topic Hi Marvin,Tomorrow morning, I in Network Access Control

Vlan Assignment

tonyp8581 — Mon, 11 Mar 2019 05:28:41 GMT

Hi, presently, I use ISE v1.1.2 to push VLAN by their number id. no issue using this method.

Now, I want to start pushing VLAN by their names. Using this method, the client (wireless) is not placed in the VLAN.

All switches have their VLAN name configured. Has anybody ever used this method with success.

I'm using WLC 7.6.130 with FlexConnect local switching

Thanks !

I've only ever seen VLAN IDs

Marvin Rhoads — Sat, 21 Feb 2015 15:03:37 GMT

I've only ever seen VLAN IDs (numbers) used.

The documentation does say that "both integer and string values are supported for the VLAN ID" but I've never tried doing it that way.

When I think about it, how would ISE know that VLAN "guest" equals VLAN ID 100 (for example)? The command it needs to push to the switch during CoA is "switchport access vlan 100", not "switchport access vlan guest".

Hi Marvin,I've read the same

tonyp8581 — Sat, 21 Feb 2015 20:12:01 GMT

Hi Marvin,

I've read the same document as you. It should be supported. However, bug CSCur89286 mentions that AP model 700 has issues with VLAN using names. But I'm using model 3602.

Your comment does make sense. But I think the name has to be entered in the WLC and switch to make the mapping work. I did configure the switch, but on WLC, nowhere to enter name.

I might have to call Cisco. If I get a definite answer, I will post it.

Thanks !

Tony

Hi Marvin,I was trying to

pemasirid — Fri, 27 Feb 2015 20:58:48 GMT

Hi Marvin,

I was trying to push vlan (dVlan) by ISE policy but it does not work for me. I use the Vlan ID and in the switch I can see the vlan is pushed to the ports (show auth sen int gix/x, in vlan policy, see attached). however the client's IP is not changing with new vlan and its still gets the IP from the default vlan configured on the port.

We have a new ISE Authz policy for certain group who should get IP from that particular vlan and then DACL will be pushed. I'm not sure whether both DACL and dynamic Vlan both works in ISE (we are using ISE 1.3).

Appreciate if you can give advise on this.

thanks in advance.

Pemasirid,Your attachment

Marvin Rhoads — Sat, 28 Feb 2015 17:52:47 GMT

Pemasirid,

Your attachment indicates the supplicant authenticated via MAB.

Can you share the interface configuration and screenshot of the applicable Authorization policy?

Hi Marvin,Tomorrow morning, I

tonyp8581 — Sun, 01 Mar 2015 15:33:22 GMT

Hi Marvin,

Tomorrow morning, I have a Webex session schedule with TAC. I will let you know how it goes.

Tony