radio profiles

WLAN settings

Interface settings

AAA profiles

Set the VLANs associated with desired subnets in the WLAN settings.

Configure firewall policies that permit the desired subnet, and add them to the initial role for the WLAN.

In the WLAN settings, configure User role rules with the desired subnet addresses as

Assign switch ports connected to APs to VLANs associated with the desired subnets

users who successfully authenticate and are assigned to the default role by the RADIUS server

users who successfully authenticate and are not assigned a different role by
the RADIUS server

users who have connected to the SSID, but have not yet attempted authentication

users who fail authentication

when the MM detects that a different channel has significantly better quality

when the Mobility Controller (MC) detects a rogue AP on the channel

when the AP detects a large amount of interference on its channel

when the Client Match rules indicate that nearby clients do not support the current channel

Define the Employee and Sales roles as internal roles, and then configure the rules as global rules for internal users.

Apply these rules as a subnet-based policy, and then ensure that only Employee and Sales users are assigned IP addresses in that subnet.

Select either the Employee or Sales role, and then configure these rules within the global policy.

Create a policy with these rules, and then apply that policy to the Employee and Sales roles.

Potential issues

Security

Performance

Network

Change user to any in the user any svc-dhcp permit rule.

Move the user any svc-dhcp permit rule to the bottom of the list.

Remove the deny rule from the policy.

Use the correct service alias in the user any svc-dhcp permit rule.

two 1000 VMC licenses (MC-VA-1000)

one 1000 VMC license (MC-VA-1000)

two 50 VMC licenses (MC-VA-50)

one 50 VMC license (MC-VA-50)