Dynamic VLAN assignment on Wireless MAB endpoint

[tcp_analysis_flags_eq_1]

Scenario: Printer is connected to WLAN network and authenticated to ISE using MAB

Problem: MAB Authentication is successful but the MAC address is currently learned at both VLANs

VLAN A = Default WLAN VLAN
VLAN B = Printer VLAN

I have setup the policy in ISE to match the endpoint group where the printer is located and to call an AuthZ profile to change the VLAN. I try to put a static IP on the same network as VLAN B but still not working.

Any thoughts.

[ahollifield]

What is the NAD?  Is VLAN B actually present on the controller?  

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

[tcp_analysis_flags_eq_1]

NAD is C9800 controller, the APs are in FLEX MODE, and yes the VLAN is on the controller as it was able to return it to the endpoint and I am seeing the endpoint in VLAN B as well.

[ahollifield]

So what’s the issue? Is VLAN B exposed to the FlexConnect AP?;

[tcp_analysis_flags_eq_1]

Problem is that the MAB endpoint is currently learned from two VLANs and the correct VLAN is not working as I am not seeing an ARP entry for the IP configured on the endpoint, and when I do via DHCP its not getting IP and the state of the endpoint is stuck in IP_LEARN. I verified that the there is no problem with the DHCP

[ahollifield]

So is VLAN B properly trucked to the FlexConnect AP?

[tcp_analysis_flags_eq_1 · Accepted solution]

Hello, Yes, actually just managed to solve this by removing the endpoint from the endpoint group, readding it was able to get the DHCP now.

[MHM Cisco World]

Sorry I reply late but how endpoint authz with two vlan?

Can i ser how you config ISE?

MHM

[muqaddasghaffar5]

I had a similar issue with dynamic VLAN assignment for my printer using MAB in Cisco ISE. The printer was being assigned to both VLAN A (default WLAN VLAN) and VLAN B (printer VLAN). After checking the policy and static IP settings, I realized the switch port wasn’t correctly configured for dynamic VLAN assignment. Once I corrected the switch port settings and ensured VLAN trunking was enabled, the printer was properly assigned to VLAN B.

This experience reminded me of optimizing network performance for gaming, like prioritizing gaming traffic to prevent lag—just like how we prioritize devices like printers to improve overall performance. Hope this helps!