topic Re: Dynamic VLAN assignment based on different AD attributes in Network Access Control https://community.cisco.com/t5/network-access-control/dynamic-vlan-assignment-based-on-different-ad-attributes/m-p/1636617#M244263 <HTML><HEAD></HEAD><BODY><P>Under ACS 5.1 this is almost certainly possible - Under 4.2..... hmm I don't think so.</P><P>However, as AD users can be member of multiple groups is there any reason why your 2000 users on your new site can't have a number of AD security groups created, which you can then map against ACS group to give you your configuration basis for VLAN overrides?</P><P></P><P>So assuming your new users are in one AD group called Users. There is no technical reason they could not also be part of a group called GroundFloorUsers, FirstFloorUsers and so on.&nbsp; Then you can map GroundFloorUsers to a new ACS group and input the VLAN override details.</P><P></P><P>You could have used LDAP as an authentication request as a second external database which you can map against different ACS groups but I am pretty sure this configuration doesn't support 802.1x (only PAP/ASCII type requests)</P><P></P><P>Paul</P></BODY></HTML> Sat, 19 Mar 2011 00:51:43 GMT pablo1711 2011-03-19T00:51:43Z Dynamic VLAN assignment based on different AD attributes https://community.cisco.com/t5/network-access-control/dynamic-vlan-assignment-based-on-different-ad-attributes/m-p/1636616#M244231 <P>Hi ALL,<BR />We use dynamic VLAN assignment with 802.1x&amp;ACS&amp;AD. ACS assign VLAN to user based on User Group in AD.<BR />Now we need to install new site with 2000 users. However most of those users belong to single User Group in AD.<BR />So in this enviroment we unable to use current logic because all users will have to be in single VLAN.<BR /><STRONG>Is there any way to allocate users in different VLANs and make VLAN assignment based on other AD attributes, except User Group? Or make some kind of load balancing in ACS?</STRONG><BR />ACS version we use is 4.2.</P> Mon, 11 Mar 2019 00:53:31 GMT https://community.cisco.com/t5/network-access-control/dynamic-vlan-assignment-based-on-different-ad-attributes/m-p/1636616#M244231 devyatkin 2019-03-11T00:53:31Z Re: Dynamic VLAN assignment based on different AD attributes https://community.cisco.com/t5/network-access-control/dynamic-vlan-assignment-based-on-different-ad-attributes/m-p/1636617#M244263 <HTML><HEAD></HEAD><BODY><P>Under ACS 5.1 this is almost certainly possible - Under 4.2..... hmm I don't think so.</P><P>However, as AD users can be member of multiple groups is there any reason why your 2000 users on your new site can't have a number of AD security groups created, which you can then map against ACS group to give you your configuration basis for VLAN overrides?</P><P></P><P>So assuming your new users are in one AD group called Users. There is no technical reason they could not also be part of a group called GroundFloorUsers, FirstFloorUsers and so on.&nbsp; Then you can map GroundFloorUsers to a new ACS group and input the VLAN override details.</P><P></P><P>You could have used LDAP as an authentication request as a second external database which you can map against different ACS groups but I am pretty sure this configuration doesn't support 802.1x (only PAP/ASCII type requests)</P><P></P><P>Paul</P></BODY></HTML> Sat, 19 Mar 2011 00:51:43 GMT https://community.cisco.com/t5/network-access-control/dynamic-vlan-assignment-based-on-different-ad-attributes/m-p/1636617#M244263 pablo1711 2011-03-19T00:51:43Z