Cisco NAC for a campus

[SteveHen]

Hi,

Please can I get some understanding for potential solutions for a problem with NAC using ISE. I have Meraki switches and the L3 is held on the SD WAN devices. Currently various client vlans but moving to NAC what are the options for the client vlan. NAC will place a client into a user vlan. This will centrally from my understanding place the port into a single vlan number across the estate. Where I have  large site across multiple buildings I do not really want to have a single vlan 10 for all client connections that would need to be a /22 for the number of clients. This could cause some STP issues that I would like to avoid.

Thanks, Steve

[Mloraditch]

Named VLANs and profiles would be the solution for, you can use names in ISE and then apply different vlan numbers to groups of switches for the same name
 https://documentation.meraki.com/Switching/MS_-_Switches/Design_and_Configure/Configuration_Guides/P...
https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Design_and_Configure/C...

[PhilipDAth]

This is the way.

[DarrenOC]

Definitely another upvote for this one 

[alemabrahao]

If you avoid a single VLAN across multiple buildings, use Rapid STP (RSTP) or MSTP for interoperability.
Meraki MS switches run single-instance MSTP, essentially Rapid STP and avoid PVST or vendor-specific STP variants.

Take a look about Meraki and ISE integration.

https://community.cisco.com/t5/security-knowledge-base/how-to-integrate-meraki-networks-with-ise/ta-...