topic Re: Wireless guest in an SD Access network in Network Access Control

Wireless guest in an SD Access network

KevinR99 — Wed, 21 May 2025 22:00:48 GMT

I’ve been testing guest wireless using CWA in an SD Access network. When I configure the SSID as a standard over the top deployment and tunnel the traffic back to the WLC all is ok. However, when I change my SSID to fabric mode redirection to the ISE portal doesn’t work.

I’ve been thinking about the process involved and redirection relies on an ACL on the WLC. Since fabric mode offloads the data at the edge switch that the AP is connected to I’m thinking the WLC doesn’t see that traffic and get a chance to use the WLC to intercept the traffic and cause a redirect to the ISE.

Can anyone advise if CWA can work in a fabric mode SSID?

AThanks, Kev.

Re: Wireless guest in an SD Access network

Greg Gibbs — Thu, 22 May 2025 02:27:02 GMT

Unless I'm mistaken, I think the RADIUS + Redirect flow would happen in the CAPWAP Control Plane. The redirect URL and ACL would be sent from the WLC to the Fabric AP. At the point where the client needs to access the portal, that would be using the VXLAN Data Plane.

If you haven't done so already, you might confirm that whatever VLAN/VN you are dropping the client onto as defined in the AuthZ Profile has routing and connectivity to the PSN Portal.

All else fails, you might have to open a TAC case to investigate further and confirm the flow.

Re: Wireless guest in an SD Access network

Boort — Sun, 25 May 2025 08:03:21 GMT

Sounds like your APs is missing the redirect ACLs. They way this is done in a fabric mode deployment is to add the redirect ACLs to the default flex connect profile or which ever profile you have assigned. Even tho you are not using flexconnect it will still get pushed to the AP.

Re: Wireless guest in an SD Access network

KevinR99 — Tue, 27 May 2025 11:05:57 GMT

Thank you Boort. I've made some progress. My wireless client is now attempting to be redirected.

Still some work to do but progress is being made.

Re: Wireless guest in an SD Access network

Boort — Wed, 28 May 2025 15:46:36 GMT

Great! Glad to help. Is there still problems getting the client authenticated?

Re: Wireless guest in an SD Access network

KevinR99 — Thu, 29 May 2025 08:34:56 GMT

All working now Boort.

Thanks again.