Trunk port security for Catalyst AP

[LinLi]

Hi Team,

Customer has deployed Catalyst 9100 series APs, connecting to Meraki MS switch. APs are Flex mode and joined to C9800 WLC.

On MS switch, the ports connecting APs are on Trunk mode. one of VLAN for SSID is in local forwarding from Meraki switching.

Question: is any way to deploy MAB authentication with ISE for those AP port on Meraki switch. Or if any other solutions to improve the port security?

Thanks.

[alemabrahao]

No, it's not, just with port in access mode.

[RaphaelL]

Only solution imo is to capwap the trafic to the WLC and put the AP ports in access mode with an access policy.

[rhbirkelund]

While unfortunately it's not using ISE, you could create a SmartPort automation that triggers on the AP LLDP description. If it's a Catalyst 91xx it uses a Trunk port, otherwise it's an Access Port with an Access Policy.