WLC Avpair SSID management since 8.3?

[Konstantin Kabassanov]

Hello,

While making some tests on my WISM2 controller, I found that there was some filtering based on the avpair ssid field sent by the radius server. A long time ago, this feature was only available on autonomous access points and was not supported by wireless controllers. The only reference I found about this change is in the configuration guide of 8.3 version while talking about "VAP ID":

"The rejection, based on the response from the AAA server, is because of the SSID Cisco AVPair support".  Do you have any information about this?

Thanks.

[Flavio Miranda]

Hi

 Onde WLC side, despite a supported version, usually you need check "AAA Override" on the advanced tab of the requided WLAN. 

Here a reference guide about Vendo Specific Attributes:

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-3/config-guide/b_cg83/b_cg83_chapter_01010.html 

-If I helped you somehow, please, rate it as useful.-

[Konstantin Kabassanov]

Hi Flavio,
Thanks for you reply. I got the same document, but I can't see what packet with "ssid=MYWIRELESS" string value as AV pair matches these examples.

[Flavio Miranda]

You are trying to do things with the SSID as attributes, right?  The way i undestand, on the WLC you need to check "AAA override". The policy you need to create on the ISE or any radius you are using. 

 On the radius you can create policy based on the SSID or WLAN ID. 

-If I helped you somehow, please, rate it as useful.-

[Konstantin Kabassanov]

Flavio,
I have already everything I need in my freeradius configuration. I was just doing some other tests (yes, with AAA overriding) and I had some troubles to connect the wireless client, because in its ethernet records in the radius server, in addition to the 3 fields related to the vlan assignation, I had also an AV pair ssid=WRONG_SSID. So when wlc received the access-accept for the MAC address with these fields, it just stopped processing the reply and started a new request. So I was simply surprised to see that the reason was something that had been missing until then.