Configure Dynamic VLAN Assignment with WLCs Based on ISE to Active Directory Group Map

Introduction

Prerequisites

The document describes how to configure the wireless LAN controller (WLC) and Identity Services Engine (ISE) server in order to assign wireless LAN (WLAN) clients into a specific VLAN dynamically.

Requirements

Components Used

The information in this document is based on these software and hardware versions:

• Cisco 5520 Series WLC that runs firmware release 8.8.111.0

• Cisco 4800 Series AP

• Native Windows supplicant and Anyconnect NAM

• Cisco Secure ISE version 2.3.0.298

• Microsoft Windows 2016 Server configured as a domain controller

• Cisco 3560-CX Series Switch that runs version 15.2(4)E1

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Conventions

Refer to Cisco Technical Tips Conventions for more information on document conventions.

Dynamic VLAN Assignment with RADIUS Server

In most WLAN systems, each WLAN has a static policy that applies to all clients associated with a Service Set Identifier (SSID), or WLAN in the controller terminology. Although powerful, this method has limitations because it requires clients to associate with different SSIDs in order to inherit different QoS and security policies.

Cisco WLAN solution addresses that limitation by the support of identity networking. This allows the network to advertise a single SSID but allows specific users to inherit different QoS, VLAN attributes, and/or security policies based on the user credential.

The VLAN ID is 12 bits and takes a value between 1 and 4094, inclusive. Because the Tunnel-Private- Group-ID is of type string, as defined in RFC2868 for use with IEEE 802.1X, the VLAN ID integer value is encoded as a string. When these tunnel attributes are sent, it is necessary to fill in the Tag field.

As noted in RFC 2868, section 3.1: the Tag field is one octet in length and is intended to provide a means of grouping attributes in the same packet which refer to the same tunnel. Valid values for this field are 0x01 through 0x1F, inclusive. If the Tag field is unused, it must be zero (0x00). Refer to RFC 2868 for more information on all RADIUS attributes.

Configure

This section provides the information needed to configure the described features in the document.

Network Diagram

Configurations

These are the configuration details of the components used in this diagram:

• The IP address of the ISE (RADIUS) server is 10.48.39.128.

• The Management and AP-manager Interface address of the WLC is 10.48.71.20.

• DHCP server resides in the LAN network and is configured for respective client pools; it is not shown in the diagram.

• VLAN1477 and VLAN1478 are used throughout this configuration. Users from the Marketing department are configured in order to be placed into the VLAN1477 and users from the HR department are configured in order to be placed into VLAN1478 by the RADIUS server when both users connect to the same SSID ― office_hq.

  VLAN1477: 192.168.77.0/24. Gateway: 192.168.77.1 VLAN1478: 192.168.78.0/24. Gateway: 192.168.78.1 

• This document uses 802.1x with PEAP-mschapv2 as the security mechanism.

Note: Cisco recommends that you use advanced authentication methods, such as EAP-FAST and EAP-TLS authentication, in order to secure the WLAN.

These assumptions are made before you perform this configuration:

• The LAP is already registered with the WLC

• The DHCP server is assigned a DHCP scope

• Layer 3 connectivity exists between all devices in the network

• The document discusses the configuration required on the wireless side and assumes that the wired network is in place

• Respective users and groups are configured on AD

In order to accomplish dynamic VLAN assignment with WLCs based on ISE to AD group mapping, these steps must be performed:

1. ISE to AD integration and configuration of authentication and authorization policies for users on ISE.
2. WLC configuration in order to support dot1x authentication and AAA override for SSID 'office_hq'.
3. End client supplicant configuration.

ISE to AD Integration and Configuration of Authentication and Authorization Policies for Users on ISE

1. Login to the ISE Web UI interface using an admin account.
2. Navigate to Administration > Identity management > External Identity Sources > Active directory.
   
   
   
   
3. Click Add and enter the domain name and identity store name from the Active Directory Join Point Name settings. In the example, ISE is registered to the domain wlaaan.com and joinpoint is specified as AD.wlaaan.com - locally significant name to ISE.
   
   
   
   
4. A pop-up window opens after Submit button is pressed that asks you if you want to join ISE to AD immediately. Press Yes and provide Active Directory user credentials with admin rights to add a new host to the domain.
   
   
   
   
5. After this point, you must have ISE successfully registered to AD.
   
   
   
   In case you have any issues with the registration process, you can use the Diagnostic Tool  in order to run the tests required for AD connectivity.
6. You must retrieve groups for the active Directories that are used in order to assign respective authorization profiles. Navigate to Administration > Identity management > External Identity Sources > Active directory > <Your AD> > Groups, then click Add and choose Select Groups from Active Directory.
   
   
   
   
7. A new pop-up window opens where you can either specify a filter in order to retrieve specific group(s) or retrieve all groups from AD.
   Choose the respective groups from the AD group list and press OK.
   
   
   
   
8. Respective Groups are added to ISE and can be saved. Press Save.
   
   
   
   
9. Add WLC to the ISE Network device list - navigate to Administration > Network Resources > Network Devices and press Add.
   Complete configuration, by providing WLC management IP address and RADIUS shared secret between WLC and ISE.
   
   
   
   
10. Now after you joined ISE to AD and added the WLC to the device list, you can start the configuration of authentication and authorization policies for users.
    • Create an authorization profile in order to assign users from Marketing to VLAN1477 and from the HR group to VLAN1478.
      Navigate to Policy > Policy Elements > Results > Authorization > Authorization profiles and click the Add button in order to create a new profile.
      
      
      
      
    • Complete the authorization profile configuration with VLAN information for the respective group; the example shows Marketing group configuration settings.
      
      
      
      Similar configuration must be done for other groups and respective VLAN tag attributes must be configured.
    • After authorization profiles are configured, you can define authentication policies for wireless users. This can be done either by configuring Custom or modifying the Default Policy set. In this example, the Default policy set is modified. Navigate to Policy > Policy Sets > Default. By default for dot1x authentication type, ISE is going to use All_User_ID_Stores, although it works even with current default settings since AD is part of the identity source list of All_User_ID_Stores, this example uses a more specific rule WLC_lab for that respective LAB controller and uses AD as the only source for authentication.
      
      
      
      
    • Now you must create authorization policies for users that assign respective authorization profiles based on group membership. Navigate to Authorization policy section and create policies in order to accomplish that requirement.
      
      

WLC Configuration to Support dot1x Authentication and AAA Override for SSID 'office_hq'

1. Configure ISE as a RADIUS authentication server on WLC. Navigate to Security > AAA > RADIUS > Authentication  section in the web UI interface and provide the ISE IP address and shared secret information.
   
   
   
   
2. Configure SSID office_hq under the WLANs section on the WLC; this example configures SSID with WPA2/AES+dot1x and AAA override. Interface Dummy is chosen for the WLAN since the proper VLAN is assigned via RADIUS anyway. This dummy interface must be created on the WLC and given an IP address, but the IP address does not have to be valid and the VLAN in which it is put can not be created in the uplink switch so that if no VLAN is being assigned, the client cannot go anywhere.
   
   
   
   
   
   
   
   
   
   
   
   
   
   
3. You must also create dynamic interfaces on the WLC for user VLANs. Navigate to Controller > Interfaces UI menu. The WLC can only honor the VLAN assignment received via AAA if it has a dynamic interface in that VLAN.
   
   
   

Verify

Use the Windows 10 native supplicant and Anyconnect NAM in order to test connections.

Since you are using EAP-PEAP authentication and ISE is using a Self-Signed Certificate (SSC), you must agree to a certificate warning or disable certificate validation. In a corporate environment, you must use a signed and trusted certificate on ISE and ensure that the end-user devices have the appropriate root certificate installed under the Trusted CA list.

Test connection with Windows 10 and native supplicant:

1. Open Network & Internet settings > Wi-Fi > Manage known networks  and create a new network profile by pressing the Add new network  button;fill in the required information.
   
   
   
   
2. Check the authentication log on ISE and ensure the right profile is selected for the user.
   
   
   
   
3. Check client entry on WLC and ensure it is assigned to the right VLAN and is in the RUN state.
   
   
   
   
4. From the WLC CLI, the client status can be checked with the show client dertails <mac-address>:
   
   

   show client detail f4:8c:50:62:14:6b 
   Client MAC Address............................... f4:8c:50:62:14:6b
   Client Username ................................. Bob
   Client Webauth Username ......................... N/A
   Hostname: ....................................... 
   Device Type: .................................... Intel-Device
   AP MAC Address................................... 70:69:5a:51:4e:c0
   AP Name.......................................... AP4C77.6D9E.6162  
   AP radio slot Id................................. 1  
   Client State..................................... Associated     
   User Authenticated by ........................... RADIUS Server
   Client User Group................................ Bob
   Client NAC OOB State............................. Access
   Wireless LAN Id.................................. 3  
   Wireless LAN Network Name (SSID)................. office_hq
   Wireless LAN Profile Name........................ office_hq
   Hotspot (802.11u)................................ Not Supported
   Connected For ................................... 242 secs
   BSSID............................................ 70:69:5a:51:4e:cd  
   Channel.......................................... 36 
   IP Address....................................... 192.168.78.36
   Gateway Address.................................. 192.168.78.1
   Netmask.......................................... 255.255.255.0
   ...
   Policy Manager State............................. RUN
   ...
   EAP Type......................................... PEAP
   Interface........................................ vlan1478
   VLAN............................................. 1478
   Quarantine VLAN.................................. 0
   Access VLAN...................................... 1478

Test connection with Windows 10 and Anyconnect NAM:

1. Choose the SSID from the available SSIDs list and the respective EAP authentication type (in this example PEAP) and the inner authentication form.
   
   
   
   
2. Provide username and password for user authentication.
   
   
   
   
3. Since ISE is sending an SSC to the client, you must manually choose to trust the certificate (in the production environment it is highly recommended to install the trusted certificate on ISE).
   
   
   
   
4. Check authentication logs on ISE and ensure the right authorization profile is selected for the user.
   
   
   
   
5. Check client entry on the WLC and ensure it is assigned to the right VLAN and is in the RUN state.
   
   
   
   
6. From the WLC CLI, the client status can be checked with the show client dertails <mac-address>:
   
   

   Client MAC Address............................... f4:8c:50:62:14:6b
   Client Username ................................. Alice
   Client Webauth Username ......................... N/A
   Hostname: ....................................... 
   Device Type: .................................... Intel-Device
   AP MAC Address................................... 70:69:5a:51:4e:c0
   AP Name.......................................... AP4C77.6D9E.6162  
   AP radio slot Id................................. 1  
   Client State..................................... Associated     
   User Authenticated by ........................... RADIUS Server
   Client User Group................................ Alice
   Client NAC OOB State............................. Access
   Wireless LAN Id.................................. 3  
   Wireless LAN Network Name (SSID)................. office_hq
   Wireless LAN Profile Name........................ office_hq
   Hotspot (802.11u)................................ Not Supported
   Connected For ................................... 765 secs
   BSSID............................................ 70:69:5a:51:4e:cd  
   Channel.......................................... 36 
   IP Address....................................... 192.168.77.32
   Gateway Address.................................. 192.168.77.1
   Netmask.......................................... 255.255.255.0
   ...
   Policy Manager State............................. RUN
   ...
   Policy Type...................................... WPA2
   Authentication Key Management.................... 802.1x
   Encryption Cipher................................ CCMP-128 (AES)
   Protected Management Frame ...................... No
   Management Frame Protection...................... No
   EAP Type......................................... PEAP
   Interface........................................ vlan1477
   VLAN............................................. 1477

Troubleshoot

1. Use the test aaa radius username <user> password <password> wlan-id <id>  in order to test the RADIUS connection between WLC and ISE and the test aaa show radius in order to show the results.
   
   

   test aaa radius username Alice password <removed> wlan-id 2
   
   Radius Test Request
     Wlan-id........................................ 2
     ApGroup Name................................... none
   
     Attributes                      Values    
     ----------                      ------    
     User-Name                       Alice     
     Called-Station-Id               00-00-00-00-00-00:AndroidAP
     Calling-Station-Id              00-11-22-33-44-55
     Nas-Port                        0x00000001 (1)
     Nas-Ip-Address                  10.48.71.20
     NAS-Identifier                  0x6e6f (28271)
     Airespace / WLAN-Identifier     0x00000002 (2)
     User-Password                   cisco!123 
     Service-Type                    0x00000008 (8)
     Framed-MTU                      0x00000514 (1300)
     Nas-Port-Type                   0x00000013 (19)
     Cisco / Audit-Session-Id        1447300a0000003041d5665c
     Acct-Session-Id                 5c66d541/00:11:22:33:44:55/743
   
   
   
   test radius auth request successfully sent. Execute 'test aaa show radius' for response
   
   (Cisco Controller) >test aaa show radius 
   
   Radius Test Request
     Wlan-id........................................ 2
     ApGroup Name................................... none
   Radius Test Response
   
   Radius Server            Retry Status
   -------------            ----- ------
   10.48.39.128             1     Success
   
   Authentication Response:
     Result Code: Success
   
     Attributes                      Values    
     ----------                      ------    
     User-Name                       Alice     
     State                           ReauthSession:1447300a0000003041d5665c
     Class                           CACS:1447300a0000003041d5665c:rmanchur-ise/339603379/59
     Tunnel-Type                     0x0000000d (13)
     Tunnel-Medium-Type              0x00000006 (6)
     Tunnel-Group-Id                 0x000005c5 (1477)
   
   
   
   (Cisco Controller) >

2. Use the debug client <mac-address> in order to troubleshoot wireless client connectivity issues.
3. Use the debug aaa all enable in order to troubleshoot authentication and authorization issues on the WLC.
   
   
   

   Note: Use this command only with the debug mac addr in order to limit the output based on the MAC address for which debugging is done.

4.  Refer to ISE live logs and session logs in order to identify problems authentication failures and AD communication issues.