topic Re: ISE Guest User get different vlans in Network Access Control

ISE Guest User get different vlans

azhar_eaggle1 — Tue, 11 Dec 2018 22:14:55 GMT

can 2 groups of Guest users have/gets 2 different vlan on Same SSID ?

we will have executive Guest with Internal Username/password on ISE and wants to have Vlan X,

while other Guest with Sponsor Access will get Vlan Y.

is that Possible ? if yes, how

Re: ISE Guest User get different vlans

Surendra — Wed, 12 Dec 2018 13:25:52 GMT

Yes you can. Here is a similar discussion.

https://community.cisco.com/t5/other-wireless-mobility-subjects/single-ssid-with-multiple-vlans/td-p/1496917

Re: ISE Guest User get different vlans

Jason Kunst — Wed, 12 Dec 2018 13:39:52 GMT

Assuming this is for wireless? If wired there is already a posting for that

Recommend looking over the prescriptive guest guide under http://cs.co/ise-guest for more information

Although it can be done it’s not recommended for an open network since there is no supplicant to switch networks. The machine wouldn’t know if the user switched vlans

If you have guest users with different guest types then they can be authorized differently . These would need to be sponsored guests otherwise there is no easy way to give them different guest types (separate discussion)

All users connect to guest network on same vlan
Userx connects to guest portal and logs in as guest typeX
authorization rule redirects to a hotspot portalX And puts device into endpoint group X
Device is disconnected and now authorized by endpoint groupX with different vlan assignment

Instead of doing reassignment on endpoint groups you could set a low DHCP timer on your initial vlan and not use endpoint groups
But this is a clunky mechanism. After user logs in there might be delay where they don’t have access for a time. Initial login 30 seconds later dhcp tuner after they login switching vlan

Another way to do this is to have users use dot1x so supplicant takes care of vlan changes

Recommendation is to use segmentation with SGTs more info in guest guide

Re: ISE Guest User get different vlans

azhar_eaggle1 — Thu, 13 Dec 2018 02:09:54 GMT

Yes, this is for Wireless. on one SSID. we have different guest groups, and wants to assign them different Vlans.

Re: ISE Guest User get different vlans

Jason Kunst — Thu, 13 Dec 2018 02:21:52 GMT

Ok my guidance stands