topic Re: Wireless controller - Single SSID with multiple VLANs in Wireless

Wireless controller - Single SSID with multiple VLANs

H1HumJG — Wed, 08 Jun 2022 14:18:42 GMT

Hello, everyone!

I am using a standalone Cisco Wireless Controller 2504 with 50 APs. I am using a Radius Authentication Server (Windows server 2016). I have deployed 5 WLANs (5 SSIDs) with 802.1x and I am wondering if there is a way to just have one SSID and separate users by VLAN so the areas of the organization where I work have different restrictions and the users just see one SSID. Is that possible with my controller and what do I need to make it work? I know that the one I am using Its and old and EoS one.

Thank you

Re: Wireless controller - Single SSID with multiple VLANs

MHM Cisco World — Wed, 08 Jun 2022 14:27:17 GMT

I think the work will done in radius Server,
each user will assign different VLAN.

Re: Wireless controller - Single SSID with multiple VLANs

H1HumJG — Wed, 08 Jun 2022 14:31:01 GMT

Yes, part of the work is done in the Radius Server and NPS. Fourtunately I have found complete guides about that with another vendors. But no information with the 2504 Cisco Controller. I want to know if there is a guide or manual for what to do in my controller. Or any reference if that is possible. I have found some info but It need Cisco ISE.

Re: Wireless controller - Single SSID with multiple VLANs

Flavio Miranda — Wed, 08 Jun 2022 15:06:34 GMT

With ISE is more common, with NPS I have no experience but, theorically should be possible as both will speak RADIUS protocol. On the WLC side, what you need to enable is "aaa override" on the WLAN.

For central switching the WLC need to have all vlans and for Local switching the switch must have all vlans.

Re: Wireless controller - Single SSID with multiple VLANs

H1HumJG — Wed, 08 Jun 2022 15:26:00 GMT

Yes I have not found anyone who has done that and documented it. I believe It should work as you said both speak RADIUS. I will try the AAA override and let you know who is it going. Thank you for the answers.

Re: Wireless controller - Single SSID with multiple VLANs

MHM Cisco World — Wed, 08 Jun 2022 15:38:50 GMT

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/99121-vlan-acs-ad-config.html

this can help you

Re: Wireless controller - Single SSID with multiple VLANs

Leo Laohoo — Wed, 08 Jun 2022 22:40:47 GMT

It is called 802.1x and we've been using this for >5 years now.

We present one SSID and users log in and they get "shunted" into specific subnets based on their role.

Re: Wireless controller - Single SSID with multiple VLANs

jonathga94 — Thu, 09 Jun 2022 13:34:14 GMT

Hello, I guess you want to configure dynamic vlan asignment with your WLC 2504 and a windows server, that is supported. The WLC is expecting to receiving the VLAN information from your windows server in the access accept of the client authentication, so on your windows server, you need to include these fields on the accept messages:

IETF 64 (Tunnel Type)—Set this to VLAN.
IETF 65 (Tunnel Medium Type)—Set this to 802.
IETF 81 (Tunnel Private Group ID)—Set this to VLAN ID.

In the link below you can see the step by step configuration for Dynamic VLAN on windows NPS:

https://www.expertnetworkconsultant.com/configuring/ieee-802-1x-authentication-and-dynamic-vlan-assignment-with-nps-radius-server/

On the WLC side, you just need to add your windows server to the WLC's raidus list and enable AAA override on the WLAN as shown in the link below:

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/99121-vlan-acs-ad-config.html#anc11

regards.