CSCvv16183 - support of DACL on 9800 WLC platform.

[thedamntech]

I was surprised dACLs just barely got partial support in the C9800 series. The C9800 platform has been out for 4 years. Anyone working with an very old 5508 or any of the newer platforms preceeding the C9800 series had dACLs, fully functioning, including flexconnect.

Flash back to 2012, we were told we can do hreap(flexconnect) with ACS5, no problem. And through the years flex controllers came out, many other wireless technologies, ISE and those worked with centralized security and dACLs, no problem.

What happened to the C9800 that broke the relationship with ISE and centralized security deployment? Is there another solution or is the C9800 platform still playing catchup after 4 years?

[marce1000]

 - Ref : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214855-ios-xe-wireless-feature-list-per-release.html
  >...

Dublin - 17.10.1

• Downloadable ACL (dACL) support for central switched deployments. No support for dACLs in Flexconnect deployment or on EWC-AP platforms

 M.

[Haydn Andrews · Accepted solution]

You could always go down the path of SDA or SGT to make this happen, although not a quick as implementing a dACL would be.

[thedamntech]

Ok, that makes sense they want people going SDA, which has been a bit of a slog so far. I was thrown off because there was a point in time Cisco was pushing FlexConnect hard, and it simply worked perfectly for us. However, there are some caveats, as with all things, when migrating. Thank you, for this suggestion.