topic Dynamic VLAN Assignment + NPS in Wireless

Dynamic VLAN Assignment + NPS

Evan Wheatley — Sun, 04 Jul 2021 04:26:41 GMT

Hello,

I'm planning a deployment with the following:

5508 WLC running 7.0.222.0

NCS 1.0.2.29

50+ 3502i AP's

Windows 2008 R2 running NPS

EAP-TLS for authentication

The end goal is to have a single SSID and utilize NPS to dynamically assign VLAN's depending on role/group.

I've read several documents that use ACS to complete the dynamic VLAN assignment (inclduing http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml), however in this case ACS is not available.

My question basically is; do I need ACS to apply the VSA for Cisco Airespace, or can this be done solely with the following IETF attributes using Microsoft NPS and AAA override on the WLC?

[64] Tunnel-Type

[65] Tunnel-Medium-Type

[81] Tunnel-Pvt-Group-ID

Any advice would be greatly appreicated!

Thanks

Dynamic VLAN Assignment + NPS

Stephen Rodriguez — Tue, 24 Jan 2012 19:00:53 GMT

You don't need to use the Airespace VSA, the IEEE standard 64/65/81 will work.

Steve

Dynamic VLAN Assignment + NPS

Evan Wheatley — Fri, 15 Jun 2012 17:23:56 GMT

Just to follow up, I've successfully implemented this and the client is happy with the outcome of the project.

Thanks for your help Steve.

Dynamic VLAN Assignment + NPS

ilyes.belhadjhassine — Mon, 16 Sep 2013 19:19:10 GMT

Hi,

I did exactly how you guys stated and it still not working.

I have 3vlan in the wlc, do I configure 3 ssid or 1 ? I have multiple vlan.

Please give me some screenshot of the WLC configuration.

Thanks

Dynamic VLAN Assignment + NPS

Stephen Rodriguez — Mon, 16 Sep 2013 22:26:09 GMT

You only need to configure one SSID, and make sure you have AAA override enabled in the WLAN config.

If you are doing 802.1x and have the NPS configured to return those attributes it should work

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

Dynamic VLAN Assignment + NPS

ilyes.belhadjhassine — Thu, 19 Sep 2013 16:03:25 GMT

Thanks Steve for your quick response.

I did everything as per your recommendation and it still doesnt work.

Do you mind providing me a remote assistance, do you have Skype?

Or your prefer that I provide you a set of logs, tell me which one and I will do so.

SSID:TT

@IP WLC: 172.20.252.70

NPS: 172.20.1.16

config rule NPS: service-Type: NAS Prompt

Tunnel-Type: VLAN

Tunnel-pvt-group-ID:10

Tunnel-Meduim-Type:802

log WLC:

*radiusTransportThread: Sep 19 12:32:47.841: ****Enter processIncomingMessages: response code=2

*radiusTransportThread: Sep 19 12:32:47.841: ****Enter processRadiusResponse: response code=2

*radiusTransportThread: Sep 19 12:32:47.841: 8c:70:5a:1c:8e:20 Access-Accept received from RADIUS server 172.20.1.16 for mobile 8c:70:5a:1c:8e:20 receiveId = 4

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.841: 8c:70:5a:1c:8e:20 Processing Access-Accept for mobile 8c:70:5a:1c:8e:20

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.842: 8c:70:5a:1c:8e:20 Applying new AAA override for station 8c:70:5a:1c:8e:20

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.842: 8c:70:5a:1c:8e:20 Override values for station 8c:70:5a:1c:8e:20

source: 4, valid bits: 0x200

qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.842: 8c:70:5a:1c:8e:20 Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1

vlanIfName: 'dy-data-ksb1', aclName: ''

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.842: 8c:70:5a:1c:8e:20 Inserting new RADIUS override into chain for station 8c:70:5a:1c:8e:20

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Override values for station 8c:70:5a:1c:8e:20

source: 4, valid bits: 0x200

qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1

vlanIfName: 'dy-data-ksb1', aclName: ''

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Applying override policy from source Override Summation:

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Override values for station 8c:70:5a:1c:8e:20

source: 256, valid bits: 0x200

qosLevel: -1, dscp: 0xffffffff, dot1pTag: 0xffffffff, sessionTimeout: -1

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Override values (cont..) dataAvgC: -1, rTAvgC: -1, dataBurstC: -1, rTimeBurstC: -1

vlanIfName: 'dy-data-ksb1', aclName: ''

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.843: 8c:70:5a:1c:8e:20 Setting re-auth timeout to 1800 seconds, got from WLAN config.

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844: 8c:70:5a:1c:8e:20 Station 8c:70:5a:1c:8e:20 setting dot1x reauth timeout = 1800

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844: 8c:70:5a:1c:8e:20 Creating a PKC PMKID Cache entry for station 8c:70:5a:1c:8e:20 (RSN 2)

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844: 8c:70:5a:1c:8e:20 Adding BSSID 00:1e:be:a7:bf:b6 to PMKID cache for station 8c:70:5a:1c:8e:20

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844: New PMKID: (16)

*Dot1x_NW_MsgTask_0: Sep 19 12:32:47.844: [0000] 80 36

Dynamic VLAN Assignment + NPS

Stephen Rodriguez — Thu, 19 Sep 2013 16:21:17 GMT

can you provide the output of

show interface summary

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

Dynamic VLAN Assignment + NPS

ilyes.belhadjhassine — Fri, 20 Sep 2013 12:05:25 GMT

Thanks Steve for your quick response.

this is the output of show interface summary also i give you the config of WLAN:

Interface Name Port Vlan Id IP Address Type Ap Mgr Guest

-------------------------------- ---- -------- --------------- ------- ------ -----

ap-manager LAG untagged 172.20.252.71 Static Yes No

dy-data-ksb1 LAG 10 10.55.21.10 Dynamic No No

dy-data-parc LAG 1 10.55.0.2 Dynamic No No

dy-guest-ksb1 LAG 50 10.55.22.10 Dynamic No No

dy-itteam-ksb1 LAG 30 10.55.20.10 Dynamic No No

dy-voice-ksb1 LAG 20 10.55.23.10 Dynamic No No

management LAG untagged 172.20.252.70 Static No No

service-port N/A N/A 172.20.252.101 Static No No

virtual N/A N/A 1.1.1.1 Static No No

Re: Dynamic VLAN Assignment + NPS

dabitgall21 — Thu, 23 May 2024 17:40:42 GMT

Hello everyone

Can somebody help me? I'm part of a new project in my job, we need to provide the IP address by NPS, i have this configuration in the port:

The service is active, we can connect the users by network account but we don't want that the ip addrees be assigned by DHCP server or a local scope. Help pleaseeeeee

Sorry if my english isn't good, i'll try to improve it.