7.3 Multi-Platform Client Management & Policy Enforcement

7.3 Multi-Platform Client Management & Policy Enforcement

Core Blueprint Focus: In enterprise wireless networks, authentication is only the first step. True client policy enforcement requires the dynamic application of access control lists, dynamic VLAN steering, security group tagging, and device classification. For the Cisco WLCOR 350-101 exam, candidates must master the Catalyst 9800 Policy Profile framework, understand AAA Override integration with Cisco Identity Services Engine (ISE), memorize RFC 2865/3580 RADIUS attributes, and comprehend multi-platform client management across Cisco Catalyst Center, Cisco Spaces, and Mobile Device Management (MDM/UEM) systems.

---

1. Policy Profile Framework on Catalyst 9800

In the modular Cisco IOS-XE wireless architecture, the Policy Profile (wireless profile policy <name>) defines how a connected client session is handled once associated with an SSID. While the WLAN Profile defines Layer 2 wireless radio attributes, the Policy Profile dictates network segmentation, transport tunneling, timeouts, and security policies.

+-------------------------------------------------------------------------------------------------+
|                               CATALYST 9800 POLICY PROFILE ATTRIBUTES                           |
|                                                                                                 |
|  +---------------------------+  +---------------------------+  +-----------------------------+  |
|  |      VLAN BINDINGS        |  |    OPERATIONAL TIMEOUTS   |  |      IP SNOOPING & SEC      |  |
|  | - Static VLAN ID / Name   |  | - Session Timeout (86400s)|  | - IP DHCP Required         |  |
|  | - VLAN Group (Load Hash)  |  | - Idle Timeout (300s)    |  | - Client Tracking DB        |  |
|  | - Dynamic AAA Assignment  |  | - Re-authentication Timer|  | - Anti-Spoofing Protection  |  |
|  +---------------------------+  +---------------------------+  +-----------------------------+  |
|                                                                                                 |
|  +-------------------------------------------------------------------------------------------+  |
|  |                      FORWARDING AND AUTHENTICATION SWITCHES                               |  |
|  | - Central Switching: Bridges client data across CAPWAP Data (UDP 5247) to WLC            |  |
|  | - Central Authentication: Relays 802.1X EAP/RADIUS to central WLC and ISE                 |  |
|  | - Central DHCP: WLC acts as DHCP Relay / Snooper for client IP allocation                |  |
|  | - Central Association: WLC processes 802.11 Association Request / Response               |  |
|  +-------------------------------------------------------------------------------------------+  |
+-------------------------------------------------------------------------------------------------+

Core Policy Profile Attributes

1. VLAN Mapping & VLAN Groups:

   • Associates the wireless client to a default Layer 2 broadcast domain: vlan <vlan-id-or-name>.
   • VLAN Groups: In high-density campus environments, placing 5,000 wireless clients into a single /20 or /19 subnet creates massive broadcast and multicast overhead. Network engineers create a VLAN Group containing multiple smaller subnets (e.g., four /24 VLANs). When clients connect, the Catalyst 9800 hashes each client's MAC address across the group, distributing clients evenly across subnets without segmenting the physical WLAN.

2. Session and Idle Timeouts:

   • Session Timeout (session-timeout <seconds>): Specifies the maximum lifetime of an authenticated client session before the WLC forces a full re-authentication or re-authorization (default: 86400 seconds / 24 hours). For guest portals, this is tuned to 28800 seconds (8 hours) to enforce daily login re-acceptance.
   • Idle Timeout (idle-timeout <seconds>): Specifies the duration of continuous inactivity (no packets sent or received) before the controller purges the client from the active association table and tears down hardware encryption contexts (default: 300 seconds).

3. DHCP Required Option (ip dhcp required):

   • When ip dhcp required is enabled in the Policy Profile, a client cannot pass any Layer 3 data traffic until the controller (or FlexConnect AP) snoops a successful DHCP transaction (DHCP DISCOVER $\rightarrow$ OFFER $\rightarrow$ REQUEST $\rightarrow$ ACK) for that client's MAC address.
   • Operational Defense: If an unauthorized user or rogue device connects to the SSID and manually assigns a static IP address to bypass DHCP, or attempts to hijack the default gateway IP, the controller drops all traffic from that MAC address at the ingress access port.
   • Enforces strict IP-to-MAC binding in the controller's Client Tracking Database, providing ironclad defense against static IP spoofing and IP theft.

---

2. Dynamic Policy Enforcement via AAA Override & Cisco ISE

While a Policy Profile establishes default parameters for an SSID, enterprise environments require dynamic, identity-based segmentation. An HR employee, an IT engineer, and a third-party contractor may all associate to the exact same corporate SSID (Corporate-Secure). Rather than creating multiple SSIDs, Cisco architectures utilize AAA Override.

When aaa-override is enabled within the Policy Profile, the Catalyst 9800 inspects the RADIUS Access-Accept packet returned by Cisco Identity Services Engine (ISE) during 802.1X or MAC Authentication Bypass (MAB) authorization. Any authorization attributes returned by ISE dynamically supersede the static parameters configured in the Policy Profile.

[ Wireless Client ]  <--->  [ Catalyst 9800 WLC ]  <=== RADIUS Access-Request ===>  [ Cisco ISE ]
        |                            |                                                  |
        |                            |  <=== RADIUS Access-Accept ===================== |
        |                            |       - Tunnel-Type = 13 (VLAN)                  |
        |                            |       - Tunnel-Medium-Type = 6 (802)             |
        |                            |       - Tunnel-Private-Group-ID = "IT_Admin"     |
        |                            |       - Airespace-ACL-Name = "IT-STRICT-ACL"     |
        |                            |       - cts:security-group-tag = 0004-Employee   |
        |                            |                                                  |
        | <--- Dynamic Steering ---> |                                                  |
        | Client placed in IT_Admin  |                                                  |
        | VLAN with SGT 4 Tagging    |                                                  |

Standard IETF vs. Cisco Vendor-Specific Attributes

1. Dynamic VLAN Assignment (RFC 2865 / RFC 3580): To dynamically steer a client into a specific VLAN based on their Active Directory group membership, Cisco ISE returns three standard IETF RADIUS attributes that must appear together:

   • Tunnel-Type (RADIUS Attribute 64): Must be set to 13 (denoting VLAN).
   • Tunnel-Medium-Type (RADIUS Attribute 65): Must be set to 6 (denoting 802 networks, including Ethernet and Wi-Fi).
   • Tunnel-Private-Group-ID (RADIUS Attribute 81): Contains the string or integer identifying the target VLAN ID or VLAN Name (e.g., 100 or "Engineering_VLAN").

2. Access Control Lists (ACLs):

   • Pre-configured Local ACLs: ISE returns the Cisco vendor-specific attribute (VSA) Airespace-ACL-Name = <ACL_Name> (Vendor ID 14179, Sub-type 6). The named ACL must be locally configured in the Catalyst 9800 configuration. The controller binds this ACL to the client's session at the data plane.
   • Downloadable ACLs (dACL): In enterprise campus fabrics, ISE dynamically pushes ACL syntax directly within RADIUS attributes using Cisco AV-pairs: Cisco:cisco-av-pair = "ip:inacl#1=permit ip any 10.1.0.0 0.0.255.255". The controller compiles the dACL on the fly without requiring prior local definition.

3. URL Redirection (Central Web Authentication & ISE Posture): For Central Web Authentication (CWA), BYOD onboarding, and AnyConnect posture compliance, ISE returns two coordinated Cisco AV-pairs:

   • Redirect ACL: Cisco:cisco-av-pair = "url-redirect-acl=<ACL_NAME>"
     • Critical Exam Logic: The Redirect ACL defines what traffic is intercepted. Traffic PERMITTED by the ACL is intercepted by the controller's HTTP/HTTPS redirect engine and forwarded to the ISE guest portal URL. Traffic DENIED by the ACL (such as DNS on UDP 53, DHCP on UDP 67/68, and traffic to Cisco ISE itself) bypasses redirection and is permitted through.
   • Redirect URL: Cisco:cisco-av-pair = "url-redirect=https://ise.cisco.local:8443/portal/gateway?sessionId=..."
     • Directs the client's browser to the customized captive portal login page.

4. Scalable Group Tag (SGT) Assignment (Cisco TrustSec):

   • ISE dynamically assigns a 16-bit Scalable Group Tag (SGT) via Cisco:cisco-av-pair = "cts:security-group-tag=0004-Employee".
   • The Catalyst 9800 inserts this tag into the Cisco Meta Data (CMD) header of encapsulated packets, allowing downstream Cisco Catalyst switches and firewalls to execute role-based Security Group ACLs (SGACLs) regardless of client IP addressing.

---

AAA Override RADIUS Attributes Reference Matrix

---

3. RFC 5176 Dynamic Authorization: Change of Authorization (CoA)

In enterprise networks, an endpoint's authorization posture changes over time. When an unauthenticated guest user logs into a captive portal, or when a corporate laptop completes an AnyConnect posture scan confirming antivirus definitions are updated, the network must elevate permissions immediately without forcing the user to disconnect from Wi-Fi.

RFC 5176 defines Dynamic Authorization / Change of Authorization (CoA). Cisco ISE initiates an asynchronous UDP request to the Catalyst 9800 WLC using one of two primary message types:

1. CoA-Reauth (Packet Code 43):
   • Transmitted over UDP port 1700 (Cisco default) or UDP port 3799 (RFC standard).
   • Prompts the Catalyst 9800 WLC to query ISE for updated authorization attributes for that specific client session.
   • ISE returns a new Access-Accept containing elevated permissions (such as dynamic VLAN, dACL, or TrustSec SGT).
   • Hitless Transition: The WLC updates data plane filters and VLAN bindings without tearing down the client's Layer 2 802.11 RF association. TCP sessions and active workflows remain intact.
2. CoA-Disconnect (Packet Code 40):
   • Terminates the client session immediately, causing the WLC to send an 802.11 deauthentication frame.
   • Used when a device is marked lost, stolen, or flagged by an Intrusion Detection System (IDS) for immediate network ejection.

---

4. Multi-Platform Policy Enforcement Ecosystem

True enterprise policy enforcement requires coordination across multiple architectural systems:

+-------------------------------------------------------------------------------------------------+
|                         MULTI-PLATFORM POLICY ENFORCEMENT ECOSYSTEM                             |
|                                                                                                 |
|       +-----------------------------+           +-----------------------------+                 |
|       |    CISCO CATALYST CENTER    |           |    CISCO SPACES (CLOUD)     |                 |
|       |  Intent-Based Automation    |           |  Location-Based Policy      |                 |
|       |  Virtual Networks (VN)      |           |  Geofencing & Analytics     |                 |
|       |  Assurance & Client 360     |           |  FastLoc / BLE Telemetry    |                 |
|       +--------------+--------------+           +--------------+--------------+                 |
|                      |                                         |                                |
|                      | REST APIs / Telemetry                   | gRPC / MQTT Telemetry          |
|                      v                                         v                                |
|       +-----------------------------------------------------------------------+                 |
|       |                 CISCO CATALYST 9800 WIRELESS CONTROLLER               |                 |
|       |      - Layer 2-7 Data Plane Policy Enforcement (dACL, SGT, QoS)       |                 |
|       |      - Embedded Device Sensing (DHCP 55/60, HTTP User-Agent, CDP/LLDP)|                 |
|       |      - Client Tracking Database & IP DHCP Required Anti-Spoofing      |                 |
|       +-----------------------------------+-----------------------------------+                 |
|                                           |                                                     |
|                       RADIUS / CoA (1700) | pxGrid REST API                                     |
|                                           v                                                     |
|                             +---------------------------+                                       |
|                             |      CISCO ISE ENGINE     |                                       |
|                             | - 802.1X / MAB Engine     |                                       |
|                             | - Profiling Dictionaries  |                                       |
|                             | - TrustSec SGT Matrix     |                                       |
|                             +-------------+-------------+                                       |
|                                           |                                                     |
|                                           | REST APIs (Posture Sync)                            |
|                                           v                                                     |
|                             +---------------------------+                                       |
|                             |     MDM / UEM PLATFORM    |                                       |
|                             | (Intune / Workspace ONE)  |                                       |
|                             | - PIN Lock / Encryption   |                                       |
|                             | - Jailbreak/Rooted Status |                                       |
|                             +---------------------------+                                       |
+-------------------------------------------------------------------------------------------------+

Ecosystem Architectural Roles

1. Cisco Catalyst 9800 WLC (Local Enforcement Plane):
   • Enforces data plane filtering, dynamic VLAN switching, QoS profile ceilings, and TrustSec SGT encapsulation directly at the hardware layer.
   • Maintains the real-time Client Tracking Database, enforcing IP DHCP Required to prevent static IP spoofing.
2. Cisco Catalyst Center (Intent-Based Network Automation & Assurance):
   • Orchestrates enterprise intent, provisioning standardized WLAN, Policy, and Tag profiles across hundreds of distributed controllers.
   • Enforces macro-segmentation via Virtual Networks (VNs) and micro-segmentation via Group-Based Policy matrices.
   • Provides Client 360 Assurance, synthesizing telemetry to evaluate client health, RF quality, onboarding latency, and application experience.
3. Cisco Identity Services Engine (ISE) (Centralized Policy & Identity Engine):
   • The authoritative AAA server evaluating 802.1X, MAB, and WebAuth authentications against enterprise identity stores (Active Directory, Azure AD/Entra ID, SAML IdPs).
   • Distributes dynamic authorization attributes via AAA Override and initiates RFC 5176 CoA requests.
   • Propagates TrustSec SGT-to-IP bindings to wired access switches and firewalls using the SXP (SGT Exchange Protocol).
4. Cisco Spaces (DNA Spaces) (Location-Based Contextual Policy):
   • Ingests streaming telemetry (RSSI probe records, FastLoc, BLE beacons) from Catalyst 9800 APs via gRPC or secure MQTT.
   • Calculates real-time indoor coordinates (x, y) for asset tracking, density monitoring, and geofencing.
   • Enforces contextual policy: for example, restricting high-privilege wireless access if a user is physically outside a secure operating room, or launching customized splash portals upon entering a specific retail floor zone.
5. Mobile Device Management (MDM) / Unified Endpoint Management (UEM) Integration:
   • Enterprise MDM/UEM platforms (Microsoft Intune, VMware Workspace ONE, Jamf Pro) manage corporate and BYOD endpoints.
   • Cisco ISE integrates directly with MDM platforms via REST APIs:
     • When a mobile client authenticates via 802.1X or MAB, ISE queries the MDM server for the device's unique MAC address or serial number.
     • The MDM server returns compliance attributes: Is device enrolled? Is storage encrypted? Is a pass-code configured? Is the operating system jailbroken or rooted?
     • If the device is un-enrolled or non-compliant, ISE returns an authorization profile with a quarantine dACL or redirects the browser to the MDM enrollment portal.
     • If an enrolled device subsequently becomes non-compliant (e.g., user removes device PIN lock), the MDM platform notifies ISE via webhook, prompting ISE to fire an RFC 5176 CoA-Reauth to immediately downgrade client network access.

Multi-Platform Policy Orchestration Reference

---

5. Embedded Device Sensing & Profiling Telemetry

Enterprise authorization engines cannot make context-aware decisions without knowing endpoint hardware and operating system classifications. The Cisco Catalyst 9800 implements Device Sensing, an embedded telemetry engine that snoops packet headers directly from client traffic:

1. DHCP Snooping Attributes:
   • DHCP Option 55 (Parameter Request List): Different operating systems request different DHCP parameters in distinct numerical sequences. For example, Apple iOS, Windows 11, and Google Android each request a unique, fingerprintable combination of options (Subnet Mask, Router, DNS, Domain Name, NTP).
   • DHCP Option 60 (Vendor Class Identifier - VCI): Endpoints explicitly declare their hardware or operating system profile in cleartext (e.g., "MSFT 5.0" for Windows devices, "Cisco Systems, Inc. IP Phone CP-8845" for enterprise phones, "Android-DHCP-11").
2. HTTP User-Agent Snooping: When a client launches an initial unencrypted web request, the Catalyst 9800 snoops the HTTP header User-Agent string (e.g., "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X)..."), capturing exact OS release and hardware revisions.
3. CDP & LLDP Snooping: For enterprise IoT endpoints such as Cisco IP Phones, surveillance cameras, and smart conference room displays, the AP and WLC listen for Layer 2 Cisco Discovery Protocol (CDP) and Link Layer Discovery Protocol (LLDP) announcements, extracting exact device models, firmware builds, and power requirements.

Telemetry Export to ISE: The Catalyst 9800 packages snooped device sensing data into periodic RADIUS Accounting-Update datagrams. Cisco ISE matches these attributes against thousands of built-in profiling dictionaries. If an unknown device was initially placed into a restricted quarantine VLAN via MAB, ISE detects the new DHCP Option 55 signature identifying it as an approved medical infusion pump, and immediately initiates an RFC 5176 CoA-Reauth to dynamically reassign the client to the protected Healthcare VLAN.

---

6. Catalyst 9800 CLI Configuration & Verification

The following configuration demonstrates creating an extended redirect ACL, configuring an enterprise Policy Profile with AAA Override and DHCP Required, and verifying client policy state:

! =========================================================================
! STEP 1: CONFIGURE WEB REDIRECTION ACCESS LIST (CWA / POSTURE)
! =========================================================================
C9800-01# configure terminal
ip access-list extended CWA_REDIRECT_ACL
 ! Deny traffic that MUST bypass redirection (DNS, DHCP, Cisco ISE node)
 deny udp any any eq domain
 deny udp any any eq bootps
 deny udp any any eq bootpc
 deny ip any host 10.10.20.50
 ! Permit HTTP/HTTPS traffic to trigger redirection to captive portal
 permit tcp any any eq www
 permit tcp any any eq 443
exit

! =========================================================================
! STEP 2: CONFIGURE POLICY PROFILE WITH AAA OVERRIDE AND DHCP REQUIRED
! =========================================================================
wireless profile policy Enterprise-Secure-Policy
 ! Default fallback VLAN if ISE returns no AAA override
 vlan Default-Corp-VLAN
 ! Enable AAA Override to accept Dynamic VLAN, dACL, and SGT from ISE
 aaa-override
 ! Enforce DHCP Required to block static IP spoofing
 ip dhcp required
 ! Operational timeouts
 session-timeout 86400
 idle-timeout 300
 ! Forwarding plane settings
 central-switching
 central-authentication
 central-dhcp
 central-association
 no shutdown
exit

! =========================================================================
! STEP 3: CONFIGURE POLICY TAG AND BIND WLAN TO POLICY PROFILE
! =========================================================================
wireless tag policy Campus-Policy-Tag
 wlan Corp-Secure-WLAN policy Enterprise-Secure-Policy
exit

! =========================================================================
! STEP 4: VERIFICATION COMMANDS
! =========================================================================
! Verify Policy Profile configuration
C9800-01# show wireless profile policy detailed Enterprise-Secure-Policy
! Verify: AAA Override = ENABLED, DHCP Required = ENABLED, Central Switching = ENABLED

! Verify client authorization, applied VLAN, dACL, and SGT
C9800-01# show wireless client mac-address aaaa.bbbb.cccc detail
! Look for:
! Assigned VLAN : 101
! AAA Override  : Yes
! Input ACL     : IT-STRICT-ACL
! SGT           : 4