User to virtual network association

[NAGISWAREN2]

Hi,

How does authenticated user to virtual network association work ? Does that depends on the user connected switch port VLAN ID > BD >VNI / VRF association , regardless of authentication information ? 

Say a user from a Business Unit A get authenticated , and we want them to get associated to Virtual Network A . how we do that ? 

[Benjamin-A]

Hi NAGISWAREN2,

please see following Guides:

• "How to SDA Host Onboarding with ISE": https://community.cisco.com/t5/networking-documents/how-to-sda-host-onboarding-with-ise/ta-p/4012430
• "DNA Campus Fabric Automation – Policy Driven Manageability" Section  "Policy Implementation – Access (Authorization)": https://www.ciscolive.com/c/dam/r/ciscolive/latam/docs/2017/pdf/BRKCRS-3811.pdf

It is through a assignment in the Authorization Profile. Either you will provide VN+SGT in the Authorization Profile or an VLAN assignment.

[NAGISWAREN2]

Hi Benjamin.

Thanks. I understand how it works if assign VLAN in authorization policy. 

But in the link you provided, instead of assigning VLAN, it assigning VLAN tag or security tag. How does this get translated to actual VLAN ?

[Benjamin-A]

Hi Nagis, 

I think it is easier to understand while using breakout session 3811: 

• its all about the authorization profile / authorization rule and how you configure it. In the authorization profile / authorization rule you map an identity to a VN + SGT
• Here is the breakout session video from CLEUR 2020  (starting approx. at 57:45) https://www.ciscolive.com/global/on-demand-library.html?search=BRKCRS-3811#/video/1580916582336001Oxuo

[NAGISWAREN2]

Hi Benjamin,

Thanks. but again , in the video it mentioning about assigning user to VN by assigning SGT and/or VN name. But my question is,  does this SGT/VN information get translated into VLAN(by ISE/DNAC) when the ISE deliver authorization result to access device(the authenticating edge node) ? or it deliver the actual SGT/VN info to access device , and the access device will figure it out how to translate into VLAN and assign that VLAN into the user facing port ?

[Mike.Cifelli]

Based on this question: But my question is,  does this SGT/VN information get translated into VLAN(by ISE/DNAC) when the ISE deliver authorization result to access device(the authenticating edge node) ? or it deliver the actual SGT/VN info to access device , and the access device will figure it out how to translate into VLAN and assign that VLAN into the user facing port ?

Essentially you will rely on ISE to push down the respective CTS and authz config authorizing clients to their network.  Upon client/user authc/authz in ISE you will create an authz profile that gets assigned to your authz policy that has conditions that will be used to identify how you wish to assign certain assets/users to your different IP pools/SGTs within a certain VN.  Under the authz profile you will assign a unique identifier that is a string you can locate after you assign an IP pool under host onboarding in DNAC that can be found here: Provision->Fabric->Host Onboarding.  Under virtual networks when you assign an IP pool you will see a authentication policy string that looks like this: 192_168_0_0-VN1.  Copy that string, and place it in the vlan box for authz profile in ISE.  If this is wrong you will have issues with proper assignment & onboarding.  Within ISE under the same authz policy you will assign the SGT as well.  HTH!

[NAGISWAREN2]

I understand how you put user into particular VN by assigning authentication policy string in ISE. My question what radius parameter the ISE deliver to edge device ? Is it sent this String ”192_168_0_0-VN1 “ or instead send VLAN ID that been associated with the IP address Pool?

If it send the string in radius packet, how does the switch knows which VLAN to associate the user interface ?

[Mike.Cifelli · Accepted solution]

If you rely on ISE to push policy down to interfaces that lets say are configured for 8021x Closed Auth, ISE will push the string that is configured in the matching policy authz profile that contains the unique string extracted from DNAC and configured in the authz profile. It will get pushed in the radius packet as a radius attribute that the switch will use as the identifier. The attribute looks like this in detailed ISE logs: Tunnel-Private-Group-ID (tag=1) 192_168_0_0-VN1. This identifier attribute allows the switch to map either the name or vlan id to the proper vlan. Once this happens your Anycast gateway comes up/up. Note that DNAC will automatically name the vlans which is why that string must match in ISE authz profiles. Run a show vlan on an EN and you will see what I am talking about. I hope this answers your question and is helpful.

[NAGISWAREN2]

Hi Mike,

Thanks. That exactly what i was looking for.