topic Re: Change of VLAN on Wireless Guest in Network Access Control

Change of VLAN on Wireless Guest

umahar — Mon, 23 Apr 2018 15:47:14 GMT

Hi Experts,

Does the endpoint send a new dhcp request after CoA or we face the same limitation as we face in wired where VLAN is changed on the NAD while endpoint remains on the old VLAN IP ?

Re: Change of VLAN on Wireless Guest

Jason Kunst — Mon, 23 Apr 2018 15:55:28 GMT

On open networks the endpoint does not refresh its ip address. You can try a low DHCP lease. For these reasons we don’t recommend IP change.

Re: Change of VLAN on Wireless Guest

Craig Hyps — Mon, 23 Apr 2018 16:33:11 GMT

There is an option in Guest Portal to use applet to trigger DHCP release/renew, but functionality is more focused on workstation platforms and not applicable to mobile devices. Functionality also entails applet which may be blocked by common endpoint security policies.

An alternative would be SGTs to segment pre-post auth traffic, or assignment to a different interface which shares same subnet.

Re: Change of VLAN on Wireless Guest

paul — Mon, 23 Apr 2018 20:40:10 GMT

Craig or Jason,

Doesn't it also depend on the Guest Portal type as well? If the portal is a Hotspot you can set the CoA type to terminate which will cause the client's WiFi to drop and reconnect allowing the VLAN move to work correctly.

Re: Change of VLAN on Wireless Guest

Jason Kunst — Mon, 23 Apr 2018 20:42:41 GMT

Yes you can do that but likely not the case as you’re not separating users and who cares about hotspot users being segregated right?

Also keep in mind if you disconnect some clients (we have seen android) they will have issues reconnecting and may even switch SSID if other OPEN networks are in range

Re: Change of VLAN on Wireless Guest

paul — Mon, 23 Apr 2018 20:45:41 GMT

Yep true enough. I advocate for no VLAN moving as well.