WLAN authentication with IAS and BSSID

[philipp.wolf]

I have an BSSID enabled AP and all Vlan clients should be authenticated on one IAS Server. On the Server the Vlans should be mapped to different Remote-Access Policies. I was not able to find any command for the "aaa group server" configuration, that adds an attribute wich allows the server to select the correct Remote-Access Policy.

Does anyone know an answer (without using different source addresses for aaa request)

[Scott Fella]

Not really understanding what you said.  You want to authenticate certain users to a different policy?  Usually with radius, once you hit a policy, you either pass or fail.  You specify a certain NAS  IP ADDRESS... this you cant get around.

[philipp.wolf]

I have configured the AP with BSSID`s (in case four VLAN`s and every VLAN has it`s own SSID)

Every Vlan has a different ruleset (ACL`s on the Firewall).

Now I would like to assign the user as follows:

User: SSID:

Admin1 Admin

Client1 Client

On the Server I have configured diffent Remote-Access Policies but the Server isn`t able to distinguish

the Source SSID of the request.

At the moment the Server is not able to distinguish the source SSID or Vlan so every existing User on the Server is accepted for every VLAN.

Message:

[Scott Fella · Accepted solution]

How do you have your policies setup in IAS?

Here are links with examples to setup a remote access policy based on vlans:

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml

http://www.techimo.com/forum/blogs/groundzero3/272-cisco-4404-ias-2003-dynamic-vlans.html

http://www.pskl.us/wp/?p=125

http://technet.microsoft.com/en-us/library/cc786581(WS.10).aspx