Wired Guest VLAN Change Release/Renew Issue

[CONNECT-PS Technical]

i have installed sponsor guest portal and i applied it for wired user and i want to change vlan after guest registration as i added new vlan in authorization profile and new vlan applied well under interface but guest still keeping old ip address and i have to release it manually from machine and renew manually so he can get new ip address

[RichardAtkin]

You need to make it bounce the port, otherwise the Client will never know there has been a VLAN change so it will never know it needs to request a new DHCP lease.

Personally I prefer to keep Guest stuff as a single VLAN - VLAN changes are often problematic (ie, when a guest connects in the back of a PoE phone, do a port bounce and you kill the phone)

[Jason Kunst · Accepted solution]

Correct it’s not recommended to change vlan. Instead use SGT and base access off of tagging

Here is another solution

https://community.cisco.com/t5/identity-services-engine-ise/solution-for-change-of-vlan-for-wired-guests-using-smart-port/td-p/3432614

[paul]

I have developed a solution similar to the one Jason posted in my lab and it worked perfectly with Auto SmartPorts, but did not work at the customer.  My theory was that my lab switch is a single switch that processed the shut/no shut quick enough so the macro didn't remove itself.  Smart Port macros trigger when a link state changes on the port. 

In my customer they had 5-6 switches in a stack and my theory was there was enough of a delay between shut/no shut that Smart Ports caught the link change and removed itself.

[Damien Miller]

A couple quick notes on this.

If you are trying to use ISE 2.4 to perform this guest vlan change then you may run in to issues. I found that as soon as you check "Enable VLAN DHCP release" with wired guest portal the guest flow no longer works as it should. It is documented in https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvj73152
You can authenticate a second time and get access.

Second item, the dhcp release/renew function with ISE leverages java. The only browser this works in anymore is internet explorer. It's essentially a dead feature in my mind, most people I know use chrome, safari or firefox.