cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
479
Views
3
Helpful
3
Replies

Just looking for good documentation to learn about VLAN Assignment.

jmilay
Level 1
Level 1

Can someone lead me to good articles in relation to understanding/configuring VLAN assignment?  i.e. one SSID assigning vlan based on AD group and/or network location?

1 Accepted Solution

Accepted Solutions

paul
Level 10
Level 10

Not sure if you will find specific documentation on this, but the only thing you need to add to your authorization profiles is a VLAN assignment.  Then the rest is just crafting your authorization rules to apply the correct authorization profile that has the VLAN you want assigned.

If you are doing centralized wireless, i.e. not FlexConnect, as long as the WLC has an interface on the VLAN assigned from ISE the user will get moved to that VLAN. 

In FlexConnect it gets a bit tricker.  If the VLAN is in use by another SSID then there is no problem assigning the VLAN to a FlexConnect client.  If the VLAN isn't used by any WLAN then you first have to "push" the VLAN information out the the FlexConnect AP.  The way I have done that in the past is using the AAA VLAN-ACL mapping tab in your FlexConnect group.  Add whatever VLANs you need there and assign "none" as the ingress and egress ACL.  That will make the AP aware of the VLAN and allow the VLAN assignment in ISE to work.

View solution in original post

3 Replies 3

paul
Level 10
Level 10

Not sure if you will find specific documentation on this, but the only thing you need to add to your authorization profiles is a VLAN assignment.  Then the rest is just crafting your authorization rules to apply the correct authorization profile that has the VLAN you want assigned.

If you are doing centralized wireless, i.e. not FlexConnect, as long as the WLC has an interface on the VLAN assigned from ISE the user will get moved to that VLAN. 

In FlexConnect it gets a bit tricker.  If the VLAN is in use by another SSID then there is no problem assigning the VLAN to a FlexConnect client.  If the VLAN isn't used by any WLAN then you first have to "push" the VLAN information out the the FlexConnect AP.  The way I have done that in the past is using the AAA VLAN-ACL mapping tab in your FlexConnect group.  Add whatever VLANs you need there and assign "none" as the ingress and egress ACL.  That will make the AP aware of the VLAN and allow the VLAN assignment in ISE to work.

Thank you for the information.  This will definitely get me headed in the right direction.

Nidhi
Cisco Employee
Cisco Employee

ISE Config guide should help you with how to create authorization profile with VLAN based assignment