Dynamic vlan using Cisco ISE

[Chaminda1912]

Hi all,

we have deployed voice solution across the estate using dynamic vlan via Cisco ISE. All the switches configured with vlan 5 as the default vlan and voice vlan will be vlan 488 ,deployed via cisco ISE using dynamic vlan.

My question is , if both ISE nodes (primary and secondary) goes down , will it break the voice traffic as dynamic vlan will enforce via cisco ISE and if both ISE nodes gone down , default vlan (vlan 5) will be passing traffic oppose to voice vlan (488).

Appreciate your advise on this 

[Arne Bier]

@Chaminda1912- to your question about DHCP and critical auth - the client initiates the DHCP based on some initial trigger - either due to a link up, or a device driver restart - the switch can't trigger this unless you can somehow cause a port bounce (which in itself can cause issues with PoE devices). Long story short - dynamic VLAN assignment and DHCP don't play well together, unless you can ensure that by the time the client sends the DHCP Discovery packet, that the switch has set the intended VLAN that will result in a DHCP Offer etc. If somewhere along the lines the client's VLAN is switched, the client won't know about it. You can imagine the rest.  

[Ping Zhou]

This is a great news… Do you mind to share the screenshots of the ISE Auth Profile where you specify the voice vlan ID or name, and the corresponding Cat9k switch port config as well? Much appreciated. 

[Chaminda1912]

@Arne Bier if a phone connects to back of a pc ,switchport can configure as access session  host-mode multi domain as per below

https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_8021x/configuration/xe-3se/3850/sec-user-8021x-xe-3se-3850-book/sec-ieee-mda.html

[k2no]

Hi, 

I don't use IBNS 2.0 on a lot of legacy switches which can be a nightmare to manage and which is not common for everybody yet..

Usually I just set set up critical vlan on switch interface by keeping the legacy model such as : 

authentication event fail action (next-method | authorize vlan XX)  -> If auth failed
authentication event server dead action authorize vlan XX -> If K.O
authentication event server dead action authorize voice -> If K.O For voice
authentication event server alive action reinitialize -> Once reachable remove critical vlan and go back to common authentication with ISE

 I never experienced any issue with this kind of configuration even in testing phase where ise cluster was fully down. 

Hope it's help.

[Chaminda1912]

Thanks