Assign different VLAN wireless authentication

Similar Questions

• Authentication of 802. 1 X with the assignment problem VLAN.

  Hello

  I intend to implement the authentication of 802. 1 X with assignment of VLANS on our network and assign different VLAN on the switch (Cat2960) of access according to the terminals (for example, VLAN10 for VLAN40 for PC, VLA30 for STB IPTV, VLAN20 for voice, WLAN) after a successful authentication.

  Is the topology of the network (backbone L3 Switch: Cat6K) <----->(L2 access switch: Cat2960) <-------->(L2 access switch: Cat2960) <-->WLAN, voice, IPTV, PC. (Please refer to the file for the detailed topology rasthaus)

  I have to respect (switch L2) <-->(switch L2) topology due to wiring problem.

  My question is below.

  1. to take account of different VLAN of terminals, the only way is in trunk on both L2 switches port. is this possible?

  As far as I know, cannot enable 802. 1 X on a trunk port. is it good?

  2. If this is true, is there a solution?

  Thank you for your help. :-)

  You will not run 802. 1 x on the junction between switch ports, but rather on the ports that connect devices to end-users.

• Assignment of VLANS on catalyst express 520

  Hello

  I ache to configure a switch to catalyst Express 520-8PC. Could it, it is not possible to assign different VLAN than '1' in access to this switch ports? I hope it is possible and I have just found this option again. If this is the case, can we please refernce to some white paper or a guide (or simply explain how and where it should be done)?

  I tried either on the web-fronend and CCA/NAC (unfortunately it isn't all cli support) and not found anywhere in the configuration.

  with greetings

  Nico Schmidt

  Hello

  According to the data sheet, the 500 series supporsts VLAN up to 32.

  Here is the link on how to add/remove a VLAN:

  http://www.Cisco.com/en/us/products/ps6545/products_configuration_example09186a00806da6c9.shtml#VLANs

  HTH

• Dynamic assignment of VLANS for MAB / ACS 5.5

  Hello

  Tried MAB works with ACS 5.5, and the looks part good ACS in the newspapers - the MAC address is sought, the authorization profile is correct. But on the switch, I get the following text:

  * 1 mar 00:12:53: AAA/AUTHENTIC/8021 X (00000004): choose method list "by default".

  * 1 mar 00:12:53: RADIUS/ENCODE (00000004): orig. component type = DOT1X

  * 1 mar 00:12:53: RADIUS: AAA Attr not supported: audit-session-id [607] 24

  * 1 mar 00:12:53: RADIUS: [0A8E0FDE00000002] 30 41 38 45 30 46 44 45 30 30 30 30 30 30 30 32

  * 1 mar 00:12:53: RADIUS: 30 30 30 38 30 [00080 41A]

  * 1 mar 00:12:53: RADIUS: AAA Attr not supported: interface [171] 20

  * 1 mar 00:12:53: RADIUS: 47 69 67 61 62 69 74 45 74 68 65 72 65 74 31 [GigabitEthernet1] 6F

  * 1 mar 00:12:53: RADIUS: 2F 30 [/ 0]

  * 1 mar 00:12:53: RADIUS (00000004): Config NAS IP: 0.0.0.0

  * 1 mar 00:12:53: RADIUS / ENCODE (00000004): acct_session_id: 4

  * 1 mar 00:12:53: RADIUS (00000004): send

  * 1 mar 00:12:53: RADIUS/ENCODE: best local IP 10.142.15.222 for Radius server address - 10.54.248.55

  * 1 mar 00:12:53: RADIUS (00000004): send request to access the id 10.54.248.55:1645 1645/5, len 162

  * 1 mar 00:12:53: RADIUS: 5th authenticator FE 17 88 64 41 1 D 09-86 EA 51 BE 78 42 B6 EB

  * 1 mar 00:12:53: RADIUS: username [1] 14 "28924ad5a199".

  * 1 mar 00:12:53: RADIUS: User-Password [2] 18 *.

  * 1 mar 00:12:53: RADIUS: 6 Service-Type call control [6] [10]

  * 1 mar 00:12:53: RADIUS: Framed-MTU [12] 6 1500

  * 1 mar 00:12:53: RADIUS: Called-Station-Id [30] 19 "00-1A-A1-99-9F-82".

  * 1 mar 00:12:53: RADIUS: Calling-Station-Id [31] 19 "28-92-4A-D5-A1-99".

  * 1 mar 00:12:53: RADIUS: Message-Authenticato [80] 18

  * 1 mar 00:12:53: RADIUS: EE F5 B8 E1 70 37 A6 3A AD 89 20 A5 A7 D0 E3 B4 [p7:]

  * 1 mar 00:12:53: RADIUS: EAP-Key-Name [102] 2 *.

  * 1 mar 00:12:53: RADIUS: NAS-Port-Type [61] 6 Ethernet [15]

  * 1 mar 00:12:53: RADIUS: NAS-Port [5] 6 50102

  * 1 mar 00:12:53: RADIUS: NAS-Port-Id [87] 22 'GigabitEthernet1/0/2 '.

  * 1 mar 00:12:53: RADIUS: NAS-IP-Address [4] 6 10.142.15.222

  * 1 mar 00:12:53: RADIUS (00000004): started 5 sec timeout

  * 1 mar 00:12:53: RADIUS: receipt id 1645/5 10.54.248.55:1645, Access-Accept, len 106

  * 1 mar 00:12:53: RADIUS: authenticator 26 B4 B9 AB 3 04 68 DA - 38 AF F6 CD 36 95 73 2 b

  * 1 mar 00:12:53: RADIUS: username [1] 19 "28-92-4A-D5-A1-99".

  * 1 mar 00:12:53: RADIUS: [25] of class 31

  * 1 mar 00:12:53: RADIUS: 43 41 43 53 3 a 41 30 31 44 52 46 4 30 30 32 2F [CACS:A01DRFN002 /]

  * 1 mar 00:12:53: RADIUS: 32 33 31 35 38 38 36 30 31 31 37 38 2F [231588601/178]

  * 1 mar 00:12:53: RADIUS: Tunnel-Type [64] 01: VLAN 6 [13]

  * 1 mar 00:12:53: RADIUS: Tunnel-Medium-Type [65] 6 01:ALL_802 [6]

  * 1 mar 00:12:53: RADIUS: Message-Authenticato [80] 18

  * 1 mar 00:12:53: RADIUS: 91 22 50 8 62 C2 F0 10 C6 OF 70 84 AF 31 6 CD [Pbp1l ""]

  * 1 mar 00:12:53: RADIUS: mount-Auth-Type [81] 6 20003120

  * 1 mar 00:12:53: RADIUS (00000004): receipt of id 1645/5

  * 1 mar 00:12:53: RADIUS: unsupported value 20003120 to the 81 attribute

  * 1 mar 00:12:53: RADIUS/DECODE: Ascend auth type; IN CASE OF FAILURE

  * 1 mar 00:12:53: RADIUS/DECODE: decoder; IN CASE OF FAILURE

  * 1 mar 00:12:53: RADIUS/DECODE: Ascend-Auth-Type attribute; IN CASE OF FAILURE

  * 1 mar 00:12:53: RADIUS/DECODE: analysis response op decode; IN CASE OF FAILURE

  * 1 mar 00:12:53: RADIUS/DECODE: analyze the answer; IN CASE OF FAILURE

  * 1 mar 00:12:53: % MAB-5-FAIL: failure of authentication for the client (2892.4ad5.a199) on the Interface item in gi1/0/2 AuditSessionID 0A8E0FDE0000000200080ABF

  * 1 mar 00:12:53: % AUTHMGR-7-RESULT: result of the "dead server" authentication "MAB" for the client (2892.4ad5.a199) on the Interface item in gi1/0/2 AuditSessionID 0A8E0FDE0000000200080ABF

  * 1 mar 00:12:53: % AUTHMGR-5-FAIL: failed authorization for customer (2892.4ad5.a199) on the Interface item in gi1/0/2 AuditSessionID 0A8E0FDE0000000200080ABF

  It recognizes the attributes 64 and 65, but the Tunnel-private-group-id, which contains the actual number of VLAN is not supported. How can I assign the vlan OK if this attribute is not taken in charge? Does not work with a string corresponding to the name VLAN on the switch either.

  The version is 12.2.55SE10 3750G.

  Hello

  Since him debugs if I see that you are missing an attribute to make the assignment of VLANs, in your test it just to send the following items:

  * 1 mar 00:12:53: RADIUS: Tunnel-Type [64] 01: VLAN 6 [13]

  * 1 mar 00:12:53: RADIUS: Tunnel-Medium-Type [65] 6 01:ALL_802 [6]

  But it would be appropriate to send:

  • Tunnel-Type = 64 = VLAN

  • Tunnel-Medium-Type = 802

  • Tunnel-private-Group-ID = 253

  When the "Tunnel-private-Group-ID" is the number/name of vlan to be awarded, the bellows is an example on what it would look like on the profile of the ACS:

  http://www.Cisco.com/c/dam/en/us/support/docs/wireless/5500-series-wirel...

  Note: Please mark as answer as appropriate

• Cisco ACS, multiple CA, assignment of VLAN relevant to the domain

  Hi all

  I searched for a solution to a specific customer requirement.

  I want authenticate users with certificates from different RootCA wireless and assign them to one VLAN based on their field?  Ideally, using the same SSID and a Cisco ACS server.

  Is this possible?  Has anyone seen that it works?

  I realize that the ACS can have trust company for the relevant RootCA (dunno what version is needed for this?).  And that assignment VLAN is also possible to a unique SSID based on RADIUS attributes.  But I am not sure that these parts would fit together?

  Would appreciate some advice!

  Thanks in advance

  Rob

  Hello

  Yes, this is possible. I suggest that you implement one by one to make sure that everything works, but no problem to do so. All recent versions of ACS allow this.

  You can do mapping group from ad groups (a group for each area, so if you want to) and assign the vlan based on the mapping of this group.

  GBA can trust several certification authorities and authenticate users with certificates of all these cases. It's just a matter of import these number certificate in the trust list.

  And you can assign the vlan and use only one ssid as well.

  I can't guide you on the procedure that it depends on which version you have and if you have IOS ap or WLC, but it is basically each function separated as in the config Guide and just used all together.

  Nicolas

  ===

  Remember responses of the rate that you find useful

• How to configure the different VLANs (using the E3200)?

  Hello.

  I want to implement different VLANs (using the E3200) so that I can have two different networks that cannot access each other.

  The E3200 is connected to a modem for internet access.

  I would like that the two networks to access the internet.

  The only E3200 does support the creation of VLANs?

  If not, is there another way I can satisfy the requirement by using the single E3200 (using something else than VLANs)?

  At the end of the day, I think that I would need at least another router.

  Thus, for example,.

  Router a (E3200) is connected to the configuration / modem to DHCP with a rank 192.168.1.1/24 LAN IP address.

  Router B is connected to the router and Setup for DHCP by using a LAN IP range 192.168.2.1/24.

  This peripheral way connected to the router A should not have access to devices connected to router B and vice versa, correct?  For example, X device connected to the router cannot ping or browse files on the device is connected to router B and vice versa, correct?

  Do I need to configure anything else on router B?  For example, do I need the DNS configuration settings so that devices connected to router B can connect to the internet without problem?  Do I need to specify that these VLANs are not bridged and which router, or both?

  I already know how to configure a static IP address, DHCP, beaches LAN IP and static DNS settings on a router, etc.

  With respect to wireless devices, I think that they would follow the same model; for devices connected to the router wireless (E3200) have access to other devices Wi-wired and connected to the router, but not to devices with or without wire, connected to router B and vice versa.  However, if the wireless devices have currently access to wired devices was also connected to the router, so it's good for now.

  Thank you very much!

  -Rami

  The E3200 has no support VLAN according to the manual. There is no way to configure two separate networks with this single router.

  You need to add network electronics.

  Ex:

  Managed with VLAN switch

  Another wireless router with VLAN

  If your modem provides several public or private IP addresses, then you could put a switch after the modem and two wireless routers that are attached to the switch.

• What does "wireless authentication failed because of a time-out" mean?

  Have a combo unit router and modem.  Having two computers.  You can use the wireless that the other cannot use Wired.  Getting messages like "wireless authentication failed because of a time-out," conflict of IP address and canceled due to the delay.  There was a variety of messages.  We had been able to use a router before, but it would be turned off every two hours or more.  Giving the same messages on Windows Vista.  The other computer is Windows XP Motorola
  modem/router.

  Hello

  1. what security WEP, WPA, etc. Do you use?
  2. is the driver software updated for the router to work correctly on Vista computer?

  I suggest you to follow these steps and check if that helps:

  Method 1:
  I suggest you to check if you can connect by using a different port or a different router in case the problem is with the router itself.

  Method 2:
  You can also visit the link provided below, which offers a similar problem resolution. Check if the steps to help you resolve the problem.
  http://social.answers.Microsoft.com/forums/en-us/vistanetworking/thread/4db4caa0-86bb-4b7b-8aa7-252d5653f063

  It will be useful.

• Wake on LAN (WOL) through different VLAN on SG-300-10

  Hello

  I try to get WOL working through different VLAN on a Switch SG-300-10 in layer 3 Mode.  To achieve this, I set up a UDP relay (GUI menu Configuration IP) for UDP Port 7 to 255.255.255.255 (this should inundate all interfaces with the package), however, does not work WOL in different VLANS.  When I am connected directly to the VLAN corresponding, WOL works fine in the same subnet.  Am I missing something here?

  All comments appreciated!

  Thank you very much!

  Hi Romeo,.

  A few minutes to try it on my SG300 - 10 p mode layer 3.

  My NAS unit is capable WOL and I thought I would use it in my test environment...

  Ran a basic test to check my sender of packet Magic from my PC "awakened" my NAS unit.

  As you would expect, on the same subnet, the magic packet WOL caused my NAS unit to power, no problem.

  But this isn't really the test, just a test database to check that my sender of the packet magic WOL and NAS was working well.

  The screenshot below shows WOL software I used on my PC.  Why use this software, no reason except that it was available for free. Also, I'm sure other WOL software out there for different platforms that work just as well or with more features.

  

  First of all, I see according to your question, you used relays UDP destination port 7, well it is the default setting on the UDP relay on my switch.

  I wonder why you used or stayed with destination UDP port 7, because the Magic packet mailers may use different destination UDP ports?

  I had to use wireshark to see the real destination UDP port that uses my sender of the magic packet WOL.

  

  Notice of capturing wireshark above, that my magic packet software uses the UDP port destination 9, NOT the default value that you can see on the switch. Ignore what wireshark labels this port.

  OK, I then created a VLAN that I named "VLAN2' with a = 2 VID on my SG300 - 10 p (SRW2008P-K9-NA)

  I added a 192.168.2.1/24 IP interface to VLAN2, which is a different network from the default VLAN.

  I then added three ports this VLAN newly created as a member untagged VLAN2.

  The default VLAN (VID = 1) an IP network 192.168.10.0/24.

  My NAS (WOL capable) unit has an IP address of 192.168.10.61.

  I plugged my PCt to the vlan 2 and statically assigned 192.168.2.2/24.  It is the PC that has the magic package software.

  I added a route static to my router WAN, just so that I could access the router my PC attached to the VLAN2 WAN.

  I tried the magic packet WOL software and will not turn on my NAS.  He expected that the magic packet broadcast would never jump over a limit of LAN in one VLAN different...

  Now, I tried to install a UDP relay so that the Magic Packet WOL "would be" the VLAN2 network interface VLAN1.

  So I configure and add to my SG300 UDP relay entry - 10 p.   See the screen capture below.

  I have to admit, I'm used to using UDP relay normally take a netbios broadcast and unicast to a server Ms.

  But check the screenshot below, I put the switch to send the UDP relay to the broadcast address of VLAN1 network... The magic packet Wakeup sent from my PC into 2 VLANS must have passed over the limit VLAN that my NAS unit woke.

  

  In order to check the destination port UDP to your WOL software using wireshark, and then create an appropriate UDP relay.

  Experiment and play with that, once you get your device WOL properly powereing successfully.

  Best regards, Dave

  If I answered your question, please rate the relevance of this response

• 4.1 of the ACS and 802. 1 x dynamic assignment of VLANS

  Hi guys,.

  a customer wants to implement assignment of VLANs with 802 dynamics. 1 x. The customer has the following facilities, Cisco ACS 4.1 for Windows, Cisco ASA 5540, CSA 5.2 with CSA MC, several routers and Cisco switches.

  Now, the questations are, we can implement assignment of vlan dynamic without a unit of the ANC and the customer also wants to decide between customers with real antivirus signatures and the old signatures. Older clients are denied access to the anti-virus server and the update of the signature and if everything is ok, to have access to the internal network.

  How could implement us this without a new hardware or software?

  Any ideas? Thanks for help.

  René

  You can have a look on the frame of the NAC system. If you want only the posture validate cable customers then there no extra components to buy. If you want to go wireless, you will likely need to buy a Cisco client that supports wireless. You can get the configuration from here guide:

  http://www.Cisco.com/application/PDF/en/us/guest/NetSol/ns617/c649/cdccont_0900aecd8040bbd8.PDF

  I suggest you prototype and see what you think, the good thing is that you can deploy on a per switchport basis so you can make the installer on ACS without disturbing what is there already and apply it by configuring the switch.

• SG300: Cant assign aw vlan 802. 1 x + freeradius

  We recently got SG300-10 and try to get the assignment of vlan dynamic works via 802.1 x and freeradius. We got it so that the client connected to the SG300 would correctly auth, IE, I see this in "see the dot1x users:

  MAC               Auth   Auth   Session        VLAN
  Port     Username         Address           Method Server Time
  -------- ---------------- ----------------- ------ ------ -------------- ----
  gi7      testuser         58:55:ca:24:19:d4 802.1X Remote 00:04:39
  

  However, the client does not seem to be at all on the vlan correct or any vlan. If I change the port of "dot1x - radius attributes vlan static" to "dot1x - radius attributes vlan" then the customer cant auth at all (which is expected because it cannot retrieve the information of vlan).

  The freeradius users file looks like this:

  testuser  Cleartext-Password := "testpassword"
  ##Tunnel-Tag = 0,
  Tunnel-Medium-Type = IEEE-802,
  Tunnel-Type = VLAN,
  Tunnel-Private-Group-Id = "104"
  

  There is this whole line in the eap.conf file:

  copy_request_to_tunnel = yes
  

  Running config:

  net055#show running-config
  config-file-header
  net055
  v1.3.5.58 / R750_NIK_1_35_647_358
  CLI v1.0
  set system mode switch
  file SSD indicator encrypted
  @
  ssd-control-start
  ssd config
  ssd file passphrase control unrestricted
  no ssd file integrity control
  ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0
  !
  vlan database
  default-vlan vlan 3333
  exit
  vlan database
  vlan 1,100,104,111
  exit
  voice vlan oui-table add 0001e3 Siemens_AG_phone________
  voice vlan oui-table add 00036b Cisco_phone_____________
  voice vlan oui-table add 00096e Avaya___________________
  voice vlan oui-table add 000fe2 H3C_Aolynk______________
  voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
  voice vlan oui-table add 00d01e Pingtel_phone___________
  voice vlan oui-table add 00e075 Polycom/Veritel_phone___
  voice vlan oui-table add 00e0bb 3Com_phone______________
  dot1x system-auth-control
  hostname net055
  line console
  exec-timeout 30
  exit
  line ssh
  exec-timeout 0
  exit
  encrypted radius-server host 172.16.200.57 key #REMOVED priority 10 usage dot1.x
  radius-server host source-interface vlan 100
  management access-list mlist2
  permit ip-source 172.16.202.0 mask 255.255.255.0
  permit ip-source 172.16.200.0 mask 255.255.255.0
  exit
  management access-class mlist2
  logging buffered debugging
  aaa authentication enable default enable none
  aaa accounting dot1x start-stop group radius
  enable password level 15 encrypted #REMOVED
  no service password-recovery
  no passwords complexity enable
  passwords aging 0
  username #REMOVED password encrypted #REMOVED privilege 15
  username #REMOVED password encrypted #REMOVED privilege 15
  ip ssh server
  ip ssh password-auth
  ip http timeout-policy 1800 https-only
  no ip http server
  tacacs-server timeout 10
  clock timezone " " 0 minutes 0
  clock source sntp
  !
  interface vlan 100
  ip address 172.16.200.21 255.255.255.0
  no ip address dhcp
  !
  interface vlan 104
  name gen-0-Gnv-204.0
  !
  interface vlan 111
  name guest-0-Gnv-10-66-61.0
  dot1x guest-vlan
  !
  interface gigabitethernet1
  switchport trunk allowed vlan add 100,104,111
  !
  interface gigabitethernet7
  dot1x guest-vlan enable
  dot1x reauthentication
  dot1x radius-attributes vlan static
  dot1x port-control auto
  switchport mode general
  switchport general allowed vlan add 104 untagged
  no macro auto smartport
  !
  exit
  ip default-gateway 172.16.200.1
  

  Looks like there was a similar questions here, but it seems to have never been resolved:

  https://supportforums.Cisco.com/message/3336810#3336810

  Hi all

  I'm working with Colin and that ends up being a problem of RADIUS. In the file eap.conf, for peap (auth phase 1).

  We need to enable copy_request_to_tunnel AND use_tunneled_reply:

  {PEAP

  # The syringe EAP session needs a default value
  # Type of EAP that is distinct from that of
  # module EAP-tunneled.  Inside of the
  # PEAP tunnel, we recommend that you use MS-CHAPv2,
  # as the default type is supported by
  # Windows clients.
  default_eap_type = mschapv2

  # module has PEAP also of these configuration
  Articles of #, which are the same as TTLS.

  copy_request_to_tunnel = yes
  use_tunneled_reply = yes

  Subsequently, we could see the answers of the test with id user vlan posting it once by response.

  See you soon!

• Dynamic assignment of VLANS / SSID using the IAS 4402/MS

  Greetings,

  In short, we have a WLC4402 (50 AP license) and about 30 1252 s towers in place. At the moment we have three VLANS / SSID in place - one for admin, to teachers and students. The WLC uses a server for MS Windows 2003 running IAS for PEAP authentication. Windows XP, the SSID clients entered manually based on "prior designation" 'type' laptop (admin, teacher or student).

  It works very well. However more frequently our users were 'sharing' portable computers so a student can need to use his laptop computer and vice versa. In short, we would like to use the dynamic assignment of VLANS / SSID as well as if a student has the teacher, 'students' laptop VLAN / SSID would receive them when connect (and apply the appropriate ACL, QoS policies, etc.)

  We have found the documents on how to do that with a CBS, but is there something available for this configuration with a MS IAS server.

  All entry information would be greatly appreciated.

  Joe

  The installer works fine with the Server IAS Ms. You must set the options for RADIUS (3 of them) which are documented in the ACS similar article of the same ilk. You can have one SSID, using RADIUS authentication and have the Active Directory to determine the membership to a vlan based on the group.

  The RADIUS attribute parameters are

  Tunnel-Type = Vlan

  Tunnel-Pvt-Group-ID = vlanid

  Tunnel-Medium-Type = 802

  I also like to set

  Ignore-User-Dialin-Properties = True

  You must create some policies in IAS to match your windows groups and set the id vlan correct. A separate policy of IAS by vlan.

  Set the attributes RADIUS by political IAS and ad group or however you plan on the determination of the membership.

  If you want to use RADIUS for administration, you must also define a separate policy that defines the RADIUS of the Service Type administrative = attribute

  Jim

• 802. 1 x assignment of VLANS

  Hi all

  We have the configuration of authentication 802.1 x on our switches.

  The switch ports have the following configured on them.

  switchport access vlan 5

  switchport mode access

  switchport nonegotiate

  switchport protected

  events-the link status logging

  Auto control of the port of authentication

  dot1x EAP authenticator

  dot1x tx-period 5

  dot1x max - req 3

  No cdp enable

  spanning tree portfast

  spanning tree enable bpduguard

  Check IP source

  In addition, the NPS server is configured to assign 9 VLAN devices authenticate successfully.

  I can't know that that one will take precedence? For example, if I connect a device to a switch port that has ' switchport access vlan 5 "but configured network policy servers return 9 VLAN switch on authentication successful unit then what VLAN switch will put the unit in?

  Hello

  It will be placed in the vlan 9. You can check this by running the following command on the switch "sh sessions of authentication interface " where the interface id is the interface of the device is connected to. An alternative is to enable logging on the switch of control of en newspapers for interface events that confirm the vlan that is positioned.

  Kind regards

  Jason

• 802. 1 x with assignment of VLANs

  Hello

  I'm trying to Setup 802. 1 x with assignment of VLANS. I have been successfully obtained the authentication works, but assigning VLAN is not applied. I tried this on a CE500, and WS2950-12 once encountering the same problem.

  If I "debug dot1x all the" I get a few messages "dot1x-ev: received VLAN Id - 1", if I'm capturing packets on my radius server, I see that the correct attribute pairs are extinguished. "." Nothing in the notes say that 802. 1 x with dynamic VLAN will not work.

  Attribute value pairs

  AVP: l = t = Framed-Protocol (7) 6: PPP (1)

  AVP: l = t = Service-Type (6) 6: Framed-User (2)

  AVP: l = t = Tunnel-Medium-Type (65) 6: Unknown (16777222)

  AVP: l = 5 t = Tunnel-Private-Group-Id (81) Tag = 0 x 01:20

  AVP: l = t = Tunnel-Type (64) 6: Unknown (16777229)

  AVP: l = 6 t = EAP - Message (79) last Segment [1]

  AVP: l = 46 t = Class (25): 53F9068C00000137000102000A011E630000000000000000...

  AVP: l = 14 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 51 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 58 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 58 t = Vendor-Specific (26) v = Microsoft (311)

  AVP: l = 18 t = Message-Authenticator (80): 33B53112C51B15C40BFBDCE687F4C9C4

  Please check if all 3 of these attributes are set correctly on the Radius Server:

  AVP: l = t = Tunnel-Medium-Type (65) 6: Unknown (16777222)

  AVP: l = 5 t = Tunnel-Private-Group-Id (81) Tag = 0 x 01:20

  AVP: l = t = Tunnel-Type (64) 6: Unknown (16777229)

  It seems that only the Tunnel-private-Group-Id is defined, not the other two.

  CFR. http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml

• That treats the assignment do VLAN authorization Cisco ISE?

  Hello

  When I create an authorization policy in Cisco ISE, under common tasks, it is the assignment of VLANS. What makes that? Is it puts the user on this VLAN?

  Thank you.

  Yes, this will overwrite the VLAN configured on the switch port/SSID or wireless. For example, all ports can be configured to be part of VLAN 10, but you want users to finances in VLAN 20. You can use the profile of EHT permission to do exactly this.

  Thank you for evaluating useful messages!

• ISE - assignment of VLAN 7.2 WLC

  Good evening

  The authorization of the Wireless_Employees profile, assign vlan 666 employees wireless.

  ISE is passing VLAN 666 to the WLC - see attachment Radius Auth - VLAN666.jpg

  When I look on the WLC to wireless employee who has connected to the network, successuflly WLC is him always place in the pre-settings 7 VLAN.

  1. can you VLAN be pushed of ISE to the WLC (code 7.2.103) for the specific user session?

  2. If so, suggestions, why it does not work for me.

  Thank you.

  Cath.

  Cath,

  Here's a guide that will help with dynamic assignment of VLANs on a WLC.

  http://www.Cisco.com/en/us/Tech/tk722/tk809/technologies_configuration_example09186a008076317c.shtml#WLC

  Thank you

  Tarik Admani
  * Please note the useful messages *.