Fallback for AAA-overridden VLAN is a wireless policy profile feature that provides backup network connectivity when AAA-assigned VLANs or VLAN groups become unavailable.

Fallback for AAA-overridden VLAN implementation details

From Cisco IOS XE Bengaluru 17.6.1, fallback for AAA-overridden VLAN or VLAN groups is supported on the wireless policy profile.

A new command is introduced in the wireless policy profile to configure the Fallback for AAA-Overridden VLAN feature. In Cisco IOS XE Bengaluru 17.6.1, you cannot configure the Fallback for AAA Overridden VLAN feature using the GUI.

Feature history for fallback for AAA-overridden VLAN

This table provides release and related information for the feature explained in this module.

This feature is available in all the releases subsequent to the one in which it is introduced in, unless noted otherwise.

Table 1. Feature history for fallback for AAA-overridden VLAN
Feature	Release	Feature Information
Fallback for AAA-Overridden VLAN	Cisco IOS XE Bengaluru 17.6.1	In Cisco IOS XE Bengaluru 17.5.1 and earlier releases, if there is a network with a single AAA server dictating policies that need to be applied to a client; and this client moves across different sites that have different policy definitions. If these policy definitions are not defined on the site to which the client needs to connect, the client does not get access to the network. For example, if a client is to be given access in VLAN 1, and VLAN 1 is not defined on the site to which the client connects, the client is excluded and does not get any access to the network. The Fallback for AAA-Overridden VLAN feature is introduced to allow fallback to policy profile VLAN when the overridden VLAN is not available.

Central switching and FlexConnect mode scenarios

Central switching and FlexConnect mode scenarios are network configurations that

define client VLAN assignment behavior when fallback is enabled for AAA-overridden VLAN or VLAN groups
determine how clients receive IP addresses based on controller and FlexConnect profile configurations, and
specify different VLAN assignment rules for Central Switching versus FlexConnect modes.

Central switching mode behavior

If fallback is enabled for AAA-overridden VLAN or VLAN groups, you might encounter these scenarios in Central Switching and FlexConnect modes.

In Central Switching mode, VLAN assignment follows these rules:

If the AAA server gives a VLAN policy to a client, and the VLAN ID or the VLAN name is defined in the controller, the client is assigned to the VLAN specified by the AAA server.
If the VLAN is not defined in the controller, the client is assigned to a VLAN that is configured on the wireless policy profile.
If a VLAN group is configured on a wireless policy profile, the VLAN, as computed by the existing VLAN group logic, is assigned to the client.
In the VLAN group case, fallback to policy profile VLAN occurs only when all the VLANs in the group are not configured in the controller, or, if the VLAN group is not defined in the controller.
If both, AAA-overridden VLAN and the VLAN configured on the wireless policy profile are not defined in the controller, the configuration is termed as invalid, and the client is excluded.
If a VLAN policy is not configured, or, if the default wireless policy profile is configured, the client is assigned a VLAN from the management VLAN.

If the AAA server assigns a VLAN policy to a client configured in the FlexConnect profile, the VLAN is resolved by the controller. If the VLAN is not configured on the FlexConnect profile, the behavior of the VLAN name and the VLAN ID is made consistent, with the help of the fallback feature, and the client receives the IP address from the wireless policy profile configuration.

FlexConnect mode behavior includes these characteristics:

If AAA VLAN is defined in FlexConnect profile, the client is assigned the AAA VLAN.
If AAA VLAN is not defined in the FlexConnect profile, FlexConnect VLAN Central Switching is configured, and VLAN is defined in the controller, and the client is assigned AAA VLAN and is centrally switched.
If AAA VLAN is not defined in the FlexConnect profile, FlexConnect VLAN Central Switching is configured, the VLAN is not defined in the controller, and the client is assigned a VLAN from the wireless policy profile.
If AAA VLAN is not defined in the FlexConnect profile, and FlexConnect VLAN Central Switching is not configured, the client is assigned a VLAN from the wireless policy profile.

Configure fallback for AAA-overridden VLAN (CLI)

Enable fallback to the policy profile VLAN when the AAA-overridden VLAN is not available, ensuring client connectivity continuity.

When AAA servers override client VLAN assignments but the specified VLAN becomes unavailable, fallback configuration allows clients to connect using the default policy profile VLAN instead of being denied access.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure the WLAN policy profile and enter wireless policy profile configuration mode. Example: `Device(config)# wireless profile policy wlan-policy-profile-name`
	3.	Allow fallback to the policy profile VLAN when the overridden VLAN is not available. Example: `Device(config-wireless-policy)# aaa-override vlan fallback`

The WLAN policy profile is configured with AAA override VLAN fallback, allowing clients to use the default policy VLAN when their AAA-assigned VLAN is unavailable.

Verify fallback for AAA-overridden VLAN

To verify if the fallback for AAA-overridden VLAN is enabled, use this command:

Device# show wireless profile policy detailed default-policy-profile | sec AAA Policy Params
AAA Policy Params
  AAA Override                  : DISABLED
  NAC                           : DISABLED
  AAA Policy name               : default-aaa-policy
  AAA Vlan Fallback             : ENABLED

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Fallback for AAA-overridden VLAN