Cisco ISE authorization

[surazb]

Hi Experts, 

I have setup where Clients connected on WLC-9800 SSID should get Vlans assignment from Cisco ISE authorization Profile, But it still clients gets IP from Access Policy configured on WLC-9800

AAA is configured on WLC with Mac Filtering and authorization list
AAA override and NAC state is selected
ISE is configured with authorization profile and with authorization plicy
Client MAC is added is Cisco ISE identity group
Strange this is ISE logs says that authorization success with correct authorization policy but actually VLans are not pushed to client 

Can you guys please help me where i went wrong, If needed i will share config snaps 
Thanks Guys

[marce1000]

  - Start with a sanity check of the  WLC-9800 configuration using the CLI command
     show tech wireless and feed the output from that into Wireless Config Analyzer
          (Use the full command denoted in green, it does not work with a simple show tech-support )

    M

[MHM Cisco World]

In wlc 9800 do you enable CoA and set password?

MHM

[surazb]

Yes, CoA is enabled with password

[MHM Cisco World]

Point to check

1- aaa override must enable 

2- if you use dyanmic vlan then you need to select vlan all under wlan profile

MHM

[surazb]

1 - Yes, AAA override is enable
2- I want ISE to push vlans through Authorization Profile so
locally configured vlan under wlan will does not matter

[MHM Cisco World]

You want to make ISE dynamic assign vlan to wlan

So it matters 

Check below link

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/217043-configure-dynamic-vlan-assignment-with-c.html

MHM

[Rich R]

- What version of software are you using?

- Have you run a Radioactive Trace on the client MAC to confirm the WLC is receiving the AAA VLAN override from ISE?
Use Debug Analyzer (link below) to clean up the RA trace output.

[surazb]

1 - WLC Version - 17.12.4
      Switch 3750 - 15.2.(4).E10

2 - Nope, But i will run radioactive test and check the logs 

Thanks guys for help

[marce1000]

 - @surazb  Execute the WirelessAnalyzer procedure from my initial reply also. Consider that mandatory ,

 M.

[surazb]

1 - WLC version - 17.12.4
Switch 3750 - 15.2.(4).E10

2. Nope, i will do Radioactive trace and observe logs

Thanks for help guys

[Saikat Nandy]

One more important thing in addition to the suggestion been made by other experts - the vlan you would like to push via AAA override need to be present in the WLC switchport - if it is local mode AP/central switching or should be present in the AP switchport - if it is flex mode AP/local switching.

[surazb · Accepted solution]

Hi Guys, 
Thanks all for your support 
Issue got resolved, actually there is no correct flex profile colled under site tag, after putting correct flex profile it works as expected 
Thanks guys