Cisco ISE Windows 10 DHCP issue... Log in with a local user, the VLANS do not change... Must perform IP address renew

[AndrewWestPMP60307]

Our Windows 10 environments, when logging in with a local user, the VLANS do not change and the user still has to do an IP address renew.  What are some Cisco Community suggestions to overcome this pathology?

[Colby LeMaire]

The solution depends on what the actual issue is.  Assuming you are doing dynamic VLAN assignment using ISE.  Are the authentications successful and the correct authorization profile being pushed down to the switch?  Or are the authentications failing because the account is a local user?  If they are failing, then that is the issue and the authorization profile won't be assigned.

[Greg Gibbs · Accepted solution]

Dynamic VLAN assignment can be tricky as the endpoint supplicant needs to be able to detect the VLAN change and request a new IP address from DHCP. The vast majority of endpoints cannot natively do this on Wired connections.

If the switch is showing the VLAN change, but the endpoint is just not detecting it, there are a few options to work around this:

1. Use a 3rd-party supplicant like AnyConnect NAM that can detect dynamic VLAN changes
2. For Low-Impact Mode, block DHCP in your pre-auth ACL (this can have adverse affects for endpoints that are sensitive to DHCP timeouts)
3. Move to Closed Mode (this can also have adverse affects for sensitive endpoints)
4. If using a Linux- or Unix-based DHCP server, set an aggressive DHCP lease (in seconds) in the scope for your starting VLAN
5. Consult Microsoft to see if the NCSI (Network Connection Status Indicator) can be tweaked to help detect VLAN changes

Cheers,

Greg