Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

RADIUS VSA

Updated: April 10, 2026

Want to summarize with AI?

Log in

RADIUS VSA details.

A RADIUS VSA is a vendor-specific attribute used in RADIUS implementations that

  • allows vendors to communicate specialized information between a network access server and a RADIUS server

  • enables support for attributes not defined by standard RADIUS specifications, and

  • is included in authentication or accounting packets, or both, according to implementation needs.

The main elements of the VSA are:

  • Type: Identifies the attribute type.

  • Length: Indicates attribute length.

  • String (Data): Contains vendor-specific data, which includes:

    • Vendor ID

    • Vendor type

    • Vendor length

    • Vendor data

Supported modes and attributes

Authentication and accounting requests per WLAN support these VSAs in addition to the existing AAA attributes.

Table 1. Newly supported attributes

Attribute name

Well-known attribute

VSA sub-attribute

Vendor ID

SVR-Zip-Code

26

14

14369

SVR-Device-Type

26

17

14369

SVR-Device-Model-Number

26

18

14369

SVR-Lat-Long

26

19

14369

SVR-Venue-Category

26

20

14369

SVR-Network-Type

26

21

14369

Aggregation-AAA

26

22

14369

BW-Venue-Id

26

7

22472

BW-Venue-TZ

26

8

22472

BW-Class

26

10

22472

BW-Venue-Description

26

11

22472

BW-ISO-Country-Code

26

14

22472

BW-E164-Country-Code

26

15

22472

BW-State-Name

26

16

22472

BW-City-Name

26

17

22472

BW-Area-Code

26

18

22472

BW-User-Group

26

27

22472

BW-Venue-Name

26

29

22472

BW-Operator-Name

26

37

22472
Note

You can use this feature only in FlexConnect central authentication mode with local switching. FlexConnect local authentication mode is not supported. Use this feature for wireless sessions only.

Create an attribute list

Create a custom AAA attribute list for use in policy mapping.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Create a AAA attribute list.

Example:

Device(config)# aaa attribute list attribute-list
3.

Specify a AAA attribute type.

Example:

Device(config-attr-list)# attribute type attribute-type
Device(config-attr-list)# attribute type BW-City-Name “MUMBAI”
4.

(Optional) Specify a AAA attribute type such as the state name.

Example:

Device(config-attr-list)# attribute type BW-State-Name “MAHARASHTRA"
5.

(Optional) Specify a AAA attribute type such as the venue name.

Example:

Device(config-attr-list)#attribute type BW-Venue-Name “WANKHEDE”
6.

Return to Privileged EXEC mode.

Example:

Device(config-attr-list)# end
After you create the AAA attribute list, you can use it in policy mapping.

What to do next

Create a AAA policy and map the attribute list.

Map a AAA policy to WLAN policy profile

Associate a AAA policy with a WLAN policy profile. This enforces authentication and authorization rules on wireless clients.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Create a new wireless policy profile.

Example:

Device(config)# wireless profile policy EAP-AKA profile-policy
3.

Create a new AAA policy.

Example:

Device(config-wireless-policy)# aaa-policy Verizon-aaa-policy aaa-policy
4.

Return to Privileged EXEC mode.

Example:

Device(config-wireless-policy)# end
You have mapped the AAA policy to the WLAN policy profile.

What to do next

Map the WLAN policy profile to a WLAN.

Map the WLAN policy profile to a WLAN

Associate a previously configured WLAN policy profile to a WLAN on a Cisco device.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Create a new policy tag.

Example:

Device(config)# wireless tag policy policy-name
3.

Map the policy profile to a WLAN.

Example:

Device(config-policy-tag)# wlan wlan-profile-name policy aaa-policy
4.

Return to Privileged EXEC mode.

Example:

Device(config-policy-tag)# end
The specified WLAN policy profile is successfully mapped to the WLAN. 
Device# configure terminal
Device(config)# wireless tag policy EAP-AKA
Device(config-policy-tag)# wlan EAP-AKA policy EAP-AKA
Device(config-policy-tag)# end