cisco wireless

[shaikh.zaid22]

hi all,

we are implementing a dynamic vlan allocation in wireless network, via forescout nac.

the clients are first joining to ssid and getting the ip range, however, the clients are getting correct ip address only when they disconnect and connect back. 

The WLC is cisco 9800 in between the client and NAC.

any guidance is appreciated

[Mark Elsen]

 - You may find this guide informative  https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/217043-configure-dynamic-vlan-assignment-with-c.html , I know it discusses ISE not forescout , but it would be advisable to review the document , also  review the 9800  current  configuration with the CLI command : show  tech   wireless , have the output analyzed by  https://cway.cisco.com/tools/WirelessAnalyzer/  , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer.               Checkout all advisories!

 M.

[shaikh.zaid22]

Hi marce,

I have done the config according to the above document. the configuration works fine, only when we perform a re-authentication from the forescout nac. That too we have to disconnect the client and connect back to take a proper vlan ip address.

i am planning to open a tac, since the debugs also not giving much info.

[Mark Elsen]

 - Ok, you can also do client specific debugging using these info's : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity  (if not yet done) , client debugs can be analyzed with  https://cway.cisco.com/wireless-debug-analyzer

[Rich R]

First question: what version of IOS-XE are you using?

TAC can be quite unhelpful when you use anything except ISE so good luck with that.  Best to get packet captures of the radius and full radioactive traces of the client to make sure Forescout is sending it correctly from the start and see how WLC is handling it.  There have been some bugs around dynamic VLAN allocation so maybe you're just running an old IOS which doesn't have those fixes but if your IOS is up to date (see links below) then I'd be inclined to think it's Forescout that's at fault.

[Arshad Safrulla]

Have you confirmed COA is enabled in Cisco WLC side? Enable it under the Radius server settings and also enable AAA override and NAC state under the policy profile. If still not working, then post a sanitized RA trace from a client.