WLC 4402 + ACS 5.4 + AD: is it possible to use separate ip dhcp pools according to AD user group?

[Ivan Rezvantsev]

Hello, we are using WLC with ACS and it is working well.

We have AD group WiFi_access, and all users from these group are able to athunticate during connecting to corporate wifi network.

How we could make, for example, two AD groups: WiFi_access and WiFi_VIP and users from first group get 10.7.0.0/24 adressess and 10.8.0.0/24 from the second? or it could be 10.7.0.0-100 and 10.7.0.100-200 it doesn't matter.

the main goal is: different AD groups of users must have different privileges and these is controling via ACL on their default gateway switch.

[Rasika Nayanajith · Accepted solution]

You can use "aaa-override" feature to do that. In that case once user get connected & if he is belong to "WIFI_VIP" group ACS can override the user vlan to a different one (10.8.0.0/24) what they initially associate to.

You can get an idea about the concept from the below post

http://mrncciew.com/2013/05/21/aaa-override-in-acs5-2/

HTH

Rasika

*** Pls rate all useful responses ***

[Ivan Rezvantsev]

thank you very much its working fine.