Real-World Cisco ISE, Part 4: Wireless 802.1X that roams fast — SSID profiles, clean CWA guest, and posture without pain

You’ll deploy EAP-TLS on WLAN, enable fast roaming that actually works, keep guest (CWA) tidy with the right redirect ACL, avoid VLAN sprawl using dACL/SGT, and leave with a validation + debug flow and RADIUS/CoA dependencies set so this runs reliably in production.

Assumed from Parts 1–3: PSNs reachable, AD integrated, PKI/EAP-TLS solid, wired 802.1X working.

0) SSID plan (one minute of design)

• Corp SSID: WPA2-Enterprise (EAP-TLS) now; add WPA3-Enterprise when clients are ready. Enable 802.11r (FT) and 802.11k/v.
• Guest SSID: Open + Central Web Auth (CWA) to ISE. A redirect ACL (walled garden) must allow DHCP + DNS + portal only.
• Contractor/BYOD (optional): WPA2-Enterprise PEAP as a time-boxed transition lane; narrower policy; plan to retire.
• PMF: Required for WPA3; optional for WPA2. For open+CWA SSIDs, keep PMF optional for legacy devices.
• Bands: Put corp on 5/6 GHz; park guest/IoT spillover on 2.4 GHz if needed.

1) Controller essentials (reliable defaults)

• AAA override: On (lets ISE push dACL/SGT or VLAN per session).
• RADIUS accounting (interims): On (ISE needs state).
• Change of Authorization (CoA): On (policy flips without kicking clients).
• Server-cert trust on clients: Install your CA chain so EAP-TLS doesn’t prompt.
• Session/idle timers: Set sane values in the policy profile (e.g., session 8–12 h, idle 30–60 min).

2) Catalyst 9800 — Corp SSID with EAP-TLS

! RADIUS and AAA
radius server ISE-PSN1
 address ipv4 10.10.10.11 auth-port 1812 acct-port 1813
 key <secret>
 timeout 2
 retransmit 3
!
radius server ISE-PSN2
 address ipv4 10.10.10.12 auth-port 1812 acct-port 1813
 key <secret>
 timeout 2
 retransmit 3
!
aaa new-model
aaa group server radius ISE-GRP
 server name ISE-PSN1
 server name ISE-PSN2
!
aaa authentication dot1x DOT1X_RADIUS group ISE-GRP
aaa authorization network DOT1X_RADIUS group ISE-GRP
aaa accounting update periodic 5
aaa accounting network DOT1X_RADIUS start-stop group ISE-GRP
! RFC 5176 CoA (dynamic authorization)
aaa server radius dynamic-author
 client 10.10.10.11 server-key <secret>
 client 10.10.10.12 server-key <secret>
 auth-type any
!
! WLAN (corp)
wlan CORP 10 CORP
 ssid CORP
 security wpa
  security wpa akm dot1x
  security wpa akm dot1x ft
  security pmf optional
 no shutdown
! Fast Transition global
dot11 ft enable
! Policy profile (override + accounting + timers)
wireless profile policy CORP-POL
 aaa-override
 accounting aaa DOT1X_RADIUS
 session-timeout 43200
 idle-timeout 3600
 ! Central switching/DHCP/NAT per design:
 ! central switching
 ! central dhcp
 ! central nat
! Bind
wlan CORP
 policy CORP-POL

Notes

• Dynamic-author is mandatory so ISE can send CoA (UDP 3799).
• Keep interim updates (accounting update periodic 5) so ISE maintains live session state.
• If a subset of clients breaks with 11r, run a temporary non-FT twin SSID and phase them out.

3) Catalyst 9800 — Guest CWA (open SSID with clean redirect)

Pre-auth (redirect) ACL — allow only the minimum (include 8443 — ISE portals often listen there)

ip access-list extended CWA-REDIRECT
 permit udp any any eq bootps        ! DHCP
 permit udp any any eq domain        ! DNS
 permit tcp any host <ISE_PSN_VIP> eq 80
 permit tcp any host <ISE_PSN_VIP> eq 443
 permit tcp any host <ISE_PSN_VIP> eq 8443
 deny   ip any any

SSID and web-auth

wlan GUEST 20 GUEST
 ssid GUEST
 security web-auth
 security web-auth authentication-list DOT1X_RADIUS
 no shutdown
wireless profile policy GUEST-POL
 aaa-override
 accounting aaa DOT1X_RADIUS
 web-auth parameter-map GUEST-PMAP
parameter-map type webauth GUEST-PMAP
 type external-webauth
 redirect for-login https://<ISE_PSN_VIP>/guestportal
 redirect-list CWA-REDIRECT

ISE authz flow (concept)

• Pre-auth hit → return URL-Redirect to portal + Redirect-ACL = CWA-REDIRECT.
• Post-auth guest → return guest dACL (Internet only) or a guest SGT.

4) AireOS (legacy) quick pointers

• Corp: WPA2-Enterprise (802.1X), AAA override, RADIUS accounting, FT (over-the-air).
• Guest CWA: Pre-auth ACL (DNS/DHCP/ISE only), Layer-3 external web-auth → ISE portal, CoA enabled.
• Allow UDP 3799 between PSN and controller for CoA.

5) Meraki MR quick pointers

• Corp: WPA2/WPA3-Enterprise with My RADIUS Server; add both PSNs; enable RADIUS accounting and CoA.
• Per-user policy: ISE can return Filter-ID (maps to Meraki Group Policy). Classic Cisco dACL isn’t applied on MR; use Group Policy or VLAN override.
• Guest CWA: Custom splash → ISE; add walled-garden entries for the portal FQDN/IP + DNS/DHCP.

6) Fast roaming that actually helps

• 802.11r (FT): Reduces handshake time; enable on corp; test with Windows/macOS/iOS/Android.
• 802.11k/v: Better roam decisions; turn on.
• OKC/PMK caching: Older stacks benefit; newer ones prefer 11r.
• If voice/video is critical, walk-roam on a call; capture loss/jitter as evidence.

7) Keep VLAN count down (prefer dACL/SGT)

• Corp baseline/full via dACL from ISE; SGT if your fabric supports TrustSec.
• Use VLAN override only when you must (legacy gear, guest isolation).
• Name dACLs sanely: ALLOW-CORP-BASE, ALLOW-CORP-FULL, GUEST-INTERNET-ONLY.

8) Ports & dependencies (open these or auth breaks)

• Controller/NAD ↔ PSN: RADIUS UDP 1812/1813, CoA UDP 3799.
• Client ↔ Portal (CWA): TCP 80/443/8443 to ISE portal FQDN/IP, plus UDP 67/68 (DHCP) and UDP 53 (DNS).
• ISE ↔ AD/DNS/NTP: Kerberos 88, LDAP/LDAPS 389/636, DNS 53, NTP 123.
• If you load-balance PSNs, ensure CoA source IP is what ISE expects (stickiness or SNAT accordingly).

9) Test matrix (capture evidence — don’t skip)

• Corp join (EAP-TLS): Laptop connects without prompt. On 9800: show wireless client mac <mac> detail → dot1x eap-tls; ISE Live Logs → EAP-TLS + authz result; dACL/SGT applied.
• Fast roam: Move between two APs during a call/video; measure loss/jitter; session stays up.
• Guest CWA: Captive portal appears; login works; post-auth policy is Internet-only; no lateral access.
• Contractor/BYOD (if used): PEAP lane works but narrower policy; ISE logs identify stragglers.
• CoA event: Change authz in ISE; 9800 applies the new dACL without disconnect.
• ISE-down: Kill one PSN; clients keep working via the other; accounting/CoA still clean.

Save controller client-detail screenshots, ISE Live Log entries, and a short roam capture. Add them to the site’s evidence pack.

10) Common breakages → fast fixes

• TLS prompt on join → Client doesn’t trust the EAP server CA or wrong cert SAN/EKU on the PSN. Install the CA chain; reissue the EAP cert with proper SAN.
• Connected but no traffic → dACL not applied. Check AAA override, CoA status, and RADIUS accounting.
• Guest portal never shows → Redirect ACL wrong; allow only DNS/DHCP/portal; confirm controller targets the correct ISE FQDN/IP/port (often 8443).
• Roam hiccups → Flaky 11r clients. Keep 11r enabled overall; stand up a non-FT twin SSID short-term; patch client drivers.
• Sessions don’t update → Interims off or PSN latency. Ensure accounting update periodic and check show aaa servers.

11) Handy show/debug (fast triage)

Catalyst 9800

show wireless client mac <mac>
show wireless client mac <mac> detail
show wireless client mac <mac> policy
show wlan id <id>
show aaa servers
show wireless stats client detail
debug wireless mac <mac>

AireOS

show client detail <mac>
debug client <mac>
show radius statistics

ISE

• Live Logs → filter by MAC; verify EAP-TLS and authz result.
• Operations → RADIUS Live Logs → check CoA successes.
• Endpoint Identity Groups → confirm guest/BYOD classification.

12) Ops that keep it boring (reliable)

• Dashboards: WLAN auth success %, top failure reasons, clients by EAP method, PSN latency, AP/channel utilization.
• Weekly: Chase PEAP users; review cert 90/60/30-day expiries.
• Monthly: Backup/restore controller + ISE in lab; re-run corp + guest + contractor tests and file the new evidence.

13) Ready-to-use snippets (stash in your repo)

Generic redirect ACL (CWA)

ip access-list extended CWA-REDIRECT
 permit udp any any eq bootps
 permit udp any any eq domain
 permit tcp any host <ISE_PSN_VIP> eq 80
 permit tcp any host <ISE_PSN_VIP> eq 443
 permit tcp any host <ISE_PSN_VIP> eq 8443
 deny   ip any any

ISE guest pre-auth result (concept)

result: url-redirect=https://<ISE_PSN_VIP>/guestportal
result: redirect-acl=CWA-REDIRECT

ISE corp authz sketch

if eap-tls_machine and domain_member -> ALLOW-CORP-BASE (dACL/SGT)
if eap-tls_user and in Corp-Users     -> ALLOW-CORP-FULL (dACL/SGT)
if guest                              -> GUEST-INTERNET-ONLY (dACL)

Closing

You now have corp EAP-TLS that roams cleanly, guest CWA that doesn’t leak, controlled BYOD/PEAP as a temporary lane, and all the CoA/accounting/ports set so policy changes stick without disconnects. Run the test matrix on two APs per floor, snapshot ISE + controller configs, and park the evidence with the site. That’s the difference between “seems fine” and provably reliable.