cisco wlc 9800 assign a ssid with realm vlan

[unsuspecting user]

Hello everyone,
i have a question regarding 802.1x and realms on a C9800 on 16.12.03.
I would like to have a SSID for all users who want to join the realm user@test.com in vlan 10.
This works as well, the Authentication with an accept lets the client join.
But now I would like to have the same SSID for the clients with the realm user@other.test.com only in vlan 11.
Other users with user@other2.test.com in vlan 12 and so on.

Does the VLAN have to come from the Free Radius Server, or is an acceppt from the Radius Server enough?
Is it possible to choose in which VLAN the client should be connected via the Cisco 9800 Controller (a rule that changes realms to vlan)?

Is there a term that explains this procedure?
I have seen this procedure on a WISM2, but I don't know what it is called.
I also don't know if the VLAN assignment of the realm is sent by the Free Radius server.

Thanks a lot

[Scott Fella · Accepted solution]

Vlan assignment always come from the radius server. If the radius server supports that to AireOS then you are good. I would with ISE and also Microsoft NPS back in the days and it’s the rules that you specify that will allow you to differentiate between the username in your case. The use of regex in the polices is what you need. You might want to hit up the forum for the radius server you are using to get a better idea of how to implement that on their solution.

[unsuspecting user]

Hi, Scott,
thank you for your quick response.
I thought it was important to mention.
Of course the trunk must have the VLAN you want to use.
And I think the function "AAA Override" must be activated as well, I'll test this in a moment.

Many greetings

[Scott Fella · Accepted solution]

AAA override is required if you plan on accepting change provided from the radius server. Without that enabled, the controller will not accept any change that the radius server sends.