Configuring Standard RADIUS Attributes for Wireless SSID Matching in Cisco ISE
Short answer
B Radius:Called-Station-ID must be used to match the SSID while adhering to the requirement for standard RADIUS attributes, avoiding Cisco-specific VSAs like Airespace-SSID.
Question
Key Takeaways
The key trap is confusing standard IETF RADIUS attributes with Cisco Vendor-Specific Attributes (VSAs); only Called-Station-ID carries SSID info in the standard format.
Learn why Radius:Called-Station-ID is the correct standard RADIUS attribute for matching SSIDs in Cisco ISE authorization policies, distinguishing it from Cisco-specific VSAs.
Common mistake: Engineers often select Airespace-Airespace-SSID because it directly names the SSID, but this violates the 'standard RADIUS attributes' constraint specified in the question.
Expert Analysis
The question explicitly mandates the use of standard RADIUS attributes to match a specific SSID name. This constraint immediately eliminates options A and D, as Airespace:Airespace-Wlan-Id and Airespace:Airespace-SSID are Cisco Vendor-Specific Attributes (VSAs), defined under the IETF RFC 2865 Type 26 mechanism, not standard IETF attributes.
Between the remaining standard options, Radius:Called-Station-ID (Option B) is the correct choice. In wireless environments, the WLC acts as the NAS and includes the SSID information within the Called-Station-ID attribute (formatted typically as MACAddress-SSID). This allows the policy to distinguish between different SSIDs using standard attributes. Conversely, Radius:Calling-Station-ID (Option C) contains the MAC address of the client device, which identifies the user endpoint, not the network resource or SSID being accessed.
This decision hinges on understanding the distinction between vendor-specific extensions and core RADIUS standards. Getting this wrong leads to misconfigured policies that fail to trigger for the intended wireless segment. The operational consequence is that users connecting to the target SSID will either be denied access or assigned incorrect profiles because the policy condition cannot evaluate the SSID via the required standard attribute.
Exam Strategy
When a question specifies 'standard RADIUS attributes,' immediately discard any option containing a vendor prefix (e.g., Airespace:, Juniper:, etc.). Focus on core IETF attributes like Called-Station-ID for network identification and Calling-Station-ID for client identification. Always verify if the scenario requires vendor-specific behavior; if not, stick to the standard list.
Frequently Asked Questions
What is the difference between Called-Station-ID and Calling-Station-ID?
Are Airespace attributes considered standard RADIUS attributes?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
ArchyinVa 👍 1 Answered BB. Radius:Called-Station-ID ### Why Radius:Called-Station-ID is the Correct Choice Standard vs. Vendor-Specific: The prompt explicitly requires the use of standard RADIUS attributes. Attributes starting with Airespace: (such as Airespace-Wlan-Id or Airespace-SSID) are Cisco/Airespace Vendor-Specific Attributes (VSAs, RFC 2865 Type 26), not standard IETF RADIUS attributes. This immediately eliminates options A and D. Called vs. Calling Station ID: Radius:Calling-Station-ID (Attribute 31): Identifies the calling party (the connecting client). In wireless networks, this carries the client endpoint's MAC address (e.g., aa-bb-cc-dd-ee-ff). Radius:Called-Station-ID (Attribute 30): Identifies the called destination (the network access point). By default, Cisco WLCs populate this attribute in the format: \text{MAC:SSID}\quad (\text{e.g., } \texttt{aa-bb-cc-dd-ee-ff:Corp-WiFi}) Because it contains the SSID name appended to the AP MAC address, an ISE authorization rule can match the SSID using a condition such as: Radius:Called-Station-ID ENDS_WITH <SSID_Name> ### Option Breakdown | Option | Attribute Type | Contents | Meets Requirement? | |---|---|---|---| | A. Airespace:Airespace-Wlan-Id | Cisco VSA | Numeric WLAN ID (e.g., 1, 2) | No (VSA, not standard; matches ID, not name) | | B. Radius:Called-Station-ID | Standard IETF (Attr 30) | AP MAC + SSID name | Yes (Standard attribute containing the SSID) | | C. Radius:Calling-Station-ID | Standard IETF (Attr 31) | Client MAC address | No (Identifies the client, not the SSID) | | D. Airespace:Airespace-SSID | Cisco VSA | SSID name | No (Vendor-specific, not standard RADIUS) |
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.