topic Re: Dynamic VLAN Assignment with Web-Auth in Wireless

Dynamic VLAN Assignment with Web-Auth

baby_yoda — Mon, 05 Jul 2021 18:40:02 GMT

Hello,

I have configured dynamic VLAN assignment on a 5520 WLC using RADIUS authentication with a Microsoft NPS. This works perfectly with Layer 2 802.1x. configured on a WLAN.

Can I configure AAA override to work when using Layer 3 web authentication? I essentially want the WLAN to try for local authentication and then try radius. The authentication works as I would expect but the VLAN does not get assigned. When I think about it being layer 3, I'm assuming the client will already be in the network of the WLAN interface, therefor an ACL would be a better way to handle this?

I am a mere CCNA R&S, so any help would be massively appreciated.

Re: Dynamic VLAN Assignment with Web-Auth

balaji.bandi — Fri, 07 Feb 2020 15:11:59 GMT

Dynamic VLAN assignment does not work for web authentication from a WLC. So you need to find a way ?

ACL - depends on requirement here.

Re: Dynamic VLAN Assignment with Web-Auth

baby_yoda — Fri, 07 Feb 2020 15:25:46 GMT

@balaji.bandi wrote:
Dynamic VLAN assignment does not work for web authentication from a WLC. So you need to find a way ?

ACL - depends on requirement here.

Happy with that, I suspected it wouldn't I just wanted to know for sure!

Thanks @balaji.bandi

Re: Dynamic VLAN Assignment with Web-Auth

sintang — Mon, 02 Mar 2020 06:21:32 GMT

This could be something to look forward to. On the Catalyst 9800 IOS-XE 17.1 release, VLAN Override on Layer 3 Web Authentication is available.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-1/config-guide/b_wl_17_11_cg/wlan-security.html#id_109551