CISCO 3850 + Radius SSID Authentication

[karan_jhr]

Hi

I am using CISCO 3850 + MS Radius to authenticate the users

Is it possible to authenticate only a specific group of users to a specific SSID

Groups Staff must be able to authenticate on SSID WIFI 1

Groups Students must be able to authenticate on SSID WIFI 2

 

thanks

[Duke5A]

Are your staff and student wireless networks on their own VLANs? You can place conditions on the connection policy by originating subnet. That will get you what you need.

 

Another option is to take away the student's access rights to authenticate to wireless using their user accounts and only allow computer authentication. This only works though if they're only using domain joined computers. I used this option in my environment.

[karan_jhr]

Thanks Duke

Yes we do have separate VLAN for them. Shall i implement this subnet policy via GUI or CLI

 

We ave all computers domain joined but i am more concerned about the wifi being used by students, thus want to restrict their authenticating and shape traffic via packetshaper

[Duke5A]

Thanks Duke

Yes we do have separate VLAN for them. Shall i implement this subnet policy via GUI or CLI

 

We ave all computers domain joined but i am more concerned about the wifi being used by students, thus want to restrict their authenticating and shape traffic via packetshaper

 

Do you have students authenticating non-domain joined devices to wireless using their AD accounts? If no, then there is a better way to do this. I had this exact same problem a few years back where students were using their AD accounts to join cell phones and other stuff to the internal wireless. On the student laptops you can specify to use computer account, user account, or both for authentication on the wireless connection. By default it's set to both and when the device boots it uses computer authentication, and after the student has logged on it passes to user authentication. Set it to strictly use computer and take away the students' rights to authenticate to wireless using their accounts at the radius server. Problem solved.

 

If you allow them to use their account to authenticate personal devices, then what I said above goes right out the window. For modifying the Radius connection policy I would most certainly do it using the management snap-in. I wouldn't know where to start doing this at the command line.

[karan_jhr]

Thanks Duke but my problem is that the students are authentication using non domain joined devices to wifi and mostly mobiles not laptops etc

I wonder why Cisco or any other appliance cant release a simple solution to authenticate users as per the groups OU bind to specific SSID.

Seems simple but still struggling to find a fool proof solution

[Priscilla110]

You can configure it to only allow access to the specific SSIDs by specific groups (one group of each SSID would be easiest). Then add those groups to AD, and add the users into each group that you want to have the capability to connect.