topic Re: Cisco 9800-CL - CoA with FLEX in Wireless

Cisco 9800-CL - CoA with FLEX

przemyslaw.wieczorek — Wed, 18 Jan 2023 13:31:24 GMT

Hi all,

I'm trying to migrate from WLC 5520 to 9800-CL and I need to create WLAN with CoA and it confused me a little bit.

I have all WLANs which use FLEX only. Now for example, I have WLAN 1 which FLEX is configured to use VLAN 100. But I've also devices that connects to that WLAN and based on ISE configuration and CoA they are switched to VLAN 4. How to configure this on 9800?

Is it Policy Profile > "Access Policies" > VLAN > here place both VLANs 4,100 as VLAN group ? Then do the rest of config that goes with CoA or maybe it should be done differently?

Thank you for all hints.

Re: Cisco 9800-CL - CoA with FLEX

przemyslaw.wieczorek — Thu, 19 Jan 2023 12:06:59 GMT

I've used Cisco TAC Tool - WLC Config Converter, and it looks that configuration regarding CoA is an "unmap config". So I guess it is a case of testing different approaches with redirections and ACLs on FLEX to get that what I currently have on 5520.

Re: Cisco 9800-CL - CoA with FLEX

Mark Elsen — Thu, 19 Jan 2023 13:05:07 GMT

- Note that when testing you can always review the 9800-CL configuration with the CLI command : show tech wireless , have the output analyzed by https://cway.cisco.com/tools/WirelessAnalyzer/ , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer. Checkout all advisories!

Re: Cisco 9800-CL - CoA with FLEX

Rich R — Mon, 30 Jan 2023 01:53:00 GMT

When you say flex do you mean flex local-switching?
If so then remember to define the VLANs in your flex profile.
And with CoA enabled the vlan config should just get applied.
There's a whole guide for this at https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213924-flexconnect-wlan-with-802-1x-aaa-overrid.html

And 9800 flexconnect in general: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html

Re: Cisco 9800-CL - CoA with FLEX

Arshad Safrulla — Mon, 30 Jan 2023 23:48:42 GMT

You will add VLAN 4 and VLAN 100 under the Flex profile. You can have VLAN100 assigned to policy profile, once the WLC receives the COA it will change the VLAN of the device.

wireless profile policy BBBBBBBB-PP
aaa-override
accounting-list ISE-Accounting
no central association
no central dhcp
no central switching
no exclusionlist
idle-timeout 43200
ipv4 dhcp required
nac
radius-profiling
session-timeout 43200
vlan 100
no shutdown

wireless profile flex BBBBBBBBB_FP
acl-policy POSTURE-REDIRECT
central-webauth
no arp-caching
local-auth radius-server-group ISE
native-vlan-id 149
vlan-name Quarantine
vlan-id 326
vlan-name Wireless
vlan-id 100

Re: Cisco 9800-CL - CoA with FLEX

przemyslaw.wieczorek — Tue, 31 Jan 2023 07:56:02 GMT

I will check how this will work asap.

Re: Cisco 9800-CL - CoA with FLEX

przemyslaw.wieczorek — Wed, 26 Apr 2023 09:21:54 GMT

That worked. I also use ACL in which name I made a typo and received log that ACL don't exist. Corrected that and all started to work 🙂 Thank you.