https://community.cisco.com/t5/network-access-control/separation-by-realm/m-p/4405618#M567396 <P>You can return different VLAN ID for external clients from ISE and add it (with another subnet) &nbsp;to the WLC interfaces.</P> Wed, 19 May 2021 18:57:25 GMT Peter Koltl 2021-05-19T18:57:25Z https://community.cisco.com/t5/network-access-control/separation-by-realm/m-p/4404270#M567338 <P>We as an institution have Eduraom implemented, but we want separation of internal user vs external users that come from different institutions and give lesser access to external users.</P><P>&nbsp;</P><P>Both internal and external client joins the eduroam network get the IP and then are authenticated/authorized by ISE.</P><P>&nbsp;</P><P>Gateway for Eduroam SSID is a firewall. Would it be possible to assign external users a different IP range than internal or is there some other way I should be looking at separating internal and external users.</P><P>&nbsp;</P> Mon, 17 May 2021 19:54:12 GMT https://community.cisco.com/t5/network-access-control/separation-by-realm/m-p/4404270#M567338 raj-toor 2021-05-17T19:54:12Z https://community.cisco.com/t5/network-access-control/separation-by-realm/m-p/4405618#M567396 <P>You can return different VLAN ID for external clients from ISE and add it (with another subnet) &nbsp;to the WLC interfaces.</P> Wed, 19 May 2021 18:57:25 GMT https://community.cisco.com/t5/network-access-control/separation-by-realm/m-p/4405618#M567396 Peter Koltl 2021-05-19T18:57:25Z