topic Re: Vlan precedence in Network Access Control

Vlan precedence

ramziabdelhak — Wed, 16 Aug 2023 09:00:30 GMT

Hello,

On a C9300L switch, i have interface with ISE Dot 1 x configuration, what i want is that the statically assigned vlan using " switchport Access vlan XX" takes precedence over the vlan pushed by the ISE after a succesfull authentication,

For now, the ISE assigned vlan takes effect,

is there a solution ?

Thanks in advance

Re: Vlan precedence

Rob Ingram — Wed, 16 Aug 2023 09:10:45 GMT

@ramziabdelhak you should modify your ISE authorisation rules to not push down the VLAN to the switch as this takes presedence over the statically assigned VLAN.

Re: Vlan precedence

ramziabdelhak — Wed, 16 Aug 2023 09:17:19 GMT

Thanks for the reply,

But this type of configuration has already worked with 3750 Switch serie, do you it is purhaps a deprectated behaviour ?

Thnks

Re: Vlan precedence

Rob Ingram — Wed, 16 Aug 2023 09:57:15 GMT

@ramziabdelhak sorry, not sure, that's not my experience.

Why do you need to send a dynamic VLAN assignment if you do not wish to use it? You can modify your ISE authorisation rules to send (or not send) a dynamic VLAN depending on the NAD group, connected user etc.

Re: Vlan precedence

ramziabdelhak — Wed, 16 Aug 2023 10:09:32 GMT

Hi @Rob Ingram

On the ISE, there a bunch of policies that apply to hundreds of users, and only 20-30 of them needs a special vlan; so instead of creating a new policy for them, we assign it statically on there interfaces.

Re: Vlan precedence

Rob Ingram — Wed, 16 Aug 2023 10:18:26 GMT

@ramziabdelhak sure ok, create a group (or a couple of groups) for those 20-30 users, create an new authorisation rule(s) above the existing rule(s) and match against the group of users and push the dynamic VLAN. Then on the existing rules remove the dynamic VLAN.

Re: Vlan precedence

ramziabdelhak — Wed, 16 Aug 2023 11:08:19 GMT

@Rob Ingram Thank you, i think it is a more scalabale solution,

Nevertheless, i realy want to know why this behavious was once supported by the 3750x,

Thanks again Rob

Re: Vlan precedence

Peter Koltl — Thu, 17 Aug 2023 07:05:45 GMT

Probably the dynamic VLAN will not be applied on this switch if the

aaa authorization network ... group RADIUSxxxx

command is removed. But it may have other effects.

Re: Vlan precedence

ramziabdelhak — Thu, 17 Aug 2023 14:50:03 GMT

Hi @Peter Koltl

That would not be possible since removing this command will desable AAA authorization on the switch as a whole,

Thanks for your help