ISE configuration in WLC migration

[ppnlr]

We are migrating wlc from aireos to 9800 existing wlc is integrated in ISE for 802.1x authentication. inorder to take the ise configuration for wlan in the new wlc, our idea is to add the IP of new wlc in the network device group> all wlc since policies is pointing on this device group. Just want to know if this correct or there are other config that needs to be done.

[marce1000]

 - Will probably work ; concerning >....are other config that needs to be done. ; review this documentation :
             https://community.cisco.com/t5/security-knowledge-base/ise-and-catalyst-9800-series-integration-guide/ta-p/3753060

 M.
                  

[ppnlr]

would like to verify if that would work and no problem would be encounter on the old wlc since it should work parallel first during migration.

[balaji.bandi]

Cat 9800 you need to create AAA

Configuration --> Security --> AAA  (in the Services Radius)

Add ISE Server you have and if you like to Group them  Server Group and create new and add multiple ISE in to that)

configuration --> tags & Profiles --> WLAN (select SSID Profle) Security --AAA Select the List fom the Server group you created

on the ISE Add WLC NAD IP  and Also how you would like to authenticate users.

[ppnlr]

done on the config in wlc side. question is about how can the new wlc adapt the policies of the old wlc in ise. it would be good if adding the new wlc in network device group will work. hehe

[ammahend]

ISE policy decision is based on condition match, not necessarily the authenticator appliance, Just make sure your ACL list, ACL names, Custom radius timer etc are replicated to new WLC properly.