topic How to dynamically assign a user to a VLAN depending on the AP location? in ExtremeWireless (Identifi)

How to dynamically assign a user to a VLAN depending on the AP location?

Dusan_K_ — Tue, 05 Dec 2017 14:25:00 GMT

Hi all,

my goal is to use same SSID and (dynamically) assign users to a VLAN depending on location.

I am looking into "Replace BSSID with Zone name" in RADIUS TLVs (RADIUS Access Request Message Options) but had no success making it work. I can see the proper "Called Station Identifier: Location x" in NPS Event Viewer though. Now I need to find a way to assign a proper VLAN to it at the AP ...

I followed procedure on https://extremeportal.force.com/ExtrArticleDetail?an=000082506 but am missing something here ...

Setup: B@AP topology, EAP-TLS, NPS, NAC (RADIUS Proxy mode)

Thanks!

RE: How to dynamically assign a user to a VLAN depending on the AP location?

Volker_Kull — Tue, 05 Dec 2017 14:56:00 GMT

Hi Dusan!

you need :
- location groups with APs
- a rule on EWC for every VLAN you use (matching the rule you get from NAC via RADIUS !) with the configured VLAN topoogy
- a NAC aaa rule for every location using this EWC rules. Radius request will overwrite the default rule on EWC
- on EWC (Global/Authentication/RFC3580): choose: "Both RADIUS Filter-ID and Tunnel-Private-Group-ID attributes"
- VLANs tagged on AP wired port

try WLAN config without TLS and NPS ! Use NAC user store to prevent issues from NPS.

br
Volker

RE: How to dynamically assign a user to a VLAN depending on the AP location?

Ronald_Dvorak — Tue, 05 Dec 2017 19:39:00 GMT

You'd take a look into this post to get some ideas how to troubleshoot the issue...

https://community.extremenetworks.com/extreme/topics/how-to-configure-windows-2012-nps-for-radius-au...

RE: How to dynamically assign a user to a VLAN depending on the AP location?

Dusan_K_ — Tue, 05 Dec 2017 20:44:00 GMT

Hi,

found a working solution w/ EAC!

Client EWC/B@AP EAC (Radius Proxy) NPS (EAP-TLS)

Here's my community contribution (based on Volker Kull's advice):

@EWC

"Both RADIUS Filter-ID and Tunnel-Private-Group-ID attributes"

Replace BSSID with Zone name

Zone:

@EAC

Access Control >

Select Location

Tagged

Select Policy Mapping

802.1X (EAP-TLS)

Select Location

Select Access Control Profiles

Policy >

RFC3580

Note:
Client is authenticated against NPS.
Policy (Role/VLAN mapping) is applied directly from EAC.
Role Enterprise Access is used as an example

Cheers!