ExtremeCloud IQ- Site Engine & Extreme Management Center

Enforcing policy domain to Extreme Wireless Controller with Mismatch

  • 1.  Enforcing policy domain to Extreme Wireless Controller with Mismatch

    Posted 11-13-2018 14:53
    Hi All,

    After a while of not doing anything with NAC, I am going to change up a configuration I made a year ago for a customer. I need some new roles with some new vlans etc. Security is done by using a firewall (FortiGate) so no need for rules etc.

    I created a few vlans on the switches (2 stacks of 3 switches X440-G2) and these are imported nicely in the policy manager. I made some new roles to which I added contain to VLAN (With the vlans I created) and now it's time to enforce the configuration to the NAC to be able to use all them roles etc for real.

    I always do a verify, as I did now and I get a lot of domain mismatches from the Wireless controllers. I fixed some of these issues by just importing the roles from the WLC to the policy domain but not all. (this was needed because we do a splash page etc for guests on the WLC.

    I am more concerned by the following messages which I hope someone can tell me what exactly will happen if I go ahead and enforce this:

    Role [name] mismatch - following needs to be written: [Access Ctrl/VLANxxx] to x.x.x.x
    - Have a few of those, will this be changed with the enforce or is this a message that I need to change this before enforcing.

    Some messages regarding some rules which need to be removed but no statement why they need to be removed.
    - Will the enforce remove the rules? Or is this (again) just a notification?

    The following VLANs [xxx][xxx][xxx][xxx] do not exist.
    - Will these be created by the enforce or will I need to do this myself?

    And some transmit queue port group statements, I do not even use so I am not too bothered about these.

    The main question is: Will a enforce just change a bunch of this (add, remove and edit) or will it just add things and not remove and edit?

    Hope you can help answer my questions :)