Cisco ISE Guest-Role Attribute not working

[Marc Aemmer]

Hi there,

In our authorization profile for guest users, we configured the Airespace Radius Attirbute "Airespace:Airespace-Guest-Role-Name" with a value of "medium". On our WLC we have a QoS Role named "medium" with the appropiate data rates.

In the results pane of the ISE Live Log I can see that the attribute was sent correctly. But the data rates configured in the QoS Role are not assigned to the client on the WLC.

Any ideas?

regards,

Marc

[paul]

Why not have ISE just set the data rates?

[Jason Kunst]

I think the guest role is something that would need to be set or specified on the WLC side of things , it's not synonymous with the ise guest portal or flows it doesn't have any correlation

Please reach out to wireless team and consult with its documentation on how it is used

[Andryan Viryadi Tanamir]

Hi Paul,

Thanks for the information.

By the way, if that is enforced in AuthZ Profile in ISE, does that settings applied to per user (per client) or a group of users sharing that amount of bandwidth rate (a group of users sharing the same AuthZ profile for example) ?

Thanks

Andryan VT

[paul]

The settings should be applied per user.  The quality of service screen shot I posted was from the client detail on the WLC.

[hslai · Accepted solution]

Table 5 in RADIUS Authentication Attributes Sent by the Controller in WLC Configuration Guide, 8.3 says,

Guest-Role-Name

Note	Guest-Role-Name is honored only on L3 security web authentication with AAA over-ride enabled on the Cisco WLC.

For non-LWA use case, please use the other attributes, as Paul suggested:

Airespace-Data-Bandwidth-Average-Contract

Airespace-Real-Time-Bandwidth-Average-Contract

Airespace-Data-Bandwidth-Burst-Contract

Airespace-Real-Time-Bandwidth-Burst-Contract

Airespaces-Data-Bandwidth-Average-Contract-Upstream

Airespace-Real-Time-Bandwidth-Average-Contract-Upstream

Airespace-Data-Bandwidth-Burst-Contract-Upstream

Airespace-Real-Time-Bandwidth-Burst-Contract-Upstream

[Richard Imus]

Did you end up using the solution posted here instead of the Guest-role attribute? we have the same issue but we're using WLC 2504 and we're not able to input a late limit because our WLC doesn't support it.

[m.soleimani]

Hi

I used this method but it didn't work correctly

https://community.cisco.com/t5/wireless-security-and-network/ise-guest-access-bandwidth-management-problem/m-p/3699188/highlight/false#M55115

BR