topic Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS in Wireless

EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

ANTONIO DEUS — Sun, 22 Jan 2023 18:27:46 GMT

Hey guys,
We bought 30 AP Catalyst C9115AXI-E, and this model has the possibility of one of the APs serving as a virtual controller, that is, Embedded Wireless Controller.
The intended scenario is to create an SSID (tono) where the vlan is assigned by RADIUS with WPA2 enterprise. The SVIs of these vlans are on a firewall. The DNS/DHCP are behind this firewall, in another vlan, not any wireless vlan.

Could someone provide an example of how to create the SSID in the EWC, where the 30 APs are registered in the EWC and the network in which each diviece gets connectivity is a different network (vlan 50, vlan 65 or vlan 650), through assignment/classification by RADIUS.

Model: cisco C9115AXI-E (VXE) processor (revision VXE) with 324133K bytes of memory.
IOS XE: Version 17.06.04
Thanks in advanced
António

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

balaji.bandi — Sun, 22 Jan 2023 18:44:59 GMT

check this deployment guide and step by step :

https://www.cisco.com/c/en/us/products/collateral/wireless/embedded-wireless-controller-catalyst-access-points/white-paper-c11-743398.html

3 VLAN mean you looking for 3 SSID WLAN for different Services? as long as the VLAN and WLAN binded reset all config same 1 SSID or more SSID, only different if you have Guest Access and Web Auth.

You can make necessary FW Rules regarding what VLAN/WLAN is required and what resources are accessed/denied.

If you looking for more AP deployment, suggest having 2 EWCs (HA), in case one failed the other one becomes active.

There is a good presentation I would suggest to read and understand the flows :

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2020/pdf/BRKEWN-2016.pdf

EDIT :

suggest having another Good blog for reference apart from cisco I have suggested a document.

https://www.wifireference.com/2019/12/07/cisco-embedded-wireless-controller-on-catalyst-access-points/

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

ANTONIO DEUS — Sun, 22 Jan 2023 19:04:01 GMT

Hi balaji.bandi,

Thank you for your answer. The first link you send, I already read it, but does not help me what we need.

What we need is one SSID,for example tono, for 3 different vlan/SVI, that are assignment by RADIUS. It is possible do it on EWC on C9115AXi?

Thanks

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

balaji.bandi — Sun, 22 Jan 2023 19:12:34 GMT

One SSID, so based on the user authentication you would like to change of Authorisation to that VLAN, sure the example guide provides the steps.

It is possible do it on EWC on C9115AXi? - check the cisco document and compatibility matrix.

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

ANTONIO DEUS — Sun, 22 Jan 2023 19:29:12 GMT

I cannot find the right answer, if does or doesn't support with this model (C9115AX). So, I put one this discussion room my doubts.

Thank you

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

balaji.bandi — Sun, 22 Jan 2023 21:00:40 GMT

Are you not able to view my Image posted and EWC supported that model?

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

ANTONIO DEUS — Sun, 22 Jan 2023 21:01:53 GMT

Yes.

Thanks.

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

ANTONIO DEUS — Mon, 23 Jan 2023 13:46:17 GMT

Hi,

I can see, but the main question is vlan assigned by RADIUS.
On Policy Profile, section Access Policies if I specifies the vlan, the laptop get IP, and have connectivity (nice!). But if I do not specifies the vlan, the laptop stay connect on the wifi, but have no connectivity, because didn't received the vlan assigned by the RADIUS.

What I need to configure in order to received de vlan assigned by RADIUS?

Thanks,
António

PS the configuration is an attachment

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

Karsten Iwen — Mon, 23 Jan 2023 14:13:08 GMT

Your config misses two eventual parts:

The VLANs need to be added to the Flex-Profile
The policy profile needs an "aaa-override"

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

ANTONIO DEUS — Mon, 23 Jan 2023 14:29:40 GMT

Hi Karsten Iwen,

Can you provide an example for both misses config?

Thanks

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

Karsten Iwen — Mon, 23 Jan 2023 14:41:25 GMT

This is my flex profile and policy profile:

wireless profile flex default-flex-profile description "default flex profile" native-vlan-id 1076 vlan-name IoT vlan-id 1162 vlan-name USER vlan-id 1032 vlan-name GUEST vlan-id 1161 wireless profile policy whichever-policy-you-want-to-change aaa-override

Re: EWC C9115AXI, SSID configuration and Vlan atribution by RADIUS

ANTONIO DEUS — Mon, 23 Jan 2023 14:47:48 GMT

Thank you Karsten Iwen.