dynamic vlan assigignment WLAN with ISE and Catalyst 9800

[Geert Reijnders]

Hi all,

I have the following situation. If a client connect wireless to our company network, ISE needs to decide in which VLAN it should connect. This part works. I can see that ISE assigns a different vlan and I see in our Controller that this vlan is assigned. However, the client does not get a IP address in that vlan. I know I need to tweak the DCHP lease time a bit, but even if I do a ipconfig/release, renew, I don't get the right IP address. We use flexconnect and I can see on the switchport that the MAC address from the client is still connected in the wrong vlan. 

The WLC is a catalyst 9800 running 17.03.06

The AP is a Catalyst 9120

ISE is running 3.1

See attachments for detail client info 

Does anyone has an idea in which direction I need to look for troubleshooting?

Thanks,

Geert

[marce1000]

             >....Does anyone has an idea in which direction I need to look for troubleshooting?
 - Start with a checkup of the current 9800 configuration with  the CLI command : show  tech   wireless , have the output analyzed by  https://cway.cisco.com/tools/WirelessAnalyzer/  , please note do not use classical show tech-support (short version) , use the command denoted in green for Wireless Analyzer.      
           Also review your settings according to https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/217043-configure-dynamic-vlan-assignment-with-c.html

  M.

[Karsten Iwen · Accepted solution]

A typical problem for this is that the VLAN was not added to the AP on the Flex-Profile:

Also check that the VLAN is added to the trunk where the AP connects.

[Geert Reijnders]

I added the vlan to the flex profile and it was working. Thanks!

[Karsten Iwen]

A very common mistake ...