I made the chances and so far I'm happy with the results.
We have 4 WLANs - student (student owned devices), staff, managed (university owned devices, but used by students) and guest. The previous network admin has built AP groups for some of the individual buildings on campus. Some buildings were part of the default group. The APs in some buildings were in the AP group for another building. Some of those AP groups had their own dedicated vlans (/24 network) and interfaces for each of the wlans. Some used the default. The networks that had exhausted their /24 address space were expanded by using a secondary IP address on the vlan interface, and a DHCP superscope. None of these various superscopes were using sequential /24 networks. It was a mess and it was time to stop patching it and clean it up.
10.3.x.x is the range of addresses/networks reserved for wireless. 10.3.0.0/24 and 10.3.10.0/24 were in use for specialized purposes and would be too difficult to reconfigure. So I started re-subnetting into /22 networks at 10.3.12.0. From there, I broke the /22 networks into groups. 10.3.12.0/22 through 10.3.108.0/22 for the student wlan. 10.3.112.0/22 through 10.3.196.0/22 for the staff wlan. 10.3.200.0/22 through 10.3.204.0/22 for the managed wlan. 10.3.208.0/22 through 10.3.212.0/22 for the guest wlan. And 10.3.216.0 and up available for future use - overflow in the unlikely event one of the other wlans maxes out again, or additional special purpose wlans, etc.
Addresses up through 10.3.45.0/24 were already in use with the original design. So I set up 3 student networks starting with the 10.3.48.0/22 network (create vlans, define routes, configure firewalls, etc). I created a "student-wireless" Interface Group on the WLC and added the interfaces for these networks to it. I built 4 staff networks starting at 10.3.112.0/22 and added them to a "staff-wireless" Interface Group on the WLC. Then one /22 network each for "managed" and "guest." I still created an Interface Group for each of them even though there's only one interface in that each of those "groups." If needed in the future, I can easily drop another interface into that group. Same for all of the wlans. Then I went through the WLC and created an AP Group for each building that didn't already have one. In those, I set up the wlans using the interface groups. On the DHCP server, I set up the scopes for each of those new networks.
This was all done during a maintenance period, but this was as far as I could go without impacting current users, so I went over everything again and verified the configurations and made a new backup (in addition to the one I made before I started making changes).
Then, I deactivated the old DHCP scopes. In the WLC, I put all the APs in their correct AP groups and reconfigured the wlans on the existing AP groups to use the new interface groups. At this point, everything should have been working so I had some guys from User Support go out and about on campus to verify first hand. No problems were reported.
So then I had a lot of cleanup to do. On the WLC, I had to delete the old interfaces, delete the old vlans and interfaces on the core L3 switches and the firewalls, and delete the old DHCP scopes.
Then, I went back and created new networks, routing and firewall rules, WLC interfaces, and DHCP scopes for the student networks using 10.3.12.0/22 through 10.3.44.0/22 and added them to the "student-wireless" interface group in WLC.
Re-verify and re-test. Update documentation. Done!
The process went very smooth and I think that was due to the level of preparation I went through. I created a "script" to follow that outlined every step in detail, pre-wrote my configuration commands so I could just copy and paste to the various devices, etc. The maintenance window was on a Friday, so I took almost the entire week leading up to that to prepare the "script" and review it for omissions or errors.
As I said, I'm very pleased with the results. We have plenty of address space available now for each wlan. Watching the DHCP scopes, they are each around 30% utilized (4 hour lease time). Everything is a lot cleaner and better organized. The next big change is IPv6!