Dynamic VLAN and DHCP

[jmannalkami]

Using Cisco ISE to send a dynamic vlan to MS switches after 802.1x user authentication.  Switch registers the dVlan and I see the client move on the dashboard, however the client is never made aware, and does not request a new DHCP address.

Do we need to bounce the port?

Switch firmware is latest (12.28) to rule out any bugs in 802.1x.  Using Windows native supplicant.

[Claes_Karlsson]

Have you enabled Radius CoA support?

[jmannalkami]

Yes we have.  ISE is never sending it (validated via PCAP) only sending access-accept w/ the dVlan information.

[Claes_Karlsson]

https://documentation.meraki.com/MS/Access_Control/Change_of_Authorization_with_RADIUS_(CoA)_on_MS_S...

Check out this documentation if you haven't 🙂

/CK

[jmannalkami]

I have, but there is no CoA occurring, ever.

The access-accept contains the dVlan info, MS switch puts user in that vlan, but user is never made aware and therefore doesn't request new DHCP address in the new vlan.

Unless I'm missing something very obvious in ISE/Meraki (and yes, I've been over ALL their documentation).

[PhilipDAth]

You are going to need to open a support case for that one.  It sounds like a big has been introduced into 12.28 around CoA.

[jmannalkami]

I have one.  They swear up and down this config should work and is supported, lots of pcaps show radius doing what it should do.

Figured I'd ask community in case they saw issues too.

[PhilipDAth]

And this is happening across multiple switches?

[jmannalkami]

Yep.  All the same MS350, some are still on 10.x firmware.

[Saadqazi]

Hello,

Based on DHCP addresses, I'm trying to determine how to dynamically assign VLANs. What happens if I have more users with the same level of authorization in one VLAN than there are available slots in the other VLANs in my Active Directory setup? To assign a VLAN, can RRAS check at the DHCP scope availability?

I don't want 2000 users with the same level of authority in a /21. I'd like if they were spread out over a few /23s.

Your suggestions are much appreciated.