dynamic vlan assignment with openldap

[k.abillama]

Hi,

I have a scenario where my customer has an ACS 5.2 and couple WLCs. the customer has also a openldap database and needs to do dynamic vlan assignement for his wireless user against this database. I know that for Active directory it works, please advise if it does as well for openldap and how?

Regards,

[Tarik Admani]

Yes this should work from the openldap as well. You will need to retrieve the directory groups once your openldap configuratoin is tested and complete.

After retreiving your group you will the proceed to create your access policies (authorization profile) there you will create the vlan assignment that you want. Once you create your authorization rule you will merge the open ldap group with the authorization policy.

Keep in mind its not openldap that provides the vlan, its the conditions you want to meet in order to trigger the vlan assignment from ACS.

Thanks,

Tarik

[Tarik Admani]

Here are the links to what i was referring to:

Creating the ldap database -

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/users_id_stores.html#wp1053043

Creating the authorization profile -

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/pol_elem.html#wp1052999

Creating the network access rule -

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/access_policies.html#wp1064991

Hope this leads you in the right direction.

[k.abillama]

Thank You tarik! and it works even if the user have an MSCHAPv2 client. There are some links that say that mschapv2 with ldap doesn't work.

[Tarik Admani]

No it doesnt work if you are using mschap v2 here is a grid of the supported eap based protocols and the directory services:

You can find this information here:

http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/eap_pap_phase.html#wp1045863

Hope this helps.

[k.abillama]

Hi Tarik,

I've been through the document but I thought there could be a workaround avaialable as I've seen some posts where customers have freeradius and ldap backend  working for mschapv2.

Anyway, what could be an alternative if the customer is a university and the end user could have any kind of OS,PDA...etc?

Regards,

[Tarik Admani]

If you have to use openldap, then those authentication protocols is what you will have to use. I dont understand how freeradius is able to convert a mschap v2 authentication protocol in order to work with ldap. An alternative workaround would be to use the ACS internal database if you want to keep all your mschap v2 settings and if you do not have a MS AD environment. You can group users in the ACS database and if you plan to grow your acs environment you can setup additonal servers as part of distributed system.

Thanks,

Tarik