cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
 
Register for the monthly ISE Webinars to learn about ISE configuration and deployment.
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

486
Views
0
Helpful
10
Replies
Explorer

WLAN Interface Groups with Cisco ISE

Hi,

Is it possible in Cisco ISE to push wireless interface group for WLAN 802.1x?

Also, is it possible for ISE to have an authorization policy like the following logic,

1. Each floors will be configured with a wireless ap-group (example, Level 1 will be having AP-Group A).

2. Each AP-group will be assigned into a VLAN (example, AP-Group-A will be having VLAN 10).

3. In ISE, if the users connects to this particular ap-group (AP-Group-A) then ISE will push VLAN10.

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions
VIP Advocate

Re: WLAN Interface Groups with Cisco ISE

Vlan Groups (for Cisco Switches) and Interface Groups (for Cisco WLCs) can be done if you simply return the "name" of the Group in your ISE Authorization Profile.  I do it all the time for WLC's and for Cisco Switches.

 

And yes you can return Authorization Profiles for just about any condition that you can think of.  But I would recommend using something that works universally. Groups are a good abstraction - and they also take care of DHCP exhaustion by performing DHCP snooping.  If the client doesn't get a DHCP response then the Switch/WLC just runs the hash algorithm again.

View solution in original post

10 REPLIES 10
Beginner

Re: WLAN Interface Groups with Cisco ISE

Hi,

 

1- you could group your APs per floor and give them a specific name.

in the author Policy put a condition for called-station ID begins or ends with the specifies group name.

Point to an author profile that u can push a vlan like vlan 10 for example.

 

Please rate if helpful

 

 

 

 

VIP Advocate

Re: WLAN Interface Groups with Cisco ISE

Vlan Groups (for Cisco Switches) and Interface Groups (for Cisco WLCs) can be done if you simply return the "name" of the Group in your ISE Authorization Profile.  I do it all the time for WLC's and for Cisco Switches.

 

And yes you can return Authorization Profiles for just about any condition that you can think of.  But I would recommend using something that works universally. Groups are a good abstraction - and they also take care of DHCP exhaustion by performing DHCP snooping.  If the client doesn't get a DHCP response then the Switch/WLC just runs the hash algorithm again.

View solution in original post

Explorer

Re: WLAN Interface Groups with Cisco ISE

Hi @Arne Bier , thanks for the feedback.

What in particular should I use for the authorization policy in ISE for me to have if user is connecting to this particular "AP-Group", then push the VLAN?

Thanks

VIP Engager

Re: WLAN Interface Groups with Cisco ISE

I am not sure if you are just giving an example or really trying to have AP groups per floor on different VLANs.  I think that will be disastrous as you can't control client roaming that precisely.  It is completely possible on client on floor 3 will roam from a floor AP to a floor 2 AP back to a floor 3 AP as they walk around floor 3.  If you move the client onto a different VLAN when it hit an AP on floor 2 the client will most likely be stuck because it will have an IP from floor 3 and not know to refresh.

Explorer

Re: WLAN Interface Groups with Cisco ISE

@paul , based on my understanding in your statement, it is much better to have the wireless in 1 VLAN?

VIP Engager

Re: WLAN Interface Groups with Cisco ISE

I am just cautioning that you have to think of client roaming and not necessarily always roaming to an AP on the same floor.

Explorer

Re: WLAN Interface Groups with Cisco ISE

hi @paul , actually there is a real life scenario there that i need to take into consideration.

so every time a client goes to different floor and have a different ap-group, ISE needs to send out CoA to grab a new IP in that ap-group.

 

VIP Engager

Re: WLAN Interface Groups with Cisco ISE

You are talking about client physically walking from floor 1 to floor 2, but I am saying that is not how wireless works. Client could be walking on floor 2 and be roaming between APs on floor 1 and floor 2.  If those are mapped to different VLANs you are going to most likely disrupt the client's communication.  The client will not know to refresh their IP because there is no network adapter event.  The client is simply roaming on the same SSID.

 

I would test it in the lab before trying anything like this in productions.  Setup two APs each with different VLAN assignment and roam between the two and watch your client get stranded when it roams from one to the other.  I could be wrong, but I pretty sure you will see a disruption.

Beginner

Re: WLAN Interface Groups with Cisco ISE

Hi Arne,

How is this configured on the WLAN and ISE? Is there documentation/examples available that you know of?

Thanks

Highlighted
VIP Advocate

Re: WLAN Interface Groups with Cisco ISE

Hi @gschmitt.ngit 

 

You're asking about the dynamic VLAN override on a Cisco WLC? The concept is that you return a VLAN name (string) instead of the VLAN number (numeric). On the WLC you always give an Interface a name. That WLC Interface Name string would be a valid string that ISE can return to the WLC during a RADIUS authentication. If your WLC is using Interface Groups, then put all your interfaces that you want/need into that Group, and tell ISE to return the Interface Group name string to the WLC during RADIUS auth.

 

below is an example from an AirOS WLC which has an Interface Group with a very creative name of "test".  That Group contains one VLAN at the moment - vlan 390, whose Interface is called 'dmz'.

 

comm04.PNG

 

In ISE I would return an Authorization profile that looks like this

 

comm05.PNG

 

You have to ensure that the WLC WLAN is configured to allow AAA Override.

comm06.PNG