- Cisco Community
- Technology and Support
- Network Access Control
Dynamic vlan with Cisco ise
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Report Inappropriate Content
08-30-2019 09:18 AM
Solved! Go to Solution.
- Identity Services Engine (ISE)
- All forum topics
- Previous Topic
08-30-2019 10:55 AM
View solution in original post
08-30-2019 09:23 AM
08-30-2019 10:30 AM
08-30-2019 10:42 AM
08-30-2019 12:02 PM
09-02-2020 02:26 AM
09-02-2020 06:44 AM
09-02-2020 03:28 PM
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:
- How to use Community
- New Community Member Guide
- Skip to content
- Skip to search
- Skip to footer
Dynamic VLAN Assignment with WLCs based on ISE to Active Directory Group Mapping Configuration Example
Available Languages
Download options.
- PDF (2.1 MB) View with Adobe Reader on a variety of devices
- ePub (2.2 MB) View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
- Mobi (Kindle) (2.5 MB) View on Kindle device or Kindle app on multiple devices
Bias-Free Language
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Introduction
This document introduces the concept of dynamic VLAN assignment. The document describes how to configure the wireless LAN controller (WLC) and ISE server to assign wireless LAN (WLAN) clients into a specific VLAN dynamically.
Prerequisites
Requirements.
Ensure that you meet these requirements before you attempt this configuration:
Have basic knowledge of Wireless LAN Controllers (WLCs) and Lightweight Access Points (LAPs)
Have functional knowledge of an Authentication,Authorization and Accounting (AAA) server such as Identity Services Engine (ISE)
- Have thorough knowledge of wireless networks and wireless security issues.
- Have functional and configurable knowledge on dynamic VLAN assignment
- Have basic understanding of Microsoft Windows AD services, as well as domain controller and DNS concepts
- Have basic knowledge of Control And Provisioning of Access Point protocol (CAPWAP)
Components Used
The information in this document is based on these software and hardware versions:
Cisco 5520 Series WLC that runs firmware release 8.8.111.0
Cisco 4800 Series AP
Native Windows supplicant and Anyconnect NAM.
Cisco Secure ISE version 2.3.0.298
Microsoft Windows 2016 Server configured as a domain controller
Cisco 3560-CX Series Switch that runs version 15.2(4)E1
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Conventions
Refer to Cisco Technical Tips Conventions for more information on document conventions.
Dynamic VLAN Assignment with RADIUS Server
In most WLAN systems, each WLAN has a static policy that applies to all clients associated with a Service Set Identifier (SSID), or WLAN in the controller terminology. Although powerful, this method has limitations because it requires clients to associate with different SSIDs in order to inherit different QoS and security policies.
Cisco WLAN solution addresses that limitation by support of identity networking. That allows the network to advertise a single SSID, but allows specific users to inherit different QoS, VLAN attributes and/or security policies based on the user credential.
Dynamic VLAN assignment is one such feature that places a wireless user into a specific VLAN based on the credentials supplied by the user. This task of assigning users to a specific VLAN is handled by a RADIUS authentication server, such as Cisco ISE. This can be used, for example, to allow the wireless host to remain on the same VLAN as it moves within a campus network.
Cisco ISE server authenticates wireless users against one of several possible databases, which includes its internal database, e.g:
- Internal DB
Active directory
Generic Lightweight Directory Access Protocol (LDAP)
Open Database Connectivity (ODBC)-compliant relational databases
Rivest, Shamir, and Adelman (RSA) SecurID token servers
RADIUS-compliant token servers
Cisco ISE Authentication Protocols and Supported External Identity Sources list the various authentication protocols supported by ISE internal and external databases.
This document focuses on authenticating wireless users that use Windows Active direcory external database.
After successful authentication, ISE retrieves group information of that user from the Windows database and associates the user to the respective authorization profile.
When a client attempts to associate to a LAP registered with a controller, the LAP passes the credentials of the user to the WLC using the respective EAP method.
WLC sends those credentials to ISE using RADIUS protocol (encapsulating the EAP) and ISE passes credentials of users to AD for validation using KERBEROS protocol.
AD validates the user credentials and upon successful authentication, informs the ISE.
Once the authentication is successful, the ISE server passes certain Internet Engineering Task Force (IETF) attributes to WLC. These RADIUS attributes decide the VLAN ID that should be assigned to the wireless client. The SSID (WLAN, in terms of WLC) of the client does not matter because the user is always assigned to this predetermined VLAN ID.
The RADIUS user attributes used for the VLAN ID assignment are:
IETF 64 (Tunnel Type) — Set this to VLAN.
IETF 65 (Tunnel Medium Type) — Set this to 802
IETF 81 (Tunnel Private Group ID) — Set this to VLAN ID.
The VLAN ID is 12-bits, and takes a value between 1 and 4094, inclusive. Because the Tunnel-Private- Group-ID is of type string, as defined in RFC2868 for use with IEEE 802.1X, the VLAN ID integer value is encoded as a string. When these tunnel attributes are sent, it is necessary to fill in the Tag field.
As noted in RFC 2868 , section 3.1: The Tag field is one octet in length and is intended to provide a means of grouping attributes in the same packet which refer to the same tunnel. Valid values for this field are 0x01 through 0x1F, inclusive. If the Tag field is unused, it must be zero (0x00). Refer to RFC 2868 for more information on all RADIUS attributes.
In this section, you are presented with the information to configure the features described in this document.
Network Diagram
Configurations
These are configuration details of the components used in this diagram:
IP address of the ISE (RADIUS) server is 10.48.39.128.
The Management and AP-manager Interface address of the WLC is 10.48.71.20.
DHCP server resides in LAN network and is configured for respective client pools; it is not shown on the diagram
VLAN1477 and VLAN1478 are used throughout this configuration. Users from Marketing department are configured to be placed into the VLAN1477 and users from HR department are configured to be placed into VLAN1478 by the RADIUS server when both users connect to the same SSID ― office_hq .
VLAN1477: 192.168.77.0/24. Gateway: 192.168.77.1 VLAN1478: 192.168.78.0/24. Gateway: 192.168.78.1
This document uses 802.1x with PEAP-mschapv2 as the security mechanism.
Note: Cisco recommends that you use advanced authentication methods, such as EAP-FAST and EAP-TLS authentication, in order to secure the WLAN.
These assumptions are made before you perform this configuration:
The LAP is already registered with the WLC.
DHCP server is assigned a DHCP scope.
- Layer 3 connectivity exists between all devices in the network.
The document discusses the configuration required on the wireless side and assumes that the wired network is in place.
- Resepective users and groups are configured on AD.
In order to accomplish dynamic VLAN assignment with WLCs based on ISE to AD group mapping, these steps must be performed:
ISE to AD integration and configuration of authentication and authorization policies for users on ISE
- WLC configuration to support dot1x authentication and AAA override for SSID 'office_hq'
- End client supplicant configuration
- Login to ISE Web UI interface using admin account.
WLC configuration to support dot1x authetnication and AAA override for SSID 'office_hq'
We will use Windows 10 native supplicant and Anyconnect NAM to test connections.
Since we are using EAP-PEAP authentication and ISE is using a Self-Signed Certificate (SSC) we would need to agree to certificate warning or disable certificate validation. In a corportate environment, you should use a signed and trusted certificate on ISE and ensure that end user devices have the appropriate root certificate installed under Trusted CA list.
Test connection with Windows 10 and native supplicant.
- From WLC CLI client status can be checked with " show client dertails <mac-address>": show client detail f4:8c:50:62:14:6b Client MAC Address............................... f4:8c:50:62:14:6b Client Username ................................. Bob Client Webauth Username ......................... N/A Hostname: ....................................... Device Type: .................................... Intel-Device AP MAC Address................................... 70:69:5a:51:4e:c0 AP Name.......................................... AP4C77.6D9E.6162 AP radio slot Id................................. 1 Client State..................................... Associated User Authenticated by ........................... RADIUS Server Client User Group................................ Bob Client NAC OOB State............................. Access Wireless LAN Id.................................. 3 Wireless LAN Network Name (SSID)................. office_hq Wireless LAN Profile Name........................ office_hq Hotspot (802.11u)................................ Not Supported Connected For ................................... 242 secs BSSID............................................ 70:69:5a:51:4e:cd Channel.......................................... 36 IP Address....................................... 192.168.78.36 Gateway Address.................................. 192.168.78.1 Netmask.......................................... 255.255.255.0 ... Policy Manager State............................. RUN ... EAP Type......................................... PEAP Interface........................................ vlan1478 VLAN............................................. 1478 Quarantine VLAN.................................. 0 Access VLAN...................................... 1478
Test connection with Windows 10 and Anyconnect NAM.
- From WLC CLI client status can be checked with " show client dertails <mac-address>": Client MAC Address............................... f4:8c:50:62:14:6b Client Username ................................. Alice Client Webauth Username ......................... N/A Hostname: ....................................... Device Type: .................................... Intel-Device AP MAC Address................................... 70:69:5a:51:4e:c0 AP Name.......................................... AP4C77.6D9E.6162 AP radio slot Id................................. 1 Client State..................................... Associated User Authenticated by ........................... RADIUS Server Client User Group................................ Alice Client NAC OOB State............................. Access Wireless LAN Id.................................. 3 Wireless LAN Network Name (SSID)................. office_hq Wireless LAN Profile Name........................ office_hq Hotspot (802.11u)................................ Not Supported Connected For ................................... 765 secs BSSID............................................ 70:69:5a:51:4e:cd Channel.......................................... 36 IP Address....................................... 192.168.77.32 Gateway Address.................................. 192.168.77.1 Netmask.......................................... 255.255.255.0 ... Policy Manager State............................. RUN ... Policy Type...................................... WPA2 Authentication Key Management.................... 802.1x Encryption Cipher................................ CCMP-128 (AES) Protected Management Frame ...................... No Management Frame Protection...................... No EAP Type......................................... PEAP Interface........................................ vlan1477 VLAN............................................. 1477
Troubleshoot
- Use "test aaa radius username <user> password <password> wlan-id <id>" to test RADIUS connection between WLC and ISE and " test aaa show radius " to show the results. test aaa radius username Alice password <removed> wlan-id 2 Radius Test Request Wlan-id........................................ 2 ApGroup Name................................... none Attributes Values ---------- ------ User-Name Alice Called-Station-Id 00-00-00-00-00-00:AndroidAP Calling-Station-Id 00-11-22-33-44-55 Nas-Port 0x00000001 (1) Nas-Ip-Address 10.48.71.20 NAS-Identifier 0x6e6f (28271) Airespace / WLAN-Identifier 0x00000002 (2) User-Password cisco!123 Service-Type 0x00000008 (8) Framed-MTU 0x00000514 (1300) Nas-Port-Type 0x00000013 (19) Cisco / Audit-Session-Id 1447300a0000003041d5665c Acct-Session-Id 5c66d541/00:11:22:33:44:55/743 test radius auth request successfully sent. Execute 'test aaa show radius' for response (Cisco Controller) >test aaa show radius Radius Test Request Wlan-id........................................ 2 ApGroup Name................................... none Radius Test Response Radius Server Retry Status ------------- ----- ------ 10.48.39.128 1 Success Authentication Response: Result Code: Success Attributes Values ---------- ------ User-Name Alice State ReauthSession:1447300a0000003041d5665c Class CACS:1447300a0000003041d5665c:rmanchur-ise/339603379/59 Tunnel-Type 0x0000000d (13) Tunnel-Medium-Type 0x00000006 (6) Tunnel-Group-Id 0x000005c5 (1477) (Cisco Controller) >
- Use "debug client <mac-address>" to troubleshoot wireless client connectivity issues.
- Use " debug aaa all enable " to troubleshoot authentication and authorization issues on WLC. Note : use this command only with 'debug mac addr <mac-address>' to limit output based on MAC address for which debugging is done!
- Refer to ISE live logs and session logs to identify problems authentication failures and AD communication issues.
Contributed by Cisco Engineers
- Roman Manchur Cisco TAC Engineer
Was this Document Helpful?
Contact Cisco
- (Requires a Cisco Service Contract )
This Document Applies to These Products
- Identity Services Engine
- Wireless LAN Controller Software
- Wireless, LAN (WLAN)
Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including Stack Overflow , the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Q&A for work
Connect and share knowledge within a single location that is structured and easy to search.
RADIUS VLAN Assignment with Cisco ISE
I am trying to install Cisco ISE 2.1 to be used as a RADIUS server with 802.1x on my switches. I want to dynamically assign a VLAN based to a user who connects on the switch port.
The problem is that, although my end client is authenticated and authorized by ISE, the VLAN id never gets received on the switch from ISE.
On ISE, I see my end user being authenticated with the correct policy, and authorized with the policy I created.
As seen on this image, I want to assign VLAN 56. However, my port does not get this information and stays in the hardcoded VLAN.
What could be the issue here?
Could it be that RADIUS options 064,065,081 are not forwarded from the ISE to the switch? I have a firewall between them.
Here is the configuration for dot1x on my switch :
And here is an output when the end user is authenticated through dot1x :
Here is the output of a debug dot1x all
Here is the output for "debug radius authentication"
- You can try "debug radius authentication" or "debug dot1x all" on the switch to see what messages it is receiving. – Ron Trunk Jun 16, 2016 at 17:06
- I did that, and edited my post to add the output above. I don't see anything really strange in the output though. – Jeremy G. Jun 16, 2016 at 17:15
- 1 I don't either. How about the radius debug? – Ron Trunk Jun 16, 2016 at 17:18
- 1 Great data, great question. +1 – Citizen Jun 17, 2016 at 8:57
- 1 @Mr.lock : my switch is a 3560 and its version is 12.2(50r)SE. it could be a firmware issue, but the TAC did not think that way. I will try another switch ASAP though. – Jeremy G. Jun 28, 2016 at 11:54
2 Answers 2
I don't know if you've already done this, but you have to go a step further than just creating the Auth profile. You have to apply that auth profile with an auth policy. To create the auth policy do the following.
Go to Policy / Authorization Edit – profiles –standard, select your auth profile click Done click Save
- You should edit your answer to explain it. – Ron Maupin ♦ Jul 19, 2016 at 21:51
- @BlackMagix : I applied this Auth profile to an auth policy indeed. Moreover, I did a tcpdump on ISE during the authorization process, and i can see an "ACCESS-ACCEPT" frame sent by ISE with the correct VLAN ID. Therefore I think the issue is more on the switch than on ISE. – Jeremy G. Jul 22, 2016 at 6:47
For those still interested in this issue, I had to upgrade the IOS to 12.2(55)SE10. Now it's working with the initial configuration.
- I would consider to upgrade to newer IOS version 15.*. Recommended version is marked as Golden image. – Pawel Jan 22, 2017 at 9:16
Your Answer
Sign up or log in, post as a guest.
Required, but never shown
By clicking “Post Your Answer”, you agree to our terms of service , privacy policy and cookie policy
Not the answer you're looking for? Browse other questions tagged cisco vlan radius cisco-ise or ask your own question .
- The Overflow Blog
- How to position yourself to land the job you want
- Building an API is half the battle: Q&A with Marco Palladino from Kong
- Featured on Meta
- We've added a "Necessary cookies only" option to the cookie consent popup
- The Stack Exchange reputation system: What's working? What's not?
Hot Network Questions
- How useful is a caliper for a home-based bike workshop?
- Is the cabin pressure "worse" at the back of the cabin than in front?
- Why is the ongoing auction for Silicon Valley Bank started privately held (vs. publicly)?
- Is there a way to use Stockfish to see tactics that aren't necessarily great?
- Dupin cyclide as the stereographic projection of a Hopf torus
- What if a student doesn't understand a question because of differences in dialect?
- What is the concept of hole in semiconductor physics?
- Are there 2 Parkruns close enough together with a large enough start time difference such that one could run both on one day?
- Can a 13-year-old in the UK accept freelance work?
- Implementation of a shared pointer constructors and destructor
- Detecting the version of i486 CPU
- Firefox very distorted, unusable
- GE historic stock price on DOD changed
- Finding a career as a researcher without any PhD, work experience, and/or relevant academic degree
- Anamolous colour properties of Nickel complexes
- Stacked NumberLinePlot?
- Did any storylines or content from The Clone Wars exist prior to its broadcasting?
- Is there a RAW or optional rule for how a player could discover what type of skill check needs to be made?
- A melody is built from both notes and chords
- SSL issue captures Facebook app send out traffic
- How to duplicate texture node without duplicating its settings?
- How did asteroid (7482) 1994 PC1 get its "face"? Is it reconstructed from optical or radar imaging, or something else?
- Would it be possible for a planet to orbit around a trinary star system in a figure 8 orbit?
- Is it insecure to sign the value 0 with ElGamal?
Your privacy
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy .
- Community Home
- Topic Thread
Wired Intelligent Edge
- Discussion 36.5K
- Library 968
- Members 1.4K
Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
1. dynamic vlan assignment /dacl's with cisco ise and arubaos-switch.
Attachment(s)
2. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
is there a way to do a reassing os the DACL, if ofr example on the cisco ISE for thet user i need ot assing him a new ACL, can id do that with the COA?
or is this not possible at all?
Hi Created,
This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.
3. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
What you normally would do is trigger a 'Terminate Session', where the switch will do a new authentication for the user/device and you can then return the new role/DACL as part of your policy/enforcement.
I'm not sure if ISE support DACL for Aruba switches, but you may fallback to user roles and return a local user role.
4. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
Yes i have configure DACL from ISE to ARUBA switches and its working perfectly but i need to do changes of the DACL and i havent figure out how to do that.(use vsa 92 standard by the way) if you need the config just let me do a session withb the cliente to do screenshot of ise and the config of the switch(the hardest part was to send the client ip address to ISE).
With the COA 'Terminate Session' if you have the experience with Cisco ISE could you show me how that configuration of the terminate session goes, i havent got that part i still have doubts with that configuration.
Gerardo Andree Mejia
5. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
You can initially deploy user role with policy and assign different user role having different policy based on your requirement using reauthentication CoA as below
6. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
so i can add the:
and send that information on the reauthenticate for the Aruba siwtches rigth?
i think i gettoting so what you do on the definition of the ISE is defines de VSA that im going to send the switch rigth?
thanks for the help by the way.
7. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
Yes we could send NAS-Filter-Rule via CoA.
8. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
Hi Shobana,
i had problem with the COA re-authenticate
this is the configuration i put on the ISE profile and sitll got no response from the switch
do you see anything bad in there??
am going to add the config of the switch i dont know if maybe theres something else that need to be done.
thanks for the help.
9. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
You have to enable this CLI for radius dyn authorization
radius dyn-authorization enable
radius dyn-authorization client { <IPV4> | <IPV6> | <HOSTNAME> }
[secret-key [plaintext <PASSKEY> | ciphertext] <PASSKEY> ]]
[time-window <WIDTH> ] [replay-protection {enable|disable}]
More details here -
https://www.arubanetworks.com/techdocs/AOS-CX/10.08/HTML/security_6200-6300-6400/Content/Chp_RAD_dyn_auth/RAD_dyn_auth_cmds/rad-dyn-aut-com-fl-10.htm
10. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
does this applyes to version 16.11 for AOS-S??
------------------------------ Shobana Aruba Original Message Original Message: Sent: Mar 10, 2023 09:45 AM From: vivarock12 Subject: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
Original Message: Sent: Mar 02, 2023 12:29 AM From: Shobana Nandakumar Subject: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
------------------------------ Shobana Aruba Original Message: Sent: Feb 28, 2023 10:45 AM From: vivarock12 Subject: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
Original Message: Sent: Feb 28, 2023 01:17 AM From: Shobana Nandakumar Subject: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
------------------------------ Shobana Aruba Original Message: Sent: Feb 27, 2023 10:13 AM From: vivarock12 Subject: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
Original Message: Sent: Feb 27, 2023 06:36 AM From: Herman Robers Subject: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
------------------------------ Herman Robers ------------------------ If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks. In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that. Original Message: Sent: Feb 23, 2023 06:53 PM From: vivarock12 Subject: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
Original Message: Sent: Mar 20, 2019 01:46 PM From: ClarenceHillard2 Subject: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch
New Best Answer
At Aruba, we believe that the most dynamic customer experiences happen at the Edge. Our mission is to deliver innovative solutions that harness data at the Edge to drive powerful business outcomes.
- Leadership Team
- Environmental Citizenship
- Support Services
- Contact Support
- Aruba Education Services
- Professional Services
- Software Downloads
- Licensing Login
- Find a Partner
- Become a Partner
- Partner Ready for Networking
- Technology Partner Programs
- Privacy policy
- Terms of service
© Copyright 2021 Hewlett Packard Enterprise Development LP All Rights Reserved.
- Technical Forums
- Dynamic Vlan/Similar option is not working for Wired Clients (MAB/8021x) on...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
Dynamic Vlan/Similar option is not working for Wired Clients (MAB/8021x) on Meraki Switches
- Mark as New
- Report Inappropriate Content
- All forum topics
- Previous Topic
- New March 13: It’s that time of year again 🧹🧼🧽 — share your spring cleaning pictures for a chance to win!
- March 2: Recognizing February's Members of the Month
- February 23: [CHALLENGE ENDED] Challenge Update: Join the Fold!
View all community news »
- Interfaces 139
- Layer 2 136
- Layer 3 104
- Community Guidelines
- Cisco Privacy
- Khoros Privacy
- Privacy Settings
- Terms of Use
integrating IT
ISE Dynamic VLAN assignment
Dynamic VLAN assignment by a RADIUS server (e.g. Cisco ISE) can be useful when you want to assign a specific VLAN to a user or group of users. In order to achieve this the VLANS configured on the switches must be configured with a name, this name must be consistent across multiple switches. However the VLAN number does not necessarily need to be the same across the switches.The scenario in this blog post will simply define 2 VLANS (ADMIN and USERS), members of the AD group Domain Admins will be assigned to a VLAN called ADMIN and members of the AD group Domain Users will be assigned to a VLAN called USERS.
The configuration of ISE in this post only describes the steps in order to configure Dynamic VLAN assignment. Refer to this previous post on how to configure Cisco ISE for 802.1x authentication.
Switch Configuration
Configure the name on the VLANS. These names must match the name specified in the Authorisation Profile on ISE.
ISE Configuration
Authorisation profiles.
- Navigate to Policy > Policy Elements > Results > Authorisation > Authorisation Profiles
- Create a new Authorisation Profile and name appropriately e.g VLAN_ADMIN
- Under the Common Tasks section, tick VLAN
- Enter the ID/Name of the Admin VLAN as ADMIN
- Repeat the task and create another Authorisation Profile for the Standard Users e.g VLAN_USERS
- Enter the correct ID/Name as USERS
Authorisation Policy
- Navigate to Policy > Policy Set
- Modify an existing Policy Set used for 802.1x
- Ensure there are different Authorization Policy rules, for Admin Users and another for Standard Users
- Assign the VLAN_ADMIN Authorisation Profile to the Admin rule Profiles
- Assign the VLAN_USERS Authorisation Profile to the Standard Users rule Profiles
- Save the policy
Verification
Before logging in as a user, confirm the configuration of the interface the test computer is plugged into. Notice the VLAN is set to VLAN 10.
- Running the command show authentication sessions interface fastethernet 0/3 confirm the computer has a valid IP address in VLAN 10. Notice under Vlan Policy N/A, this means this interface was not dynamically assigned a VLAN.
Login as a user that is a member of the AD group Domain Users.
- Run the command show authentication sessions interface fastethernet 0/3
- Compare the output this time with above. Notice the computer now has an IP address from the VLAN 11 DHCP Pool and Vlan Policy = 11, this confirms the computer has dynamically been assigned to VLAN 11.
- Run the command debug radius whilst the users is logging on
- You can confirm the VLAN name being returned by successful authorisation by the RADIUS server by the presence of Tunnel-Private-Group .
Logoff and log back in as a user in the Domain Admins AD group.
- Compare the output this time with above. Notice the computer now has an IP address from the VLAN 12 DHCP Pool and Vlan Policy = 12
- Running the command debug radius confirms the correct VLAN name ADMIN was sent by the RADIUS server.
Share this:
- Click to share on Twitter (Opens in new window)
- Click to share on Facebook (Opens in new window)
- Click to share on LinkedIn (Opens in new window)
Published by integratingit
View all posts by integratingit
3 thoughts on “ ISE Dynamic VLAN assignment ”
- Pingback: Initial Cisco ISE Configuration – integrating IT
Hi it is cool . What happend if some device has IP fix
If the device has a static IP address and is moved to a different VLAN, the user will not be able to communicate. It will only work if using DHCP.
Leave a Reply Cancel reply
Fill in your details below or click an icon to log in:
You are commenting using your WordPress.com account. ( Log Out / Change )
You are commenting using your Twitter account. ( Log Out / Change )
You are commenting using your Facebook account. ( Log Out / Change )
Connecting to %s
Notify me of new comments via email.
Notify me of new posts via email.
This site uses Akismet to reduce spam. Learn how your comment data is processed .
- Already have a WordPress.com account? Log in now.
- Follow Following
- Copy shortlink
- Report this content
- View post in Reader
- Manage subscriptions
- Collapse this bar
- FortiGate / FortiOS
- FortiGate-5000 / 6000 / 7000
- FortiManager / FortiManager Cloud
- FortiAnalyzer / FortiAnalyzer Cloud
- FortiMonitor
- FortiGate Cloud
- Secure SD-WAN
- FortiLAN Cloud
- FortiSwitch
- FortiAP / FortiWiFi
- FortiAP-U Series
- FortiExtender / FortiExtender Cloud
- FortiVoice / FortiVoice Cloud
- FortiRecorder / FortiCamera
- Zero Trust Network Access
- FortiClient EMS
- FortiAuthenticator
- FortiTrust Identity
- FortiToken Cloud
- FortiGate Public Cloud
- FortiGate Private Cloud
- FortiDevSec
- FortiGate CNF
- FortiWeb / FortiWeb Cloud
- FortiADC / FortiGSLB
- FortiMail / FortiMail Cloud
- FortiSIEM / FortiSIEM Cloud
- FortiSandbox / FortiSandbox Cloud
- FortiDeceptor
- FortiInsight / FortiInsight Cloud
- FortiIsolator
- FortiClient / FortiClient Cloud
- Public & Private Cloud
- Secure Access
- Security Fabric
- Tele-Working
- Multi-Factor Authentication
- Secure Access Service Edge
- FortiAnalyzer
- FortiAnalyzer Big-Data
- FortiAP U-Series
- FortiCarrier
- FortiController
- FortiDDoS-F
- FortiExtender
- FortiGate-5000
- FortiGate-6000
- FortiGate-7000
- FortiHypervisor
- FortiManager
- FortiRecorder
- FortiSandbox
- FortiTester
- AWS Firewall Rules
- FortiADC E Series
- FortiADC Manager
- FortiADC Private Cloud
- FortiADC Public Cloud
- FortiAnalyzer BigData
- FortiAnalyzer BigData Private Cloud
- FortiAnalyzer Cloud
- FortiAnalyzer Private Cloud
- FortiAnalyzer Public Cloud
- FortiAuthenticator Private Cloud
- FortiAuthenticator Public Cloud
- FortiBalancer
- FortiBridge
- FortiCamera
- FortiCamera Cloud
- FortiCare Elite
- FortiClient
- FortiClient Cloud
- FortiCloud Account Services
- FortiConnect
- FortiConverter Service
- FortiConverter Tool
- FortiDeceptor Private Cloud
- FortiDeceptor Public Cloud
- FortiExplorer
- FortiExtender Cloud
- FortiInsight
- FortiInsight Cloud
- FortiIsolator Public Cloud
- FortiMail Cloud
- FortiManager Cloud
- FortiManager Private Cloud
- FortiManager Public Cloud
- FortiNDR Cloud
- FortiNDR Private Cloud
- FortiNDR Public Cloud
- FortiPAM Private Cloud
- FortiPlanner
- FortiPolicy
- FortiPortal
- FortiPortal Public Cloud
- FortiPresence
- FortiPresence VM
- FortiProxy Private Cloud
- FortiProxy Public Cloud
- FortiSandbox Cloud
- FortiSandbox Private Cloud
- FortiSandbox Public Cloud
- FortiSIEM Cloud
- FortiSOAR Cloud
- FortiSwitch Manager
- FortiTester Private Cloud
- FortiTester Public Cloud
- FortiVoice Cloud
- FortiVoice Private Cloud
- FortiVoice Public Cloud
- FortiWAN Controller
- FortiWeb Cloud
- FortiWeb Manager Private Cloud
- FortiWeb Manager Public Cloud
- FortiWeb Private Cloud
- FortiWeb Public Cloud
- Managed FortiGate Service
- Security Awareness and Training
- Wireless Controller
- Ordering Guides
Table of Contents
- Introduction
- Models without a dedicated management port
- Models with a dedicated management port
- Example configurations
- Overlapping subnets
- Switch virtual interfaces
- VXLAN interfaces
- Routed VLAN interfaces
- IP conflict detection
- ARP timeout value
- Using SSH and the Telnet client
- Configuring the temperature sensor
- Administrators
- Access control
- Setting the idle timeout
- Configuring system banners
- Using Wake-on-LAN packets
- Configuring automation stitches
- Using the alias commands
- User definition
- User groups
- TACACS+ server
- Administrative accounts
- User accounts
- Example configuration
- Flow export
- Configuring a DHCP server
- Detailed operation of a DHCP relay
- Configuring a DHCP relay
- Packet capture
- Debug report
- Fault relay support
- Identifying a specific FortiSwitch unit
- Using the Reset button on FortiSwitch units
- Amber and red LEDs
- Configuring general port settings
- Configuring flow control, priority-based flow control, and ingress pause metering
- Auto-module speed detection
- Setting port speed (autonegotiation)
- Configuring power over Ethernet on a port
- Energy-efficient Ethernet
- Diagnostic monitoring interface module status
- Configuring split ports
- Configuring QSFP low-power mode
- Configuring physical port loopbacks
- Switched interfaces
- Dynamic MAC address learning
- Layer-2 table
- TFTP network port
- Cable diagnostics
- Link aggregation groups
- Multi-stage load balance
- Unicast hashing
Dynamic VLAN assignment
- Dynamic access control lists
- MAC authentication bypass (MAB)
- Configuring global settings
- Configuring the 802.1X settings on an interface
- Viewing the 802.1X details
- Clearing authorized sessions
- Authenticating users with a RADIUS server
- Authenticating an admin user with RADIUS
- RADIUS accounting and FortiGate RADIUS single sign-on
- RADIUS change of authorization (CoA)
- Detailed deployment notes
- MSTP overview and terminology
- MSTP configuration
- Interactions outside of the MSTP region
- Viewing the MSTP configuration
- Support for interoperation with Rapid per-VLAN RSTP (Rapid PVST+ or RPVST+)
- DHCP snooping
- Dynamic ARP inspection
- IPv6 router advertisement guard
- Configuration notes
- LLDP global settings
- Configuring LLDP profiles
- Configuring an LLDP profile for the port
- Enabling LLDP on a port
- Checking the LLDP configuration
- Configuration deployment example
- Checking LLDP details
- ACL policy attributes
- Configuring an ACL policy
- Configuration examples
- Selective packet sampling
- Creating a schedule
- IGMP snooping
- MLD snooping
- Configuring a SPAN mirror
- Configuring an RSPAN mirror
- Configuring an ERSPAN auto mirror
- Configuring an ERSPAN manual mirror
- Native VLAN
- Allowed VLAN list
- Untagged VLAN list
- Frame processing
- Configuring VLANs
- VLAN stacking (QnQ)
- MAC/IP/protocol-based VLANs
- Private VLANs
- Virtual wires
- Storm control
- Persistent (sticky) MAC addresses
- Static MAC addresses
- Network monitoring
- IP-MAC binding
- Classification
- Determining the egress queue
- Configuring FortiSwitch QoS
- Checking the QoS statistics
- Resetting and restoring QoS counters
- Configuring security checks
- Cut-through switching mode
- Enabling packet forwarding
- Configuring auto topology
- Viewing port statistics
- Media Redundancy Protocol
- Configuring PTP transparent-clock mode
- Layer-3 routing in hardware
- Using layer-3 routing within an MCLAG
- Unicast reverse-path forwarding (uRPF)
- Policy-based routing
- Parts and terminology of BGP
- How BGP works
- Troubleshooting BGP
- Configuring BGP
- Sample configuration
- IS-IS routing
- Remote access to the management port
- Equal cost multi-path (ECMP) routing
- Link monitor
- Bidirectional forwarding detection
- Virtual routing and forwarding
- Deployment scenario
- Appendix A: FortiSwitch-supported RFCs
- Appendix B: Supported attributes for RADIUS CoA and RSSO
- Appendix C: SNMP OIDs for FortiSwitch models
Administration Guide
You can configure the RADIUS server to return a VLAN in the authentication reply message:
- On the FortiSwitch unit, select port-based authentication or MAC-based authentication and a security group.
- On the RADIUS server, configure the attributes.
Using the GUI:
- Go to Switch > Interfaces .
- Select a port and then select Edit .
- Select one or more security groups.
- Select OK .
Using the CLI:
To select port-based authentication and the security group on the FortiSwitch unit:
config switch interface
edit <interface_name>
config port-security
set port-security-mode 802.1X
set security-groups <security-group-name>
The FortiSwitch unit will change the native VLAN of the port to that of the VLAN from the server.
To select MAC-based authentication and the security group on the FortiSwitch unit:
set port-security-mode 802.1X-mac-based
Here, the switch assigns the returned VLAN only to this userʼs MAC address. The native VLAN of the port remains unchanged.
Use the following configuration command to view the MAC-based VLAN assignments:
diagnose switch vlan assignment mac list [sorted-by-mac | sorted-by-vlan]
Configure the following attributes in the RADIUS server:
- Tunnel-Private-Group-Id—VLAN ID or name (10)
- Tunnel-Medium-Type—IEEE-802 (6)
- Tunnel-Type—VLAN (13)
NOTE: If the Tunnel-Private-Group-Id attribute is set to the VLAN name, the same string must be specified in the set description command under the config switch vlan command. For example:
config switch vlan
set description "local_vlan"
Starting in FortiSwitchOS 7.0.0, you can use the following RADIUS attributes to configure dynamic non-native VLANs:
To set the VLAN ID value, use 0x31 for a tagged VLAN or 0x32 for an untagged VLAN. For example, to indicate that VLAN 16 is untagged, the Egress-VLANID is 0x32000010 or 838860816.
To provide the VLAN name as the VLAN description string defined under the config switch vlan command, use ‘1’ for a tagged VLAN or ‘2’ for an untagged VLAN. For example:
- To assign the description “VLAN_8” to VLAN 8, which is tagged, use the following string: “1VLAN_8”
- To assign the description “SALES_1772” to VLAN 1772, which is untagged, use the following string: “2SALES_1772”
- Ingress-Filters—Enables the use of ingress filters (57). The use of ingress filters cannot be disabled.
NOTE: The VLAN name in the Egress-VLAN-Name attribute must match the string specified in the set description command under the config switch vlan command. For example:
You can verify your configuration with the diagnose switch 802-1x status <port_name> command. In the following example, the lines in boldface show the dynamic non-native VLANs:
IMAGES
VIDEO
COMMENTS
Wired Dynamic VLAN Assignment Go to solution averill.johnson1 Beginner Options 06-04-2019 07:34 AM - edited 02-21-2020 11:06 AM I have been doing a bit of research on this and haven't found anything definitive on this but I feel it should work. Can anyone confirm or deny? Equipment: Virtual: ISE 2.4 Cisco 3850 Stack (s) IOS 3.6.9E
Dynamic VLAN Assignment with RADIUS Server Configure Network Diagram Configuration Steps Cisco ISE Configuration Step 1. Configure the Catalyst WLC as an AAA Client on the Cisco ISE server Step 2. Configure internal users on Cisco ISE Step 3. Configure the RADIUS (IETF) attributes used for dynamic VLAN Assignment
ISE responds with the Access-Accept and the dynamic VLAN assignment instructions to put the port in whatever VLAN the user is supposed to get. That will cause the PC to request a new IP address since it detects a link state change. It gets a new IP address in the dynamically assigned VLAN.
Dynamic VLAN assignment is one such feature that places a wireless user into a specific VLAN based on the credentials supplied by the user. This task of assigning users to a specific VLAN is handled by a RADIUS authentication server, such as Cisco ISE.
Hi Created, This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network.
I want to dynamically assign a VLAN based to a user who connects on the switch port. The problem is that, although my end client is authenticated and authorized by ISE, the VLAN id never gets received on the switch from ISE. On ISE, I see my end user being authenticated with the correct policy, and authorized with the policy I created.
Dynamic VLAN Assignment In lieu of CoA, MS switches can still dynamically assign a VLAN to a device by assigned the VLAN passed in the Tunnel-Pvt-Group-ID attribute. It may be necessary to perform dynamic VLAN assignment on a per computer or per user basis. This can be done on your wired network via 802.1x authentication (RADIUS).
1. Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch. This guide below is how to set up DACL's and how to dynamically assign a vlan to a device connecting to the network. 2. RE: Dynamic Vlan Assignment /DACL's with Cisco ISE and ArubaOS-Switch.
I s it possible to configure a dynamic vlan allocation via Cisco ISE (Radius Server) for wired clients (MAB/8021X) ? ... The documentation says that dynamic VLAN assignment is supported though. Make sure you are passing all theee required parameters from ISE back to the switch (Tunnel-Medium-Type, Tunnel-Pvt-Group-ID and Tunnel-Type). ...
Dynamic VLAN assignment with ISE - 5508+5760 ... Just concluded the dynamic vlan authentication with flexconnect. In the ISE, the config is the same as demonstrated in the pptx file. ... wired infrastructure: For my flexconnect site, I have a l3 switch directly connected to my OSPF area 0.
Dynamic VLAN assignment by a RADIUS server (e.g. Cisco ISE) can be useful when you want to assign a specific VLAN to a user or group of users. In order to achieve this the VLANS configured on the switches must be configured with a name, this name must be consistent across multiple switches.
Dynamic VLAN assignment You can configure the RADIUS server to return a VLAN in the authentication reply message: On the FortiSwitch unit, select port-based authentication or MAC-based authentication and a security group. On the RADIUS server, configure the attributes. Using the GUI: Go to Switch > Interfaces. Select a port and then select Edit.