topic Re: cisco wireless in Wireless

cisco wireless

shaikh.zaid22 — Mon, 20 Feb 2023 07:58:34 GMT

hi all,

we are implementing a dynamic vlan allocation in wireless network, via forescout nac.

the clients are first joining to ssid and getting the ip range, however, the clients are getting correct ip address only when they disconnect and connect back.

The WLC is cisco 9800 in between the client and NAC.

any guidance is appreciated

Re: cisco wireless

Mark Elsen — Mon, 20 Feb 2023 09:08:06 GMT

- You may find this guide informative https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/217043-configure-dynamic-vlan-assignment-with-c.html , I know it discusses ISE not forescout , but it would be advisable to review the document , also review the 9800 current configuration with the CLI command : show tech wireless , have the output analyzed by https://cway.cisco.com/tools/WirelessAnalyzer/ , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer. Checkout all advisories!

Re: cisco wireless

shaikh.zaid22 — Tue, 21 Feb 2023 17:25:06 GMT

Hi marce,

I have done the config according to the above document. the configuration works fine, only when we perform a re-authentication from the forescout nac. That too we have to disconnect the client and connect back to take a proper vlan ip address.

i am planning to open a tac, since the debugs also not giving much info.

Re: cisco wireless

Mark Elsen — Tue, 21 Feb 2023 18:03:10 GMT

- Ok, you can also do client specific debugging using these info's : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity (if not yet done) , client debugs can be analyzed with https://cway.cisco.com/wireless-debug-analyzer

Re: cisco wireless

Rich R — Tue, 21 Feb 2023 18:26:16 GMT

First question: what version of IOS-XE are you using?

TAC can be quite unhelpful when you use anything except ISE so good luck with that. Best to get packet captures of the radius and full radioactive traces of the client to make sure Forescout is sending it correctly from the start and see how WLC is handling it. There have been some bugs around dynamic VLAN allocation so maybe you're just running an old IOS which doesn't have those fixes but if your IOS is up to date (see links below) then I'd be inclined to think it's Forescout that's at fault.

Re: cisco wireless

Arshad Safrulla — Tue, 21 Feb 2023 20:01:11 GMT

Have you confirmed COA is enabled in Cisco WLC side? Enable it under the Radius server settings and also enable AAA override and NAC state under the policy profile. If still not working, then post a sanitized RA trace from a client.