ACS 5.2 Assign VLAN based on AD group

[messagevector]

I'm trying to configure ACS 5.2 to assign the VLAN to a user dynamically based on the AD group that the user belongs to. I've gone into:

Users and Identity Stores -> External Identity Stores -> Active Directory -> Directory Groups tab

and selected the group name from the AD. If I understand correctly, I should now see this group under:

Policy Elements -> Authorization and Permissions -> Network Access -> Authorization Profiles -> Common Tasks -> VLAN ID/Name

However, it does not. Am I missing something?

[Nicolas Darchis · Accepted solution]

No.

"VLAN id/name" is, at the name clearly states, a vlan id or name. Not a "group name".

You don't assign a group name as vlan.

The group name has to go in the "if" condition of your authorization profile. If "AD user group= x" then assign this vlan.

Then the vlan id/name is you typing manually what vlan relates to the AD user group.

If it creates too many rules because you have a lot of AD groups, what you can do is create an AD attribute in AD storing the vlan number or name and ACS will simply return that.

Nicolas

[messagevector]

Thanks, that seemed to point me in the right direction. Basically, I selected Static and then put in the VLAN ID that I wanted to assign to the user (based on his/her group in AD). This works for me since I only have a handful of AD groups that need special VLAN assignment; all others get the "access" VLAN specified on the switchport. Your approach on getting the VLAN ID fom AD makes sense also. Thanks.