topic Fabric wireless dynamic IP pool assignment in Software-Defined Access (SD-Access)

Fabric wireless dynamic IP pool assignment

dm2020 — Sun, 19 May 2019 19:23:07 GMT

Hi All,

For the dynamic assignment of wired users to a particular VN/IP pool, we can configure an authorisation policy in ISE to return the VLAN name that matches the required IP pool's auth policy (such as 10.1.1.0-CAMPUS). I have tested and this works without any problems. Is it also possible to achieve the same thing with Fabric wireless? For example, if my corporate SSID is associated to corporate data pool 10.1.1.0/24 within DNAC, but I want to dynamically assign certain users to a different IP pool when connecting to the same SSID, (such as a dedicated pool for BYOD), can I use the same method as above? I dont have fabric wireless currently enabled so I cant test this.

thanks

Re: Fabric wireless dynamic IP pool assignment

Mike.Cifelli — Mon, 20 May 2019 17:45:16 GMT

Yes you should be able to accomplish this by using different authz conditions. Assuming you will use your SSID as one of the conditions just separate the different use cases out using other conditions such as AD security group, local ise endpoint group, etc. You just need to simply determine how you want conditions to be met in order to push different authz result profiles. As you mentioned your authz profiles will push policy for the different ip pools/sgts that you wish to push. In DNAC just create your other IP pools, assign to VN, and follow your same wired steps. They should be similar and straightforward. HTH!