How to push an authorization profile from ISE to a 9800 WLC

[etarnow]

I am trying to create an authorization profile on ISE for machine authentication when using PEAP. (We are moving away from this but it has to be supported for now.) If a machine has never authenticated on wireless before, it should receive restricted access to only talk to AD to authenticate. I have been unable to figure out how to do this with ISE and a 9800 WLC (under version 17.10.x, I cannot use dACLs). Previously this was done by the Airspace ACL Name task but this doesn't seem to be supported by the 9800 controllers.

Is the way to go with web authentication? That seems geared more for guest access and not for this application.

Any help would be appreciated, thank you.

[Arne Bier · Accepted solution]

Hello

Think of the 9800 like you would any Catalyst switch - you would use dACLs to achieve this.

Have a look at this link about dACLs on 9800.

In ISE, you would create the dACL, give it a name, and then in the ISE Authorization Profile, you can select that dACL from a drop down list.

[thomas · Accepted solution]

https://cs.co/ise-guides#WLC

https://cs.co/ise-resources#Wireless

both list the ISE and Catalyst 9800 Series Integration Guide which covers

• Catalyst 9800 Configuration
• Steps 1 - 3: Define AAA
• Step 4: Create Webauth Parameter Map (Required for BYOD)
• Step 5: Create VLANs
• Step 6: Create WLANs
• Step 7: Create Policy Profiles
• Step 8: Create Policy Tag
• Step 9: Assign Policy Tag to AP
• Step 10a: Create Redirect ACL for Guest flow
• Step 10b: Create Redirect ACL for BYOD flow
• Step 11a: Create URL Filter for BYOD flow
• Step 11b: Create URL Filter for Social Network Guest access - Facebook
• ISE Configuration
• Authorization Profile with URL Filter
• Catalyst 9800 Configuration for FlexConnect Local switching
• Modify Policy Profile
• Create Flex Profile
• Create Site Tag
• Assign Site Tag to AP
• Modify Redirect ACL