ACS 5.2

[NAVIN PARWAL]

Folks,

          I am new to ACS5.2, I am setting up a wirless network and want to write a policy where desktops will go in a specific vlan and laptops would go in a specific vlan. I am reading documentation on ACS 5.2 and it does talk about device type. Any anyone point me in the right direction, how to use this attribute to authenticate based on device type (desktop or laptop).

Thanks,

Parwal

[Scott Fella]

Well this will be pretty hard to explain:)

First off you will need to do 802.1x on both your wired and wireless (I'm going to assume you know how to do this).  Then I would define your NDG (network device groups) which state switches, routers, wireless.  This will help in defining your polices under Access Polices | Default Network | Access.  To specify the vlan you want place the device on, you would configure Authorization Profiles.  This is located in the Policy Elements | Authorization Profiles | Network Access.  You will need to create a new Authorization Profile, enter a name and description, click on Common Task and define your VLAN as Static and enter the vlan under the value

Then in your Access Policy, you would add your Policy Element you just created.  I also specified what devices this policy should be applied to (NDG)  See below:

That is it in a nutshell:)

[NAVIN PARWAL]

Anyway I can distinguish between laptops and PDA's on ACS 5.2?

Your example only includes controllers which are added on the ACS server.

If I want to distinguish between Laptops and PDA's and send different vlans to them, how would i do that as they are only clients?

[Scott Fella]

You would need ISE for that. With ACS you can differentiate between a wired and wireless. Now for a laptop on your domain, you can use machine authentication and the policy would point to AD computer group. The PDA's would authenticate using peap and that is one way of forcing a vlan change.

Thanks,

Scott Fella

Sent from my iPhone

[George Stefanick]

Scott, plus 5+...

I didnt realize you were a master at 5.2 .. I may need to hit you up on some questions!

[Scott Fella]

Haha. No problem George. Anytime... I lab a lot of stuff for my company so I get to see what works and doesn't.

Sent from Cisco Technical Support iPhone App