Change of VLAN on Wireless Guest

[umahar]

Hi Experts,

Does the endpoint send a new dhcp request after CoA or we face the same limitation as we face in wired where VLAN is changed on the NAD while endpoint remains on the old VLAN IP ?

[Jason Kunst]

On open networks the endpoint does not refresh its ip address. You can try a low DHCP lease. For these reasons we don’t recommend IP change.

[Craig Hyps · Accepted solution]

There is an option in Guest Portal to use applet to trigger DHCP release/renew, but functionality is more focused on workstation platforms and not applicable to mobile devices.  Functionality also entails applet which may be blocked by common endpoint security policies.

An alternative would be SGTs to segment pre-post auth traffic, or assignment to a different interface which shares same subnet. 

[paul]

Craig or Jason,

Doesn't it also depend on the Guest Portal type as well?  If the portal is a Hotspot you can set the CoA type to terminate which will cause the client's WiFi to drop and reconnect allowing the VLAN move to work correctly. 

[Jason Kunst]

Yes you can do that but likely not the case as you’re not separating users and who cares about hotspot users being segregated right?

Also keep in mind if you disconnect some clients (we have seen android) they will have issues reconnecting and may even switch SSID if other OPEN networks are in range

[paul]

Yep true enough. I advocate for no VLAN moving as well.