Catalyst 9800 and CCC

[besart-rexhepi]

Hi,
From Catalyst Center I send out two SSIDs.
These SSIDs and their settings must apply to all my sites (Network Hierarchy).

However, I need to change the NAS-ID for one of the SSID on specific access points (not buildings or floors) that can be located anywhere in the environment.

I manually created one policy under "Wireless AAA Policy" for my NAS-ID setting in the WLC. I apply it in a tag policy and I put this setting manually on the specific access point by changing "policy" to the one I created manually (see screenshot).

The problem will be the next time I make a Provision from the Catalyst Center. Then it overwrites the manual setting I did from my WLC..

How do I prevent this?

[Haydn Andrews]

You have to configure everything from CCC otherwise it will override on next provision.

Look at AP zones and put a tag on an AP to get it into the zone and that will then mean u canuse the NAS-ID based on the policy tag

Can i ask what is the use case of why u need it seperate to an entire floor level as it could cause client issues depending on what the settings are

[besart-rexhepi]

Thanks for your reply but I don't know how AP Zone will help me as I can only change the RF-Profile there. If the device is tagged with "SelReg", I can only change the RF-Profile for one SSID.

"Look at AP zones and put a tag on an AP to get it into the zone and that will then mean u canuse the NAS-ID based on the policy tag" - Do you mean that APs that are tagged under the AP-Zone can use the NAS ID that is set under the SSID but not those who are not tagged?

In ISE I have two Guestportal. One with self-registration and one without. In WLC 5520 I created AP Group with NAS ID "SelfReg". There I could put APs that would show the Self-Registration portal and still use the same SSID.

For example, we have APs in schools where the management wants Self-registration on a specific AP only and not on all APs that are on the same "floor" as it is when configuring from CCC.

Where in AP Zone can I associate the tag with a Wireless AAA Policy for specific NAS ID?

[Haydn Andrews · Accepted solution]

Under the SSID in CCC you have this option

Then under the wireless network profile create a custom Policy Tag

And us AP Zones to apply to which APs you want it to go to

Then in ISE use the AP Policy Profile and a regex to match part of the custom profile you create

[besart-rexhepi]

If I have the SSID lets say "Guest" on Global so that it spans the entire hierarchy. I set the NAS ID "AP Policy Tag" under Networks Setting --> Wireless --> SSID

This setting will apply on all APs and not just APs that are in the AP Zone. The AP Zone will only change RF-Profile I think.

I will try this tomorrow but find it hard to believe it works like that.