topic Re: 802.1x and Dynamic VLAN deployment for Cisco ISE and Meraki Access Points in Network Access Control

802.1x and Dynamic VLAN deployment for Cisco ISE and Meraki Access Points

SaintEvn — Mon, 21 Jun 2021 10:11:35 GMT

Hi all,

We’ve deployed Cisco ISE in our DC and we planned to control 802.1x wireless access from branch sites. We’ve already configured VPN tunnel between DC and Branches. We would like to configure Dynamic VLAN assignment to the client PCs on branch sites, i.e., we’ve only one SSID and users from different user groups will be assigned to different VLAN when connected to Wi-Fi.

As we are using Meraki Wireless APs on branch sites, it is possible to use dynamic VLAN assignment feature with Cisco ISE?

As for now, we already configure dynamic VLAN feature in our environment, but some endpoints did not get IP assigned although it passed authentication and authorization.

Thank You!

Re: 802.1x and Dynamic VLAN deployment for Cisco ISE and Meraki Access Points

balaji.bandi — Mon, 21 Jun 2021 11:30:59 GMT

I do not believe this solution works, since you have only 1 SSID, that is associated with VLAN aleady.

But with ISE profiling, based on the user Group you can setup the Security profile, what user / end device can access the resources.

As for now, we already configure dynamic VLAN feature in our environment, but some endpoints did not get IP assigned although it passed authentication and authorization.

is this wired or wireless ?

Re: 802.1x and Dynamic VLAN deployment for Cisco ISE and Meraki Access Points

SaintEvn — Mon, 21 Jun 2021 13:28:32 GMT

Dynamic VLAN feature is supported with Cisco WLC right? But with Cisco Meraki , it cannot be work ?

But right now only some endpoints can't get IP address while most endpoints are working Ok. And there is no VLAN tagging enable for SSID at this moment.

We planned to enable 802.1x only for Wireless network.

If this is not a proper solution , we'll deploy with different SSID then.

Re: 802.1x and Dynamic VLAN deployment for Cisco ISE and Meraki Access Points

thomas — Mon, 28 Jun 2021 00:04:41 GMT

Typically your WLAN SSID is associated with a specific VLAN, regardless of the wireless product.

Cisco AireOS WLC with a specific Interface Group mapping to a VLAN:

And in Meraki APs for a given SSID:

Re: 802.1x and Dynamic VLAN deployment for Cisco ISE and Meraki Access Points

Ping Zhou — Wed, 30 Jun 2021 05:38:11 GMT

Have you tried Group Policy with Filter ID or Airespace ACL?

Depends on your AuthZ conditions, you probably can assign different Group Policies to different AuthZ Profiles, each has different Group Policy associated with different VLAN ID.

Here are the docs for your reference. https://documentation.meraki.com/MR/Group_Policies_and_Block_Lists/Using_RADIUS_Attributes_to_Apply_Group_Policies

https://documentation.meraki.com/General_Administration/Cross-Platform_Content/Creating_and_Applying_Group_Policies

Basically you create the several Group Policies with different VLANs on Meraki Dashboard, then creat corresponding AuthZ Profiles on ISE which call the names of the Group Policies.

HTH

Re: 802.1x and Dynamic VLAN deployment for Cisco ISE and Meraki Access Points

Ping Zhou — Wed, 30 Jun 2021 05:51:35 GMT

Looking for “Per User VLAN Tagging”

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/VLAN_Tagging