Access Point IP addressing 2 different APs - Same SSID Diff Vlans

[aBITtooTALL68]

Hello,

This is a question on ip assignment between our APs on our 9800-40 WLC. 

I work in a school district. We allow or deny student access to YouTube by leveraging unique policy profiles that have different assigned vlans based upon which AP needs to allow or deny youtube. These unique policies are all applied with the same SSID. 

The issue we are having is that a few clients remember the IP address originally assigned on the YouTube Allow vlan when connected to an AP that does not have that assigned vlan. 

For example, AP 1 hands out address 10.1.0.0 which gives access to YouTube, but AP 2 hands out address 10.2.0.0 which denies access to YouTube. The client received an address originally from 10.1.0.0, but since the client has moved. The client is now across the building at AP 2 but still has an originally assigned address of 10.1.0.0. How do I make sure that when the client connects to a different AP (AP 2 in this example) it receives the unique VLAN information?

Any advice would be greatly appreciated, thank you!

[Flavio Miranda · Accepted solution]

@aBITtooTALL68 

 What do you see is the expect behavior  and I dont believe you can change that.

 Basically, what you are saying is that you dont want clients to roaming. They need to ask for a new IP and, therefore, they will re-associante and re-authenticate every time the move from one AP to the other.

 This is not good at all because client moves among AP even though they are in the same place. There is no way to prevent this.

[aBITtooTALL68]

Thank you, Flavio! As always, I really appreciate your input and advisement. Thank you!

We will resolve this by creating a 2nd SSID and by leveraging an MDM to help mainstream the needed network switches on demand. 

[Leo Laohoo]

We have a special OU in our Active Directory.  This policy is enforced in ISE and the rule goes like this: 

Machines assigned to this OU can join CORP SSID and ALL SITES.  

However, when the machines assigned to this OU goes to site XDX, the machines can only join the SSID if the APs are named with a certain prefix, like "-Z".