topic Active Directory and ACS 5.2.0.26 in Wireless

Active Directory and ACS 5.2.0.26

tdaly — Sun, 04 Jul 2021 07:00:46 GMT

I want to create an SSID that will only allow teachers to authenticate at my school. Is this possible using ACS? In other words can ACS allow only certain groups in AD access to a particular SSID or subnet?

Thanks for any suggestions.

Active Directory and ACS 5.2.0.26

Jatin Katyal — Wed, 01 May 2013 19:24:53 GMT

In order to restrict access for a specific AD group to specific SSID this is what you need to perform.

When the WLC sends an authentication request to the ACS, it will include the SSID that the user is connecting to, in the attribute Calling-Station-Id(31). We can use this information to create multiple rules in ACS 5.x in order to take actions based on the information contained in the attribute.

Under the Users and Indetity Stores > click on Directory Groups > select > check the group name you want to add and hit ok. Save the changes.

We just need to create a DNIS rule that includes the name of the SSID and use it as a condition in any rule that we create for authentication. The * is required because the attribute not only contains the SSID but also a MAC address so the * is use as a regular expression.

Now go to access-policies > default-network access > identity should be AD1.

Go to authorization > click on customize > move the AD1:ExternalGroups and end-station filter attribute on the right side and hit ok.

After that slect the appropriate ad group for teachers and end-station filter.

Save changes.

Jatin Katyal
- Do rate helpful posts -

Active Directory and ACS 5.2.0.26

Jatin Katyal — Wed, 01 May 2013 19:37:08 GMT

In order to restrict access for a specific AD group to specific SSID this is what you need to perform.

Under the Users and Indetity Stores > click on Directory Groups > select > check the group name you want to add and hit ok. Save the changes.

Now go to access-policies > default-network access > identity should be AD1.

Go to authorization > click on customize > move the AD1:ExternalGroups and end-station filter attribute on the right side and hit ok.

After that slect the appropriate ad group for teachers and end-station filter.

Save changes.

Jatin Katyal
- Do rate helpful posts -

Active Directory and ACS 5.2.0.26

tdaly — Thu, 02 May 2013 11:14:36 GMT

Thank you so much. This worked perfectly. Your instuctions and screenshots made it very easy.

Active Directory and ACS 5.2.0.26

Jatin Katyal — Thu, 02 May 2013 11:18:58 GMT

Glad!!! Have a blessed day.

Jatin Katyal
- Do rate helpful posts -