2

I am trying to migrate from Microsoft NPS using 802.1x PEAP to Cisco ISE 802.1x PEAP for our WLC wireless clients. I see a lot of articles regrading Dynamic VLAN assignment, which we are not trying to do. We are trying to use ISE only for AAA and not for VLAN Assignment. I have ISE authenticating users correctly and authorizing them with the "PermitAccess" profile, however users are being put in VLANID 0 on the WLC? This VLAN is used by the WLC AP Management subnet.

I'm hoping this is just a simple checkbox or something that I missed on either ISE or WLC, but I cannot seem to figure out why ISE/WLC is dumping users into this VLANID0 and not into the Interface Assigned to the SSID. It is bizaree, because our NPS config we don't have to assign the VLAN in the RADIUS message.

As of now we have two SSIDs, production which still uses NPS, and "-Test" which points to Cisco ISE. Here are the WLC client info from both.

Working (NPS) "VLANID is 107":

enter image description here

Not Working (ISE) "VLANID is 0??": enter image description here

SSID vWLC Config Page: enter image description here

Advanced WLAN vWLC Config Page: enter image description here

ISE Policy Set: enter image description here

Other Info:

*ISE v2.4

vWLC v8.3.150* https://pastebin.com/j5jTUcrH

Improve this question
5
  • Really need to see some config here to even begin to understand what is going on with any certainty. If ISE is really sending over VLAN 0 and the WLC is accepting it, then simply unchecking the Allow AAA Override option on the WLC (WLANs -> <WLAN ID> -> Advanced) should prevent that if you aren't passing anything else from AAA and can take a bit more time finding the problem in your ISE config. If you still have the issue, then at least you know the problem is on the WLC.
    – YLearn
    Nov 5, 2019 at 19:48
  • Hi YLearn, yes Allow AAA is unchecked. I will post more pictures of the vWLC configl.
    – Jim
    Nov 5, 2019 at 21:02
  • Then we really need to see some off the config off the CLI. SSH to the WLC, make sure you have logging enabled in your SSH client, do a config paging disable and then show run-config commands (my preference). Sanitize and share the text with something like pastebin.com.
    – YLearn
    Nov 5, 2019 at 23:17
  • pastebin.com/j5jTUcrH
    – Jim
    Nov 6, 2019 at 14:41
  • Jim, couldn't get back to it right away, but I think I found your problem and posted an answer below.
    – YLearn
    Nov 8, 2019 at 4:26

1 Answer 1

Reset to default
2

Looking through the configuration I now see the problem. It was also hinted at in the screenshots you provided, but I missed it until I saw it in your configuration.

WLAN 1, your normal production WLAN is not configured as a FlexConnect WLAN. WLAN 4, your -Test WLAN is configured as a FlexConnect WLAN as indicated below:

wlan flexconnect local-switching 1 disable
wlan flexconnect local-switching 4 enable

I only see the default FlexConnect Group configuration, which likely means you have no associated WLAN VLAN mappings and clients end up in "VLAN 0" since the controller doesn't know where to place them.

Since this doesn't sound like the configuration you actually want, I would suggest you go back and reconfigure your WLAN 4 to match your WLAN 1 configuration. The FlexConnect configuration check boxes are on the Advanced tab of the WLAN configuration, but I suggest you pull the interface up on two browser windows (preferrably on two screens) and compare all settings across all tabs to make sure they match, other than your AAA server configuration.

Improve this answer
1
  • Yes, that did it. Thank you! . Appreciate your time!
    – Jim
    Nov 8, 2019 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.