Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

AAA override

Updated: April 10, 2026

Want to summarize with AI?

Log in

Describes the AAA Override option of a WLAN that enables configuration of WLAN for identity networking.

AAA override is a WLAN option that enables you to configure the WLAN for identity networking by applying VLAN tagging, Quality of Service (QoS), and Access Control Lists (ACLs) to individual clients based on the returned RADIUS attributes from the AAA server.

Configure AAA override (CLI)

Enable AAA override functionality to allow authentication servers to dynamically override wireless policy configurations on a per-client basis.
AAA override allows RADIUS servers to push policy attributes that supersede the locally configured wireless policy settings. This is useful for implementing dynamic policies based on user authentication results.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Configure WLAN policy profile and enter the wireless policy configuration mode.

Example:

Device(config)# wireless profile policy profile-policy

Example:

Device(config)# wireless profile policy test-wgb
3.

Configure AAA policy override.

Example:

Device(config-wireless-policy)# aaa-override
Note

If VLAN is not pushed from the RADIUS server, the VLAN Override feature can be disabled from the RADIUS server.
4.

Return to privileged EXEC mode.

Example:

Device(config-wireless-policy)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.
AAA override is now enabled for the wireless policy profile, allowing RADIUS server attributes to override local policy settings for authenticated clients.

VLAN override

VLAN override is an authentication feature that

  • requires AAA Override to be enabled under the Policy Profile

  • enables VLAN assignment from the RADIUS server using IETF RADIUS attributes or Aire-Interface-Name attribute, and

  • supports VLAN ID, VLAN name, or VLAN group name assignment.

VLAN assignment methods

You can assign VLAN from the RADIUS server in two ways:

  • Using IEFT RADIUS attributes 64, 65, and 81—The attribute 81 can be a VLAN ID, VLAN name, or VLAN group name. Both VLAN name and VLAN group are supported. Therefore, VLAN ID does not need to be predetermined on RADIUS.

    The RADIUS user attributes used for the VLAN ID assignment are:

    • 64 (Tunnel-Type)—Must be set to VLAN (Integer = 13).

    • 65 (Tunnel-Medium-Type)—Must be set to 802 (Integer = 6).

    • 81 (Tunnel-Private-Group-ID)—Must be set to the corresponding VLAN ID, VLAN name, or VLAN group name.

  • Using Aire-Interface-Name attribute—Use this attribute to assign a successfully authenticated user to a VLAN interface name (or VLAN ID) as per the user configuration. When you use this attribute, the VLAN name is returned as a string.

Note

If additional 802.1x authentication is executed after VLAN override in MAB authentication, the RADIUS server must be configured to return the same value in VLAN attribute even with 802.1x authentication. VLAN overridden by MAB authentication and the VLAN assigned by 802.1x authentication should have the same value.

The VLAN ID is 12-bits, and takes a value between 1 and 4094, inclusive. Because the Tunnel-Private-Group-ID is of type string, as defined in RFC2868 for use with IEEE 802.1X, the VLAN ID integer value is encoded as a string. When these tunnel attributes are sent, it is necessary to fill in the Tag field.

Configure override VLAN for central switching (CLI)

Enable dynamic VLAN assignment from a RADIUS server for centrally switched wireless clients.
Override VLAN configuration allows the RADIUS server to dynamically assign VLANs to wireless clients during authentication, providing flexible network segmentation based on user credentials or policies.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Define VLANs that can be pushed from the RADIUS server.

Example:

Device(config)# vlan vlan-id

Example:

Device(config)# vlan 20

The valid VLAN ID range is 1 to 4094.
3.

(Optional) Change the default name of the VLAN.

Example:

Device(config-vlan)# name vlan-name

Example:

Device(config-vlan)# name vlan_ascii
4.

Return to privileged EXEC mode.

Example:

Device(config-vlan)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.
The override VLAN is configured and ready to accept dynamic VLAN assignments from the RADIUS server for centrally switched clients.

Configure override VLAN for local switching (CLI)

Configure VLAN name to ID mapping under flex profile for local switching scenarios.
If the VLAN name ID mapping under flex profile is newly added or updated, then the WLAN policy profiles having a matching VLAN name configured, must be shut and unshut. This is to ensure that the updated WLAN-VLAN mapping is pushed to the APs and the client receives the IP address from the intended VLAN.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Configure a Flex profile.

Example:

Device(config)# wireless profile flex flex-profile-name

Example:

Device(config)# wireless profile flex rr-xyz-flex-profile
3.

Define VLANs that can be pushed from the RADIUS server.

Example:

Device(config-wireless-flex-profile)# vlan-name vlan-name

Example:

Device(config-wireless-flex-profile)# vlan-name vlan_123
4.

Configure VLAN ID.

Example:

Device(config-wireless-flex-profile-vlan)# vlan-id vlan-id

Example:

Device(config-wireless-flex-profile-vlan)# vlan-id 23

The valid VLAN ID range is 1 to 4096.
5.

Return to privileged EXEC mode.

Example:

Device(config-wireless-flex-profile-vlan)# end

Alternatively, you can also press Ctrl-Z to exit global configuration mode.
The override VLAN is now configured for local switching with the specified flex profile, enabling VLAN name to ID mapping for wireless clients.

VLAN override on Layer 3 web authentication

VLAN override on Layer 3 web authentication is a network authentication feature that

  • enables the RADIUS server to push a new VLAN assignment during Layer 3 authentication

  • triggers client re-association and DHCP renewal when VLAN changes occur, and

  • maintains client state during the transition process.

Authentication process and client transition

When a client gets connected to the controller and authenticated using the RADIUS server for Local Web Authentication (LWA) and Central Web Authentication (CWA), the RADIUS server pushes back in access-accept the new VLAN. If the RADIUS server pushes back a new VLAN in the access-accept, the client goes back to IP learn state on the controller. The controller de-associates the client while maintaining the client state for 30 seconds. Once the client re-associates, the client lands immediately to the new VLAN and re-triggers a new DHCP request. The client then learns a new IP and moves to the RUN state on the controller.

The VLAN Override on Layer 3 Web authentication supports:

  • Local clients

  • Anchored clients

  • FlexConnect central authentication, central or local switching

VLAN override verification on Layer 3 web authentication

Verify VLAN override on layer 3 web authentication using specific show commands to display override status and statistics.

To display the VLAN override after L3 authentication, use this command:

Device# show wireless client mac <mac> detail
[…]
        Vlan Override after L3 Auth: True

To display the statistics about client, use this command:

Device# show wireless stats client detail
[…]
      Total L3 VLAN Override vlan change received      : 1
      Total L3 VLAN Override disassociations sent      : 1
      Total L3 VLAN Override re-associations received  : 1
      Total L3 VLAN Override successful VLAN change    : 1
      […]
      L3 VLAN Override connection timeout                             : 0