topic Re: cisco-ISE in Wireless

cisco-ISE

Anjana A — Mon, 05 Jul 2021 17:39:32 GMT

Hi Team,

Please confirm whether this set up is possible through Cisco ISE?

WLC (cisco) and access points were locally situated and the Access points were in local mode.

the wlan interface(corporate) is mapped to management interface.

And the requirement is that users were getting ip adddress from the correct client vlan.

And we are using cisco ise for authentication.

Whether this can be possible through cisco ISE policy by overriding the wlan inetrface mapping.

Please explain how we can do this via ISE and explain the stpes involved.

Regards,

Anjana.

pieterh — Thu, 04 Jul 2019 07:17:34 GMT

Yes this is possible. follow the steps in this document: Dynamic VLAN Assignment with WLCs based on ISE

balaji.bandi — Thu, 04 Jul 2019 12:05:50 GMT

here is the guide for reference :

RaffyLindogan — Fri, 05 Jul 2019 02:27:27 GMT

Hi mate,

This is possible.

The steps below assumes that:

1. WLC and ISE are communicating via RADIUS (WLC added on ISE under Network Resource and RADIUS enabled)

2. Depending on your authentication result (you can authenticate user based on locally stored username and password on ISE or via AD, etc..)

3. WLAN is configured already on WLC and AAA server tab on specific wlan is pointing to ISE

4. Authentication policy on ISE is configured and conditions on both authentication and authorization are defined

Steps:

1. Create authorization profile on ISE under Policy/Results/Authorization/Authorization Profile

2. Click Add and on the Comman Tasks/VLAN, specify the vlan

3. Create authorization policy and use that newly created authorization profile on Authorization Policy/Results.

Let me know if you need further details.

And by the way, if your focus more is on ISE. you can post the question under Security/ISE on this community. 🙂

Cheers,

Raffy