topic Re: WLC-5508 dynamic vlan assignment by radius in Wireless

WLC-5508 dynamic vlan assignment by radius

tllewell55 — Mon, 05 Jul 2021 19:26:26 GMT

The docs on 5508 controllers say radius can assign vlans by vlan ID (see https://community.cisco.com/legacyfs/online/legacy/3/3/0/55033-AAA-overide-ACS52.pdf). Radius servers actually return a string, and the vlans are all associated with an interface name, so I'd rather use the name, like you can with cisco's ethernet switches (by using the vlan name). Does the software allow this? We're on 8.5.140.0.

Re: WLC-5508 dynamic vlan assignment by radius

patoberli — Mon, 24 Aug 2020 15:53:50 GMT

I've never tested it, but the guides clearly recommend you should use the number:
https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/99121-vlan-acs-ad-config.html#anc5
They also reason why this is the case.
You can of course test it, by setting the ID/Name to the name of the virtual interface.

Re: WLC-5508 dynamic vlan assignment by radius

tllewell55 — Mon, 24 Aug 2020 16:01:37 GMT

If you can use the name, you can provision clients who move from one environment to another. VLAN numbers are less portable due to the way our environment has been built (not because they are less portable in theory). And yes, I could test, probably will, but if it's not possible how do I know if something isn't quite right or I'm trying something that just doesn't work?

Thanks,

Ted

Re: WLC-5508 dynamic vlan assignment by radius

patoberli — Mon, 24 Aug 2020 17:31:45 GMT

I solved this by using site aware policies, for example calling station id or ip address of the ap.

Re: WLC-5508 dynamic vlan assignment by radius

tllewell55 — Mon, 24 Aug 2020 18:19:47 GMT

Kind of what I've been trying to avoid, since it would mean programming in VLAN information for a bunch of stuff that are not WLCs to account for the fact that the WLCs won't do names. Probably have to code it in a way that will use the name for the bulk of the devices and will use a vlan-id for the smaller set of devices that have to have the number. Thanks.

Re: WLC-5508 dynamic vlan assignment by radius

patoberli — Mon, 24 Aug 2020 19:12:45 GMT

Check vlan interface name here: https://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_010100111.html#auth-attr-in-access-accept-packets
Based on this it might work.

Re: WLC-5508 dynamic vlan assignment by radius

tllewell55 — Mon, 24 Aug 2020 20:07:10 GMT

Cool, thanks. That does look promising.