Vlan precedence

[ramziabdelhak]

Hello,

On a C9300L switch, i have interface with ISE Dot 1 x configuration, what i want is that the statically assigned vlan using " switchport Access vlan XX" takes precedence over the vlan pushed by the ISE after a succesfull authentication,

For now, the ISE assigned vlan takes effect,

is there a solution ?

Thanks in advance

[Rob Ingram]

@ramziabdelhak you should modify your ISE authorisation rules to not push down the VLAN to the switch as this takes presedence over the statically assigned VLAN.

[ramziabdelhak]

Thanks for the reply,

But this type of configuration has already worked with 3750 Switch serie, do you it  is purhaps a deprectated behaviour ?

Thnks

[Rob Ingram]

@ramziabdelhak sorry, not sure, that's not my experience.

Why do you need to send a dynamic VLAN assignment if you do not wish to use it? You can modify your ISE authorisation rules to send (or not send) a dynamic VLAN depending on the NAD group, connected user etc.

[ramziabdelhak]

Hi @Rob Ingram 

On the ISE, there a bunch of policies that apply to hundreds of users, and only 20-30 of them needs a special vlan; so instead of creating a new policy for them, we assign it statically on there interfaces.

[Rob Ingram]

@ramziabdelhak sure ok, create a group (or a couple of groups) for those 20-30 users, create an new authorisation rule(s) above the existing rule(s) and match against the group of users and push the dynamic VLAN. Then on the existing rules remove the dynamic VLAN.

[ramziabdelhak]

@Rob Ingram Thank you, i think it is a more scalabale solution,

Nevertheless, i realy want to know why this behavious was once supported by the 3750x,

Thanks again Rob

[Peter Koltl]

Probably the dynamic VLAN will not be applied on this switch if the 

aaa authorization network ... group RADIUSxxxx

command is removed. But it may have other effects.

[ramziabdelhak]

Hi @Peter Koltl 

That would not be possible since removing this command will desable AAA authorization on the switch as a whole,

Thanks for your help