Cisco 9800-CL - CoA with FLEX

[przemyslaw.wieczorek]

Hi all,

I'm trying to migrate from WLC 5520 to 9800-CL and I need to create WLAN with CoA and it confused me a little bit.

I have all WLANs which use FLEX only. Now for example, I have WLAN 1 which FLEX is configured to use VLAN 100. But I've also devices that connects to that WLAN and based on ISE configuration and CoA they are switched to VLAN 4. How to configure this on 9800?

Is it Policy Profile > "Access Policies" > VLAN > here place both VLANs 4,100 as VLAN group ? Then do the rest of config that goes with CoA or maybe it should be done differently?

Thank you for all hints.

[przemyslaw.wieczorek]

I've used Cisco TAC Tool - WLC Config Converter, and it looks that configuration regarding CoA is an "unmap config". So I guess it is a case of testing different approaches with redirections and ACLs on FLEX to get that what I currently have on 5520.

[marce1000]

 -  Note that when testing you can always review  the 9800-CL   configuration with the CLI command : show  tech   wireless , have the output analyzed by  https://cway.cisco.com/tools/WirelessAnalyzer/  , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer.               Checkout all advisories!

 M.

[Rich R]

When you say flex do you mean flex local-switching?
If so then remember to define the VLANs in your flex profile.
And with CoA enabled the vlan config should just get applied.
There's a whole guide for this at https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213924-flexconnect-wlan-with-802-1x-aaa-overrid.html

And 9800 flexconnect in general: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html

[Arshad Safrulla · Accepted solution]

You will add VLAN 4 and VLAN 100 under the Flex profile. You can have VLAN100 assigned to policy profile, once the WLC receives the COA it will change the VLAN of the device.

wireless profile policy BBBBBBBB-PP
aaa-override
accounting-list ISE-Accounting
no central association
no central dhcp
no central switching
no exclusionlist
idle-timeout 43200
ipv4 dhcp required
nac
radius-profiling
session-timeout 43200
vlan 100
no shutdown

!

wireless profile flex BBBBBBBBB_FP
acl-policy POSTURE-REDIRECT
central-webauth
no arp-caching
local-auth radius-server-group ISE
native-vlan-id 149
vlan-name Quarantine
vlan-id 326
vlan-name Wireless
vlan-id 100

[przemyslaw.wieczorek]

I will check how this will work asap.

[przemyslaw.wieczorek]

That worked. I also use ACL in which name I made a typo and received log that ACL don't exist. Corrected that and all started to work Thank you.