Dynamic VLAN assignment with WLC and ACS for

Unanswered Question

Currently, using our autonomous APs and ACS, our users get separate VLANs per building based on their security level (students or staff). Basically, the student VLAN in one building is different from that of the student VLANs in other buildings on campus. Currently, we do this by filling the Tunnel-Private-Group-ID IETF RADIUS attribute with the VLAN name. This all works because each individual AP can map VLAN names to different VLANs like this:


dot11 vlan-name STUDENT vlan 2903

dot11 vlan-name FACSTAF vlan 2905


As we are working on our WiSM deployment, we see that the document below shows how to do the dynamic VLAN assignment on our WLAN controllers:


http://www.cisco.com/en/US/customer/products/sw/secursw/ps2086/products_configuration_example09186a00808c9bd1.shtml


However, we haven't figured out if it's possible to still provide our users with different VLANs for each building they're in.


With the instructions above, it looks like ACS uses a Cisco RADIUS Attribute to indicate the Air-Interface-Name, mapping an ACS/AD group to a single WLC interface which can only have one VLAN/subnet associated with it.


Does anybody know if what we're trying to accomplish is possible, or if we're really stuck with only one VLAN/subnet per mapped ACS group?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
ivillegas Tue, 10/16/2007 - 12:49
User Badges:
  • Silver, 250 points or more

Are you using same WiSM acroos the building. Normally a WLAN is cionfigured and mapped to a unique Vlan interface thereby ensuring all Wlan are in unique vlan. This is true for all access point that joins the WiSM. In this case you can make the client use different WLAN ensuring they are in Unique Vlan.

We only have the one WiSM for all of campus, so it's handling everything. This Cisco docs do indicate how to put differnet users in different Vlans, but we don't currently see a way to also put them in different subnets per building.


This being the case, any suggestions on how best to handle more than a Class C subnet's worth of users? Should we just subnet larger than Class C, or is there a more elegant way of handling this?

Rob Simkins Tue, 11/16/2010 - 07:33
User Badges:

Look at AP VLAN Groups, assign one group per building and apply VLAN to SSID as required.

Better late than never!

After more investigation (back then), we decided it wasn't really possible. What we ended up doing was simply using larger subnets and giving each user groups a single VLAN. I want to say that a limit on the number of interfaces was what stopped us initially. Ultimately, we decided that the single subnet per user group worked better and was easier to manage


Ethan

Actions

This Discussion

 

 

Trending Topics - Security & Network