NAD AP

[creserva1]

When a clients connects to our wireless networks the endpoints shows up under Context Endpoints on ISE. Since we only have one controller but we have multiple remote office and we are using Flexconnect everyone who gets profiled the network device is WLC. 

My question is how can I make ISE so when someone connects to AP1 that is on a remote office will show up AP1 instead of the WLC? Thanks

[Aravind Ravichandran · Accepted solution]

In WLC, under Radius authentication-> Auth Called Station ID Type various options are there like AP name/AP group/AP name:SSID. If you call that NAD will send AP details also in radius packet to ISE.

Once it is enable, you can see AP name details under context visibility as SSID/Called station id.

Also you can create a new context visibility report like SSID & call all the Auth attributes. So that you can filter the endpoints based on AP name under SSID column.

You can't make AP name apper under Network device. Rather that you can create a attribute like Radius: called station-id starts with <AP-name>(example: LONUKAP) & you can call that in Authorization policy. Then you can filter based on authorization policy in raidus live session.Likewise you can create as many authorization policy based on Remote locations

-Aravind

[creserva1]

There is one AP right now that shows up on the context visibility. I don't understand why and how just suddenly showed up. 

I did got this message that unknown NAD and this is not our WLC.  So I started adding AP to the NAD devices on ISE but it has not shows up yet. 

[Aravind Ravichandran]

Radius flow will be like Endpoint>AP>WLC>ISE.WLC is the one which forwards the AAA request to ISE,Hence there is no meaning in adding AP under Network device.