topic Another way to determine in Network Access Control

ISE - Network Devices - Split larger IP range into smaller ones

dal — Mon, 11 Mar 2019 05:47:21 GMT

Hi.

We have several businesses, each of them have assigned a class B subnet, for example 172.21.xx /16, 172.27.xx /16, etc.

But each business has several locations, that normally has a class C subnet assigned to it

This is a structure I would very much like to build in ISE also.
This is very practical when making authorization profiles and you need to pinpoint where the customer are trying to access the WIFI. You know, to assign the correct VLAN, etc.

But when I try to do just that, I get this error:
Failed to create network device - given IP subnet overlaps with existing network device: Business1.

Why oh why?

Is there a way around this? If not, PLEASE implement this feature!

It was no problem doing this in ACS, so why should it be a problem here?

Thanks,

Another way to determine

M. Wisely — Mon, 08 Jun 2015 15:16:51 GMT

Another way to determine where the wifi client is located is to use a nas-identifier which you can specify on an AP group or WLAN (by default it's the WLC name) and you can use rules in ISE that make use of the nas-identifier radius attribute. The disadvantages with NAS-Identifier is that you have to configure the AP group nas identifier on the WLC, it cannot be done by template from PI and you cannot do a report in ISE using a nas identifier.

Hello.This is an excellent

dal — Mon, 08 Jun 2015 15:29:19 GMT

Hello.

This is an excellent tip! I was not aware of this, and I will try it out for sure. If it works as intended, it will solve my problem.
It would of course be easier to split the subnet, I cannot understand why this is not possible.

But I guess that is a feature we have to wait for, and I need a solution now.

Doing it from the WLC's is OK, since I have trouble assigning AP's into AP Groups made in PI anyway (from PI, not in the WLC's)

Thanks again, I will let you know how it turned out.

you can also have a option of

Venkatesh Attuluri — Thu, 11 Jun 2015 10:53:29 GMT

you can also have a option of location to group NAD

Hello.Thanks for the tip.But

dal — Mon, 15 Jun 2015 18:58:45 GMT

Hello.

Thanks for the tip.

But how do I do that, exactly?

Thanks.

This worked like a charm! :

dal — Tue, 25 Aug 2015 09:36:53 GMT

This worked like a charm! 🙂

Thanks again.

I add all my NADs with a /32

phosawyer — Wed, 02 Sep 2015 10:28:02 GMT

I add all my NADs with a /32 address to limit auth access. I also add them to a group and then use the group in my authz rules.