topic Re: Flexconnect with multiple vlans on one SSID managed by ISE in Wireless

Flexconnect with multiple vlans on one SSID managed by ISE

apasquino — Sun, 04 Jul 2021 07:04:45 GMT

Hello,

we have a couple of WLCs, Access points and ISE where we run two SSIDs:

SSID Corporate: by means of Radfius CoA users are mapped to a vlan based on their AD group (4 different rules on ISE)

SSID Guest: central web auth with ISE

We are happy with that but we need to move further, so my question is:

is it possible (and how) to set up APs on a branch office as Flexconnect, and manage vlan enforcement on a single SSID the same way we do with central switching ? We have tried a lot of configs but had no chance.

Thanks a Lot

Andrea

Re: Flexconnect with multiple vlans on one SSID managed by ISE

Scott Fella — Thu, 16 May 2013 12:17:36 GMT

Are you on v7.4? Have you looked at this guide

http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/flexconnect/config_flexconnect_chapter_0100.html
Sent from Cisco Technical Support iPhone App

Re: Flexconnect with multiple vlans on one SSID managed by ISE

apasquino — Thu, 16 May 2013 12:28:55 GMT

Hello Scott,

yes we run 7.4 and I've read though this guide (there's also a "consolidated" version).

It's plain to see that for each WLAN we can only map a single vlan ID, and this behaviour is roughly the same as the mapping between WLAN and interface in central switching

The problem is that the WLC enforces the vlan that comes from radius CoA on its port, but does not enforce it on the Flex AP Port.

Best Regards

Andrea

Re: Flexconnect with multiple vlans on one SSID managed by ISE

Scott Fella — Thu, 16 May 2013 12:43:47 GMT

Yeah... So basically you want to have one SSID and map users to vlans depending on the policy they would hit with ISE. Have you tried posing your question on the Security AAA forum? They have some knowledgable people there that can tell you right away if its even supported or not. From what I have found, it doesn't seem like its supported that way yet.

Sent from Cisco Technical Support iPhone App

Re: Flexconnect with multiple vlans on one SSID managed by ISE

apasquino — Thu, 16 May 2013 13:53:49 GMT

Scott,

that's exactly what I am looking for, and as I see there is no evidence on your side that it is feasible. I'll try to drop a query on security, altough our current ISE "vlan policies" are running fine when the AP is not flexconnect.

Andrea

Flexconnect with multiple vlans on one SSID managed by ISE

itsupport — Tue, 22 Oct 2013 19:16:34 GMT

Did you ever get a reply to this or get it working? i am trying to do something simiar but while I am able to flexconnect a single vlan, i do not seem to be able to do more than 1 vlan to ssid (locally - centrally switching i can do several vlans)

hey guys, I am running a

hegefd — Wed, 09 Mar 2016 00:43:48 GMT

hey guys, I am running a WLC8540 WITH 8.1 code, was there ever a solution found to do this. multiple vlans for one SSID on colo based controllers and cisco ap's running in flex connect mode. also I am using Microsoft nps sending attributes of each vlan based on nps policy and user belongs to the AD group tied to the policy

Is this of any help?

luizmatos — Mon, 28 Mar 2016 18:43:11 GMT

Is this of any help?

https://www.youtube.com/watch?v=l8b8SCdphJo

As we can see on the video, he've changed the vlan of a client connected to a flexconnect AP (local Switched SSID) based on ACS policies. I just don't know if it also works for multiple vlans too.

Re: Is this of any help?

Smurf12345 — Mon, 01 Jan 2018 17:07:40 GMT

Thanks for the link. This was exactly the piece I was missing to get Flexconnect and multiple VLAN CoA working. I missed the Flexconnect Group -> ACL Mapping defining the additional VLANs. No ACL needs to be applied, just leave it "none" so it defines these VLANs on the APs.