An engineer configured a single WLAN with WPA2 Enterprise and wants to use Cisco ISE to implement AVC profiles for users in different departments. Each department is placed into its own unique VLAN…

Local Profiling classifies client device types using DHCP or HTTP fingerprinting for local policy enforcement and does not process or apply AVC profiles or VLAN assignments returned by an external RADIUS server.

Role-based access control on the WLC enforces policies based on locally defined client roles and does not enable the controller to accept or apply dynamically assigned attributes from ISE during authentication.

AAA Override instructs the WLC to honor RADIUS vendor-specific attributes (VSAs) and standard attributes returned by ISE during 802.1X authentication, including dynamic VLAN assignment and AVC profile names, overriding the WLAN's static defaults on a per-session basis.

Change of Authorization allows ISE to modify the policy of an already-authenticated session mid-session, but it is not the mechanism that enables the WLC to initially accept and apply RADIUS attributes at the time of authentication.