connect any access points to the controller, either a Cisco DNA software subscription or Cisco Networking subscription is required." The licence is bought per access point, with the APs. Every model, the C9800 vs CW9800 comparison and the accessories are on Cisco wireless controllers; add Cisco Catalyst Center to manage wired and wireless together.
The FortiGate wireless controller
Fortinet's Wireless Product Matrix says: "The FortiGate Wireless Controller is built into all FortiGate models and does not require any additional licensing to use." FortiAP access points are configured from the FortiGate itself, from a FortiGate VM, from FortiSASE or from FortiManagement Cloud (formerly FortiEdge Cloud), so Wi-Fi and firewall policy sit in one place.
The number of access points a FortiGate can manage depends on the model; Fortinet lists it in each FortiGate data sheet, and we size it at quote. See FortiAP access points and the Fortinet Security Fabric. FortiManager and FortiAnalyzer are management and logging platforms rather than wireless controllers; they are on FortiManager and FortiAnalyzer.
Not sure what you need?
Tell us about your sites and we will recommend the right kit and licences.
Wireless managed from a vendor portal
Cloud platforms do the controller's job from a web portal, with nothing to rack on site:
- HPE Aruba Networking Central: HPE says it "provides two primary subscription tiers: Foundation and Advanced".
- HPE Mist: access points "work in conjunction with the HPE Mist Cloud and HPE Mist AI" (HPE), with Wireless Assurance on every AP.
- WatchGuard Cloud: WatchGuard access points are "managed end to end in WatchGuard Cloud".
- FortiManagement Cloud: Fortinet's SaaS option for FortiAP, FortiSwitch and FortiGate devices.
Cisco Meraki is the Cisco cloud option; it is on our sister store, see cloud managed Wi-Fi (opens in a new tab).
Embedded Wireless Controller and older controllers
Cisco's Embedded Wireless Controller (EWC) let a Catalyst 9100 Wi-Fi 6 access point act as the controller for up to 50 APs. Cisco's data sheet says "Embedded Wireless Controller functionality is not supported on the Wi-Fi 6E Access Points", and the EWC-capable indoor Wi-Fi 6 models have a last order date of 31 Dec 2026 (EOL15855), so for new sites we suggest a CW9800L or one of the cloud options instead.
The Catalyst 9800-40 and 9800-80 appliances reached end of sale on 31 Dec 2025, with support until 31 Dec 2030; Cisco's notice EOL15034 names the CW9800M as the replacement for the 9800-40 and the CW9800H1 and CW9800H2 for the 9800-80. If you are replacing an older controller, send us the model and AP count.
Controllers by range
| Range | Vendor | Models | Examples |
|---|---|---|---|
| Cisco Catalyst 9800 and CW9800 wireless controllers | Cisco | 6 | C9800-L, CW9800L, CW9800M, CW9800H1, CW9800H2, CW9800H1-MCG |
| HPE Mist Edge | HPE Networking | 3 | ME-X2-M, ME-X6, ME-VM |
How to order a wireless controller
How ordering works. Press Add next to a part number and it goes into your basket; where the hardware needs a subscription or support term, you pick it in the same step. Add mounts, injectors and accessories, then View basket and Request a quote. We check every line, quantity and term against your site and come back with a personalised quote by email. Nothing is charged online. We can also design, supply, stage, install and configure the wireless network as a project, with the scope confirmed at quote (see network installation).
Contact us with your access point count, sites and whether you want traffic tunnelled, and we will suggest the controller and licences together.
How we can help with your network
Forever Systems can design, supply, stage, install and configure the network around the hardware you buy here, as a project or one step at a time.
- Design: we look at your sites, users and existing kit and size the switches, wireless and firewalls to fit
- Supply: every order gets a personalised quote by part number, with the subscriptions and support each product needs
- Stage: we can pre-configure and label equipment before it reaches site
- Install: we can rack and mount switches, access points and firewalls on site
- Configure: VLANs, wireless, firewall policy, VPNs and management platforms set up and documented at handover
Scope is confirmed at quote, so you only pay for the parts of the project you need.
Frequently asked questions
What is a wireless LAN controller?
A device or service that manages many access points as one network: configuration, security, roaming, radio tuning and monitoring. It can be a hardware appliance, built into a firewall, or a cloud platform.
Do I need a wireless controller?
With more than a few access points, yes, or a cloud platform that does the same job. FortiGate firewalls include one, and HPE Mist, HPE Aruba Networking Central and WatchGuard Cloud do it from the cloud.
Does a Cisco 9800 controller need a licence?
Not to boot. Cisco says connecting access points needs a Cisco DNA software subscription or Cisco Networking Subscription, bought per access point with the APs.
Does the FortiGate wireless controller cost extra?
Fortinet says the FortiGate Wireless Controller is built into all FortiGate models and does not require any additional licensing. FortiCare support for each FortiAP is optional.
What replaces the Cisco 9800-40 and 9800-80?
Both reached end of sale on 31 Dec 2025. Cisco's notice EOL15034 names the CW9800M for the 9800-40 and the CW9800H1 or CW9800H2 for the 9800-80; we confirm the right model from your AP and client counts.
Ready to order?
Build your basket and check out when you are ready.