The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Allow Authentication, Authorization, Accouting (AAA) Override option of a WLAN enables you to configure the WLAN for authentication. It enables you to apply VLAN tagging, QoS, and ACLs to individual clients based on the returned RADIUS attributes from the AAA server.
AAA overrides for FlexConnect access points introduce a dynamic VLAN assignment for locally switched clients. AAA overrides for FlexConnect also support fast roaming (Opportunistic Key Caching [OKC]/ Cisco Centralized Key management [CCKM]) of overridden clients.
VLAN overrides for FlexConnect are applicable for both centrally and locally authenticated clients. VLANs can be configured on FlexConnect groups.
If a VLAN on the AP is configured using the WLAN-VLAN, the AP configuration of the corresponding ACL is applied. If the VLAN is configured using the FlexConnect group, the corresponding ACL configured on the FlexConnect group is applied. If the same VLAN is configured on the FlexConnect group and also on the AP, the AP configuration, with its ACL takes precedence. If there is no slot for a new VLAN from the WLAN-VLAN mapping, the latest configured FlexConnect group VLAN is replaced.
If the VLAN that was returned from the AAA is not present on the AP, the client falls back to the default VLAN configured for the WLAN.
Before configuring a AAA override, the VLAN must be created on the access points. These VLANs can be created by using the existing WLAN-VLAN mappings on the access points, or by using the FlexConnect group VLAN-ACL mappings.
AAA Override for IPv6 ACLs
In order to support centralized access control through a centralized AAA server such as the Cisco Identity Services Engine (ISE) or ACS, the IPv6 ACL can be provisioned on a per-client basis using AAA Override attributes. In order to use this feature, the IPv6 ACL must be configured on the controller and the WLAN must be configured with the AAA Override feature enabled. The AAA attribute for an IPv6 ACL is Airespace-IPv6-ACL-Name similar to the Airespace-ACL-Name attribute used for provisioning an IPv4-based ACL. The AAA attribute-returned contents should be a string that is equal to the name of the IPv6 ACL as configured on the controller.
AAA Overrides of Bidirectional Rate Limiting on an AP and Controller
Upstream/Downstream | Local Mode | FlexConnect Central Switching | FlexConnect Local Switching | FlexConnect Standalone |
---|---|---|---|---|
Per-Client Downstream | Controller | Controller | AP | AP |
Per-Client Upstream | AP | AP | AP | AP |
AAA | QoS Profile of AAA | WLAN | QoS Profile of WLAN | Applied to Client |
---|---|---|---|---|
100 Kbps | 200 Kbps | 300 Kbps | 400 Kbps | 100 Kbps |
X | — | — | — | 200 Kbps |
X | X | — | — | 300 Kbps |
X | X | X | — | 400 Kbps |
X | X | X | X | Unlimited |
Before configuring a AAA override, VLANs must be created on the access points. These VLANs can be created by using the existing WLAN-VLAN mappings on the access points, or by using the FlexConnect group VLAN-ACL mappings.
At any given point, an AP has a maximum of 16 VLANs. First, the VLANs are selected as per the AP configuration (WLAN-VLAN), and then the remaining VLANs are pushed from the FlexConnect group in the order that they are configured or displayed in the FlexConnect group. If the VLAN slots are full, an error message is displayed.
VLAN, ACL, QoS, Rate limiting are supported with local and central switching WLAN.
Dynamic VLAN assignment is not supported for web authentication from a controller with Access Control Server (ACS).
AAA override of bidirectional rate limiting on an AP and the controller is supported on all the following 802.11n nonmesh access points:
If bidirectional rate limiting is not present, AAA override cannot occur.
The ISE server is supported.
The upstream rate limit parameter is equal to the downstream parameter, from AAA override.
Local authentication is not supported.
To configure VLAN overrides on a FlexConnect access point, use the following command:
config ap flexconnect vlan add vlan-id acl ingress-acl egress-acl ap_name