Still Stuck in Attribute List and multiple SSID in WLC9800..

[eeebbunee]

Hello Professionals,

I read this https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/mac-authentication-bypass.html#config-mab-external-auth-gui and succeed the mac filtering with specific WLAN test.

My next test is one mac address with multiple WLAN connection, but not all WLAN access.
I'm not sure WLC9800 provides 1 or ALL allow, but if multiple WLAN access is possible please teach me.

My test keeps failing, please pinch me why.

1) Test - A
 - Attribute List: HR_List
 - Attribute Type: SSID - Value: HR 
 - Test PC mac: aaaa.bbbb.cccc
 - WLAN Profile name: HR_Profile (VLAN10) ====> Test PC able to connect 'SSID:HR' only.

2) Test - B
 - Attribute List: General_List
 - Attribute Type: SSID - Value: Corp
 - Test PC mac: aaaa.bbbb.cccc
 - WLAN Profile name: Corp_Profile (VLAN20) ====> Test PC able to connect 'SSID:Corp' only.

3) Test - C
 - Attribute List: Special_List
 - Attribute Type: SSID - Value: HR 
 - Attribute Type: SSID - Value: Corp
 - Test PC mac: aaaa.bbbb.cccc
 - WLAN Profile name: Nothing ====> Test PC can't connect HR or Corp.

I have total  4 SSIDs with different VLAN/interface, but want to make access test PC to 2 SSID only.
Is it possible? 

Thank you for your attention.

[balaji.bandi]

what kind of Radius you have ISE ?

Are you looking MAB authentication ? 

check below thread :

https://community.cisco.com/t5/wireless/understanding-wlc9800-aaa-mac-filtering-for-multiple-wlan-access/m-p/4919676

 check WLAN profile :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213911-understand-catalyst-9800-wireless-contro.html#toc-hId--57998064

[eeebbunee]

Hi, I don't use/have ISE solution. Without ISE, is it unavailable to make macfiltering for multiple VLANs..?

Thank you for your attention.

[Rich R]

Never tried it myself but I would only recommend trying to do that with ISE.
If you can make it work with static MAC filtering you'll probably be the first.
I don't think it's designed for that and I doubt Cisco has ever tested it either.

[balaji.bandi]

I suggest to get any Radius which can do that work for you, as mentioned @Rich R - not that have option.