Cisco av-pairs SSID vs Dynamic Vlan Assignment

[Konstantin Kabassanov]

Hello,

Once upon a time, there was a Cisco av-pairs attribute to allow a Wireless user to a given SSID through Radius servers.

If I'm not wrong, this feature has not been supported anymore (for several years) on WLC.

Dynamic vlan assignment is an alternative way to control user acces to a given vlan. It simplifies the architecture, because only one SSID is needed and the user traffic is then redirected to the right vlan. But... There is an important issue with it, since only one SSID (and BSSID) is used, broadcast packets from all vlans are transmitted to everybody. It is an issue when some services use broadcast to announce their features (IPv6 autoconf, Bonjour, and so on...).

So the question is if a working alternative to SSID av-pairs exists.

Thanks.     

[Scott Fella]

To be honest, I have never heard of this SSID av-pair ever working in wireless:)

You would need at least two ssids and the radius server would need to ability to send a CoA to dissassociate the device so that the device would join the other SSID. The radius server would also have to push out the wireless profile to the client for the SSID they need to associate to. This can be done using Cisco ISE, but not Microsoft radius or even Cisco ACS.  

You can still use aaa overuse to place devices on specific vlans and use the WLC to allow bonjour or  ACLs to filter what you don't want going out of the vlan.  WLC has bonjour capabilities and thus you can specify that on the interface and not on the WLAN.  If course their are limitations, but with newer requirements means that there is no one answer.  You might be able to meet certain requirements, but other you will have to sort of figure out.  

-Scott

[Konstantin Kabassanov]

Scott, SSID av-pair worked pretty well on autonomous APs. User is simply allowed to associate or not if the SSID network he tries to connect to is the same as the one in the av-pair...

[Scott Fella]

That is called-station-id on the radius policy.

-Scott

[Konstantin Kabassanov]

Pardon?

The called-station-id is the AP on which the client tries to connect to. It receives a reply from radius server with eventually the av-pair: "SSID=MySSID". Then it tries to match this SSID with the one the client tries to use, and if success then it allows the connection.

Konstantin  

[Scott Fella]

From what you mentioned here, "User is simply allowed to associate or not if the SSID network he tries to connect to", called-station-id can be used.  yes the AP sends the information to radius and your policy can send and accept or reject based off of the rules, which includes the called-station-id.  Again, I don't know of any av-pair that switches SSID's.

-Scott

[Viten Patel]

Hi,

i dont necessarily agree that all broadcast traffic from all vlans will be forwarded to all other vlans.

wondering if you have a over the air sniff to show that.

you can enable igmp snooping to at least limit the forwarding of multicast traffic to only desired clients over the air.

[Konstantin Kabassanov]

Viten,

My concern is over the air. Since the bssid remains the same for all clients and the destination ethernet address is the broadcast one, there is no way (IMHO) to ignore packets from a vlan the client does not belong to... Typically IPv6 RAs...

[Viten Patel]

Hi, but how many clients are you expecting on a single AP radio?

also, you can have ACLs to block the broadcast if you want to ignore that traffic.

[Konstantin Kabassanov]

Even with only 2 clients, if they are on different vlans, they will both take broadcast trafic from the 2 vlans (IPv6 autoconf for instance and they will create their ipv6 addresses on both networks)).

Let's say we are talking about "multicast" traffic. It is rather difficult to block it completely, and on the other hand you can see all the time similar services using not unicast addresses on multiple vlans.