How to apply a per-client QoS policy on a 9800 WLC based on ISE authz profile?

matty-boy — Mon, 05 Jul 2021 20:19:56 GMT

Hi,
Our customer has a network consisting of 9800 (IOS XE) WLCs, 9130 APs and ISE 2.6p6.
They want to provide a free guest wifi solution with a very low basic bandwidth of say 1Mbps. This will be on a dedicated SSID (Guest_Free_Wifi)
They also want to provide a premium, paid-for guest wifi service on a different SSID (Premium_Wifi) where the customer can purchase from a set of levels (10M, 20M, 50M, etc).
Guest is fine, we can implement that no problem and configure a 1Mbps client policing policy for that SSID on the WLC directly as the same policy will apply to all users.
For the Premium service we were going to use the sponsor portal method as for this use-case somebody will manually configure each premium guest account (automation is not on the agenda here at the moment as there won't be many).
My question is this: Is it possible for ISE to send an A/V pair to the IOS XE based 9800 WLC, instructing it to apply a per client QoS policy for that user?

I see there are some A/V pairs like "Aire-Data-Bandwidth-Average-DownStream-Contract" but I suspect these only work on the older AireOS WLCs and probably not the newer IOS XE based 9800 WLCs.

Also, can the RADIUS A/V pair that is sent from ISE to the WLC be based on the 'group tag' that is entered when creating the account in the sponsor portal (see attachment)?
If the answer is no, can you think of any alternative methods of achieving this goal?
Many thanks in advance!

Re: How to apply a per-client QoS policy on a 9800 WLC based on ISE authz profile?

matty-boy — Fri, 21 May 2021 15:45:38 GMT

Answering my own question.

Credit to @vibobrov for identifying the solution: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215441-configure-qos-rate-limiting-on-catalyst.html

topic Re: How to apply a per-client QoS policy on a 9800 WLC based on ISE authz profile? in Wireless

How to apply a per-client QoS policy on a 9800 WLC based on ISE authz profile?

Re: How to apply a per-client QoS policy on a 9800 WLC based on ISE authz profile?