topic Scoot is correct. This is in Wireless

801.x WLANs authenticated via Radius and Active Directory permit any user access any WLAN

Alejandro.Angon — Mon, 05 Jul 2021 09:11:07 GMT

Hi,

I have configured several WLANs with WPA2 and 8021.x which authenticate users through Radius server (Windows Internet authentication service) that conects with an Active Directory, into the AD exists one user group for each WLAN but the problem is that any user that was added to some group can get access to any WLAN, does anyboby know if I need some configuraion on the WLC to restric that?

thanks for your help.

The WLC doesn't prevent that,

Scott Fella — Fri, 26 Dec 2014 19:19:36 GMT

The WLC doesn't prevent that, it's your radius policies that you need to look at. Maybe creating a new User Group for specific SSIDs and place users in one of those specific groups and then have a radius policy look at the called station id since the SSID will be present there and then create a policy that points to that specific User Group for that SSID.

-Scott

Scoot is correct. This is

George Stefanick — Fri, 26 Dec 2014 20:21:55 GMT

Scoot is correct. This is also assumimh your other wlans are all dot1x

Hi Scott,I have done some

Alejandro.Angon — Wed, 07 Jan 2015 18:18:21 GMT

Hi Scott,

I have done some test modifying the Radius Policy to look at called station ID and test too looking at the NAS-ID, In the first case, I change the Call Station ID Type into WLC RADIUS Authentication Servers configuration to AP MAC Address:SSID and AP Name:SSID and into the Radius Server using .*:SSID-NAME$ and SSID-NAME$ ,but it blocks access for any user. In the second case, I change the NAS-ID into WLC WLAN and interface confguration and into the radius server Policy to match all, but it doesn´t have any impact, what other test could I try?

thanks for your help.

Hi,I have done some test

Alejandro.Angon — Sun, 01 Feb 2015 23:28:48 GMT

Hi,

I have done some test installing a new Radius Server (Windows NPS) and adding a condition that evaluates the called station ID into the Network Policy and keeping the default IP address option into the WLC Radius server configuration and now user group restricctions works

ragards.