9800 Dynamic Vlan

[hs08]

I test dynamic vlan on my WLC 9800 with cisco ISE.

When the client successfull authenticate to ISE then the client will get vlan 101 to the client, but why the client not getting ip address?

Vlan 101 already add to the flex profile

On the client monitor i can see ISE already assign vlan 101

but get APIPA address

Switch port which connected to the AP configured as trunk port with all vlans enabled. 

Anyone know why?

If i create another SSID and pointed staticly to the vlan 101 then the client get ip from vlan 101

[Mark Elsen]

  - @hs08    Debug your problematic client(s) using instructions from : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity
                    And feed the result of the RadioActive Tracing into Wireless Debug Analyzer

   M.

[Haydn Andrews]

What is your ISE policy returning, the VLAN ID or the VLAN Name?

Do any other dynamically assigned VLANs work on that SSID?

Confirming you have AAA override enabled on the WLAN

Do you also by any chance have a VLAN on the WLC with the same VLAN ID? if so does the VLAN Name in the flex profile match the WLCs name for the VLAN. I have seen stupidity where the flex profile doesnt like it if it doesnt match for some reason

[hs08 · Accepted solution]

Solved, there is one AP connected to the port switch and vlan 101 is pruned.