topic Re: WLAN configuration in Wireless

WLAN configuration

shaikh.zaid22 — Thu, 01 Dec 2022 18:12:07 GMT

Hello,

I have 9800 WLC configured with single WLAN and shared across all the org departments for corporate resource access.(Forescout NAC recently deployed)

recently we have segregated all the org departments into separate vlans and disallowed inter-vlan communication as part of compliance requirement.

Now, my requirement is, i need to create one or utilize the existing WLAN in such a way that when for instance if a finance user connects to the WLAN, the user should receive ip address from the same finance subnet range (say vlan 32). Similarly, i have to accomplish for all departments.

How shall i approach this use-case in the WLC configuration.

Need your guidance and assistance in this regards folks.

Re: WLAN configuration

Mark Elsen — Thu, 01 Dec 2022 18:20:42 GMT

- Review this document : https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/dhcp-for-wlans.html

Re: WLAN configuration

Haydn Andrews — Thu, 01 Dec 2022 22:15:49 GMT

802.1x Authentiated SSID with AAA Override

RADIUS server returning seperate VLAN ID dependant on the policy matched to identify which group a user is from.

Not a forescot NAC setup but here is the config guide for doing it with ISE the principles will be the same

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/217043-configure-dynamic-vlan-assignment-with-c.html

If using local mode, need to ensure the VLANs are trunked to the 9800. Flexconnect need to ensure the VLANs are trunked to the AP and defined in the Flex Profile

Re: WLAN configuration

shaikh.zaid22 — Sat, 03 Dec 2022 10:15:03 GMT

Hi Haydn,

Thank you for the document. It really made me understand with all necessary configuration.

Just one more thing here, since we have users integrated via AD, and in this doc the users are created locally in ISE and Vlan was assigned manually in the user identity for Vlan 102 assignement here.

So via AD, how i can achieve this? Do i need to tweak the user settings in the AD user account details with specific Vlan X ?

Re: WLAN configuration

shaikh.zaid22 — Mon, 26 Dec 2022 14:35:34 GMT

hi Haydn,

Thank you for the reference document. I was able to get it done successfully with Forescout NAC.

Re: WLAN configuration

kakhan0345 — Mon, 29 Apr 2024 11:50:30 GMT

brother I am also facing the same with wlc9800, 802.1x and forescout, may I know how you sorted out ? Thanks

Re: WLAN configuration

shaikh.zaid22 — Mon, 29 Apr 2024 14:08:04 GMT

This can be done on Forescout, after reading the department details of the connected user , it can move the user to respective vlan. This u can do after assessing the connected endpoint and configure the control action to move the user into proper vlan.