topic Stephen, thank you for in Wireless

Flexconnect with ISE

CSCO12400920 — Mon, 05 Jul 2021 09:24:11 GMT

Hi, I have a question. we are trying to implement flexconnect for our branch offices for the employee's WLAN, the guest WLAN will not be in flexconnect mode. My question is that my manager wants to have unique subnets for every branch in the Employee WLAN. By doing it this way I will have to create multiple Interfaces and tide it to the SSID per branch location. Is there other way around to do this without having to create multiple interfaces and WLANs?

You do not need to create an

Stephen Rodriguez — Mon, 02 Feb 2015 18:57:34 GMT

You do not need to create an interface for each location.

When you do FlexConnect configurations, you map the WLAN to the local VLAN ID on a per AP basis.

http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_010001101.html#d35947e1465a1635

HTH,

Steve

Stephen, thank you for

CSCO12400920 — Fri, 06 Feb 2015 16:44:28 GMT

Stephen, thank you for replying to my post.

Sorry for no replying soon, I wanted to tested first before replying. I did map the WLAN to the local VLAN ID on an access point and it works,

My goal is:

corporate equipment will be assign to vlan 10
non-corporate equipment but AD user authentication is successful will be assign to vlan 11,

I wanted to accomplish all of this using one SSID and let ISE do the change of vlans according to Authorization policies, but I can't figure it out how to do it. When I the APs were in local mode, we used one single ssid "Employees" and ise put the employees in different subnet depending if it is corporate or not corporate devices. I was able to accomplish this by using two different authorization profiles in ISE that changes the Airespace-Interface-Name = employee-noncorp for Non-corporate devices, and Airespace-Interface-Name = employees for corporate devices. Since we are using vlan mapping on the AP how will I go to accomplish this? I have been searching for some info on how to do this, but I couldn't find anything related to what I am trying to do.

Thanks

Hey, it´s quite easy. You can

Philip91 — Mon, 09 Feb 2015 23:26:14 GMT

Hey,

it´s quite easy. You can use the AP-Groups in your Radius Request to assign different VLAN per AP-Group per User Typ. That means in worst case two Radius Auth Policies per Branch. Good that we have rule based ;-).

Location A Corporate VLAN X

Location A non Corporate VLAN Y

Location B Corporate VLAN M

Location B non Corporate VLAN N

From the Call Station ID Type drop-down list, choose the option that is sent to the RADIUS server in the Access-Request message. The following options are available:

IP Address
System MAC Address
AP MAC Address
AP MAC Address:SSID
AP Name:SSID
AP Name
AP Group
Flex Group
AP Location
VLAN ID

Note

The AP Name:SSID, AP Name, AP Group, Flex Group, AP Location, and VLAN ID options are added in the 7.4 release.

http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_0101100.html

And to set the VLAN ID use:

The RADIUS user attributes used for the VLAN ID assignment are:

IETF 64 (Tunnel Type)—Set this to VLAN.
IETF 65 (Tunnel Medium Type)—Set this to 802
IETF 81 (Tunnel Private Group ID)—Set this to VLAN ID.

Hope that is what you need......

Kind regards

Philip

--> Pls rate useful responses <--