Interface group in WLC 5508 didn't work

[giangle]

Hi all,

I have an issue with WLC 5508 as below:

Diargram:

WLC 5508 ----- Cisco 9300 ------- Cisco APs (Trunking vs natvie vlan 155 for management)

WLC and APs is using OS 8.5.135.0

We have 3 vlan: 155.0/24 (management) to configure IP management for WLC and APs

vlan 141.0/24 is using for ssid 'staff' with Interface 141.x. When User conect ssid 'staff', they can receive IP from DHCP server.

vlan 157.0/24 is using for ssid 'tablet' with Interface 157.x. When tablet conect ssid 'tablet', it can receive IP from DHCP server.

Issue is:

Because vlan 141 (with ssid 'staff') is using for over 250 devices so it is out of IP address. I extended ssid 'staff' to vlan 157 and reconfigure 'staff' with Interface Group (with 2 Interface 141 and Interface 157).

When User connect ssid 'staff', they only receive IP from vlan 141 and cannot receive IP from vlan 157. 

Attachment are my configuration. Please help me to fix it. Thanks

[Leo Laohoo]

---

@giangle wrote:

When User connect ssid 'staff', they only receive IP from vlan 141 and cannot receive IP from vlan 157. 

---

Maybe the SSID or the AP Group is still pointing to the VLAN interface.

[giangle]

Hi @Leo Laohoo 

How can I verify SSID or AP group is still pointing to VLAN Interface instead of Inteface Group. Attachment is in Interface Group. It's configured to Interface Group.

Please help me. Thanks

[Leo Laohoo]

---

@giangle wrote:

How can I verify SSID or AP group is still pointing to VLAN Interface instead of Inteface Group. Attachment is in Interface Group. It's configured to Interface Group.

---

Look at the settings of the SSID. 

For the AP group, look at the tabs.  

[giangle]

Hi @Leo Laohoo 

I checked for SSID and Interface, Interface group. It's OK. But if Cisco have command to check. Please guide me.

[Leo Laohoo]

---

@giangle wrote:

But if Cisco have command to check. Please guide me.

---

Does the controller have AP-Group specified configuration(s) or not?

[Scott Fella]

The WLAN vlan mapping is overridden by the AP Group.  So in your screen shot, if the ap is part of that ap group, then the interface group is being used.  Create a test SSID and map that to one vlan at a time and validate that it is working.  If you are using radius and AAA override, that could be the reason it's not working as you need to use an airespace attribute to define the interface group.

[giangle]

Hi @Scott Fella 

For this SSID, we are using AAA overriden and RADIUS to authenticate to RADIUS server in 2016. Can you guide me to fix it ? Thanks!

For 'you need to use an airespace attribute to define the interface group.' --> how can I configure ?

[Rich R · Accepted solution]

You must have configured it initially surely?

Do these help?

https://community.cisco.com/t5/security-documents/ise-radius-network-access-attributes/ta-p/3616253

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/91392-airespace-vsa-msias-config.html