topic Re: Options for wireless access lists in Network Access Control

Options for wireless access lists

chad.drier — Thu, 16 Jan 2020 19:43:36 GMT

Hello Community, Currently we are using Airespace access lists in ISE and using local mode instead of centrally switched. Our cisco rep told us that we shouldn't use airespace access lists and these should be using dacls instead. Everything I have read for wireless, you should use airespace and dacls are for wired.

Is this not true? Are there other ways to deploy access lists when using wireless locally switched?

Thank you!

Re: Options for wireless access lists

Colby LeMaire — Thu, 16 Jan 2020 20:03:37 GMT

That is correct. AFAIK, dACL's are not supported on the wireless side yet. You have to create the named ACL's on the controller and then you can reference them by name in your ISE policies.

Re: Options for wireless access lists

Mike.Cifelli — Thu, 16 Jan 2020 20:22:02 GMT

@Colby LeMaire is right. I have been going through deploying wireless in our enterprise over the last few weeks. We have 5520 WLCs with ~45 APs. On the WLC setup your ACLs under:Security->Access Control Lists. Then in the authz profile you intend to use reference them via airespace acl name. Make sure on WLC side your AAA servers, override etc. are configured properly.

Re: Options for wireless access lists

Greg Gibbs — Thu, 16 Jan 2020 21:21:20 GMT

While this is true for the 5500 series, it is entirely dependent on the WLC OS.

The most widely deployed WLC models (5500, 2500, 3500) are built on the AireOS and would require Airespace ACLs, but some models are build on IOS-XE. The IOS-XE models like the 5700 series do support downloadable ACLs.

The new Catalyst 9800 series WLCs are also built on IOS-XE and support the use of dACLs as shown in this ISE and Catalyst 9800 Series Integration Guide

Cheers,

Greg

Re: Options for wireless access lists

chad.drier — Fri, 17 Jan 2020 15:06:59 GMT

Thanks @Greg Gibbs for the great information. This makes a lot of sense because we are currently on the 2504/5508 but we will be migrating to the Catalyst 9800 series WLCs. Thank you!