Describes DHCP options 55 and 77 functionality and provides configuration procedures for sending these options to ISE, including EAP request timeout settings via GUI and CLI.

The DHCP sensors use these DHCP options on the ISE for both native and remote device profiling:

Option 12: Hostname
Option 6: Class Identifier

These options must also be sent to ISE for accurate profiling:

Option 55: Parameter Request List
Option 77: User Class

Configure the DHCP options 55 and 77 to ISE using the GUI

Ensure DHCP options 55 and 77 are sent to ISE to enable device profiling and policy enforcement

These options allow ISE to collect device-specific DHCP information for accurate profiling on wireless networks.

Before you begin

Confirm that your network devices are compatible with ISE profiling features.

Procedure

	1.	Choose Configuration > Tags & Profiles > Policy.
	2.	On the Policy Profile page, click Add to view the Add Policy Profile window.
	3.	Click Access Policies tab, choose the RADIUS Profiling and DHCP TLV Caching check boxes to configure radius profiling and DHCP TLV Caching on a WLAN.
	4.	Click Save & Apply to Device

he network device now sends DHCP options 55 and 77 to ISE, enabling accurate device profiling and network access policy enforcement.

Configure the device to send DHCP options 55 and 77 to ISE (CLI)

Enable the device to send specific DHCP options to ISE for improved client profiling.

This configuration is essential for environments where client profiling is necessary for network access control and monitoring.

Before you begin

Ensure that the device is running a compatible version of the software that supports DHCP options 55 and 77.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure WLAN policy profile and enters the wireless policy configuration mode. Example: `Device(config)# wireless profile policy profile-policy` The profile-policy is the name of the WLAN policy profile being configured.
	3.	Configure DHCP TLV caching on a WLAN. Example: `Device(config-wireless-policy)# dhcp-tlv-caching` Enables caching of DHCP TLV information for better profiling.
	4.	Configure client radius profiling on a WLAN. Example: `Device(config-wireless-policy)# radius-profiling` Enables RADIUS profiling to enhance client identification.
	5.	(Optional) Return to privileged EXEC mode. Example: `Device(config-wireless-policy)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The device is configured to include DHCP options 55 and 77 in client profiling information sent to Cisco ISE.

Configure the EAP request timeout using the GUI

Use the steps to configure the EAP request timeout through the GUI:

Procedure

	1.	Choose Configuration > Security > Advanced EAP.
	2.	In the EAP-Identity-Request Timeout field, specify the amount of time (in seconds) in which the device attempts to send an EAP identity request to wireless clients using local EAP.
	3.	In the EAP-Identity-Request Max Retries field, specify the maximum number of times that the device attempts to retransmit the EAP identity request to wireless clients using local EAP.
	4.	Set EAP Max-Login Ignore Identity Response to Enabled state to limit the number of clients that can be connected to the device with the same username. You can log in up to eight times from different clients (PDA, laptop, IP phone, and so on) on the same device. The default state is Disabled.
	5.	In the EAP-Request Timeout field, specify the amount of time (in seconds) in which the device attempts to send an EAP request to wireless clients using local EAP.
	6.	In the EAP-Request Max Retries field, specify the maximum number of times that the device attempts to retransmit the EAP request to wireless clients using local EAP.
	7.	In the EAPOL-Key Timeout field, specify the amount of time (in seconds) in which the device attempts to send an EAP key over the LAN to wireless clients using local EAP.
	8.	In the EAPOL-Key Max Retries field, specify the maximum number of times that the device attempts to send an EAP key over the LAN to wireless clients using local EAP.
	9.	In the EAP-Broadcast Key Interval field, specify the time interval between rotations of the broadcast encryption key used for clients and click Apply. Note After configuring the EAP-Broadcast key interval to a new time period, you must shut down or restart the WLAN for the changes to take effect. Once the WLAN is shut down or restarted, the M5 and M6 packets are exchanged when the configured timer value expires.

Configure EAP request timeout

Set the timeout for EAP requests to manage client exclusion effectively.

This configuration is useful in environments where EAP authentication is used, and it is necessary to handle clients that do not respond in a timely manner.

Before you begin

Ensure you have access to the device and are in the appropriate configuration mode.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Enable exclusion on timeout and no response. Example: `Device(config)# wireless wps client-exclusion dot1x-timeout` By default, this feature is enabled. To disable, append a no at the beginning of the command.
	3.	Return to privileged EXEC mode. Example: `Device(config)# end` Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The EAP request timeout is now configured, allowing for better management of client exclusions.

Configure the EAP request timeout in wireless security

Set the EAP request timeout to ensure timely authentication in wireless security.

This configuration is essential in environments where EAP is used for authentication, as it affects the responsiveness of the authentication process.

Before you begin

Ensure you have access to the device and are in privileged EXEC mode.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal` Enters global configuration mode.
	2.	Configure the EAP request retransmission timeout value in seconds. Example: `Device(config)# wireless security dot1x request timeout timeout` Configures the EAP request retransmission timeout value in seconds.
	3.	Return to privileged EXEC mode. Example: `Device(config)# end` Returns to privileged EXEC mode. Alternatively, you can also press Ctrl-Z to exit global configuration mode.

The EAP request timeout is now configured, which will help in managing the authentication process in wireless security.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

DHCP option 55 and 77 parameters

Configure the DHCP options 55 and 77 to ISE using the GUI

Before you begin

Procedure

Configure the device to send DHCP options 55 and 77 to ISE (CLI)

Before you begin

Procedure

Example:

Example:

Example:

Example:

Example:

Configure the EAP request timeout using the GUI

Procedure

Configure EAP request timeout

Before you begin

Procedure

Example:

Example:

Example:

Configure the EAP request timeout in wireless security

Before you begin

Procedure

Example:

Example:

Example: